0d71884d6b2e4078180e9f7b571b56edab8a7b0d3ecade97a3d109ec5ebb894b

Analysis

max time kernel
149s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 5.9MB
Sample260418-ec89lsfz7x
SHA256 0d71884d6b2e4078180e9f7b571b56edab8a7b0d3ecade97a3d109ec5ebb894b
MD5 8a46794cc5ff2139b55566367c5b7b88
SHA1 40b213b7ae8e52c0982b118b0f8e8bd14675fa9a
SHA512 6370171c8ac84a488d54768e418e312fe50398fcae3b68dde7e0e47c73df6f4cb9ed0f64987ebbaea84f966b14bd634f0688e069c57fd629658be41d3eb54adf
SSDEEP 49152:wabH/8fuM4YXDgOabH/8fuM4YXDg//KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy4e:aygDLygD1WQtZ/K0tGOFWVRuLftCT
TLSH
T17D566C13F2E500E9E06AD178DE758621EB327C554BF1A9DF229072D51E73AD07B38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
5100	UpdatAuto.exe
3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
3948	UpdatAuto.exe
2220	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
3400	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4056	sc.exe
4728	sc.exe
3388	sc.exe
4432	sc.exe
1948	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3224	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209577481621774"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
568	chrome.exe
568	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe
Token: SeShutdownPrivilege	4796	chrome.exe
Token: SeCreatePagefilePrivilege	4796	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4796	chrome.exe
4796	chrome.exe
4796	chrome.exe
2028	chrmstp.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1120	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5100	UpdatAuto.exe
3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
3948	UpdatAuto.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 3356	1120	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	80
PID 1120 wrote to memory of 5100	1120	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	82
PID 5100 wrote to memory of 4040	5100	UpdatAuto.exe	83
PID 1120 wrote to memory of 3000	1120	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 3000 wrote to memory of 2852	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	86
PID 3000 wrote to memory of 3948	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	88
PID 3948 wrote to memory of 868	3948	UpdatAuto.exe	89
PID 3000 wrote to memory of 2220	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	91
PID 2220 wrote to memory of 3400	2220	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe	92
PID 2220 wrote to memory of 4796	2220	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe	93
PID 4796 wrote to memory of 2816	4796	chrome.exe	94
PID 3000 wrote to memory of 2224	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	95
PID 3000 wrote to memory of 3268	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	96
PID 3000 wrote to memory of 3892	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	98
PID 3000 wrote to memory of 2476	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	100
PID 3000 wrote to memory of 4416	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	102
PID 3000 wrote to memory of 1960	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	104
PID 3000 wrote to memory of 2184	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	105
PID 3000 wrote to memory of 1948	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	106
PID 3000 wrote to memory of 4432	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	107
PID 3000 wrote to memory of 3388	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	108
PID 3000 wrote to memory of 4728	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	109
PID 3000 wrote to memory of 4056	3000	2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	110
PID 4796 wrote to memory of 2284	4796	chrome.exe	119
PID 4796 wrote to memory of 3224	4796	chrome.exe	120
PID 4796 wrote to memory of 2284	4796	chrome.exe	119
PID 4796 wrote to memory of 2704	4796	chrome.exe	122
PID 4796 wrote to memory of 2704	4796	chrome.exe	122
PID 4796 wrote to memory of 1516	4796	chrome.exe	123
PID 4796 wrote to memory of 1516	4796	chrome.exe	123
PID 4796 wrote to memory of 4256	4796	chrome.exe	124
PID 4796 wrote to memory of 4256	4796	chrome.exe	124
PID 4796 wrote to memory of 3204	4796	chrome.exe	126
PID 4796 wrote to memory of 3204	4796	chrome.exe	126
PID 4796 wrote to memory of 1692	4796	chrome.exe	127
PID 4796 wrote to memory of 1692	4796	chrome.exe	127
PID 2224 wrote to memory of 2712	2224	cmd.exe	128
PID 3268 wrote to memory of 4272	3268	cmd.exe	129
PID 3892 wrote to memory of 1076	3892	cmd.exe	130
PID 4272 wrote to memory of 3536	4272	net.exe	131
PID 1076 wrote to memory of 2772	1076	net.exe	132
PID 2184 wrote to memory of 3076	2184	cmd.exe	133
PID 2476 wrote to memory of 1876	2476	cmd.exe	134
PID 2712 wrote to memory of 2000	2712	net.exe	135
PID 4416 wrote to memory of 4544	4416	cmd.exe	136
PID 1960 wrote to memory of 5068	1960	cmd.exe	137
PID 1876 wrote to memory of 2812	1876	net.exe	138
PID 3076 wrote to memory of 2368	3076	net.exe	145
PID 4544 wrote to memory of 1432	4544	net.exe	140
PID 5068 wrote to memory of 2268	5068	net.exe	141
PID 4796 wrote to memory of 2952	4796	chrome.exe	143
PID 4796 wrote to memory of 1056	4796	chrome.exe	144
PID 1056 wrote to memory of 3004	1056	chrmstp.exe	146
PID 1056 wrote to memory of 2028	1056	chrmstp.exe	147
PID 2028 wrote to memory of 872	2028	chrmstp.exe	148
PID 4796 wrote to memory of 4732	4796	chrome.exe	149
PID 4796 wrote to memory of 572	4796	chrome.exe	150
PID 4796 wrote to memory of 1344	4796	chrome.exe	151
PID 4796 wrote to memory of 568	4796	chrome.exe	152

C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3356
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4040
- C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2852
- - C:\Windows\SysWOW64\UpdatAuto.exe
    C:\Windows\system32\UpdatAuto.exe
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:868
- - C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2220
  - - C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
      C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff67941b618,0x7ff67941b628,0x7ff67941b638
      4⤵
      Executes dropped EXE
      PID:3400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbca28c728,0x7ffbca28c734,0x7ffbca28c740
        5⤵
        
        PID:2816
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,15374617682620645605,18192137738390294475,262144 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1944 /prefetch:2
        5⤵
        
        PID:2284
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2096,i,7525391734713946750,17209357358791317371,524288 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2108 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:3224
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2240,i,13987405461507550049,9694469627390576196,524288 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2588 /prefetch:13
        5⤵
        
        PID:2704
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3196,i,1334331252895426628,8228693551328381871,2097152 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3220 /prefetch:1
        5⤵
        
        PID:1516
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,9749806597485996438,11872585366303215179,2097152 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        
        PID:4256
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4108,i,818305888583199935,13967739100721591368,2097152 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4124 /prefetch:9
        5⤵
        
        PID:3204
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4608,i,6667826633167166612,3623394056321080768,2097152 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4528 /prefetch:1
        5⤵
        
        PID:1692
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5412,i,18352603281213120889,8121338145622406570,524288 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:14
        5⤵
        
        PID:2952
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1056
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x208,0x210,0x214,0x20c,0x250,0x7ff75fa855a0,0x7ff75fa855ac,0x7ff75fa855b8
        6⤵
        Drops file in Windows directory
        
        PID:3004
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        6⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2028
        
        C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff75fa855a0,0x7ff75fa855ac,0x7ff75fa855b8
        7⤵
        Drops file in Windows directory
        
        PID:872
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,1054473741749793855,10545327021292415071,524288 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5824 /prefetch:14
        5⤵
        
        PID:4732
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,1030508672161288512,778932241917862384,524288 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5812 /prefetch:14
        5⤵
        
        PID:572
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5836,i,320817898176868177,14193757105736858444,524288 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5884 /prefetch:14
        5⤵
        
        PID:1344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=948,i,8703188296572115139,14701827482528283451,262144 --field-trial-handle=1948,i,16232066851699717582,6331945491654686310,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5560 /prefetch:10
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\SysWOW64\net.exe
      net stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2712
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop sharedaccess
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2000
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3268
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4272
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\SysWOW64\net.exe
      net stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wscsvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\SysWOW64\net.exe
      net stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1876
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop srservice
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Windows\SysWOW64\net.exe
      net start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 start TlntSvr
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\SysWOW64\net.exe
      net user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5068
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user helpassistant 123456
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2268
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2184
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3076
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators helpassistant /add
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2368
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1948
- - C:\Windows\SysWOW64\sc.exe
    sc config SharedAccess start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4432
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3388
- - C:\Windows\SysWOW64\sc.exe
    sc config wscsvc start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc config srservice start= disabled
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4056

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.3MB
SHA256 20c1793557b7761f84df7e00f765f54cdd103dde095ed5d04258236d80369486
MD5 0b9857929671ddba619fd081f243c235
SHA1 3dba1e8f7a6b40da9d16cc24dce810008e694ad2
SHA512 e97a7ea5cdcbf91cb95a4edf074787679bf3e3744265652145d7caed8c6d37f84c737e0a11b32b2d292005c484b17b3f48dd0858e8051243d9c42c2d90be5584
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20Gp0Le5ji0hmxNrM:wabH/IfuM4YXDgaPji0Aj
TLSH
T18D553A15B6A446A5E473C179C8E1964AEA323C510B30DECF5381B72D2F377D29A39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.1MB
SHA256 d8fe9141b0cf8e82e478ff19386596a740467d74ac62528ee08fa01c4e686cba
MD5 f931f1d47f555e139852044ec3fb55d4
SHA1 c664e9bb6220505b58b2b13b33dec67d8e6eeba1
SHA512 c7bf0ccc9702d5eb8b39b33f7667dd6b6d8639e000e582f149018356a67cfc916fd3bf94323c4d8ba47e71220bb220254acd8b898f0fa40d2272186bbbc234fa
SSDEEP 49152:wabH/IfuM4YXDgxabH/IfuM4YXDgaPji0Aj:WygDYygDXjo
TLSH
T171A55A15B7A405A5E433D579D8A19606EA327C610B30DECF5381B62D2F337D2AE39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.7MB
SHA256 3a5aca67fad9064f2af64613d2d433886a78f7dddac5b647f3e66aa6af2ada89
MD5 029c72486daf43bc90813f408f60eec3
SHA1 8c5c3c803e6a45313941112cee3a83209af4b0d8
SHA512 982b4dd9225fc8cf21d3b5a8b043b8a7d381d8886539954c3eb294a3ef6cb6bc7ae8ffc68a22a4f028ee277f3abc13088df856d9b27bcba45757da0ff08445cf
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20G7a7/ezSC6vUyD/aqgrvWx6q8wyu:wabH/IfuM4YXDgd/ezSC6vUzPvMHjy
TLSH
T1CE852B15B6B84366D473D079C5E2A659FE323C420B308ADF4346A72C2E377D29A35B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.5MB
SHA256 a882a13f528ad70c0c6b27f07c0aacbeaba68f1901f85f8afe57550f3bc39ed2
MD5 f13aa5c37d744eca8404faf90c6aee85
SHA1 91f6d84afc3e87a5df231e2d5293256fefcf0d85
SHA512 c046584780658edcf718874ca74ff78dfe8f1d52314aea330c3f4cbaff7f1739ff2399fdf47a6da4c3bc23f0929f1c0c6721ae9cf8c6609c0a43c9149ca96f8d
SSDEEP 49152:wabH/IfuM4YXDgxabH/IfuM4YXDgd/ezSC6vUzPvMHjy:WygDYygD4ezSC6v2XMH
TLSH
T1B7C53A15B6B44266E473D179C8E19655FA323C520B308ECF5385B32D2E337D2AA39B36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.3MB
SHA256 3fdf7f9109e489a6d36d68308e07585a3e3b325bb60d10bb65a69e587589f161
MD5 5196398e54504a54ef46a689abf6e29b
SHA1 3c3dbd41f56c1c595470ea8583b085aa6f2948ca
SHA512 06e303f724f2dc348b9f8420b1e951b26eceb1d9dee39a41e126a88effdbab679983f1304bff9c7204a288fd6121c6cfc2489528daec4310f062a919d3916b16
SSDEEP 49152:wabH/3fuM4YXDgxabH/3fuM4YXDgSVO88hXl+:5ygDnygD8/h1+
TLSH
T109B54915B3A441A5E433D579D8A19656EA327C520B30CECF5381B72D2E337D2AE39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.5MB
SHA256 c65bbe41e12f4a3b6ac8cd804d1fe007d227f1525fb1b6e119b13d572441bb94
MD5 012013b6840f9168ff0a22b0c4f111ae
SHA1 ec41b9ff711ca64ea97f67af3190080b551d72f0
SHA512 b69fe16a5d5be87d2025ebad185a23e747b736fe5c2f961806f6c28177fd0b287aa7a978ad6df2ac0d5e5764ee532782aaf8f765eb46dd57792b9cac357d51d0
SSDEEP 24576:w4R5CIH/71jiGnB9um6c20GNcydWXkgg20GdVbqPb88hv/l+7:wabH/3fuM4YXDgSVO88hXl+
TLSH
T189653B15B6A44265E073C175C8E2965AEA323C510B31CECF5385B72D2E377D2EA39B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 826KB
SHA256 229543a11fafd4ea2631776d12e2937cfc0835f3059b3f286300d1d70d31465e
MD5 95dd20054fa0892d33c10a1813f38cea
SHA1 4aeda1010beb3f5d35581997e83e9e5631bb9149
SHA512 2898188731f92e740cefb015301101755eef0ff0d4c5bfaf17ef0498a40d6f82783159f472933c508d9c2600a329e18e7f3835ec7a096b737edee5bd7f8917f5
SSDEEP 24576:w4R5CIH/7AjiGnB9um6c20GNcydWXkgg20Gja:wabH/6fuM4YXDg
TLSH
T1F8053A1167E404A5E873D634A8A08516EA32BD610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.6MB
SHA256 e13ac3ed197a48ac39cf586baefcaaaf25d34dcfe180327e3e121e1cf9b5b76c
MD5 8e9f2891018875ce6328500f71dff156
SHA1 62cfd19d0427ffda28da2cbb6ef85680c62f4026
SHA512 9d667c70c139a06826598193a36507f79f0ecf28f464c1c9af7c68b8eaa6294cc3d2db4fd0aa62f1b51f260d1118e618f2ee55e0980646c510ca4ce3ab0579e6
SSDEEP 24576:w4R5CIH/7AjiGnB9um6c20GNcydWXkgg20Go4R5CIH/7AjiGnB9um6c20GNcydWM:wabH/6fuM4YXDgxabH/6fuM4YXDg
TLSH
T14B753A1167E404A5E873D634A8A08516EA32BD610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 955KB
SHA256 76120402cb0d40e09f59be539001a516957700b30e8602a5e1de890f962d3736
MD5 90aa0562a94d5b6f1e6370695f238634
SHA1 45a71682baa5321ac677a926603af2da13fa1f63
SHA512 84f6dcd50edfaf2c2a2c9d07d2a1091f5bdbf16865f63d94da5912f6c0b5c2ac6097743fedb9aaca886ecc9fc84bd0ccf40596f8843a86482e0c3af0f2682e95
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20GqD:wabH/IfuM4YXDg3
TLSH
T12325F615E39404A5E82E9534DBA08501BA337D610BE09ADF53D0F63D1F326D2AEF9B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.7MB
SHA256 4cec5265a8c18cfd61e5b52f2b50519bf6b4515bec84abd3e36aa71f201f43a4
MD5 76f0a318180c3153424111d617250071
SHA1 33bbd53fdd85a7c3cc2db3217fbce009323c974b
SHA512 ecb4f6d132136067e7a5a4dae5524377da96109436f307deae567a3d27a9b66545058515c4a5ecf2313f640c49c323d41fe2706c9f11a898015c0a3e5c6dfc41
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20Go4R5CIH/7ajiGnB9um6c20GNcydWE:wabH/IfuM4YXDgxabH/IfuM4YXDg3
TLSH
T119851715E39404A5E83A9534DAA08501BA337D610BE09EDF53D0F63D1F336D2AEB9B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 868KB
SHA256 9a52e49e58df394d747e2058b38be2c34ccbd0e0fd3df6c4c6e0a0a17ec45b23
MD5 e5a76a77c14759a623b9a31bf5258860
SHA1 06d59500c872cee126f06d7c786a12ec7970afee
SHA512 8137e7fe36d77eabe49c5167528603a7356f9899b3985a65c4def26f8d68b37e1651a6f51e3a4300841a95130d395828e757dfcda2c4bcb0b2eb58d2fc2e3f8a
SSDEEP 24576:w4R5CIH/7WjiGnB9um6c20GNcydWXkgg20GC:wabH/MfuM4YXDgb
TLSH
T18C15391167E404A9E833D67498A08516EA32BD610B60DFDF63D0761E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 1.6MB
SHA256 8933b27201e24ef355937d4d1e4af75f1b6ec67bc0f61bb85ee8eb7ffe794271
MD5 3b839a18d3db8d05e1634f97a62aa976
SHA1 3ef7903630860172fb5c8cdf3ac1736b6d4ad77f
SHA512 95bfb1d60e0be9bf88a24a3dc8c19da6e0265dc85872ef5fa8104e253e8e97e7c2aedea202713b89f38915ed7a4e4fb0fc6bcec44037983ebb7956ce40c68f29
SSDEEP 24576:w4R5CIH/7WjiGnB9um6c20GNcydWXkgg20Go4R5CIH/7WjiGnB9um6c20GNcydW0:wabH/MfuM4YXDgxabH/MfuM4YXDgb
TLSH
T1E985391167E404A9E833D67498A08516EA32BD610B60DFDF63D0761E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 876KB
SHA256 1e9dfc4c14068f0895745385152525b32ab8832e6f600a0feb7c36c27536ee61
MD5 3bbada5509c11dbd87d990932b8c3cef
SHA1 3683486a7661b3dcd33989a3375962784ec8d9ac
SHA512 0c71d9cd72368e1157fc0f8c32b529de303e944183bf327a69710f40f46775eff058ea17034374a322af6dd2c2f09e92ba0c51a545b1cdb5522d40523a749d91
SSDEEP 24576:w4R5CIH/7WjiGnB9um6c20GNcydWXkgg20GSj:wabH/MfuM4YXDgJj
TLSH
T14415391167E404E9E833967498A08516EA32BD610B60DFDF63D0761E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 1.6MB
SHA256 b9c28a69a28479f0c25f24646e56eb9327d118291ad2ec850f0037b93996974f
MD5 79c9126f7dd073d93eae0eeba9e36b89
SHA1 13ff09329a1399e45dd22a402dd75940064b873b
SHA512 f8ba1e2798def9190f3dd6268f59f0d8732a9fa049baff432861f79027bc3810265e284a2fa08e09856af7efd4a55997c423f58a72f1c896d18c9ae815da52a8
SSDEEP 24576:w4R5CIH/7WjiGnB9um6c20GNcydWXkgg20Go4R5CIH/7WjiGnB9um6c20GNcydWK:wabH/MfuM4YXDgxabH/MfuM4YXDgJj
TLSH
T1CC854A1167E404A9E833D67498A08516EA32BD610B60DFDF63D0761E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 872KB
SHA256 0a12e08c45b44239058ef960fdc5fd3575ca04b80561cbc48d4f5f2faa901111
MD5 28e0edd376c09d9fa4e59030ca641127
SHA1 b867b061569c90dd3fa6f989338c06fa38a3c3cd
SHA512 c3972b2fdbf8cdc9c1cdecc301d4f196c73161dd5db8e040b1e6836ee7dbd55a8f3884efe5c86c2815470dac07abd8bdeecc16b557f9810110de7d2bc4865e1c
SSDEEP 24576:w4R5CIH/7yjiGnB9um6c20GNcydWXkgg20GIjv:wabH/QfuM4YXDgbD
TLSH
T1D515391167E404E9E833967498A18516EA32BD610B60DFDF63D0721E1F337D2AE39F26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d4b20187d1a27791dd95f08abe7840e0cdd1ce61f275bd653b136d14b779d85d
MD5 a9c52baf89a3b7bd355ceacb31f4c1fa
SHA1 772d3bd6852fdecd31426b10b2a48b0bb4513a74
SHA512 4b5eb51f8e5d34c50df3f8fbaaf6247de584377339da9ed1a759628bc0c6a5ffa3098bfa7fbf0ca780c77f39d44b791375aefc45ca92b2ec120b8b98c74f7f5c
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5b3c639f042cdc0bd7ef6bfb8d03aecdf45a795c1f8ffdee7d266cc0b274573e
MD5 5c3d0795fa87d492951cbc2df889de6c
SHA1 264589aff8c655b280c8902f234915c3f8426c17
SHA512 e4c05290f21accab17f87904e61b78cda3dfb8d4ab85128874a7057c3f971a615960770ccda432bc1ccb3d185b9be5ed795e9dc07424fda449b088cac0885984
TLSH
T1ABE02BAACD219C270CFD17297458C74BEB50135B2740885F3B3D860D4FB263B454185C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 18988a6fa4b4a70c5fe55a845d0f9757982c8a10b2d2cc8dfc88a3395ffe672e
MD5 df9c0ebe996912f281787d2bf2cde6d8
SHA1 dc695ea3e62402e910961d18ef1750e6edafd620
SHA512 454d8bf81c0486801ad66d69381a415e62f5337249fd0ff2921d0949c9057baa8c6fa0a99b452337a9658cbc8ba99ff253c181998029a5279c11cea7ea57e922
TLSH
T120518DF393E4967DC91166E49B116E1FCE6E0A28031C3C62C9D4AE0B43E2972D20174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f31c51704dbf99f2a90cd3eb40113d85a5117c9764010a0b6bb92992a2553bc4
MD5 3f76ec0d12c828a17ddc897395eb0d81
SHA1 5fe91939d5ab348eb02f4da9be46d4cad979ca7c
SHA512 d7b6320b4d8f675484e245e12f1870ac785e6f60f149ae2482ffe45ad77311e65a3504d46c132c42e2b06042bd2d46c68793b5a8b9d50b0b40ca0353b3e59723
SSDEEP 192:+RXH76m7twv7VMjPRpeKXsb+WNnIe2s3eW2osGb1iciyIsnAUgraJ:+RXH7XskXFXw12G2osGb4e
TLSH
T19042E62EBA14683B5CEBD21BF9657B97DBF5102261902D40E7FC9A2C14EB9CC321741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 feb2ff5865d5485951390456f43594ffda9bbb549d734e4c145376442d45b438
MD5 48554ec8a9fea987c0819fbdf101e703
SHA1 50ec2af91de3d3f1448416edd1da98135e361704
SHA512 787e50ceb5f2f8d3737dce8e492800b005512b4e3a865e14105fa47772a38b739009f552290dcd35c6aca3db165c6409b26a2969ee4194bfd57e252316420c0b
SSDEEP 192:+RXH76m7twv7VM9PRp2KXsb+WNnIe2m3eW2osGb1ioiyIsnAUgtaJ:+RXH7XsOXdXw1202osGbe8
TLSH
T1E832C62DBA18683B5CEBD21BFA657797DAF5102271902D80E7F8991C14EB9CC322741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe587b74.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe587b74.TMP
Size 3KB
SHA256 15954fd91b5261c07a31aae9dea90739517ab305d71c02d01cd136ad21daff6f
MD5 b0fc42aedc9a02bb50e5974e1f3723b5
SHA1 3b5f35cf2f23ca838b06c5d962b47a90deb79a25
SHA512 c41be981db14ed5b6e13f5cfa40a9f915787e9e4a26e485fecbfc092e72d5779810524137df4e4ef3e22439a872a8ea43fbb5d4b9a3ed526dfef37f339deb841
TLSH
T14C617419C0E54CBB5DB57B24B4680782FED7433F010018867ABE598C0FB6D2BD082F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 1334a8559121a48618279c848e17b8799126876f8599fcee9939572a879e642e
MD5 e3d5ccba2fcaa8a3521e833aebd3d661
SHA1 c08b50de3f0e7c2998ccdf817d3199f55971b518
SHA512 76d02f29f3097dd2c352745acdd2fb6fea21c636a0f17e01d1e34a568dfccd66c8ed7b5d118b7e03fe144892b49758b48126ca8275a3d9fc5e5e883185e3cf84
TLSH
T11AB01221C402A509C04303F011D2048836146F588B052302A3E16DB5DC275F14014250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a8be.TMP
Size 96B
SHA256 d028b5814db44f53f406379b22bb9db4d07cb5ef8818e8df6ed0f70a1f344b5f
MD5 1c24342790067ec9156c2e82c4779bac
SHA1 995c7a9f0d41e78f76d7e0332c1a500cea3f8b59
SHA512 5715e82321a4805f370b083a23d065f4f486477fb11c4f75123fd5b20cc8f1009771d8c3295da5ec7644421c93d8d53594100e087a165b116aa4dfa16f58daf5
TLSH
T16DB02200C002B302E00203B020A8E2C83030FF20C303020BC3E30A2BEC28AB008B0220
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 4325fc78996a3469f1b318c9c3b1bbf8e9958db602c56d6b740977aa0a459f7d
MD5 cf41497d0e8f03384247801e1841b886
SHA1 65c40b3d67087e373dbc91a3b3694fbaee52ed89
SHA512 c71ea5567c951ea9aa168978ff4b9bc3479d5d0ec11cab6f9efd914bfeb046472cc84c3f559c9f834d346d7d2606f651a5368cb4291aab1d774228d859c2b391
SSDEEP 6144:lCbFRRMZlUVpJcMnpSE++JjcMW2VcVLl0:l4DDFnppOMWj0
TLSH
T1F8141237D60D7D7D567B51AAF0074C680EA3CEEF5968B2AD318B2F1C205EB149B4B812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 66379d0c12c08c40c7682812e8f229219ff869968524b2178985790f411083c6
MD5 c7abbb37bf5276352f91f269a8abb363
SHA1 53c4aaabdf4af31d5444edb1ff707032efdc4e54
SHA512 66cfbba7c24b4d410ba3f0379ee8d70e9b983b8c4d555dfc57510dc83e02bf53c8b3b608e4054568caf6ee81b2142a54e4de6f1bde0e65729533bfa9d4717f7a
SSDEEP 6144:lMbFRRMZlUVpJcMnpSE++JjcMW2VcVLl0:leDDFnppOMWj0
TLSH
T11F141317C60D3D7D576B91AAF00B4CB90F93CEED5568A2A931DB2F1C206EB119B4BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 77d4abf9817fcbda0bb6f1ad63665aa0958227b379de1994e75eae91c059ba31
MD5 d36d1cda1c200d3d853477d70d35c762
SHA1 eceee35f397d7d506dfd747c1fcca4a4fc01d8cc
SHA512 a5ec27ea11726c2550956bc244a9d6476f783442205cac7a87ef6ae21866c1d8980d6b5022d01cdc0cf33da2c329f07216fceb4528e308b3e436e505bf8f0d24
SSDEEP 1536:4LsP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gC++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1799302B9991E7D79636ED396A0079CAC8CD3DCCE151051BC30C76F0E14BA3A3A35B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 0424c96b0589c05a62c9ec0627b7354b926ced570cd0a32db53e61788abf4b6b
MD5 4f2b22e0955dbb40ad77bdcf701bac7d
SHA1 b12e5f58a7d68a071fad4695bc020fae19cb4477
SHA512 34de47b58dc9053cbd2ee5696a404b69282e2bc523d1a9596cb58977cacd6ee4500c8cd4136a981803eb3f33301266d24ac3e6c50e99ef95e563b6a235118499
SSDEEP 6144:UMbFRRMZlUVpJcMnpSE++JjcMW2VcVLl0:UeDDFnppOMWj0
TLSH
T167141317C60D3D7D576B91AAF00B4CB90F93CEED5568A2A931DB2F1C206EB119B4BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 5.1MB
SHA256 9fe4f1431f2d0d0e543c59911a4908fac645b2a5277cdd56fe5c3b2fd5f44b5e
MD5 6f002aa27b9250e37738bb47a1b1b04f
SHA1 7a8551a7fad62ae5e05b1429a6e768bfc5cbd1a4
SHA512 a49d651d8ac3c29bc3fb9b37219243eef14829ca712a59376530682d6d4396deb7731a7d51c72bcd9789edc41e1c71f35934854099bcb327bcace1be530718ed
SSDEEP 49152:wabH/8fuM4YXDg//KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWV2:aygD1WQtZ/K0tGOFWVRuLftCT
TLSH
T166365B13F2E900E9E06AE278DF3586219B727C5A4BF1A5DF225032D51E77AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-18_8a46794cc5ff2139b55566367c5b7b88_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4~4.exe
Size 4.3MB
SHA256 d00b1820bfc76c68cd68ef57c77027fbae39de00f82a0615c2201f05a9a79db0
MD5 ffc92ca23754119f6131903564a063d3
SHA1 5fc09b579d4c02cd6a0879446b67dbfdca8858bf
SHA512 c5d2d0a0e0b8070fd75cec21ab6e351b853d7df56240bde4c2b047036cd78b005d555eaf4a187e30509ca97a3cf8be6abc9db8a5d23256a27a63917f8145752f
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T19A264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 811KB
SHA256 e7efecdb012e197c799ed0193976249ab153f7d4b821dd2babf185571046bcfe
MD5 30cdeb81288f379b282f1014d308e4b4
SHA1 d2ec07744d6677372a30b34511e2bde76ddcc61b
SHA512 54e6d3b249a2165fdd297f38e3f153d24f70c607e1fbbb314f68109a5e91b7b05377cd1ca76634327793cfe0c0cc0299fc1bfae212d05478e3366b6fb494f39e
SSDEEP 24576:w4R5CIH/7mjiGnB9um6c20GNcydWXkgg20Gg:wabH/8fuM4YXDgL
TLSH
T12F053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 1aabdcfd3e20364df4f852615989c3cee07e9809d42626876fd3476598a191ff
MD5 6df8022e05265ba987c21aa88ad7c86b
SHA1 b1b44bcc5cfd667297738aa4324fbe74e7e85b0b
SHA512 65404bbc0bfe1a9d2a9817f7b9071c81fd852e985479dfbba8751166e4e843071405b3cd475dc8fe36d2fc64aa9c780695d5f55727df165721338cb4abc584d0
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 df650f8a7646fdfbc77a9a35d85b9fd1ab99a9f4539555896f6c7ef095622098
MD5 d0fbff422dfd126bfa573123d595955f
SHA1 7bf3a3931593ea2b37f490b9d1aaddbec9a20661
SHA512 970cbc8ee64416515071444c61847b43443fb9b439f613ce206f4fce0750888e9231a8e822186bc20c94fbfb3151f8cd48083e73157769ec138bf31026ba7bd6
SSDEEP 192:PyDY9AGWSXRwJ3AY2RUFFgfbY/PAQFAcJXBfGARgXGzzy9E1eiAlztb/wKgEJkn1:PyU9AGWSXRwJ3AY2RUFFgfbY/PAQFAcH
TLSH
T10112AED54F02446F3B82DF6B335332516DAB240ACBE465B277EF5206B4CAA65041F2B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 7faa8638b77beb4a0c1ff506ff7a22090b154c6e17e99bb0b43c80e8cba3d064
MD5 116b760a38b3a4da2a36fbc12abef746
SHA1 adc20a1af1c9bf5b2bb574f226bd267430dcf64b
SHA512 9f2e0a9ed15961f9cd53757f46633c1313185443f6f57c4988f6a89749619910b2bf1ebfeb41e85855c16aa0864b9e3b1ae70df2d0fd6257424644b3693b37aa
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20Gg:wabH/IfuM4YXDgL
TLSH
T133053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 5eff2ad2249618966ba58110e20fce81989afcaeea7eb82c4b9aa54196f7503e
MD5 362c91e6d403f47feb8b597544cbec41
SHA1 28c36b76776ce5eb33262f8c86b5a02bd3490cc4
SHA512 dd02e6f174aaf536ccac2dbe56ec53082fd0c1616078900bb5b16f87db0f658c432f2a75352dcab3252b795ee715db58755452247a2f7bd44b29a8f1ee532114
SSDEEP 24576:w4R5CIH/71jiGnB9um6c20GNcydWXkgg20Gg:wabH/3fuM4YXDgL
TLSH
T1CA053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 0d48416aa027063e4dd93c96ab7fadf1e49c7212c6667cd4dc53eabf574b3c70
MD5 685d19646877bad7a60675e21f0d50a4
SHA1 a50aeb7bde5bb3e4a52c1ad192a96b817f07fa67
SHA512 398f19c2abf457b249619e3f2be6eade372a629f5f09c557982003fa294d57a32e0167aead7f1791beed984c168ede36ec6a83cc972be67de5ac8178599a56fb
SSDEEP 24576:w4R5CIH/7AjiGnB9um6c20GNcydWXkgg20Gg:wabH/6fuM4YXDgL
TLSH
T132053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 08bbac944fd5a079cc76e35ed9b92c26f16d0086ffffa64cbb53e0c7262b7f80
MD5 a5031c839ac5a7fba27155ccdb7171b4
SHA1 fd52cc2994b2f07d88a5b0faf1fd5633a6e2042c
SHA512 5798eff8453cf7e88014955a8a26b0621276d26885d544b448c356c3b117fc8067dd5bbe397bfd84bd922ce339759a902dedb6f0bea0811d56144f12ca373f13
SSDEEP 24576:w4R5CIH/7yjiGnB9um6c20GNcydWXkgg20Gg:wabH/QfuM4YXDgL
TLSH
T196053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 e75045d582ece31fd391582c47d57aebab0f644579346d1438a7d9251fc264e5
MD5 46f6278d8e29f0090ab5a962b4ca3268
SHA1 5311be8a971534811e51d0f8174dff5e37733570
SHA512 312a3bb35edc071d861ba952e0353a6ee39e506d34aca0e1cc5dc922bd1ac789aa118d2d578d624b3fe135ddfd16cb601e6dbf4bdaab51c5609c1917661cf9b3
SSDEEP 24576:w4R5CIH/7WjiGnB9um6c20GNcydWXkgg20Gg:wabH/MfuM4YXDgL
TLSH
T1F8053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 6392d238bcef104fc6829ca74785345a5a1ee63456fdedfcb389ecc8f0235688
MD5 5a77cf38306edace9ffceedf71e4950d
SHA1 0bc8d1214e60cdf591114a32b4dc00e60ba01198
SHA512 db94a37dae2997a0df727aea2c2559eb0eb638c55275c29ec5787aa64ed6b665bd3ce37336591eb9b91c879d08f8b57186db5445d021dd96a2dd8412c0b8d89d
SSDEEP 24576:w4R5CIH/7cjiGnB9um6c20GNcydWXkgg20Gg:wabH/OfuM4YXDgL
TLSH
T1E0053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 811KB
SHA256 777497dd54fa3ea2dabf3ae28aaef937fa1f23db23e8448c5414d4107f070b85
MD5 3a1b94cdb125759f172153bad19cccdb
SHA1 22e4adc8cc959c6beded5e4d37d1bb881470e146
SHA512 960cb73efd16df5bfc08ace909d81b250a5f7a2fcc3b49f1b6f61d251558def8a8e0017aaa940bb41be7be09ad0538a364d07eabf323ceae29dd858d63361c56
SSDEEP 24576:w4R5CIH/7ajiGnB9um6c20GNcydWXkgg20Gg:wabH/IfuM4YXDgL
TLSH
T187053A1167E404A9E833D674A8A08516EA327D610B60DFDF63D0761E1F336D2AE39F36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1056-181-0x0000023574AB0000-0x0000023574B9A000-memory.dmp

Download

memory/2028-177-0x000001B47A110000-0x000001B47A1FA000-memory.dmp

Download

memory/2220-78-0x0000019C952F0000-0x0000019C953DA000-memory.dmp

Download