01684d9b949eee58d4f815ce1e404992a89e2c08ed1e4e73c2b6376e8e1b2c78

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 04:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 7.7MB
Sample260503-ffslpsbx81
SHA256 01684d9b949eee58d4f815ce1e404992a89e2c08ed1e4e73c2b6376e8e1b2c78
MD5 966246fedb72c46949d66e3a342901d4
SHA1 525c7f064451d22254e8a37533f8ebbd39bc6094
SHA512 2631c44d7d9092587cd373e21abd92c2be04a7725ec08d69f01023630a91115505e6cfa85b4a6837e7427d677b6fec5354c81c229e2cb078e4b8b181d007a15d
SSDEEP 98304:V7Iw3Vd0oAaldmdmnpRWQtZ/K0tGOFWVRuLftCT:j4Kmd0HWyZ/K0ttYVAAT
TLSH
T1BA865B13F2A540E9E06AD178DE268231DB327C594BF1A5EF328076D52E73AD07B39721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5116	UpdatAuto.exe
2328	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
2436	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Integrator.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4608	sc.exe
2432	sc.exe
5212	sc.exe
1316	sc.exe
5884	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4980	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222573691405400"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4300	chrome.exe
4300	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe
Token: SeShutdownPrivilege	4392	chrome.exe
Token: SeCreatePagefilePrivilege	4392	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4392	chrome.exe
4392	chrome.exe
4392	chrome.exe
4820	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5116	UpdatAuto.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3968	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	79
PID 2924 wrote to memory of 5116	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	81
PID 5116 wrote to memory of 3220	5116	UpdatAuto.exe	82
PID 2924 wrote to memory of 2328	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 2328 wrote to memory of 2436	2328	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	85
PID 2328 wrote to memory of 4392	2328	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	86
PID 4392 wrote to memory of 3192	4392	chrome.exe	87
PID 2924 wrote to memory of 6000	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 2924 wrote to memory of 1684	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 2924 wrote to memory of 4828	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 2924 wrote to memory of 5904	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 2924 wrote to memory of 5656	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 2924 wrote to memory of 4200	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 2924 wrote to memory of 5624	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 2924 wrote to memory of 4608	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 2924 wrote to memory of 5884	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 2924 wrote to memory of 2432	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	105
PID 2924 wrote to memory of 1316	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	107
PID 2924 wrote to memory of 5212	2924	2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	109
PID 6000 wrote to memory of 1100	6000	cmd.exe	112
PID 5624 wrote to memory of 5552	5624	cmd.exe	113
PID 5904 wrote to memory of 4044	5904	cmd.exe	114
PID 4392 wrote to memory of 1756	4392	chrome.exe	119
PID 4828 wrote to memory of 4640	4828	cmd.exe	117
PID 4392 wrote to memory of 1756	4392	chrome.exe	119
PID 4200 wrote to memory of 2552	4200	cmd.exe	115
PID 5656 wrote to memory of 792	5656	cmd.exe	118
PID 1684 wrote to memory of 5208	1684	cmd.exe	116
PID 4392 wrote to memory of 4980	4392	chrome.exe	120
PID 4392 wrote to memory of 4324	4392	chrome.exe	122
PID 4392 wrote to memory of 4324	4392	chrome.exe	122
PID 4392 wrote to memory of 2532	4392	chrome.exe	123
PID 4392 wrote to memory of 2532	4392	chrome.exe	123
PID 4392 wrote to memory of 1664	4392	chrome.exe	124
PID 4392 wrote to memory of 1664	4392	chrome.exe	124
PID 1100 wrote to memory of 5740	1100	net.exe	128
PID 5552 wrote to memory of 1744	5552	net.exe	125
PID 4392 wrote to memory of 2044	4392	chrome.exe	126
PID 4392 wrote to memory of 2044	4392	chrome.exe	126
PID 4044 wrote to memory of 6132	4044	net.exe	129
PID 792 wrote to memory of 2236	792	net.exe	130
PID 4640 wrote to memory of 5252	4640	net.exe	131
PID 5208 wrote to memory of 2308	5208	net.exe	133
PID 2552 wrote to memory of 2828	2552	net.exe	132
PID 4392 wrote to memory of 2708	4392	chrome.exe	134
PID 4392 wrote to memory of 2708	4392	chrome.exe	134
PID 4392 wrote to memory of 5192	4392	chrome.exe	136
PID 4392 wrote to memory of 6040	4392	chrome.exe	137
PID 6040 wrote to memory of 2284	6040	chrmstp.exe	139
PID 6040 wrote to memory of 4820	6040	chrmstp.exe	140
PID 4820 wrote to memory of 5092	4820	chrmstp.exe	141
PID 4392 wrote to memory of 5496	4392	chrome.exe	142
PID 4392 wrote to memory of 5984	4392	chrome.exe	143
PID 4392 wrote to memory of 5748	4392	chrome.exe	144
PID 4392 wrote to memory of 4300	4392	chrome.exe	145

C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3968
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3220
- C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff73d32b618,0x7ff73d32b628,0x7ff73d32b638
    3⤵
    - Executes dropped EXE
    PID:2436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4392
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9dadc728,0x7fff9dadc734,0x7fff9dadc740
      4⤵
      PID:3192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,2373224391897503060,5385269470709743495,262144 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1908 /prefetch:2
      4⤵
      PID:1756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1304,i,4069604537111072467,11906948445830084460,524288 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2236 /prefetch:11
      4⤵
      System Time Discovery
      PID:4980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,12516536460680471553,1941445681018276321,524288 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3324 /prefetch:13
      4⤵
      PID:4324
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3004,i,11555512920423335303,5106618895802984126,2097152 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3348 /prefetch:1
      4⤵
      PID:2532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3008,i,14654763172668591943,17912680997126816350,2097152 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:1664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3460,i,3901043914104596666,13808945125169150849,2097152 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4352 /prefetch:9
      4⤵
      PID:2044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4580,i,10986477769899822988,4966838455096016284,2097152 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4592 /prefetch:1
      4⤵
      PID:2708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,263657817596176931,803383055664089769,524288 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:14
      4⤵
      PID:5192
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:6040
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7c47d55a0,0x7ff7c47d55ac,0x7ff7c47d55b8
        5⤵
        Drops file in Windows directory
        
        PID:2284
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4820
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7c47d55a0,0x7ff7c47d55ac,0x7ff7c47d55b8
        6⤵
        Drops file in Windows directory
        
        PID:5092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,5006858821069142262,14826580921715650492,524288 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:5496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5724,i,14135248666138367700,9321509238096208851,524288 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5732 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,5552336721159397677,7206175041008542019,524288 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:5748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5296,i,10091217287002528934,3501876059473184376,262144 --field-trial-handle=1952,i,5079433526781120378,8466501733212811240,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4424 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4300
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:5740
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5208
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:5252
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:6132
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:792
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:2236
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:2828
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5624
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1744
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4608
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5884
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2432
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1316
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5212

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2196

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 4.0MB
SHA256 08def82f81a451eb3c07a77af9fc2b062e649d500de219b3756a7930c106284a
MD5 435e00060d34e1934521d18b2c9e374e
SHA1 ff0cf307634b1fe3f500327694ba6ab0d90c63ce
SHA512 706acbe54c50d67c801afdfb6c0cac7aca183c8f6ddd124d1b7805809117aac91ad93f0e68c5b1cfb903b4e83407d8a95c9e0af001fe1b0dce5ab8e7e81668ef
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyTPjih:57Iw3Vd0oAaldmdmnpLjo
TLSH
T19F165A13F29445A9D066C074CE96C226EB327C5947F1A5EF3280B6D93E33AD17B3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 4.4MB
SHA256 342c3971460ef35847156b2392da9165385f3beafaaa22c2a8267fb9efc23c19
MD5 69dd2327bbe79cebf50f7581f59c3a60
SHA1 f12b3a33feb02ea4e4d97b7cd1336177bf745530
SHA512 f0ea11e145b2527e6db110543473449a10d6aedbbaf5c452ec5259de2b6949cb4cf66236fe24b9878f3046caa7a23469e37bdf56b6f481c58ed90941cb4ff4c1
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyA/ez7:57Iw3Vd0oAaldmdmnpEezSC6v2XMH
TLSH
T103265B13B2A446A6D066C074CE969635EB323C4907F195EF3280B7D93E33AD17B3A725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 4.1MB
SHA256 a093ade0a242738b0fee693e71e5f5591a9a29256a58170744db6dfa0fffbd78
MD5 240390fe98a0a1ab3711247252c63d8f
SHA1 47abd89335e5fcc9689a4f1d94abfd3ae097c36e
SHA512 c3690353c6fd0c1b5f1834877e5b39fd529a10e5c791b9ea52c3f530456cf72b4dfd555703f98f82064fb8451fb4cfb08bb868dd39a027bfa65ebad2b23b5781
SSDEEP 49152:wabH//9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyzVO8N:u7Iw3Vd0oAaldmdmnpQ/h1+
TLSH
T107165B13B2A445A9D066C074CE96C635EB327C5947F1A5EF3280B6D93E33AD07B3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 3.4MB
SHA256 f442b08cb5f3c4391310952ca2310a89244b2933c57f41cef15a2858487cab54
MD5 dfde1dca483336019f677b40b55d54a2
SHA1 011388ea1ff38300fb21271b5afd1a0b582c82aa
SHA512 625a417ae827fe12690e23ac9eec845879511f286850be490e5935c8a38b4047f1f2e71a072d72e8c3e27a299996c6d720bc0d5eb7ea4eeb49c9337ff5522ecd
SSDEEP 49152:wabH/x9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nky:47Iw3Vd0oAaldmdmnp
TLSH
T132F55A13A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 9.5MB
SHA256 6dbf6b4cd385856b6cf82c8e1a423a215af882e2a7add2d40bd5b97a8b68b2c4
MD5 17f627138c37e81602f75c2057fbd3c4
SHA1 a8e8ccf52170b797c2464a73f083b83d5e3bf61a
SHA512 2ae7c481e0a1b037ffb604421617cb5c29b93113204279fe7d9505f2378b2a24ee3df2fb096f63475b7abecd3c8d26c2dc68359e9d973a76596072d91d7b1608
SSDEEP 98304:x7Iw3Vd0oAaldmdmnpNQRQyi36YOcP+Lvw2gAf+PN34:f4Kmd0iQyiKaUX+PNo
TLSH
T1A9A67C13F2A501E8E05ED574CF2992329B357C4A47F192EF369436E52E72AD07B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 5.1MB
SHA256 45845906b54e0dc02f7729eda2be97a910fc85270878ae8367c00bb6c670e27f
MD5 cfac798aabdf0c12144387ba323dabbe
SHA1 cb5cec7a3f3552b4950a4c576784c866ca0051f5
SHA512 7d33188601459e9f956ebd1daae74449f951fa225987cec6ff51e1b38051fa26c658fc4f47bd980b31ceb0e01003c07b3a84fbc40b77c359f03f535fdffb803e
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nky268Q8:x7Iw3Vd0oAaldmdmnpUthHRc/Q
TLSH
T1E3465B23B2E500D9D05AD075DF468231D7A17C698BF1A6EF228076D62F73AD03B3A716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 6.9MB
SHA256 07337f3d6038a4dbe43685868c0f099f87685659a608a1660fccf22e86f19c54
MD5 a607065f6f7293a4ae361cd8f53317d8
SHA1 4f91579f272b6a6db036af91e345fe17b66bd43f
SHA512 409493ecff4db706f0ffa28a84c81d2b71a3db11adc0bfa6c7b3aa812e2964afc85bd9c3b8435e40099fed2e036b57f1a6ec451bf23016abf7e56b552f681572
SSDEEP 98304:x7Iw3Vd0oAaldmdmnpLy5112gYy5azzVvf69nLKnhZO:f4Kmd0wLIHuWhs
TLSH
T19D766B13F29900E9D059C178CB468232EB62BC5A4BF1A6EF269077D52E77AD07B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 5.7MB
SHA256 49152b5fb4ffae4b65354a972c89b4107541f92813896c10625fcda291e891d0
MD5 ba027e14b09b9b3a203df1cc8e8d8023
SHA1 42f37366b1fe1a40436baa1121d54cf9a16aeba5
SHA512 a374a02bc2b230b67939da08bb7e8f24cf747b489849376df97ba5591aabfb31f3d88c648dcafd6cb2273b4c2c3a40224ef7bd11179c10e2ecc89bac96e43bfb
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyTB+tt:A7Iw3Vd0oAaldmdmnplu6Jm0xd2d3
TLSH
T150567C13F29500E9D05AC074DF468232EB62BC590BF1A6EF269076D62E77AE07B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 5.1MB
SHA256 1bee6b7e34e460fc32b6f034ad03549ceb6dc1219ce2ae972157cda08814507c
MD5 eae0b2549d51100ed8c9719761abb2e7
SHA1 4a2588ef556c21ac4b2bdc971ec5354e2c03ae8c
SHA512 b856feb063466b47f8c2e7805caf944ba3fadd21518d5da4c4b638c1b18c6082167f6beb6c9cba5a30dc87b5fed78d2604609256fc8f1e460fc20ed6b79e2f5d
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyr1hpp:x7Iw3Vd0oAaldmdmnprmifP5R7
TLSH
T1EC367C13F29444E9D05AC174CF568232EB22BC590BF1A6EF3690B6D62E77AD03B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 5.3MB
SHA256 37bfce8106bfff9134863d8a3b169ec5efefdd37d005571a465399f944ebf9ff
MD5 0fd8987a646e36d548d2e0e8272596ce
SHA1 2941790807aa4fdb3428c38f6a72b02281e9e631
SHA512 085465e78dc72d919466764006732ddbd9ab58e2328d5deb35e48b378cfc7a94e46eec61632db9ffc01a14bf5798eddefe638c47c93dc8fa74dc8c33a66fd102
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyWSuZU:x7Iw3Vd0oAaldmdmnp45dKCi616
TLSH
T1F1467D13B29544E9E0AAC174CF568232EB72BC594BF1A5EF328076D52E33AD07B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 4.9MB
SHA256 643b5f2baad7a6395082a30f005519352f81a27a495e324a6cceaff4ffb4ea26
MD5 c21ed0d700e423d231b3bc00160c85b6
SHA1 d9d1c54f2f5eb33568808128748ecd226f01d7d4
SHA512 8e40d79ced90ec0db6276d8d6002222e55e94b13ab33762af04d9b9f489393d06cf5f82517e4f9597a17c3d96b7b9527046be580d130e9f1478daf40b2337845
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkykhtS2:A7Iw3Vd0oAaldmdmnplX2iwphX
TLSH
T1D4367B13B29544E9D05AC174CE46C232EB62BC5907F1A6EF3690B6D62E37BD03B3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 3.5MB
SHA256 846dcde56b9a17c2955f138c6f271b7c73f7dc5e091c874d8e6fd923a99751d6
MD5 f7f00459a5b7df24be675e9fdf9d5dcb
SHA1 117acdd5da5c38de0b2cfafd3a37d8d2321994a4
SHA512 abf8e742e945be64ed2c08e3d12ebf3c5451847dd96b22c9091818d46a2dbb9925412e3558a8e737f5fddfee16612190f5f63654a9dc5be3614168d3bdfb77b6
SSDEEP 49152:wabH/g9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyo:F7Iw3Vd0oAaldmdmnpo
TLSH
T1D2F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 3.5MB
SHA256 49d4619ddfab5fc4dcaa80e99e99aa5b3f9b2473dcc174786727c0111e64ef69
MD5 9d243431a9536838e88aead8c4b6d5a3
SHA1 1ff929b2f5c064557ea98cc9f084b3c6ac779119
SHA512 69eed78eadf86bff51e395a4abe20eae6cfea10beb2cdc67059ca436e66d43414d6c9af34848b5c640847db93e424e730c2c6b4d2e5185330cb4d5f79b06ef9a
SSDEEP 49152:wabH/g9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyw:F7Iw3Vd0oAaldmdmnpw
TLSH
T1ACF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 3.5MB
SHA256 a4d404b78d88dd28666fe13bb655dd5c834ceb6d46b99af50bb42521c58b7dd4
MD5 5d68843fe5cda1dd20ffdb250987bdc0
SHA1 7059b01e80ffc758b7b39f56b6e220586972e3a3
SHA512 3e6220bd572aca6e7e213bb7223902483632985c0512978655e9fa8fdd087e68c40a1b04649b303be71f4eb6f42fe7b48b57f65da27c91c47576bba869a3ca8d
SSDEEP 49152:wabH/g9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nky7:F7Iw3Vd0oAaldmdmnp7
TLSH
T187F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 3.6MB
SHA256 8bc1a071c9f004e903e3e4a0c3a7414801fa34848742b4f56dc9cbafd878ba84
MD5 4681e3acb54e0305df4cafeab6e07642
SHA1 6245d5f176a1bb5ae63b2136fafb244d7665fd2e
SHA512 0a6cfb8ba283ed8378f823b24279afe21e393946df7ef195795fa76c41b928def39289954a1d8242d073100f9caf696110125dbde251ebbf255f0beb2584fb05
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyU:57Iw3Vd0oAaldmdmnpU
TLSH
T133063813E29444E9D15AC174CF468131EB227C5947F1A5EB32D0B6EA2F33AD03BBA716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 3.5MB
SHA256 c5b45032e734e58a1d28d46954472d584d5f46505eb983773b2b851212c9fc81
MD5 34285cc506acf208a69d486b998cf38e
SHA1 c6595ece2c32fb54ba7a074baada1f0a305072b3
SHA512 f802b4663d554d716a2f83a8ce3786046bce6e47e97b675e1fc4120a5b8e4feeacba7e7fcd2ab298d30f31ea31174559a1b2a94686f604526b517569271dd628
SSDEEP 49152:wabH/g9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyk:F7Iw3Vd0oAaldmdmnpk
TLSH
T1DA065A13A29548E9D15AC174CE46C231EB227C5947F1A5FF3290BADA3E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 3.5MB
SHA256 7f5580af1c2600a944ed15febb6a25a1629c67e94f5db6c637db03de7e1304a3
MD5 c17a218e3cf84ea139494d1f8465f4a1
SHA1 8bebe02addc9bb7d7e0204b0696e6ecafc79c5a4
SHA512 7d0b91d7558a557cf615e03c2dfff0cd5105468877854f72fbd511922fe5bb2b38625fb6a90fffb241021fab371bfacb172aa2e037524deb92055d20cc729a09
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyQj:A7Iw3Vd0oAaldmdmnpQj
TLSH
T14E065A13A29548E9D15AC174CE46C231EB227C5947F1A5FF3290BADA3E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 3.5MB
SHA256 290f1fb6a57331c0f5af8b07642931f05d6edf163118948bf41cfe1d736ac416
MD5 47d296fde308ceb2f1b201ded45fd39b
SHA1 89306c8042e855aa0d0acd070b2dfb5d2bd2e82b
SHA512 a230e76164a7c21ea243b10fc8ed3ba12cf860446f90aeff623d3e8a9fb5f2b200fb7a0e5c903529279eb5cafd0eeddedc0af1afb5961d49367d5ce16fccedf4
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyCD:x7Iw3Vd0oAaldmdmnpCD
TLSH
T1B8065A13A29548E9D15AC174CE46C231EB227C5947F1A5FF3290BADA3E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 dc16642704bbd372b6b47bd40a67b3413b4b7662236763e613a05a38e3b945e9
MD5 6c354b71b1035c9a05249154bf2c7eaa
SHA1 818a1522b5415c5dde6731dea3ccdd609647f1b0
SHA512 64495d08931e8c0d7fce3ed657eac2ade85545fba2df0ad2a6fcbebf2cadea317fef84c21734100265a8766cf23f22ade353123805ce79e3170a8a9be5feb6d4
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 85d3a4925d796ccfa26c65c660da736d5af575cda35b3a6cd4d2c8f85adf52f8
MD5 8dd89bc9e8337489d54d06d1022b0a91
SHA1 93e9d1b40ecbd1e9fdd2003932fbfe8b3593a435
SHA512 2658f2b1ed2d807e049e914a0e7c707c23690b36964b439deab821bcbb05e8f66f63f769660a94af4ba91fd24ed29303ed1fcb87a77129522b3c625a295d796c
TLSH
T11AE02BA6CE26DC370CFE0B1850905782EA4013972740496F7A3D830C8FB0A3F1285D1D
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

126d500b-061a-4aa3-b0de-bd7f05dfb149.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\126d500b-061a-4aa3-b0de-bd7f05dfb149.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3edcaf8c03b27c4a913e985bb9e9592a6f048851c7953f774a9652fb6c419736
MD5 3f1916decd10f43adbe30d29ccd06a28
SHA1 dd24a75c708d4c7f557a157e76bc42f9b6db0362
SHA512 ad51694cd8d468164e3439ddeedd2daf8abff66a0271e235011dc9e93e4fa4aefddc661b7dab7bb0d102a5d1f937eec5d1bf00cca0ee90607ab97f89d873fabd
TLSH
T1AC517BF7C3E4896D851296F4EA156E2FCE6E0A25031C3C6688D4AF4B53E2972D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 28bf66b58b4a50544d358e7f184d71e5b2b686561bae247026d0229ec11d3998
MD5 58a476bcdba09e1b48ff9a2d137bea1b
SHA1 ef279a7119a1e846a0ef4468d42fa6a3f5a38978
SHA512 da8d2ca5d58b7565a230e135f2478b55293f7966d811f929703f49118b4eb954b93d26f3438b82576bb31d7bce2b7db937a28da1434007daf405a8b61f679730
SSDEEP 192:SWR9YqHb6+v7S9PRp2QAXsb+WNnGL2TI2eMawvmiyIsnAUgtaJ:SWR9Yqm6KXzAXwI202lao8
TLSH
T1F332932EBD107E7B5DEBC61AFA267A13D2F51020B1842E84DAF88A1C15D75DC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 26722fb1b81410adc2af22bf1270e9e3cfc139521c96ec8722743174431d45ea
MD5 dea575c8a335b6c320d7ea3c7ef1e137
SHA1 302b379ba5aa2c3bc1ffd495350e78f8346d64c7
SHA512 78955fe855245bbf8d9738a5444b8659b6bb13d9b680a5931a8568e009b347fed588ebfc7b9e22be7915d2092e88ea75ff9ae512f5067cc184467c07d7b87c56
SSDEEP 192:SWR9YUHb6+v7SzPRpiQAXsb+WNnGL2HI2eMawvDiyIsnAUgraJ:SWR9Y4m6wX3AXwI2o2laTe
TLSH
T1CE42A32EAD106E7B5DEBD61AFA167B13D3F42020B1842E44DAFC8A1C15E76DD231702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58489d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58489d.TMP
Size 3KB
SHA256 c90d5b5d061944f3aac7eab0b2c4e8593409a36e066600235666ea2ed88d1b1e
MD5 a8d15ae50764f7686199e16dd5086c96
SHA1 cd7aa0906ddc4b21deecced541615545b2ffe774
SHA512 7b41657ff5b4fb31999444289a1c09267d261cffe3a0f6c799921bf5fdbf4517914edd001cc253a4f8eb89e1dd3c8f2325323f786bf522fdf615f5a788a7d686
TLSH
T11061751DC4640DAB0DB67B75792A0783FA50827B25016C573E7E198C0F778664080F2E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
MD5 80e775e497e26256725722f158c1a7e7
SHA1 24ed3e37ba5a437a46beacb73c33c43eae3aec98
SHA512 09ac01744410777e518bc948ab2c8649e18de947108d5d4afd77f70e32dbc68ce133ca9306edde725939c3c02ac6e14f160c2e4f358579e678e152b19c349bfd
SSDEEP 384:oSj0X7KxkXqKf/pUZNCgVLH2HfgslrL7pLuLcifyTXOD0b+ErU3wRHGU/QT:oy0X7KxkXqKf/pUZNCgVLH2Hfgs1L7pY
TLSH
T1E77219676C4C9E3B0FA4CACCDC16BE4FADB5024B65D9886843FA582903D5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 a7aff15864ac446b9844d03015b2d62708cb1c0900c43fe845bb47ea1f428c0b
MD5 70472350a60aba7439404bbd50c360e2
SHA1 a561db1d8d17c42454600809b075a3d5dfd008c0
SHA512 981b85ea44eb09f82e542e3a962cf9ca871487c057df885173a44cbffee1b40172c7bb0f2984726e3f3b6550802dab27d778e59cd9353e1961f3817d110e9dcb
TLSH
T1CBB0125480515501C40702F4328604C831249F14C705170153F46975D8275904014260
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587308.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587308.TMP
Size 96B
SHA256 ce9d26a7924557b9c5cbbc84341e7f98d1049200e6eacb31ff57eb275c102f4c
MD5 63381b82a93e8e43b1496c99c73f08b3
SHA1 a82888668ff6e5daf26477d45e4ec76a0ea26ad5
SHA512 338b503ed4e53e899fb7f9e76c1f9037bfdfeb7f0e9891308abd1849d7ec1da1f5c3ecc6bfc985ce2b2eccc47f6afc3da01e9ec6dc0eafb5180f08b35a61522a
TLSH
T1EDB00295C1036212C08217B1699595D9B660EF65CF03126BD3E43E6AEC356609625570
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 62163e8a5ee288ce0456a63ffa69e9ae2bdbc648e519fdfa171419aa44f66fcc
MD5 ad3e36ab6ea69a732e376e0e44d97620
SHA1 ac15941ab69b8c565dfcf529698dd4a1c0cb4c17
SHA512 d60486a76a8ab580be0098948d7f89f424d19550521af3d1c7c383c5eb84dafa14eabe2dd9f210b9b07f13d17a695325862112e3401e9bbfcc842567694b6426
SSDEEP 6144:cCRxx+5VwBbR6GoUGU6YZ++JjcMW2VcVLU:1S5VyzoUGUFOMW+
TLSH
T197141373BE1B7EA5836BCAF6740A8C448CD7C4CE5A00A76C51996F8609B87A3C7134B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 09d5acc0a82190a7646844fc0a27d41a30fbeb3dccd82b13bf9c551ebe649f32
MD5 fbc7cd24f612a4c64af444fab43fe771
SHA1 92c9173fd38a197d156bd0abcb80d4b514225a8c
SHA512 884ed66bd6f809acd8e455d7135332deec0e61812181e75a318f074ea211c6e7dc3e939b689e0ba5bddbb321dacf33a08e9d82df6b9ef7095dd29d8d90991a4a
SSDEEP 6144:xPRxx+5VwBbR6GoUGU6YZ++JjcMW2VcVLU:x5S5VyzoUGUFOMW+
TLSH
T1B6141372BE1B7E65836FC7B7740B8C548DD388C91600A778529A6F9A0DF57A383134B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 199KB
SHA256 48e8cf37d08fd77cbe57eea9cda2f638167224a4409852c6a92426d870b30e57
MD5 76cbc33d0cb39c37a549075acbf96f1d
SHA1 8f2f19c20271dc3732c2d750b811dc0acad020c4
SHA512 4b9315e20da7dc94bf28331287be4ba4891fc5ae03178d17db572527cbdafc4ab32f781759d894ec81374c7628117c6c31a1433c8d1933a900fbe630da8782d0
SSDEEP 6144:/8CRxx+5VwBbR6GoUGU6YZ++JjcMW2VcVLU:/xS5VyzoUGUFOMW+
TLSH
T1B4141273AE1B7EA5836BCAF6740B8C448CD7C4CE5A00A77C52596F8609B97A383134F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 198KB
SHA256 9f4aeec499898dc18a6e15e2b6770d62286758127700f21b35cb6acb6d777929
MD5 a29960400d9be038d6478237174bedee
SHA1 807caa0f99e86013690aefe99a26880ff2b05cb0
SHA512 b01c6f6577c90991730a5a5ac863f60775b28033fd55416001864c520b189a638236c7a325523bb8aaa9830d5bad0b2a90ba83f7978bd29f4d7ce3e4d84bd58f
SSDEEP 6144:EPRxx+5VwBbR6GoUGU6YZ++JjcMW2VcVLU:E5S5VyzoUGUFOMW+
TLSH
T167141372BE1B7E65836FC7B7740B8C548DD388C91600A778529A6F9A0DF57A383134B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 82ff0caff4bbe46e02c3f140f24ae41cc122e45ad86250f0d86c5819b076b945
MD5 06b90af7a6d5e1f990bc9ee17627e160
SHA1 063bf7bc238d414fe5ed433d48219f1055b756af
SHA512 0138a2421e954f446681e17cb720c1824adb07ef61cbb3d41f33b711d6faec492c995ef0e6c5c1bb6a3cf36000279a244bfeda6b9fa3f475ba1e42c39e844198
SSDEEP 1536:eG1gNP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNM:CF++J3qUQm08KMWF0bFTcVHr6zD
TLSH
T18E9302B9991E7D75636AC6D690079CAC8CE3DCCE1514117C30C7AB1E24BE3A3A31B8E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-03_966246fedb72c46949d66e3a342901d4_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 3.4MB
SHA256 50a70b65d2eec08f233db188e06180e7268c9e17736d1598564a9fe2d4a221b1
MD5 5687b6d63413e1bb9c1ea56004f9462c
SHA1 9f7f4697087d9e60272962ed50f21f8ebfba671a
SHA512 1425df76967aeab043763c636596a3cf04557eed28a074360ba97cecb64338b49dc5e713d2de9ff3a2fe6d6ec5beb864a4c13824dda34f4f529860287711ecbb
SSDEEP 49152:wabH/w9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:V7Iw3Vd0oAaldmdmnpW
TLSH
T1F9F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 137a899c007e2b66a8ea92cb4baa30b18b263459194684f050bd79eb4405f919
MD5 cb8db3a3a2fbb529db62062bc45d3e5e
SHA1 fbe69ebd1ce6146f3876dfacc1002d1a3d8f375a
SHA512 d99bc57bc8f6196097e05971c6b5bc8c8d9888a930e2872dc469749cfb10b413b15054d327af219da5989380610bcf42646894bf0250641b12b4b5305d1f85fb
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 fc00de20cac2a3102318a1c4aa1a2a71959559d34eff2dd850e5a12d5a9c5700
MD5 f41dce0b1ef7d450f0e1833b17ca2843
SHA1 a2c4f0ea688d9893b49fc1a7d7538d419e980b14
SHA512 e068327f53d3f2d91c1f7ff044a1dd0654a167441abc5107be675189b82c3f3abb95f20c01b6b4713739ba9a62f0977dd7c1f205b94aa9a25ca5b0704cac0c5b
SSDEEP 96:ManuExf7iw9i8hK36K3fvBV4BidvHhK2OK2vTX9b1/BQHRxk2hK3VK3wa0:juw7R9Wb4UodBpBQvKBT
TLSH
T1E512B0DA8E024A7F3B82DFAB325721715D9B200AC7E954B237DB5106F4CAB64012F5B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 b0d1bc6a0a673128d9c2a5ac7c1dde08a20f7635eb9cf66ff6399d29428ec11b
MD5 19a3b65e94f6a748750248c272e43ece
SHA1 f529d4ac43618bb79a815e4207f4ca677929536e
SHA512 53d17d0e63c0f9ad28824ba262053c1febd3e10da89a37b8a20b0383bea117db738e28950aa51026fab07d5566d20780c41e7699cd627a4357127aa405e14172
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:57Iw3Vd0oAaldmdmnpW
TLSH
T16FF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 69051ff6df47e4e0d1cd72de8a5d600386848dd2c8be4c3157e58784c80719c5
MD5 37fd936ab4d71b4b88809d977ac6be3b
SHA1 06757f845b30cd7e8e9fa0e6b5ff886e7df99fe4
SHA512 48695624ce9d7b57886ee461b8e55adbfa31a288110ea83b0d5b68d66ec37581da6268cebbceb38cc80332547827cc16bc47f40f29c18c19ee16c64ceb4d8478
SSDEEP 49152:wabH/x9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:47Iw3Vd0oAaldmdmnpW
TLSH
T1D5F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 593483196d34b0844e5261bbc137bde4ce6aec30599be248a17038d03f70e81c
MD5 6f6974545b1dc4a7418ba66d72930f03
SHA1 70b690d28ffd1ccfbe83816e4710d2ddfe3ac86e
SHA512 714fc7e747ed3d2fba8b3bd41b5cceef6b6af15662561cbc0bca7a08e47c9b61643ec17ac7c27bc0a9a083cbcf1a187ccc6d923e91cce0262f9861153d72bc19
SSDEEP 49152:wabH/s9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:57Iw3Vd0oAaldmdmnpW
TLSH
T1BCF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 37201614875e1e965ba4ee30ee848018b917dfc124ff42a4fcbff402271d8141
MD5 7035b8ef7ac4cd5b3008c71fe5465663
SHA1 8b9b95b19ce68892cb20abfb70d3be06ab85aa36
SHA512 73448f8d78b88e31ae1ec32fff090db14f0f446a534ffc38deb18a83edd9d1f75a9416596da936775f3335e4fae1e2c5a8c90429b5390d0428092c31fa552c04
SSDEEP 49152:wabH//9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:u7Iw3Vd0oAaldmdmnpW
TLSH
T1ACF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 83ba22265130cc17d600c8172b79e6a598a3e64c2792382d36bdbdce3396378e
MD5 3f0d6c21731d35f5eef439eb4076e5d5
SHA1 5a28e26740ff454763ac3d958e0a339913bcb0ab
SHA512 587825d5ff8f827336e705ea46cc6cd43751bad50857569d9035216db2a6bc62cb349ed0cbd2264c5973a47fb40089d23b8888cff74c0ce91da8e377a82cccc7
SSDEEP 49152:wabH/Z9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:A7Iw3Vd0oAaldmdmnpW
TLSH
T19AF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 025eaa471df5ae66806a4919fdf68ad607bb26cd22f0b93251baf24962d97fe7
MD5 bdefa9f34edc3fdbbedcef59b68f2acc
SHA1 60757dad356a6ab5bc9ec8a2b27031fb22089f47
SHA512 b0b76b1e1f2166528f782020884b213b275b62c439b125efb3aab606a5268a80f758b6bd8cf42d3d16543caff843ef5b7454adfd1dab967b25c27e6f2325aac2
SSDEEP 49152:wabH/g9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:F7Iw3Vd0oAaldmdmnpW
TLSH
T1B2F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 f681ebb81f1bae5b956c5753361c25ec773af56848bc18585946d2eda64a5b55
MD5 ded3e59cb0422f8a3cc87297596911f3
SHA1 6f6cbf61c56464dbab9e723f15887e971975c4cb
SHA512 adc3c0d1e3a75cb952e49d0ffed557074fc14cb1f486f652aaa2e6565fe5c4e04470ddc9a57541e13e30670be5acc2ea9d3e68fd521642faaaa8a10fb87090e3
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:x7Iw3Vd0oAaldmdmnpW
TLSH
T169F55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.4MB
SHA256 839d338c6aa2831994f93d04badce4fd278357c41d9ddcdc2477bc52b4f5257a
MD5 c415865fba9ca04c5d478fc49685202d
SHA1 66ea30db5858c733a021a243065cf06f75e86601
SHA512 b84f2b8aea44a1a7dbbb4e4dc393ff68ea813822ff9325e47782b858a81563f9666a2835ab5fd4cd370ea6e20f7a75bfc5583d2a424e70b0b55b037758d1d9ae
SSDEEP 49152:wabH/E9dsTh7IwCcVs+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyW:x7Iw3Vd0oAaldmdmnpW
TLSH
T10EF55913A29548E9D15AC174CE46C231EB227C5D47F1A5FF3290BADA2E33AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2284-208-0x0000024A88590000-0x0000024A885FF000-memory.dmp

Download

memory/2328-30-0x000001BB79690000-0x000001BB796FF000-memory.dmp

Download

memory/2436-164-0x000002291B6B0000-0x000002291B71F000-memory.dmp

Download

memory/2924-135-0x00000000009C0000-0x0000000000A3C000-memory.dmp

Download

memory/4820-101-0x00000249966C0000-0x000002499672F000-memory.dmp

Download

memory/5092-209-0x0000020B2BF30000-0x0000020B2BF9F000-memory.dmp

Download

memory/5116-154-0x00000000009C0000-0x0000000000A3C000-memory.dmp

Download

memory/6040-105-0x00000197EEFE0000-0x00000197EF04F000-memory.dmp

Download