shodi | b9a4b1caef2f005e232c7d9877a2ea03a77308793a5bad534a60f64638193a24

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
Size 6.4MB
Sample260420-11gp6aev8p
SHA256 b9a4b1caef2f005e232c7d9877a2ea03a77308793a5bad534a60f64638193a24
MD5 9f8d07cd95eb85cd2bb959f2bcf8501c
SHA1 0cf3e2ba686e9fc9aaf0959a046ba7d1a1b92e93
SHA512 0439b807db62e753743e93e5266bfa314a9fa18322038d77f100e5a44e546ededf93ccf3348d3cb167251ff17de47122ee5abb0ff34b43fc7a79dc796befdf9f
SSDEEP 98304:02K5jx9vuFOnYHEILapILWQtZ/K0tGOFWVRuLftCTW:0ljvUJcILWyZ/K0ttYVAATW
TLSH
T196668C13F6E500A9E06AD174CF359631EB72BC6A4BF1A5DF228076D41E36AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery shodi spyware stealer worm

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 2 IoCs

resource	yara_rule
behavioral1/files/0x00070000000243b4-12.dat	family_shodi
behavioral1/files/0x00090000000243be-653.dat	family_shodi

Executes dropped EXE 12 IoCs

pid	Process
5020	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
1728	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
1076	chrome.exe
1436	chrome.exe
4988	chrome.exe
2472	chrome.usa
3144	chrome.usa
4980	chrome.usa
4436	chrome.usa
4556	chrome.usa
2388	chrome.usa
972	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UsaShohdi.asu	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.usa	chrome.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSQRY32.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\protocolhandler.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\misc.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\maintenanceservice.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\7-Zip\Uninstall.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\uninstall\helper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1604	972	WerFault.exe	123

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3288	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211964172239393"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4972	chrome.exe
4972	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe
Token: SeShutdownPrivilege	4972	chrome.exe
Token: SeCreatePagefilePrivilege	4972	chrome.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
3600	chrmstp.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe
4972	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 5020	5092	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe	86
PID 5020 wrote to memory of 1728	5020	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa	87
PID 5020 wrote to memory of 4972	5020	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa	88
PID 4972 wrote to memory of 2484	4972	chrome.exe	89
PID 4972 wrote to memory of 3288	4972	chrome.exe	90
PID 4972 wrote to memory of 4020	4972	chrome.exe	91
PID 4972 wrote to memory of 4020	4972	chrome.exe	91
PID 4972 wrote to memory of 2352	4972	chrome.exe	92
PID 4972 wrote to memory of 2352	4972	chrome.exe	92
PID 4972 wrote to memory of 5028	4972	chrome.exe	93
PID 4972 wrote to memory of 5028	4972	chrome.exe	93
PID 4972 wrote to memory of 4564	4972	chrome.exe	94
PID 4972 wrote to memory of 4564	4972	chrome.exe	94
PID 4972 wrote to memory of 2436	4972	chrome.exe	96
PID 4972 wrote to memory of 2436	4972	chrome.exe	96
PID 4972 wrote to memory of 4264	4972	chrome.exe	97
PID 4972 wrote to memory of 4264	4972	chrome.exe	97
PID 4972 wrote to memory of 3424	4972	chrome.exe	99
PID 4972 wrote to memory of 4292	4972	chrome.exe	100
PID 4292 wrote to memory of 968	4292	chrmstp.exe	102
PID 4292 wrote to memory of 3600	4292	chrmstp.exe	103
PID 3600 wrote to memory of 1308	3600	chrmstp.exe	104
PID 4972 wrote to memory of 1076	4972	chrome.exe	113
PID 4972 wrote to memory of 1436	4972	chrome.exe	114
PID 4972 wrote to memory of 4988	4972	chrome.exe	115
PID 1076 wrote to memory of 2472	1076	chrome.exe	116
PID 1436 wrote to memory of 3144	1436	chrome.exe	117
PID 4988 wrote to memory of 4980	4988	chrome.exe	118
PID 3144 wrote to memory of 4436	3144	chrome.usa	119
PID 2472 wrote to memory of 4556	2472	chrome.usa	120
PID 4980 wrote to memory of 2388	4980	chrome.usa	121
PID 4972 wrote to memory of 972	4972	chrome.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
  C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
    C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff6e1c5b618,0x7ff6e1c5b628,0x7ff6e1c5b638
    3⤵
    - Executes dropped EXE
    PID:1728
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedc49c728,0x7ffedc49c734,0x7ffedc49c740
      4⤵
      PID:2484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1984,i,3428615167166626784,2293427963621139931,524288 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1696 /prefetch:3
      4⤵
      System Time Discovery
      PID:3288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,15956551960957112355,18359795576396528190,262144 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2132 /prefetch:2
      4⤵
      PID:4020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,13376007193153504004,7557586596540737788,524288 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2556 /prefetch:8
      4⤵
      PID:2352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,7543204314495565239,7499101979995640787,2097152 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:5028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,14973362188835510663,2677558443076713253,2097152 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3284 /prefetch:1
      4⤵
      PID:4564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4288,i,7447601104678130268,17957935292655187154,2097152 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4300 /prefetch:2
      4⤵
      PID:2436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,9342972244952375331,18393102940427537303,2097152 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4688 /prefetch:1
      4⤵
      PID:4264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,1941809218477986067,1578751798865304902,524288 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5488 /prefetch:8
      4⤵
      PID:3424
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4292
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x228,0x274,0x7ff76a4e55a0,0x7ff76a4e55ac,0x7ff76a4e55b8
        5⤵
        
        PID:968
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3600
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff76a4e55a0,0x7ff76a4e55ac,0x7ff76a4e55b8
        6⤵
        
        PID:1308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,10933613729724608796,11363703734634955890,524288 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5724 /prefetch:8
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2472
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffedc49c728,0x7ffedc49c734,0x7ffedc49c740
        6⤵
        Executes dropped EXE
        
        PID:4556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,9210898090515975054,3460986230154488159,524288 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5796 /prefetch:8
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1436
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3144
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffedc49c728,0x7ffedc49c734,0x7ffedc49c740
        6⤵
        Executes dropped EXE
        
        PID:4436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,13913037230750786697,2518507286957024342,524288 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4988
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4980
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffedc49c728,0x7ffedc49c734,0x7ffedc49c740
        6⤵
        Executes dropped EXE
        
        PID:2388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5704,i,4896192844192579779,12158902511923298660,262144 --field-trial-handle=2136,i,1828406843221939442,18267724166964623843,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5712 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:972
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 972 -s 232
        5⤵
        Program crash
        
        PID:1604

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1992

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 972 -ip 972
1⤵
PID:468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 f025950d7b79f0036c7fa7903c242ed8eaa8754cb19f090544d6f5757c2043d4
MD5 23d37c3311152e8432e6a47fa9d297c3
SHA1 0d46339ed833611144695c91ac1a707c41e7fd4f
SHA512 88315a64ea52c5176a801feb23d50b087b2a8753599a12608162f58c60912606dd065fece657aeb79f32b7c352e0969ae5ec60692528a64209cf73269e6af597
MD5 SHA1 SHA512

Submit Download

3600_13421196417335597.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3600_13421196417335597.pma
Size 696B
SHA256 6da8adc0422c299b3bf1bb4a5227a684a9eaf0e28b9f661ebbd2d582a4e9006e
MD5 92efe58d36f0e8b5f8950d70f977e8c5
SHA1 73dbab7ea3777695a4bc5d65ef6535a2af30218b
SHA512 84a3c7e073b0bf346e8605037bb036d97eacaa711da0880ddc4e35b13bc65a8b09a19752797d636f5462ef484f1c2356d240d8e314e9cb7c1e0c20137b7dbe37
TLSH
T190010E46A3184F77CC828D3585FF27512BB0FA501B821BBF7B24724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

4292_13421196417354145.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4292_13421196417354145.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 5.1MB
SHA256 d0b28647714d607618ba0f905a305296a11a27b1e8d403644f95a9200685fbb9
MD5 8c1169bde0204e718599bf9f7ae22e18
SHA1 eaad6f51a5eac92ea4f0553d7f91d877bb1f055d
SHA512 5c2c28d6b098b0d3c81679c98ca59cd306063cf0707ffe3d3d573c8bcf231fb1182aeb613d5a6871b84370da5f859b721a0452b53d1fe43891c015ca18b6a416
SSDEEP 49152:XGT2K5dFx9+CVD2SouuFOnYIsEygjI45TMwwapISyLSrJhMeJNvjLAE3dGGj8b2A:02K5jx9vuFOnYHEILapIpm7vj1BDlZU
TLSH
T146469D13F2D540E9D06AC074875A9632EA72BC6507306ADF0790BB662F77BD06B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.usa

Path C:\Program Files\Google\Chrome\Application\chrome.usa
Size 3.1MB
SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
MD5 fa63967c128ae8a0849c916979790211
SHA1 7064ec510e9828d290aacdee2af26855ca816c84
SHA512 db167c33774c8032501e36488c9f6724a7394f9e7134a1c9235df8bc7f71658132bc39a84967cf98ef8a61e68ce2d4c813f156ae445a8f6273c811e746fe181f
SSDEEP 49152:VyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Um7vj1BDlZG
TLSH
T19DE58C13F2D940D8D059D079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 1050a95cda4daee336bc317d5a0a31133be40a4cc260e3e289b545471b53f011
MD5 f792b239d4d308a21b9ea81feb552d39
SHA1 57762b12dd902594e1d6344d51c6a4336cff02b1
SHA512 120cea13cbb47084c0280b53eb0c347c5b1df83be7dfa8e68f725cf9e9578a18494c7d473af3da3fdaa93abd86bc86eee770071cfead868e9eee850e449ddc4e
SSDEEP 192:p2XK8+77gnUR2AEroD7CrrIO3VZCrG5+8IaUnaXQtbpRKk:p2Xv8EnUYZ5lcIPXQtbpRKk
TLSH
T139127BD69E03486F3BC39F2B325331955D9B140AC7E454B23BFB5106B8CEA64141FAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 36d37a4f3db537588ec69a489da93506d94c577b4f53bea7ea39c3462654b28b
MD5 789544b272d42a7ffe9a443caab0aa00
SHA1 d378b39df3fb41aee2e3a60ec3332cd08fcf162a
SHA512 fb02fa3810689423f9c391285e2090241ced98a502159a41f4c729bfb827bcfcadcf11953f8fe742392051a49b9db58f49204b4140208cbca1223731290bb151
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4e0fabb511c0dc9915e0492d1721d9cb3fed48406b185b7ce2657e8c3bafc90a
MD5 acf7c4aca71a521e4e7a0a36111a2067
SHA1 35873a67154cb24eda43d85ba29a817c1d173f54
SHA512 4598d63d7753bb59033d246edc370c624fde2ad7f15dde10be2cf8097ec7b24f05deb869aa40b9d7641d0c7c4ce6d7c2a8af6a7822c99ffc0201e47ba16388ae
TLSH
T126E061AFCD61DC3B08FD571920945745F75503572741650F7A3D821C8FB067E558AC1C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e8283e10dc73b1bc8c258bc8ed74dcca91c92c884be936bd55d322204f6bee8a
MD5 2322593631985d18ecb686701c0c7a88
SHA1 1ecd42718a4a2a9d3db871eb6e8498670fe5f0de
SHA512 a66189442872168e476cbe5acfc26d13946ec649b75aee1d3451ca3da8719b450ad91faea1baf373932709d2e5ae6c5ac30d504fe7d91e273a146d0132f064b1
TLSH
T15A519DF793E8867EC91196E4DA116E1FCE7D0A28131C3C6689D4AF0B43F2972D21178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c9207f47a85eaea3a79b0a6d945c53b86b2812971eb8bc40d2bf3c2c56d5dcba
MD5 9da369660b289af639cfa41f6ab4d0ef
SHA1 482a6a2be902391d7f68d154d55942a05a41e2e5
SHA512 8899b1053bc110310b073610cdc36352d5485d6281975510655d1292d49feace50ae6ace62c4d5563a04aef787e537f7d86967318cf8221a9bdefdf3cd15584c
SSDEEP 192:sRZUCMfeMNnv7w9PRp2LXsb+WNnGK2YDoXvLqniyIsnAUgtaJ:sR+N3vwXwXwr2Io2S8
TLSH
T11D32C52EBD00AA7B5CCBC659F9257713D6F6107171852D84DAFC862C19E7ACC222B06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cecf48430dea1ed77609365ce32a05d7e0f9778eb9b7552db1ba1c4a0620fe15
MD5 50a36f22dbec4bf6f4e8fc7b8e49a39d
SHA1 80561cd3a0d74a3547b15908994dc67cb6c19285
SHA512 02ae8195addf51935a647bc0a153237d620df06a34906329588e4ab5073a8f016d4e72e21bc01a65e2f92dbb5e6c1364c962842a056b8e91c1580241d04377c8
SSDEEP 192:BRZJCMfeMNnv7w9PRp2LXsb+WNnHgY5DoXvLqdiyIsnAUgraJ:BRvN3vwXwXwAYVo2Ae
TLSH
T12842D72EB900AA7B5CCBD659F9217713D6F5106131942E84DAFCC62C1DE7ACC221B06F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 731786ffa4f9b1e87ea3c4dcc441bd2ca4ea47d043f101c0b43d1409080acdec
MD5 49a4c7ebf615019dbaad0f3bba2d781e
SHA1 54c33ed1fbbcf7bdacc7a7f942c48a7dc4a2f410
SHA512 526d8465fb28d3715c9eb33f5ddbcdad6c099145ea49a3b6dc2744ce26f72a202ccaf54ba3507630e3adca08ae0307eaac84e77b1c3fbaba6471b2641de2ab66
SSDEEP 192:BRZJCMfeMNnv7wTPRpwLXsb+WNnHgYsDoXvLq5iyIsnAUgraJ:BRvN3veXuXwAYko28e
TLSH
T11E42D72EB900AA7B5CCBD659F9217713D6F5107121902D84DAFCC62C1DE7ACD221B0AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe583ab2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe583ab2.TMP
Size 3KB
SHA256 6bd63f7bf430e3d81a0baa2cec93fcba48679d5c97f06168b50e9b4cb8878503
MD5 75b9fabdc9f3f738013335ee3a3a040d
SHA1 63d435f8c0d4be18bcbe97319d08e74b87ff9b93
SHA512 63eb7e995b7d7722d13aba5ccf42c3f24a71455c550674ada8bd6ff88d8d850f29fd913358cd7966eb64f6a9ca8d0d786e611dc8c96d6af0f209efa273dc1a9a
TLSH
T1EA61709CD4240CB71EF57679B9BA4B81F962522F2241480B3ABF42CC0F72927D041F6E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d6607fbd037cc04b81e0c37dcf122df6f3229e2e0a0b73cc1fa4a20b8d6850ec
MD5 dd195d6b3d75d8e6449a89c5f244b58f
SHA1 215adda26a39132813d29fe4596d8f46218aca3a
SHA512 f2b613c01a7a2fe7f97cc03eb37d7f1c80a0760bd016beb6a7d8db5f5b028489d85b7b85980d3dc2cc2708feca2ce4dda78da705de52bd193164019f832980f1
TLSH
T15FB0126080419941C04303F411E2049C36149F1597092302A3E469B1A9272B18014390
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58656c.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58656c.TMP
Size 96B
SHA256 446c0410e593bd69c96e595d9f80676a232a88b930378e8ac116cce65b9ce106
MD5 43d2c35b80eda1bfc03dea6f7d238735
SHA1 6fef132943d17f249f9c629f7c349d8d4e14cb8f
SHA512 f9ffcfab6b4f515abfdafcb930024749153e4344b92a658cf49e55c8166402d1e999c4a09cac74a303bef1bc117d7fc854ec01fc92e237223024beebc42e6691
TLSH
T1B4B0220CC003A222C80203F02C8280C83030CF32C3030203C3F03EA2CC2A22000200B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 9635db1a4d9b30ea5b3cd4042761d12bfa79cc67b39bd86e204c32d6ab684c21
MD5 dabc0087c99975a203c340108e1af4df
SHA1 10f46305b1d225cb73b328fcc9a72dcdb8320f88
SHA512 3dcee7b7e52e9bef4d3618f5f0d32ca9651b8b180e8fdc3b872be04a6a527a640e3a87227048147149517f9d1260cc9ca8220f1ee8b545254179d356f6ac6438
SSDEEP 3072:0pEcqFK0NwHDujeFYcX0bg+gMaYf2yftK3Qw/xLANk0mUW5GmRntSFCjEENb:LgPuG0m02yFKrOk0HOGm/SFyEEV
TLSH
T13514122EAB2419F7246E4A7AF35B7A08CE203EDF71AFB5DC5014279D14852CE1F62D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 0f760041a5610968a4d6467229f736f4453355342367f464234111192b369cc4
MD5 97c03049343aaa5aca4c6d08ac625ce5
SHA1 7278d2be7642bb15412ffa977e67982cdee18e8f
SHA512 b349b4bb3db00da698ec222d713f287e3c3d59ee0cbfbab38829c4baa5a5ff364703dc537ec2730ce6baefa071452f3500b5e2f65d0550ae72f0e8561fc5b884
SSDEEP 3072:rWEcqFK0NwHDujeFYcX0bg+gMaYf2yftK3Qw/xLANk0mUW5GmRntSFCjEENb:jgPuG0m02yFKrOk0HOGm/SFyEEV
TLSH
T13014122EAB2415F7286E467AF35B7A09CE203EDF71AFB5DC5414278D14842CE1F62C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ce59dd3a1bb8b1c066b877fec9ee1198be30e78baf42a960dbccec82aa2e6354
MD5 73e1d3d2dd3ae8404de8f9b73a2cfb9c
SHA1 1f1284113194faa51ab014ba0d2b19d1217e3fdf
SHA512 66edc41cf21eca4e394dc774cf70bce98154240d6c533f44ddae3d6b8ceef698aea4cf5f47625213b2521a94b455ba3224e82efbe0821ee2fbc5bfe6ae8c8f4a
SSDEEP 1536:jVbcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xb3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T1219302BA5E174AE7957D4AC176AA7809CE12630D70AFA8CC315CA39C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 db259f1db4aec0c294eaf2c063c866f3c515fe31d33c2e6f22e95d7ef3b1c7be
MD5 815a24f71d7ff1cbb804a5a81d7ffd59
SHA1 bdd0ec1db289ca6f7ecdca4d701bcb48607a7ca5
SHA512 1aae52d56ed55ddd71b827b7d0dcab1d6a2482420f6d4e45e1d257cc6406f9b8ed7f64a31d345ad00ef6c16007f006a17073b79f35d290da7a1120067b1c4a8b
SSDEEP 3072:0bEcqFK0NwHDujeFYcX0bg+gMaYf2yftK3Qw/xLANk0mUW5GmRntSFCjEENb:VgPuG0m02yFKrOk0HOGm/SFyEEV
TLSH
T15214122EAB2415F7246E467AF35B7A09CE203EDF71AFB5DC5014278D14842CE1F62C42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa

Path C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
Size 4.3MB
SHA256 a8c4ca099a07dbd87d9045f22be0e4acb34857323b8633d7fac46c97dc41d6ef
MD5 c451c81ed46b64c08d9db05237dcee8d
SHA1 ac63c873facf263439de14edde1b03f51514e0fe
SHA512 55649b927b706ba5fdda88539236e8344df8ed7ae6cb2976b8bff1b71bb1ba2dd88d3aea488ad178f6b184941ea38cdf49a19fbedc98bd8bff2fa6039c6fe763
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T1D2264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsaShohdi.asu

Path C:\Windows\SysWOW64\UsaShohdi.asu
Size 6.4MB
SHA256 b9a4b1caef2f005e232c7d9877a2ea03a77308793a5bad534a60f64638193a24
MD5 9f8d07cd95eb85cd2bb959f2bcf8501c
SHA1 0cf3e2ba686e9fc9aaf0959a046ba7d1a1b92e93
SHA512 0439b807db62e753743e93e5266bfa314a9fa18322038d77f100e5a44e546ededf93ccf3348d3cb167251ff17de47122ee5abb0ff34b43fc7a79dc796befdf9f
SSDEEP 98304:02K5jx9vuFOnYHEILapILWQtZ/K0tGOFWVRuLftCTW:0ljvUJcILWyZ/K0ttYVAATW
TLSH
T196668C13F6E500A9E06AD174CF359631EB72BC6A4BF1A5DF228076D41E36AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/968-305-0x00007FF769F70000-0x00007FF76A59C000-memory.dmp

Download

memory/1308-306-0x00007FF769F70000-0x00007FF76A59C000-memory.dmp

Download