01684d9b949eee58d4f815ce1e404992a89e2c08ed1e4e73c2b6376e8e1b2c78

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/05/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 7.7MB
Sample260503-ffslpsbx81
SHA256 01684d9b949eee58d4f815ce1e404992a89e2c08ed1e4e73c2b6376e8e1b2c78
MD5 966246fedb72c46949d66e3a342901d4
SHA1 525c7f064451d22254e8a37533f8ebbd39bc6094
SHA512 2631c44d7d9092587cd373e21abd92c2be04a7725ec08d69f01023630a91115505e6cfa85b4a6837e7427d677b6fec5354c81c229e2cb078e4b8b181d007a15d
SSDEEP 98304:V7Iw3Vd0oAaldmdmnpRWQtZ/K0tGOFWVRuLftCT:j4Kmd0HWyZ/K0ttYVAAT
TLSH
T1BA865B13F2A540E9E06AD178DE268231DB327C594BF1A5EF328076D52E73AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4000	UpdatAuto.exe
3776	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
4608	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1808	sc.exe
2452	sc.exe
4580	sc.exe
2092	sc.exe
5080	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4112	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222573695479529"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3292	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe
Token: SeShutdownPrivilege	3920	chrome.exe
Token: SeCreatePagefilePrivilege	3920	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3920	chrome.exe
3920	chrome.exe
3920	chrome.exe
4736	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4000	UpdatAuto.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4220	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 4380 wrote to memory of 4000	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 4000 wrote to memory of 2096	4000	UpdatAuto.exe	87
PID 4380 wrote to memory of 3776	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 3776 wrote to memory of 4608	3776	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	90
PID 3776 wrote to memory of 3920	3776	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	91
PID 4380 wrote to memory of 3756	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 4380 wrote to memory of 4876	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 4380 wrote to memory of 4716	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 4380 wrote to memory of 456	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 4380 wrote to memory of 1692	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 3920 wrote to memory of 3292	3920	chrome.exe	97
PID 4380 wrote to memory of 4900	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 4380 wrote to memory of 4684	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 4380 wrote to memory of 5080	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 4380 wrote to memory of 2092	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 4380 wrote to memory of 4580	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	103
PID 4380 wrote to memory of 2452	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	104
PID 4380 wrote to memory of 1808	4380	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	106
PID 3756 wrote to memory of 3788	3756	cmd.exe	117
PID 1692 wrote to memory of 2148	1692	cmd.exe	118
PID 2148 wrote to memory of 1880	2148	net.exe	119
PID 3788 wrote to memory of 1952	3788	net.exe	120
PID 3920 wrote to memory of 1876	3920	chrome.exe	121
PID 3920 wrote to memory of 1876	3920	chrome.exe	121
PID 3920 wrote to memory of 4112	3920	chrome.exe	122
PID 3920 wrote to memory of 3372	3920	chrome.exe	123
PID 3920 wrote to memory of 3372	3920	chrome.exe	123
PID 3920 wrote to memory of 2232	3920	chrome.exe	125
PID 3920 wrote to memory of 1872	3920	chrome.exe	126
PID 3920 wrote to memory of 2232	3920	chrome.exe	125
PID 3920 wrote to memory of 1872	3920	chrome.exe	126
PID 3920 wrote to memory of 888	3920	chrome.exe	127
PID 3920 wrote to memory of 888	3920	chrome.exe	127
PID 456 wrote to memory of 5104	456	cmd.exe	128
PID 4684 wrote to memory of 4864	4684	cmd.exe	129
PID 4876 wrote to memory of 3464	4876	cmd.exe	130
PID 4864 wrote to memory of 2800	4864	net.exe	131
PID 3920 wrote to memory of 4148	3920	chrome.exe	132
PID 3920 wrote to memory of 4148	3920	chrome.exe	132
PID 5104 wrote to memory of 1044	5104	net.exe	133
PID 3464 wrote to memory of 3768	3464	net.exe	134
PID 4716 wrote to memory of 4024	4716	cmd.exe	135
PID 4900 wrote to memory of 4360	4900	cmd.exe	136
PID 4024 wrote to memory of 4568	4024	net.exe	137
PID 4360 wrote to memory of 3704	4360	net.exe	138
PID 3920 wrote to memory of 2636	3920	chrome.exe	140
PID 3920 wrote to memory of 1396	3920	chrome.exe	141
PID 1396 wrote to memory of 1052	1396	chrmstp.exe	143
PID 1396 wrote to memory of 4736	1396	chrmstp.exe	144
PID 4736 wrote to memory of 3164	4736	chrmstp.exe	145
PID 3920 wrote to memory of 2672	3920	chrome.exe	154
PID 3920 wrote to memory of 5040	3920	chrome.exe	155
PID 3920 wrote to memory of 728	3920	chrome.exe	156

C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4220
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2096
- C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff68736b618,0x7ff68736b628,0x7ff68736b638
    3⤵
    - Executes dropped EXE
    PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf198c728,0x7ffbf198c734,0x7ffbf198c740
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,17456997615819277684,10141249850314015060,262144 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1760 /prefetch:2
      4⤵
      PID:1876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,11828823365342317374,4955603614732971232,524288 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2252 /prefetch:3
      4⤵
      System Time Discovery
      PID:4112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5416126627777886521,1649944632917867520,524288 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2536 /prefetch:8
      4⤵
      PID:3372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,10655763628739170961,10098124258764012232,2097152 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      PID:2232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,8132932412616433331,9900520057539345880,2097152 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      PID:1872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4352,i,10196051580158234849,1994847107397355502,2097152 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4412 /prefetch:2
      4⤵
      PID:888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3076,i,8201153361257609381,2230813810368617657,2097152 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4648 /prefetch:1
      4⤵
      PID:4148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5472,i,558916229191048330,7242820151053637190,524288 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5480 /prefetch:8
      4⤵
      PID:2636
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1396
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff6dcef55a0,0x7ff6dcef55ac,0x7ff6dcef55b8
        5⤵
        
        PID:1052
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4736
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6dcef55a0,0x7ff6dcef55ac,0x7ff6dcef55b8
        6⤵
        Drops file in Program Files directory
        
        PID:3164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,1938783622623071368,17447490868233861317,524288 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6024 /prefetch:8
      4⤵
      PID:2672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6068,i,8693778476135728963,11780711038627833940,524288 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6008 /prefetch:8
      4⤵
      PID:5040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,6798315482800270687,16178845152435963889,524288 --field-trial-handle=1948,i,1947889397785194571,2437482357601811554,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6120 /prefetch:8
      4⤵
      PID:728
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1952
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3768
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:1044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:1880
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4360
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2800
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5080
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2092
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4580
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2452
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 4.0MB
SHA256 08def82f81a451eb3c07a77af9fc2b062e649d500de219b3756a7930c106284a
MD5 435e00060d34e1934521d18b2c9e374e
SHA1 ff0cf307634b1fe3f500327694ba6ab0d90c63ce
SHA512 706acbe54c50d67c801afdfb6c0cac7aca183c8f6ddd124d1b7805809117aac91ad93f0e68c5b1cfb903b4e83407d8a95c9e0af001fe1b0dce5ab8e7e81668ef
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyTPjih:57Iw3Vd0oAaldmdmnpLjo
TLSH
T19F165A13F29445A9D066C074CE96C226EB327C5947F1A5EF3280B6D93E33AD17B3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 4.4MB
SHA256 342c3971460ef35847156b2392da9165385f3beafaaa22c2a8267fb9efc23c19
MD5 69dd2327bbe79cebf50f7581f59c3a60
SHA1 f12b3a33feb02ea4e4d97b7cd1336177bf745530
SHA512 f0ea11e145b2527e6db110543473449a10d6aedbbaf5c452ec5259de2b6949cb4cf66236fe24b9878f3046caa7a23469e37bdf56b6f481c58ed90941cb4ff4c1
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyA/ez7:57Iw3Vd0oAaldmdmnpEezSC6v2XMH
TLSH
T103265B13B2A446A6D066C074CE969635EB323C4907F195EF3280B7D93E33AD17B3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 4.1MB
SHA256 a093ade0a242738b0fee693e71e5f5591a9a29256a58170744db6dfa0fffbd78
MD5 240390fe98a0a1ab3711247252c63d8f
SHA1 47abd89335e5fcc9689a4f1d94abfd3ae097c36e
SHA512 c3690353c6fd0c1b5f1834877e5b39fd529a10e5c791b9ea52c3f530456cf72b4dfd555703f98f82064fb8451fb4cfb08bb868dd39a027bfa65ebad2b23b5781
SSDEEP 49152:wabH//9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyzVO8N:u7Iw3Vd0oAaldmdmnpQ/h1+
TLSH
T107165B13B2A445A9D066C074CE96C635EB327C5947F1A5EF3280B6D93E33AD07B3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 3.4MB
SHA256 f442b08cb5f3c4391310952ca2310a89244b2933c57f41cef15a2858487cab54
MD5 dfde1dca483336019f677b40b55d54a2
SHA1 011388ea1ff38300fb21271b5afd1a0b582c82aa
SHA512 625a417ae827fe12690e23ac9eec845879511f286850be490e5935c8a38b4047f1f2e71a072d72e8c3e27a299996c6d720bc0d5eb7ea4eeb49c9337ff5522ecd
SSDEEP 49152:wabH/x9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nky:47Iw3Vd0oAaldmdmnp
TLSH
T132F55A13A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 a9a3819519c64255ef214cce8df48e231fc453fa79c9b539f5275908de167d75
MD5 f76433602d6380671df5f9bde01a1bdf
SHA1 a91a74cefa3d6205c79644996970c4eda4784d99
SHA512 258a6ac0e5fdbeb7d8ed8e348451a49fcea09c49df2a72ca5ec2e8b52d58a0576fa85b381b6b4aa79e8b9364b6342d17b8d77c96416d3c7df6db7b0bdbe5eda0
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 9.5MB
SHA256 7f4cd31c53b28bbfa4ef8c135691087718af0ad9958e3ede9ed9ce981f32c91d
MD5 c220c7f09ca5cd0fc0b965978ed67b56
SHA1 aa2cbb3107e7610e1ddb1bbb0cc08b8d0b78e009
SHA512 428fa3353b572a4471093bee65d67202613fa64501d1cf75e891055504479f6726e0bb09363c057b161cd33f6bbc0bf912908459fd24aa276cd1b8363fa6d9a6
SSDEEP 98304:x7Iw3Vd0oAaldmdmnpNQRQyi36YOcP+Lvw2gAf+PN34:f4Kmd0iQyiKaUX+PNo
TLSH
T130A67C13F2A501E8E05ED574CF2992329B357C4A47F192EF369436E52E72AD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 5.1MB
SHA256 45845906b54e0dc02f7729eda2be97a910fc85270878ae8367c00bb6c670e27f
MD5 cfac798aabdf0c12144387ba323dabbe
SHA1 cb5cec7a3f3552b4950a4c576784c866ca0051f5
SHA512 7d33188601459e9f956ebd1daae74449f951fa225987cec6ff51e1b38051fa26c658fc4f47bd980b31ceb0e01003c07b3a84fbc40b77c359f03f535fdffb803e
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nky268Q8:x7Iw3Vd0oAaldmdmnpUthHRc/Q
TLSH
T1E3465B23B2E500D9D05AD075DF468231D7A17C698BF1A6EF228076D62F73AD03B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 6.9MB
SHA256 07337f3d6038a4dbe43685868c0f099f87685659a608a1660fccf22e86f19c54
MD5 a607065f6f7293a4ae361cd8f53317d8
SHA1 4f91579f272b6a6db036af91e345fe17b66bd43f
SHA512 409493ecff4db706f0ffa28a84c81d2b71a3db11adc0bfa6c7b3aa812e2964afc85bd9c3b8435e40099fed2e036b57f1a6ec451bf23016abf7e56b552f681572
SSDEEP 98304:x7Iw3Vd0oAaldmdmnpLy5112gYy5azzVvf69nLKnhZO:f4Kmd0wLIHuWhs
TLSH
T19D766B13F29900E9D059C178CB468232EB62BC5A4BF1A6EF269077D52E77AD07B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 5.7MB
SHA256 49152b5fb4ffae4b65354a972c89b4107541f92813896c10625fcda291e891d0
MD5 ba027e14b09b9b3a203df1cc8e8d8023
SHA1 42f37366b1fe1a40436baa1121d54cf9a16aeba5
SHA512 a374a02bc2b230b67939da08bb7e8f24cf747b489849376df97ba5591aabfb31f3d88c648dcafd6cb2273b4c2c3a40224ef7bd11179c10e2ecc89bac96e43bfb
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyTB+tt:A7Iw3Vd0oAaldmdmnplu6Jm0xd2d3
TLSH
T150567C13F29500E9D05AC074DF468232EB62BC590BF1A6EF269076D62E77AE07B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 5.1MB
SHA256 1bee6b7e34e460fc32b6f034ad03549ceb6dc1219ce2ae972157cda08814507c
MD5 eae0b2549d51100ed8c9719761abb2e7
SHA1 4a2588ef556c21ac4b2bdc971ec5354e2c03ae8c
SHA512 b856feb063466b47f8c2e7805caf944ba3fadd21518d5da4c4b638c1b18c6082167f6beb6c9cba5a30dc87b5fed78d2604609256fc8f1e460fc20ed6b79e2f5d
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyr1hpp:x7Iw3Vd0oAaldmdmnprmifP5R7
TLSH
T1EC367C13F29444E9D05AC174CF568232EB22BC590BF1A6EF3690B6D62E77AD03B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 5.3MB
SHA256 25537f957d111fcb2cb8fb248f0d35bbe1da632053855bc299a834fc2836a06f
MD5 46bf27fc2f9647152ebc740ac395a17a
SHA1 d482ca4d300a22f05cbcd0f1c55da51057b96c01
SHA512 9f365813a970357beec90b04c4769d2c3a453cc33a8d391ae9213c6e6d8e27058a1970f8a513caf712bdffea171ae113c18dd3b19f9d2456cc152601da4bc250
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyWSuZU:A7Iw3Vd0oAaldmdmnp45dKCi616
TLSH
T1A3467D13B29544E9E0AAC174CF568232EB72BC594BF1A5EF328076D52E33AD07B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 4.9MB
SHA256 643b5f2baad7a6395082a30f005519352f81a27a495e324a6cceaff4ffb4ea26
MD5 c21ed0d700e423d231b3bc00160c85b6
SHA1 d9d1c54f2f5eb33568808128748ecd226f01d7d4
SHA512 8e40d79ced90ec0db6276d8d6002222e55e94b13ab33762af04d9b9f489393d06cf5f82517e4f9597a17c3d96b7b9527046be580d130e9f1478daf40b2337845
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkykhtS2:A7Iw3Vd0oAaldmdmnplX2iwphX
TLSH
T1D4367B13B29544E9D05AC174CE46C232EB62BC5907F1A6EF3690B6D62E37BD03B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 3.5MB
SHA256 90a6f1c292685c288e13591f94a573c9706deec3798fcb781d608ca10263320a
MD5 3c14014b8158501d4154da43e1d8ddd4
SHA1 f0b0b07dd706b440a13f3d425f5b91fbd129bea9
SHA512 f0d9929754496bc6840d98a03271f520a8cb2f9e105aa529a26f08e5f0a1bb1af19fedd105486bcf2161d61358730477e5ec6e31b751bf592573d7c4e87093fe
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyo:A7Iw3Vd0oAaldmdmnpo
TLSH
T124F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 3.5MB
SHA256 8223b5d927038fb3f63cd4c81b16567927859c6747f2dd4728ae8fb7dbf82a90
MD5 7c7416be8629e9835e57a90972663814
SHA1 48651eb43edf3db0b50ce647d1475e1edb8ff72f
SHA512 e45be6168068a6e876658026d4d0d02d0060fa5de86efd29fe5a4be8b79a4714fc7123f167198540e3b74c0433a51884fd4357c78555644cc3a7e0611fa8fcca
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyw:A7Iw3Vd0oAaldmdmnpw
TLSH
T10DF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 fddb3327c9b62dbe4810129e7a6de04fd2c29cf755dfb4e618c73b0692a80ba5
MD5 308499423a960d669def79aa8c715954
SHA1 d76bb221353cf144ba403b673f347605032ea070
SHA512 0d4feb2708fb0629b9496711e277d7d9871272faf6e75e77ae69388a23d8dad504e9aea6847b55c7644f52132a094636db49c224882c41cce9c868edad7087a5
SSDEEP 192:w8m6rO/2seDySDtrDhDlDpDUDpDpDSDMEfzgfMrfg2Aa/DbvjahvuHMk:NpJy2t/1xtYtt2MizuMTvbvjahvuHMk
TLSH
T17F12A0E95E02456F7BC2DB6B329325605E97200BC7E494723BFF5206B4CEA64042F6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 3.6MB
SHA256 8bc1a071c9f004e903e3e4a0c3a7414801fa34848742b4f56dc9cbafd878ba84
MD5 4681e3acb54e0305df4cafeab6e07642
SHA1 6245d5f176a1bb5ae63b2136fafb244d7665fd2e
SHA512 0a6cfb8ba283ed8378f823b24279afe21e393946df7ef195795fa76c41b928def39289954a1d8242d073100f9caf696110125dbde251ebbf255f0beb2584fb05
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyU:57Iw3Vd0oAaldmdmnpU
TLSH
T133063813E29444E9D15AC174CF468131EB227C5947F1A5EB32D0B6EA2F33AD03BBA716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 3.5MB
SHA256 c5b45032e734e58a1d28d46954472d584d5f46505eb983773b2b851212c9fc81
MD5 34285cc506acf208a69d486b998cf38e
SHA1 c6595ece2c32fb54ba7a074baada1f0a305072b3
SHA512 f802b4663d554d716a2f83a8ce3786046bce6e47e97b675e1fc4120a5b8e4feeacba7e7fcd2ab298d30f31ea31174559a1b2a94686f604526b517569271dd628
SSDEEP 49152:wabH/g9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyk:F7Iw3Vd0oAaldmdmnpk
TLSH
T1DA065A13A29548E9D15AC174CE46C231EB227C5947F1A5FF3290BADA3E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 3.5MB
SHA256 7f5580af1c2600a944ed15febb6a25a1629c67e94f5db6c637db03de7e1304a3
MD5 c17a218e3cf84ea139494d1f8465f4a1
SHA1 8bebe02addc9bb7d7e0204b0696e6ecafc79c5a4
SHA512 7d0b91d7558a557cf615e03c2dfff0cd5105468877854f72fbd511922fe5bb2b38625fb6a90fffb241021fab371bfacb172aa2e037524deb92055d20cc729a09
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyQj:A7Iw3Vd0oAaldmdmnpQj
TLSH
T14E065A13A29548E9D15AC174CE46C231EB227C5947F1A5FF3290BADA3E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 3.5MB
SHA256 290f1fb6a57331c0f5af8b07642931f05d6edf163118948bf41cfe1d736ac416
MD5 47d296fde308ceb2f1b201ded45fd39b
SHA1 89306c8042e855aa0d0acd070b2dfb5d2bd2e82b
SHA512 a230e76164a7c21ea243b10fc8ed3ba12cf860446f90aeff623d3e8a9fb5f2b200fb7a0e5c903529279eb5cafd0eeddedc0af1afb5961d49367d5ce16fccedf4
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyCD:x7Iw3Vd0oAaldmdmnpCD
TLSH
T1B8065A13A29548E9D15AC174CE46C231EB227C5947F1A5FF3290BADA3E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0e16dbd80606f2bf8550b4cbdf9aeb4167eb83430ef926a3cbfd18c538899472
MD5 96b69267a6ec1aff2f1458f85203bc3c
SHA1 dbc13d2068dccefa2aa317e0f97d8fe48baef7b7
SHA512 1dae3df6661dba8679f3c0c78ea6125af04f0a2721422450b9ae450848164ea1662b0186f683bb086d3370eed2cc3394194d8cc271e0f312e3f156e4dfb3b84b
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 00e34b76cde65d6de4ecc498f70936f746bbe8dd50644f57603b95fcba92dffc
MD5 239e6a03b9bd3ed4aca4b31417b02fff
SHA1 caef794ec009796e9cf26dba508a39c3582db46a
SHA512 3234ad8293145a8b22c84ff2f3b0b867657d13b250f1c12f22f3826e6ca59cbe71af3dd5af017ef9b48f7efeabdd85fb28e3b78c0ca657e5ac7267c6cf0dea00
TLSH
T120E0E5AACC259C7B09F90F2861284A46E74023172782485F763C921D8FB0A3A468286C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 74be7c3861c66821d2e3579dc491c4ca285be62d65d7e1da7e821f6eefd296f5
MD5 079eda2c03c0781cbdd3989c7cbde31c
SHA1 4091c97b151e4ee02a42384662f60ff4e8657fb8
SHA512 488a857a09797cffb12d6ee46b51fd59aad0c0f408d2536a97879e41254052a9ccb6a5729d9ab47b14a929575637c9f340d54088ca3995764fc5700aaf16cd64
TLSH
T1B7518BF7D3E4856DC52196F49B257E2FCE6E0A25031C3C6688D4AF1B63E2972D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

bae66297-238f-4bc3-9186-c4c048ea76ff.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\bae66297-238f-4bc3-9186-c4c048ea76ff.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences~RFe58af36.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58af36.TMP
Size 3KB
SHA256 db0aa9008321d98b143718919c42eceb44e600c18376508fccc471bbb6a38bd5
MD5 3176f41b86eb0cc10ad9499bad05dc50
SHA1 94fad53a6eab038e7a1f2c45d35c8472e2cc06a7
SHA512 3c94af9c8a482d56461c401fa65c957a6d64ce6a063053ce0d24dffc5e2cf61bde97a53fb6eb657860ca98083808f93fe501d8396d44584ea011a0981470e5ca
TLSH
T1736145ADD0944CAB0DF2B731B4290782FA925B3B5140180B7D7F86CD5F725175085F8E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 03973a25da0021eab19b8f1369a5523343654f3887234a1e1cc301245a48728d
MD5 e96921d5ae30116aafe48367f7ac6695
SHA1 c6641ccac61c68d82ff32eff425c15feb5074091
SHA512 7547cbfa0fc206b66f70451b792b574afeb0e98365fa6e0b5000e8553976425c99b5d9d4c5ead0b18d87bd8ab8100bb185fc97363145cbc0d2cc4cf9b3e8d865
SSDEEP 384:MajIf7KxkXqKf/pUZNCgVLH2HfgslPa7pLuLcifqrXODID+ErU36SHG6+AwTlTNv:MKIf7KxkXqKf/pUZNCgVLH2Hfgs9a7pb
TLSH
T1A1720B777C4C9E7B0F94C6C8D8167E4FADB6024A65DD886482FB982A03D4BCF114A1E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 4445a3e4b0748fea848892d979fcdda11fbda4a1059214b637beb111f2bb44b6
MD5 d43159587aa21cc3e30d949d6c6c5900
SHA1 76dabb6bbfb10c57ff37c1bd48dc186e24a070d8
SHA512 f2fa0c96d5910b13177babf7667c11ff331478c985307ed94f487811f27b63f85c0bf37a7d3136dcafebe3f93e9561443ef7db33e01226115f81b3864cb90043
TLSH
T1BBB00259C5026256C44213B0259599FD7A60DF25CF135212A2F06A66DC25A754529160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 31ccdea86f67a3a310fab991a441b475fbcaca18e571c70eae152929939d5f64
MD5 804b50a19c4e8d7ad1cab17d5bdd39f5
SHA1 174cca31737322a4dc5aac65a0b96f6fab65e18f
SHA512 9f88155694164fa00a87bbc14fb50151958fa4ba7b691e1fe8da6c91446fe7a62a554126337d427e9387e1c5af488bdf72de3600d799d30e1dd0852de248339e
TLSH
T1D8B012518002E541C04712F111C2848832545F109B06130153E0AD77D8271B24015370
MD5 SHA1 SHA512 TLSH

Submit Download

a80c8069-a8a3-4e3f-b63c-51319489fd58.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\a80c8069-a8a3-4e3f-b63c-51319489fd58.tmp
Size 11KB
SHA256 0e8c9667ab637fe4723c7a2ab4600165cbc1afdc99bae96ca0c3ab3b65709720
MD5 3b4140b0332b2c3dd5f24c9d019042b4
SHA1 7f4e49ab65b6e22c97089e8c75d6a023c72e7692
SHA512 e852dd456779e15b060738bd5c32e5a88f59589ae65549f7ecc196b90c1c858b75dc0f6c84c368970ce4dbe5342bc35ff1df0e231ea7de728fb5117d85ae3343
SSDEEP 192:PRd6qfL7st/v7u9PRp23Xsb+WNnEq20kwJ2MekZiyIsnAUgtaJ:PRd6oIXGXEXwp29wJ22c8
TLSH
T1C632D52EAE107ABB5DDBD629F9253A53D3F51025B1942D40E7F88A2C19E75CC232702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 197KB
SHA256 07d3876e4a7cc73f2fa1ea6facbd49cca61f3514eb2e0345ecfe742e7ad996c2
MD5 31f45c5c498a205046a51b6634bb6851
SHA1 e830677bbb6d0c2fd2b0558794ba9415ac85cd32
SHA512 70f2b42d49e0e6d92c18786577b79010136f5927251a7755b01bcf6813fc64dbd23d773308a4bf9ee81526cae6085735eac29ef034b4caaf02f474a4dd730ce3
SSDEEP 6144:SRxx+5VwBbR6GoUGU6Y6rOk0HOGm/SFyEEc:kS5VyzoUGU0rOjuGdF2c
TLSH
T19A141273AF176FD6C57E8AB6368D5C00CE5702C5718AEA88836C2BD546E01DB0B73671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 ebe8a02955fac8918718c027bcf3c7c77d3c5dc88e5c3d2eaede0c9ab432b1bf
MD5 8c8b3bb9b7afb890e92474a64342451b
SHA1 66ed8ab88d54b28a0bbd9339dc2849bf669966d8
SHA512 e5ae8923e5d859d063b97d2bb27a7498813d7d19f61bf4fbfeb8a162f3923086565c1a32a3418d63d580c87f3df030672b8cb58eb9f84b91afc3d7077c113206
SSDEEP 1536:g5cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3b:g3Qw/xLANk0mUW5GmRntSFCjEENl
TLSH
T1CE9302BA4E2A4AE7957E469176AE7809CE12130D70AFA8CC316C539C31D01C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 80e2873d5393600e4577f303211a94e7878e707de8f8ddb6642c1f8cb603b117
MD5 d3fa5b3ea5da17826a80305f4725b315
SHA1 a6d5dccc8adfc8278ab66974f305e7dc0b7c0f66
SHA512 4d6c396d3042e79500deebad3573d73844921ec8bd8fd4e328228299507bc307e6c38bee32552f792035e73afc4a93db2a8aeff6280282a3720fdefb39d5f085
SSDEEP 6144:/Rxx+5VwBbR6GoUGU6Y6rOk0HOGm/SFyEEc:pS5VyzoUGU0rOjuGdF2c
TLSH
T111141273AF176FD6C57E8AB6368D5C00CE5702C5718AEA88836C2BD946E01DB0B73671
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 3.4MB
SHA256 50a70b65d2eec08f233db188e06180e7268c9e17736d1598564a9fe2d4a221b1
MD5 5687b6d63413e1bb9c1ea56004f9462c
SHA1 9f7f4697087d9e60272962ed50f21f8ebfba671a
SHA512 1425df76967aeab043763c636596a3cf04557eed28a074360ba97cecb64338b49dc5e713d2de9ff3a2fe6d6ec5beb864a4c13824dda34f4f529860287711ecbb
SSDEEP 49152:wabH/w9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:V7Iw3Vd0oAaldmdmnpW
TLSH
T1F9F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 593483196d34b0844e5261bbc137bde4ce6aec30599be248a17038d03f70e81c
MD5 6f6974545b1dc4a7418ba66d72930f03
SHA1 70b690d28ffd1ccfbe83816e4710d2ddfe3ac86e
SHA512 714fc7e747ed3d2fba8b3bd41b5cceef6b6af15662561cbc0bca7a08e47c9b61643ec17ac7c27bc0a9a083cbcf1a187ccc6d923e91cce0262f9861153d72bc19
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:57Iw3Vd0oAaldmdmnpW
TLSH
T1BCF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 37201614875e1e965ba4ee30ee848018b917dfc124ff42a4fcbff402271d8141
MD5 7035b8ef7ac4cd5b3008c71fe5465663
SHA1 8b9b95b19ce68892cb20abfb70d3be06ab85aa36
SHA512 73448f8d78b88e31ae1ec32fff090db14f0f446a534ffc38deb18a83edd9d1f75a9416596da936775f3335e4fae1e2c5a8c90429b5390d0428092c31fa552c04
SSDEEP 49152:wabH//9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:u7Iw3Vd0oAaldmdmnpW
TLSH
T1ACF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 839d338c6aa2831994f93d04badce4fd278357c41d9ddcdc2477bc52b4f5257a
MD5 c415865fba9ca04c5d478fc49685202d
SHA1 66ea30db5858c733a021a243065cf06f75e86601
SHA512 b84f2b8aea44a1a7dbbb4e4dc393ff68ea813822ff9325e47782b858a81563f9666a2835ab5fd4cd370ea6e20f7a75bfc5583d2a424e70b0b55b037758d1d9ae
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:x7Iw3Vd0oAaldmdmnpW
TLSH
T10EF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 f681ebb81f1bae5b956c5753361c25ec773af56848bc18585946d2eda64a5b55
MD5 ded3e59cb0422f8a3cc87297596911f3
SHA1 6f6cbf61c56464dbab9e723f15887e971975c4cb
SHA512 adc3c0d1e3a75cb952e49d0ffed557074fc14cb1f486f652aaa2e6565fe5c4e04470ddc9a57541e13e30670be5acc2ea9d3e68fd521642faaaa8a10fb87090e3
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:x7Iw3Vd0oAaldmdmnpW
TLSH
T169F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 83ba22265130cc17d600c8172b79e6a598a3e64c2792382d36bdbdce3396378e
MD5 3f0d6c21731d35f5eef439eb4076e5d5
SHA1 5a28e26740ff454763ac3d958e0a339913bcb0ab
SHA512 587825d5ff8f827336e705ea46cc6cd43751bad50857569d9035216db2a6bc62cb349ed0cbd2264c5973a47fb40089d23b8888cff74c0ce91da8e377a82cccc7
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:A7Iw3Vd0oAaldmdmnpW
TLSH
T19AF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 025eaa471df5ae66806a4919fdf68ad607bb26cd22f0b93251baf24962d97fe7
MD5 bdefa9f34edc3fdbbedcef59b68f2acc
SHA1 60757dad356a6ab5bc9ec8a2b27031fb22089f47
SHA512 b0b76b1e1f2166528f782020884b213b275b62c439b125efb3aab606a5268a80f758b6bd8cf42d3d16543caff843ef5b7454adfd1dab967b25c27e6f2325aac2
SSDEEP 49152:wabH/g9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:F7Iw3Vd0oAaldmdmnpW
TLSH
T1B2F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 be03aba5e0e15fc2cb6637dcee228812e62ffe3edd0a3aa499376024f35fab18
MD5 69173c56556920c6167290d835ea4f0b
SHA1 1f819aee67cc62c0d98fd8f3f71261313848af89
SHA512 b49d8b72a7d4b3a0827c11839337f06fe34c8dee6b7ccebdc1c6ae8e940f35212a99f7a2e49d4c359176ae422c31b9288a71a36131b2966aeeda5b30b8dc1d22
SSDEEP 49152:wabH/p9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:Q7Iw3Vd0oAaldmdmnpW
TLSH
T187F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 b0d1bc6a0a673128d9c2a5ac7c1dde08a20f7635eb9cf66ff6399d29428ec11b
MD5 19a3b65e94f6a748750248c272e43ece
SHA1 f529d4ac43618bb79a815e4207f4ca677929536e
SHA512 53d17d0e63c0f9ad28824ba262053c1febd3e10da89a37b8a20b0383bea117db738e28950aa51026fab07d5566d20780c41e7699cd627a4357127aa405e14172
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:57Iw3Vd0oAaldmdmnpW
TLSH
T16FF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 69051ff6df47e4e0d1cd72de8a5d600386848dd2c8be4c3157e58784c80719c5
MD5 37fd936ab4d71b4b88809d977ac6be3b
SHA1 06757f845b30cd7e8e9fa0e6b5ff886e7df99fe4
SHA512 48695624ce9d7b57886ee461b8e55adbfa31a288110ea83b0d5b68d66ec37581da6268cebbceb38cc80332547827cc16bc47f40f29c18c19ee16c64ceb4d8478
SSDEEP 49152:wabH/x9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:47Iw3Vd0oAaldmdmnpW
TLSH
T1D5F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4000-165-0x0000000000940000-0x0000000000965000-memory.dmp

Download

memory/4380-146-0x0000000000560000-0x0000000000585000-memory.dmp

Download