shodi | b9a4b1caef2f005e232c7d9877a2ea03a77308793a5bad534a60f64638193a24

Analysis

max time kernel
150s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
Size 6.4MB
Sample260420-11gp6aev8p
SHA256 b9a4b1caef2f005e232c7d9877a2ea03a77308793a5bad534a60f64638193a24
MD5 9f8d07cd95eb85cd2bb959f2bcf8501c
SHA1 0cf3e2ba686e9fc9aaf0959a046ba7d1a1b92e93
SHA512 0439b807db62e753743e93e5266bfa314a9fa18322038d77f100e5a44e546ededf93ccf3348d3cb167251ff17de47122ee5abb0ff34b43fc7a79dc796befdf9f
SSDEEP 98304:02K5jx9vuFOnYHEILapILWQtZ/K0tGOFWVRuLftCTW:0ljvUJcILWyZ/K0ttYVAATW
TLSH
T196668C13F6E500A9E06AD174CF359631EB72BC6A4BF1A5DF228076D41E36AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery shodi spyware stealer worm

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 2 IoCs

resource	yara_rule
behavioral2/files/0x001a00000002b45e-10.dat	family_shodi
behavioral2/files/0x0002000000029e05-711.dat	family_shodi

Executes dropped EXE 12 IoCs

pid	Process
2200	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
2476	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
1412	chrome.exe
3080	chrome.exe
5420	chrome.exe
780	chrome.usa
4652	chrome.usa
3280	chrome.usa
4424	chrome.usa
6112	chrome.usa
3324	chrome.usa
5588	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UsaShohdi.asu	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ONENOTE.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\javaws.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSOUC.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ORGCHART.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\javaws.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\SDXHelper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\Wordconv.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.usa	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
776	5588	WerFault.exe	108

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4464	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134211964168022875"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
4632	chrmstp.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 2200	4988	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe	79
PID 2200 wrote to memory of 2476	2200	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa	80
PID 2200 wrote to memory of 5972	2200	2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa	81
PID 5972 wrote to memory of 3160	5972	chrome.exe	82
PID 5972 wrote to memory of 4464	5972	chrome.exe	83
PID 5972 wrote to memory of 1984	5972	chrome.exe	84
PID 5972 wrote to memory of 1984	5972	chrome.exe	84
PID 5972 wrote to memory of 3752	5972	chrome.exe	85
PID 5972 wrote to memory of 3752	5972	chrome.exe	85
PID 5972 wrote to memory of 1580	5972	chrome.exe	88
PID 5972 wrote to memory of 1580	5972	chrome.exe	88
PID 5972 wrote to memory of 4016	5972	chrome.exe	87
PID 5972 wrote to memory of 4016	5972	chrome.exe	87
PID 5972 wrote to memory of 3720	5972	chrome.exe	89
PID 5972 wrote to memory of 3720	5972	chrome.exe	89
PID 5972 wrote to memory of 2352	5972	chrome.exe	91
PID 5972 wrote to memory of 2352	5972	chrome.exe	91
PID 5972 wrote to memory of 3088	5972	chrome.exe	93
PID 5972 wrote to memory of 1404	5972	chrome.exe	94
PID 1404 wrote to memory of 5224	1404	chrmstp.exe	96
PID 1404 wrote to memory of 4632	1404	chrmstp.exe	97
PID 4632 wrote to memory of 5824	4632	chrmstp.exe	98
PID 5972 wrote to memory of 1412	5972	chrome.exe	99
PID 5972 wrote to memory of 3080	5972	chrome.exe	100
PID 5972 wrote to memory of 5420	5972	chrome.exe	101
PID 3080 wrote to memory of 780	3080	chrome.exe	102
PID 1412 wrote to memory of 4652	1412	chrome.exe	103
PID 780 wrote to memory of 3280	780	chrome.usa	104
PID 5420 wrote to memory of 4424	5420	chrome.exe	105
PID 4652 wrote to memory of 6112	4652	chrome.usa	106
PID 4424 wrote to memory of 3324	4424	chrome.usa	107
PID 5972 wrote to memory of 5588	5972	chrome.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
  C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
    C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff72c77b618,0x7ff72c77b628,0x7ff72c77b638
    3⤵
    - Executes dropped EXE
    PID:2476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0dbcc728,0x7ffc0dbcc734,0x7ffc0dbcc740
      4⤵
      PID:3160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=1488,i,10035349887002332179,9774264397433131569,524288 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2140 /prefetch:11
      4⤵
      System Time Discovery
      PID:4464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,4944564344288728719,1324929303524900752,262144 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2072 /prefetch:2
      4⤵
      PID:1984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2392,i,18299957043668891270,3023620089208844068,524288 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2544 /prefetch:13
      4⤵
      PID:3752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3152,i,10773048363158361588,5552748161966537789,2097152 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3160 /prefetch:1
      4⤵
      PID:4016
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3996,i,14940802745196430118,13985561417090440923,2097152 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4012 /prefetch:9
      4⤵
      PID:1580
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3156,i,7730407553264297105,13942551458012971898,2097152 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:3720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4572,i,10016808099249411486,6805044338237136278,2097152 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4628 /prefetch:1
      4⤵
      PID:2352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5392,i,7395974150421307257,1733649253010973250,524288 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:3088
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1404
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7f68a55a0,0x7ff7f68a55ac,0x7ff7f68a55b8
        5⤵
        Drops file in Windows directory
        
        PID:5224
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4632
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7f68a55a0,0x7ff7f68a55ac,0x7ff7f68a55b8
        6⤵
        Drops file in Windows directory
        
        PID:5824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5648,i,17521377056719777615,5552058934932902109,524288 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5668 /prefetch:14
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1412
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4652
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc0dbcc728,0x7ffc0dbcc734,0x7ffc0dbcc740
        6⤵
        Executes dropped EXE
        
        PID:6112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5800,i,16218439587153648068,3953790724624097128,524288 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3080
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:780
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0dbcc728,0x7ffc0dbcc734,0x7ffc0dbcc740
        6⤵
        Executes dropped EXE
        
        PID:3280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5632,i,12554994633371370480,8512968212645818661,524288 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5820 /prefetch:14
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5420
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4424
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc0dbcc728,0x7ffc0dbcc734,0x7ffc0dbcc740
        6⤵
        Executes dropped EXE
        
        PID:3324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5956,i,3278961782112827784,13459523450966594379,262144 --field-trial-handle=2076,i,245479761347967713,8766125591557854353,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5776 /prefetch:10
      4⤵
      Executes dropped EXE
      PID:5588
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 244
        5⤵
        Program crash
        
        PID:776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5588 -ip 5588
1⤵
PID:424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1404_13421196417108090.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1404_13421196417108090.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

4632_13421196417063825.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4632_13421196417063825.pma
Size 696B
SHA256 b47e3855ee09e0deb72b7089f35de602e69e7ee8e3e31e97719bf4992224a9f9
MD5 66960afcd0fdfd90f6c22d0bbbb12f69
SHA1 8cd2864e4ca8067b1a78aeffe49942e8547d4831
SHA512 9823d1af559d88ee9ede7c870dfe9b6d72010543b63352d5a0d699e91ca38c6a65fe8d571b1af2b6d00bddc0bbfb01677683f1d38367ea717174211a05a8a268
TLSH
T18901C946A3144F77CC868D3584BE27512BB0FA502B821BBF7B10764F3E022C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 5.1MB
SHA256 d0b28647714d607618ba0f905a305296a11a27b1e8d403644f95a9200685fbb9
MD5 8c1169bde0204e718599bf9f7ae22e18
SHA1 eaad6f51a5eac92ea4f0553d7f91d877bb1f055d
SHA512 5c2c28d6b098b0d3c81679c98ca59cd306063cf0707ffe3d3d573c8bcf231fb1182aeb613d5a6871b84370da5f859b721a0452b53d1fe43891c015ca18b6a416
SSDEEP 49152:XGT2K5dFx9+CVD2SouuFOnYIsEygjI45TMwwapISyLSrJhMeJNvjLAE3dGGj8b2A:02K5jx9vuFOnYHEILapIpm7vj1BDlZU
TLSH
T146469D13F2D540E9D06AC074875A9632EA72BC6507306ADF0790BB662F77BD06B3EB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.usa

Path C:\Program Files\Google\Chrome\Application\chrome.usa
Size 3.1MB
SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
MD5 fa63967c128ae8a0849c916979790211
SHA1 7064ec510e9828d290aacdee2af26855ca816c84
SHA512 db167c33774c8032501e36488c9f6724a7394f9e7134a1c9235df8bc7f71658132bc39a84967cf98ef8a61e68ce2d4c813f156ae445a8f6273c811e746fe181f
SSDEEP 49152:VyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Um7vj1BDlZG
TLSH
T19DE58C13F2D940D8D059D079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 dc16642704bbd372b6b47bd40a67b3413b4b7662236763e613a05a38e3b945e9
MD5 6c354b71b1035c9a05249154bf2c7eaa
SHA1 818a1522b5415c5dde6731dea3ccdd609647f1b0
SHA512 64495d08931e8c0d7fce3ed657eac2ade85545fba2df0ad2a6fcbebf2cadea317fef84c21734100265a8766cf23f22ade353123805ce79e3170a8a9be5feb6d4
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 17b542b9efa81d8e150128f55a69ff866d752a73654dcfa2600212e44d84649a
MD5 98687447ccde59c0c96cc27fd3d1b076
SHA1 6c6385e654d1cca0b356b1c22cb28ceb3ba6751c
SHA512 062c437acd27b3c592235b5e9bba87e414b991f4379da0c7e28a8ff39b06f9d980f513a35f74cfbadcb671c97f64f9c9ba12c95e6f4de5835adbbff70a948ec0
TLSH
T142E02BEAC825EC3B4CFE4718A0915746F65513A72740491B7A3D820C8F70A3E4189C1C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f170d5c1f3eb0d1f6cc7e2557bc86fd7a00e7cc99e03313f73fbea3c4f1d6dba
MD5 a5063a6e3df1c80a0ed31096ebbf45c0
SHA1 b14c23eff0897c0ba400485bc3d2b2fa60550472
SHA512 046e30d72e8ad396cd858ef0aff9172d55f507e7051c3bf416c0b5b3d33f0385fe0e6843c4649741f98402ed0bb73ce323e6d037a427f69e3a4df0c93783827b
TLSH
T19061ADF7C7E8867D891196F4AA116E2FCE3D0924131C3C6688D8AF4B57F2872D24178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e592f9a11ccc36d21578358a4b07c929f9d80160168f848d5d52e0cc62b0a2e0
MD5 35efb82132212d57037c8c8f5ce3eb9a
SHA1 5255a088ddd6afaa07cadbb966669eb99c99d278
SHA512 5ae4de72c95c292d8a63fd15590ba618a9aca6aca560834e2462732d93735a1cb190c84aee036e98f2369674c0d056e8be0104b20e90d2025437166138e8e013
SSDEEP 192:zRPKfGTqQMv7k9PRp2NXsb+WNnXUYwVS2+T10gkwP+iyIsnAUgraJ:zRPKaY0XSXwEYw02+T6gvHe
TLSH
T18742D86EBD10A57B5CDAC25AFB167743D7F6113121842E80EAFC863C19D79CC621B06B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 2bfe81f83561e2a1c2f7596c3fddeed582a1fa177638527b4dcf68304f58f921
MD5 88c9896a8bc04ca432d9b4d5aabff80e
SHA1 4160ecf11a278b7a915e92cbf1a7f780e337acec
SHA512 8b0a72e4c0eeab7fd6416c5dd31354d401d81bd23386b28361a193780aab6389c53ab5f286d51af3c2cf399ffb1bc4912aee825a4e1e104a7d6154599b6c0132
SSDEEP 192:5RrKfGTqQMv7k9PRp2NXsb+WNnjJ2XS2+T10gkwx+iyIsnAUgtaJ:5RrKaY0XSXw92i2+T6gRH8
TLSH
T11C32D76EBD14A57B5CCAC25AFB157743D7F6113121842E80EAF8863C18D79CC622B4AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 a7e1e1e8eb184acb199cad068673e9312a6bb2daa59a0da575178959bbf14832
MD5 ab296bc208e17e60e55bbad836efcaf3
SHA1 f6187ba8987d91f9463a0923169eccc769a02472
SHA512 1c931062ad0dfc44b997e43111e098b2d6d621b1d278e6ed0dbaf14919bf3ce42519cad376bcaef9e227082721c7435edc58501c73a1536dca36fc7a71d123be
SSDEEP 192:zRPK5GTqQMv7kCPRpDNXsb+WNnXUYlmS2+T10gkwd+iyIsnAUgraJ:zRPKIYNXZXwEYl52+T6g9He
TLSH
T11342D96EBD10A57B5CDAD25DFA167B43D3F6113121902E84EAFC863C19D7ACC221B06B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe586731.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe586731.TMP
Size 3KB
SHA256 c90d5b5d061944f3aac7eab0b2c4e8593409a36e066600235666ea2ed88d1b1e
MD5 a8d15ae50764f7686199e16dd5086c96
SHA1 cd7aa0906ddc4b21deecced541615545b2ffe774
SHA512 7b41657ff5b4fb31999444289a1c09267d261cffe3a0f6c799921bf5fdbf4517914edd001cc253a4f8eb89e1dd3c8f2325323f786bf522fdf615f5a788a7d686
TLSH
T11061751DC4640DAB0DB67B75792A0783FA50827B25016C573E7E198C0F778664080F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 403a76aab789823c6c4570a62638f4e25244177c23ffc01b69898934be845924
MD5 029e36097c09070bffce958c73f19d41
SHA1 aff583a7afb41a9d1cc49362614cee057f1127c5
SHA512 8e9ef9b20659cb5fcce739ee3ab04e9b32a09d2256569423d9ca7923185866d78dc33b55eafa59fe616eec4a2abf5f3c830e8bcfc6f3473794f1542cbaee3266
TLSH
T116B012508445DA01C00702F83182088CF2289F308705330E53E0AD71982B190401C160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5892c5.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5892c5.TMP
Size 96B
SHA256 1d46737e913f85dea7dbd92f9d08666a7f388909112db5d2571f34a487081a63
MD5 e586b5c1c694f044e0ca9882d6c24191
SHA1 f4202773f0df349667a0dae05dadabba5e780fd1
SHA512 9fcdac456fc6196e132430e50aa65499f1acee2cb0053d99ca2e44b340e7b183c47ef04bcbb29a62b1a5548353256d0e11ecf63d2ac95847920a069043bce7b7
TLSH
T11CB0222EC002BA82C00203F838A0C2C830F0CF28CA03030FA2E08A3BEC3B2300830830
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 7bf5e8fffbb4dd7d018864a8f10b5ecf8792b469ce436da33e231021d988b095
MD5 12490014395fea231c1f252b71e4ea23
SHA1 86364d905791bd26395a920c0a6ba45ec62d194b
SHA512 94115b3d97fad138af1723e788b1bd6811595801d1361700da28075e00a798e742f3530981b281bc41842c938a9c472fe92ec045e9675caee789d2757e1cc127
SSDEEP 3072:nIEcqFK0NwHDujeFYcX0bg+gMaYf2yfta++J3qUQm08KMWF0bFTcVHr6z8:nlgPuG0m02yFa++JjcMW2VcVLH
TLSH
T15E14131EAB283DF6224B867BF2075E5C8DE1ACEF162971FC60426B5E085E78B5746C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 17721b193f9f19ce0924b906ba4f9da8cc4500a3c769eea12e53ad94d620d8e3
MD5 9e4a7ca9d6eccac8fd9a989e8b24d331
SHA1 6085952624f4e9026a26f40013fe9eae31c8f2e4
SHA512 843f0fc46c76683e74824e083f094bfa960645cd5fcd5dfb976cdae0c66a61e8b50756fbad3380189c21216e58768a67c837ce1bea81c4311b6829f1ea256bd0
SSDEEP 3072:pIEcqFK0NwHDujeFYcX0bg+gMaYf2yfta++J3qUQm08KMWF0bFTcVHr6z8:plgPuG0m02yFa++JjcMW2VcVLH
TLSH
T16814131EAB283DF6224B867BF2075E5C8DE1ACEF162971FC60426B5E085E78B5747C40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 193KB
SHA256 503833abc3f8e674c1050021cdc358ded75d53a7b2f3d2cfce1ed65a5fc98333
MD5 014d304167ef134e65ae9f2c60c66ada
SHA1 90768c2e826d1f0ce7a3f08aa9a7946d89ab59bc
SHA512 9153091793232d67fa6cd3d94f0400e0fa9ce3065f736f9ecc0b6b34f2647e5ca422dd3ffe538d27c97e48f5151288569d7da46efa843f65f69feda1a87edfba
SSDEEP 3072:0EcqFK0NwHDujeFYcX0bg+gMaYf2yfta++J3qUQm08KMWF0bFTcVHr6z8:RgPuG0m02yFa++JjcMW2VcVLH
TLSH
T1FE14131EAB2839F6224B867FF2075E5C8DE1ACEF162971FC20426F5E085E78B5746C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 1b02f9544306726aa2b274f3912684034ed67a7afefccae4f3019ec9a5b641b3
MD5 6c7b4e874d41fac4ae486af08add7abc
SHA1 1a38fa1512e04910eb2f41411793e2d5bfba1adb
SHA512 ea9030665c179cbe05477e15b3c1c1c505094a3253e83ace78dffa4190df0265d117515decb95574ab3adaba33d9a5c53f558af2c4c85da4702b3e1c93770383
SSDEEP 1536:eGsliP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:aI++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T1F49312B9991E7D75636AC6D690079DAC88E3DCCE1514117C30C7AB1E28BE393A30B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa

Path C:\Users\Admin\AppData\Local\Temp\2026-04-20_9f8d07cd95eb85cd2bb959f2bcf8501c_amadey_cloudeye_cobalt-strike_elex_hellokitty_hijackload.usa
Size 4.3MB
SHA256 a8c4ca099a07dbd87d9045f22be0e4acb34857323b8633d7fac46c97dc41d6ef
MD5 c451c81ed46b64c08d9db05237dcee8d
SHA1 ac63c873facf263439de14edde1b03f51514e0fe
SHA512 55649b927b706ba5fdda88539236e8344df8ed7ae6cb2976b8bff1b71bb1ba2dd88d3aea488ad178f6b184941ea38cdf49a19fbedc98bd8bff2fa6039c6fe763
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T1D2264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsaShohdi.asu

Path C:\Windows\SysWOW64\UsaShohdi.asu
Size 6.4MB
SHA256 b9a4b1caef2f005e232c7d9877a2ea03a77308793a5bad534a60f64638193a24
MD5 9f8d07cd95eb85cd2bb959f2bcf8501c
SHA1 0cf3e2ba686e9fc9aaf0959a046ba7d1a1b92e93
SHA512 0439b807db62e753743e93e5266bfa314a9fa18322038d77f100e5a44e546ededf93ccf3348d3cb167251ff17de47122ee5abb0ff34b43fc7a79dc796befdf9f
SSDEEP 98304:02K5jx9vuFOnYHEILapILWQtZ/K0tGOFWVRuLftCTW:0ljvUJcILWyZ/K0ttYVAATW
TLSH
T196668C13F6E500A9E06AD174CF359631EB72BC6A4BF1A5DF228076D41E36AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 137a899c007e2b66a8ea92cb4baa30b18b263459194684f050bd79eb4405f919
MD5 cb8db3a3a2fbb529db62062bc45d3e5e
SHA1 fbe69ebd1ce6146f3876dfacc1002d1a3d8f375a
SHA512 d99bc57bc8f6196097e05971c6b5bc8c8d9888a930e2872dc469749cfb10b413b15054d327af219da5989380610bcf42646894bf0250641b12b4b5305d1f85fb
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 92aaab4a1696caecbff40f0347ed6819f0a8ccf18a02ac431fce889cccdd1a68
MD5 8bb82783956d7d3b860552ac6af1b9ba
SHA1 a475e5f5bfcbdb83432ba3d9bf5f67c219975b26
SHA512 23f2a3b4d8bb718ad204ebbf7e7e66d2ef42ae042a14a95c07fab78c0ba470f80529fa98ed078d3386e3be1b65ef3416fb9c5ea59765aaf1b03d21f95d0c7294
SSDEEP 96:ManuExf7iw9i8hK36K3fvBV4BidvHhK2OK2vTX9b1/ZlOEJV9hK3hK3Q60:juw7R9Wb4UodBpZlzCZz
TLSH
T18612BDD64E02896F3B82DFAB325721A16D9B600AC7E954F237EB5106F4CEB64001F5B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2476-270-0x00000297FF300000-0x00000297FF41E000-memory.dmp

Download

memory/3280-926-0x000001EC9F090000-0x000001EC9F1AE000-memory.dmp

Download

memory/3324-928-0x000001CAC8350000-0x000001CAC846E000-memory.dmp

Download

memory/5224-350-0x00007FF7F6330000-0x00007FF7F695C000-memory.dmp

Download

memory/5224-351-0x000001589EE00000-0x000001589EF1E000-memory.dmp

Download

memory/5824-352-0x00007FF7F6330000-0x00007FF7F695C000-memory.dmp

Download

memory/5824-353-0x000001B006530000-0x000001B00664E000-memory.dmp

Download

memory/6112-927-0x0000027073380000-0x000002707349E000-memory.dmp

Download