da35b856a5dc0472899fa921ec0818ac771947501aa7a73fc912a72dd96f2c62

Analysis

max time kernel
149s
max time network
144s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 4.9MB
Sample260511-ew441abs3v
SHA256 da35b856a5dc0472899fa921ec0818ac771947501aa7a73fc912a72dd96f2c62
MD5 9ae8ef8be6ccfa036106261896a3883c
SHA1 02d087870746decc149f7bb438897dadc6e56c7b
SHA512 6bfae784cef38c76e0932739d53d01aecd9a206f1c1e1ac27f32579831c5adf2fc3191c499a1469154df0e8291d650502fd404d285bd5b1eedadd17eea52f4a5
SSDEEP 49152:PabH/P6//KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJ8:IWQtZ/K0tGOFWVRuLftCT
TLSH
T1A9365B13F6E941E9E0AAD178DF3586219B327C5A8BF1A5DF324032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2036	UpdatAuto.exe
2052	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
2192	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3224	sc.exe
3140	sc.exe
4312	sc.exe
2816	sc.exe
4760	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1260	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229467138165063"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
3520	chrome.exe
3520	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe
Token: SeShutdownPrivilege	3156	chrome.exe
Token: SeCreatePagefilePrivilege	3156	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3156	chrome.exe
3156	chrome.exe
3156	chrome.exe
2216	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
2036	UpdatAuto.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1400 wrote to memory of 848	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	80
PID 1400 wrote to memory of 2036	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	82
PID 2036 wrote to memory of 2224	2036	UpdatAuto.exe	83
PID 1400 wrote to memory of 2052	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 2052 wrote to memory of 2192	2052	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	86
PID 2052 wrote to memory of 3156	2052	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	87
PID 3156 wrote to memory of 1360	3156	chrome.exe	88
PID 1400 wrote to memory of 4740	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1400 wrote to memory of 3968	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 1400 wrote to memory of 1752	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 1400 wrote to memory of 4776	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 1400 wrote to memory of 3896	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	93
PID 1400 wrote to memory of 1300	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 1400 wrote to memory of 3232	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 1400 wrote to memory of 4760	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	96
PID 1400 wrote to memory of 2816	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 1400 wrote to memory of 4312	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 1400 wrote to memory of 3140	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 1400 wrote to memory of 3224	1400	2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 3156 wrote to memory of 3868	3156	chrome.exe	113
PID 3156 wrote to memory of 1260	3156	chrome.exe	114
PID 3156 wrote to memory of 3868	3156	chrome.exe	113
PID 3156 wrote to memory of 1700	3156	chrome.exe	116
PID 3156 wrote to memory of 1700	3156	chrome.exe	116
PID 3156 wrote to memory of 3104	3156	chrome.exe	117
PID 3156 wrote to memory of 3104	3156	chrome.exe	117
PID 3156 wrote to memory of 2844	3156	chrome.exe	119
PID 3156 wrote to memory of 2844	3156	chrome.exe	119
PID 3156 wrote to memory of 2232	3156	chrome.exe	118
PID 3156 wrote to memory of 2232	3156	chrome.exe	118
PID 4740 wrote to memory of 1696	4740	cmd.exe	121
PID 1696 wrote to memory of 4104	1696	net.exe	122
PID 3156 wrote to memory of 4496	3156	chrome.exe	124
PID 3156 wrote to memory of 4496	3156	chrome.exe	124
PID 3968 wrote to memory of 3192	3968	cmd.exe	123
PID 3896 wrote to memory of 1376	3896	cmd.exe	125
PID 4776 wrote to memory of 4192	4776	cmd.exe	126
PID 3192 wrote to memory of 2248	3192	net.exe	127
PID 1300 wrote to memory of 2612	1300	cmd.exe	128
PID 3232 wrote to memory of 1444	3232	cmd.exe	129
PID 4192 wrote to memory of 776	4192	net.exe	132
PID 1752 wrote to memory of 4016	1752	cmd.exe	130
PID 1376 wrote to memory of 4708	1376	net.exe	131
PID 2612 wrote to memory of 4372	2612	net.exe	133
PID 1444 wrote to memory of 840	1444	net.exe	134
PID 4016 wrote to memory of 4420	4016	net.exe	135
PID 3156 wrote to memory of 2692	3156	chrome.exe	137
PID 3156 wrote to memory of 1792	3156	chrome.exe	138
PID 1792 wrote to memory of 1584	1792	chrmstp.exe	140
PID 1792 wrote to memory of 2216	1792	chrmstp.exe	141
PID 2216 wrote to memory of 2124	2216	chrmstp.exe	142
PID 3156 wrote to memory of 4372	3156	chrome.exe	143
PID 3156 wrote to memory of 680	3156	chrome.exe	144
PID 3156 wrote to memory of 3540	3156	chrome.exe	145
PID 3156 wrote to memory of 3520	3156	chrome.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:848
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2224
- C:\Users\Admin\AppData\Local\Temp\2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Users\Admin\AppData\Local\Temp\2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff6c34eb618,0x7ff6c34eb628,0x7ff6c34eb638
    3⤵
    - Executes dropped EXE
    PID:2192
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfdaac728,0x7ffcfdaac734,0x7ffcfdaac740
      4⤵
      PID:1360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,3792551583948689936,6601748631546866523,262144 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:3868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1452,i,2550224805483886096,15497271885098995441,524288 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2052 /prefetch:11
      4⤵
      System Time Discovery
      PID:1260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,13555908187962283927,14540278738226555158,524288 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2332 /prefetch:13
      4⤵
      PID:1700
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3024,i,11822895914685600424,5627211333393102447,2097152 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3028 /prefetch:1
      4⤵
      PID:3104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3020,i,1109556453979191375,7672670041952518818,2097152 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2796 /prefetch:1
      4⤵
      PID:2232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3824,i,566811742605705708,10123262004759703628,2097152 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3840 /prefetch:9
      4⤵
      PID:2844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4544,i,14122558356805417538,8189638623471192183,2097152 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4548 /prefetch:1
      4⤵
      PID:4496
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5380,i,11418831582139033380,7256050679900977179,524288 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5176 /prefetch:14
      4⤵
      PID:2692
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1792
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7dfa755a0,0x7ff7dfa755ac,0x7ff7dfa755b8
        5⤵
        Drops file in Windows directory
        
        PID:1584
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2216
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x20c,0x250,0x7ff7dfa755a0,0x7ff7dfa755ac,0x7ff7dfa755b8
        6⤵
        Drops file in Windows directory
        
        PID:2124
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,1092348374821671910,17977943880456527797,524288 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:4372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,5142713316573709502,7530078504054159388,524288 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5624 /prefetch:14
      4⤵
      PID:680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,7287374732944972925,4062150593408107783,524288 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5644 /prefetch:14
      4⤵
      PID:3540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5184,i,10316329629056735461,814736203897815162,262144 --field-trial-handle=1916,i,4033720820172738945,13660293069344025807,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3856 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3520
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1696
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2248
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:776
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3896
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1376
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:4708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1300
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:4372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1444
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:840
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4760
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2816
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4312
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3140
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3224

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.1MB
SHA256 3dad5df5c63f20dcd2c01e34f43a1d9fa5624b69a043e34ee95bc84b840a0f2a
MD5 e6c6a13710f54d70efdc5a977fef408b
SHA1 74d7ecd29a4feebae6bdf9a0e6a64a7e502668a1
SHA512 79c441c68de699996784e98c7e59fd1bd90b207dccc6092ef1dd6830598a253a2c853ef7783cebe4c0426e1aecdb595408aa63fb983822b5c9a5c28106ff03eb
SSDEEP 12288:P4Ryed8I7r/7m2GXL1fh7NhO0ZUHXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:P4R5CIH/7HGD20Gp0Le5ji0hmxNrM
TLSH
T1C9451A15F6B48335E073C0B5C9E2968AED313D9107308ACB5385E76C2E77AE69936732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 56e85a0b05168f3e8e92e21680ee04c4e66f6e6d47db966d3bcd63d6ef5f36c4
MD5 effed2506cbd6a0c3f65ed33fc444dee
SHA1 7b01be555b7e54500f006514754eec164adaa2d1
SHA512 ff4be04cdbde3f74bd474495e99f9ffbe1f1e737b55cb49cfae569d1e0a3afe4c4489a28d2a755fc3d35581c4347f5bef0255b9b24320fc318f76c6f50119d72
SSDEEP 24576:P4R5CIH/7HGD20G7a7/ezSC6vUyD/aqgrvWx6q8wyu:PabH/L6d/ezSC6vUzPvMHjy
TLSH
T18B750925F5788323D0B3D0BAC5D6A65AFE323842073089CB5246A76C3E376E6D53573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.3MB
SHA256 4c4f019a2f9212f93c8cf76d967b7fbabd384b5a0f8157cb49e31abb985db6a9
MD5 8d5b39d3cefb18b72fe04ef628a40e46
SHA1 edeb3831581b205c6cd2d63e5ccc774798dad9ef
SHA512 c0a421686b41aaaaefd5811c032f4e55230f016024dd7dbb84ca0910cb829a9ca467785bfbcbf7f6799b8b8d4cba367e17299304c29f6ac18efac725ca84ae62
SSDEEP 12288:P4Ryed8I7r/7mpGXL1fh7NhO0ZUdVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:P4R5CIH/7YGD20GdVbqPb88hv/l+7
TLSH
T16D552A65F6B48225E073C0B5C4E2965AEE323C514B308ECB5345A72C2E77BD6DA36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 622KB
SHA256 6b6e7fd8554829813f9fd3d64de2ac839f7a261b582d73b9fc7b75d886964bc5
MD5 f7ffeea3f3f80c9f5f110e4a1a6b58d4
SHA1 e0308d913ca8aed59fc50b5498aeacfc320d8463
SHA512 aae6ef196146939349b0699f5ece67beae51e865d250baabd290680b3e8f774cd188d4b49059aba27530586fdedc824d64410aa6521882ec0e5f5622de78c031
SSDEEP 6144:P4RywzYmqBml6I7r/7m1GltPLZffh7vFh4ZrMy2ZUja7:P4Ryed8I7r/7m1GXL1fh7NhO0ZUja
TLSH
T1D0D40921A794505AF173CAB17C748516AE367E710A509E5FB3807B4D2A31AD3FCB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.7MB
SHA256 4e3930aea3938b83889b7f19792e29ac144505fe098aea1db46ca47a5381f9d4
MD5 c2c3da9cbe69ece1005c2aef647d8fa9
SHA1 b7be99cc478db775ba1d0340927f98c85171e1af
SHA512 4e6b848bed813b3583500a7e11abcfb5f125ed9779c557b14469d8ea4f47f11d4fa149ef1a1ab9ea29731a17c6390ac50814c5fc787abfb77d69d751ebc1bdde
SSDEEP 49152:PabH/46Zj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4Fv:rQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T10D666B13F3A501E8E05ED974CF3952229B357C4A8BB093EF259436E51A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 70b32c997e269d56751db5a6990757d6552815550636ef1699ab27bd705e70e1
MD5 5de8e8a8d6441c41d6453c849ffe3f0a
SHA1 4c351b931069cc97e6c3be11e5089250826b2897
SHA512 3210961f48de03b6c12def9e77d10e29bb833740891e111b257869a0fd224e3110cd71beb9ef04bb6abcf0d48d2eb4662ed4f92ad79ef21855d8f6211ef8ec29
SSDEEP 24576:P4R5CIH/7EGD20GSwvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL0:PabH/46N68Qg55nhoeWu7PNU3/Q
TLSH
T174B50733B2E20099D05ED5769F56872196E27C718FE0E7DB8241730A1BB2AD07B3971B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.1MB
SHA256 bf4e06c05fa7438013918aeafab49fc1a190b680351e76db577e294253469f71
MD5 4cabc11a50ea15a40b1bb8f38cfd0095
SHA1 5874c2fc74093a5ca44efb2d87857bb3b64d416d
SHA512 86f2ed31056ce1a9af86f9ca2e3c1f57794e32420c3a4e623ad563b258e39df59aabcda37286aa0825b8b31aabbe4875dad5174c213e93d8e9183da39fe5359c
SSDEEP 49152:PabH/46j3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/nho5:Vy5112gYy5azzVvf69nLKnhZO
TLSH
T1A5166A13F29900E8D01DD1B9975A8232EA72BC534B31A6DF0A5077562F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.9MB
SHA256 f769e14edad967ea0ccff61594c09780867a736ed8dacb6251701218436ab2f5
MD5 bd6a5aa5ec86132203f185577b408935
SHA1 7855dc4c5d197c757c062960278c2e4427a79649
SHA512 f245deeda7228685a19dbee189744ff5cb4280533ce8644f4206dcc2ff1332a8c412bedbbb6718621df2ba85ba60d599886b434f0509f2072d15a7c50bbed4e7
SSDEEP 49152:PabH/46uB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:Lu6Jm0xd2d3
TLSH
T199D57C13F2D901E8D06AC478975A9232FA62BC590B30B6DF0B9073552E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 155e8447b5ac7ccb32578427e4753fac109b38b8bd3916f480edd7763d879ee5
MD5 6e7437f2b3eefb1cd293f05ecc64450d
SHA1 de5195c1745b1b327e2b8e46ec055d1e8c4f609a
SHA512 6da33e33f9eaa0e4d7017a909bc3b3f4a537e2e38a891eb462cd89a5d6e5901fcbab88df1c5c96eb991c6363db0631be46bd9842977c8bd6a4ee5c3501c702a0
SSDEEP 49152:PabH/46tSuZQIY0Be2K8RVtOnks6NMHq6:G5dKCi616
TLSH
T1FEC58D13F2E940E8E0BAD5749B758222EA72BC550B34A6DF074072591E77FE06B3D722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 8658473a1479326a6f1929cf02a09267c4747ebbae27337236387f95794d2f42
MD5 fc03c346836d9065aa20740e6c99d4c4
SHA1 88669cdcbaf7ed659603b72f52c31eddd105431f
SHA512 377b28e5a78011d735a5de8fb29d52179aaad493b9aad7a5c7f84b6637b8b54981ac28dd5440bd12b7de8fcd89cda4427c489b7fe62872924a5037bc133484d3
SSDEEP 24576:P4R5CIH/7EGD20GShiavrPSLT8EARn+FgyUgd0fJY6B1i3iy9CTn0AP5+2QLy:PabH/46rhtSn8EApI0fig1giDn0AP5w2
TLSH
T149A58D13F2D940E8E06AC574D7568632EA72BC210B24AADF0790B7561F77BE06F39712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 631KB
SHA256 039a65ac0fd6b2e721853ccd6bae89ff6f846e6867a864d33ed1a25f3dc55546
MD5 680bfeace21ec59601e24d1a7046787f
SHA1 89c7b2570c69764b2ff31d1dd7a0fa5cd89387ee
SHA512 88cf7be8c5bdccda50546d3d4967981a319393090e4745885e80e2631666ba8cea61339aee2060565f8c9d0ccef37a7d8452ac4922cd2948abac97600c26eb67
SSDEEP 6144:P4RywzYmqBml6I7r/7mdGltPLZffh7vFh4ZrMy2ZUVe7:P4Ryed8I7r/7mdGXL1fh7NhO0ZUw7
TLSH
T194D40921A794545AF073CAB17C748116AE367E710B909E5FB380770D2A71AD3BDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 631KB
SHA256 e2ca8df36f57cb5698a8c8304b9b23965e411e5b4880b463fdb8810142d4bc8e
MD5 0265214b827079945ced7d3e9dc65660
SHA1 4780e9101dcdb3a940c5c61aa8a604740b718c6f
SHA512 4e12e51a2fc859343dfcdf43f28c113fcfdeee1db6dbc581f71341eab74c00d96010a8f5299b8b3a36131a78e179e51a3bf074a10697bafefa6a151d81fd4847
SSDEEP 6144:P4RywzYmqBml6I7r/7mdGltPLZffh7vFh4ZrMy2ZUWNx:P4Ryed8I7r/7mdGXL1fh7NhO0ZU+x
TLSH
T105D40921A794545AF073CAB17C748116AE367E710B909E5FB380770D2A71AD3BDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 631KB
SHA256 f6283d1316c61c30766cd9cc6d3e0a15415bb91a8ffa1aa9cca81db8c05107ab
MD5 7d45e50ae1d1c7434936f3b59d7204be
SHA1 965bc4a5a4ef355b4dad75b7ffc24539a109b847
SHA512 013297e09ceff121c05f6c8d4cd565153a89e83585aa5ac7283f645a5903256aff0d16e67eac70ec71e37b2c323563b294fc47830d6671d10fbe58db55202b91
SSDEEP 6144:P4RywzYmqBml6I7r/7mdGltPLZffh7vFh4ZrMy2ZU5qs:P4Ryed8I7r/7mdGXL1fh7NhO0ZUss
TLSH
T13DD40921A794545AF073CAB17C748116AE367E710B909E5FB380770D2A71AD3BDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 752KB
SHA256 61e068f6ee34817264bfb12aaa210def02f9ea2d4e881401932347d5ddd9fdc4
MD5 dfa3eec54912f61f18ede78f30a407ca
SHA1 1cd929d9d93b61faa3bf45545720ced8ef4e4f3a
SHA512 91421b9dcccfe79d74c73918dc322d0fa289388191f78534dad045d78b838f687d7edd72ef06f9ca44ce1ae1f0ba87c04710466e75e9a49d59be7b77724aca5f
SSDEEP 12288:P4Ryed8I7r/7mZGXL1fh7NhO0ZULXsf3z:P4R5CIH/7cGD20GqD
TLSH
T1CEF4E511E2944199E06E8671EB648505BA377D7107D09A8FA3C0F63E1F32AD2BDF4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 664KB
SHA256 41cc398db0bc5c4544ba529846579f782850be0d223f926b90df1600d23e80e9
MD5 4fc59ed4e2b7563a972673baba613077
SHA1 31f4d37b02aed20aa05e889a50cfa017f9ce914f
SHA512 b110c61508ba4d61eb718257bdd3a2f9fc8987f8dd92f9645bc86d22599a08be27a60f8dd06d81ff334c6b753f704f0e6f06728cbd36b7cf2e6892e93cc49e53
SSDEEP 6144:P4RywzYmqBml6I7r/7mdGltPLZffh7vFh4ZrMy2ZU4JJ:P4Ryed8I7r/7mdGXL1fh7NhO0ZU4r
TLSH
T17DE40921A794409AF073CAB068748516BE367E7107509E5FB780770D2E72AD3BDB4B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 672KB
SHA256 0f708a04352f118bfa4da110482ce41a10d98666576948d6c8116e88c17ff6f0
MD5 b9906f9eaddaea31be3e974591703681
SHA1 0e03a1a4fecc20b8059d52c82fb7923fb11bb26f
SHA512 082e53a52a857fbee4f248211e162548af30fd0897cde9132bd4b979c2c80eac4b6226b4afa912814374119264b9cca754412bcf161b0b598b17669dbdc5c7ba
SSDEEP 12288:P4Ryed8I7r/7mdGXL1fh7NhO0ZUSqnkraG:P4R5CIH/7oGD20GSj
TLSH
T136E41A11A79440AAF073CAB168748516BA36BE710750AE9FB380770D2E71AD3FD74B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 668KB
SHA256 70cb26089073ccea7f1b8089cedcf60d6ca494b1682429e3256b4402fb87af31
MD5 b00007984c8a81fd4f7ea9a1e090b413
SHA1 32c505e1ea5a04f31c537c75c4fd3147df370cce
SHA512 3b7d9bbb468e71972ec68ba5ed982bbc76856f8843400f7cf421d20dcade4b1a8d21d30c2c83160a534bc2be5485dad4930e3106b668de23b2e15772c677bdb9
SSDEEP 12288:P4Ryed8I7r/7mBGXL1fh7NhO0ZUIpIyvJd:P4R5CIH/7EGD20GIjv
TLSH
T1D3E42A61A794409AF073CAB168748116AE367E7107509E9FB380770D2E72AD3FDB4B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dc4726b-46af-4d9b-abd3-a4f34b4270bc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4dc4726b-46af-4d9b-abd3-a4f34b4270bc.tmp
Size 201KB
SHA256 014c6a9842988beb67569a5780ecad26f5b9897e6b7d6aedabe3d745c6df5ac4
MD5 582d0ee356ab9bbb78da98a68305259a
SHA1 ec2f84e0a5b9624ef77ea2567319dca5f605ca62
SHA512 4c36125ed659cf0a504639fa7f1db07770e9ecf4f5f808fc38eb86e865ef5cf3f3a091be1ce0164ec61fe939718553423262e11517f6382d673b2b170c8b8631
SSDEEP 3072:AEhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/M++J3qUQm08KMWF0bFTcVHr6zI5:Ai6OgB2HWv3G8YnOnU++JjcMW2VcVLl5
TLSH
T11D1412268919BC78232EE3D2D01F1D858DD29CAF895964F87193774F02EA341278FD6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 d4b20187d1a27791dd95f08abe7840e0cdd1ce61f275bd653b136d14b779d85d
MD5 a9c52baf89a3b7bd355ceacb31f4c1fa
SHA1 772d3bd6852fdecd31426b10b2a48b0bb4513a74
SHA512 4b5eb51f8e5d34c50df3f8fbaaf6247de584377339da9ed1a759628bc0c6a5ffa3098bfa7fbf0ca780c77f39d44b791375aefc45ca92b2ec120b8b98c74f7f5c
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 53f5bf2b0dfdfde678e856e0d6c8f1f9104501b68f602e98755d3a1a59aafab5
MD5 635094e7c8f77b83c9fbfcf24d6a7a8a
SHA1 163095d369310495e83a20f98281c0c21e73991a
SHA512 66092b2cdb3254ee806b2fd9f2cc9d3d959cc34027bc86a134ae1d7ce82a33a4473e02f35bf0ee2a0dc3aa7fa15acdd01da6257db7ccf067ade14aea4798083f
TLSH
T1FEE02BBACC11AD3B0CFD1B1960648647F74113973740495F3A3D834D4FB1237054595C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5c32130c891ff2edb2c9cabac4191deac4f97a6f7f10fa6680937d91b9cb1f37
MD5 c159b1c031b19123b6ccd0068a3b54ce
SHA1 bbf27ab6d8fbf8040196c8d4dc95640116dec9fe
SHA512 8576fbaf59a33e8090512813ead9c4afe8ec0620830b22f9ab0e9308309f4df8f8650c45c6ed3b0bb2dfae86ddc8066c7200c0efc481ac83f8abab2d8034a413
TLSH
T1FD518CF793E48ABD851596F49B206E2FCD790A14131C3C66C8D4AF0B43F28B2D20139E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d0f8e571f9bde49810681752359d2f93eb50933c82a41cecf8a722171f302cf4
MD5 288161e9f2fe27b4230e0cc102e76f22
SHA1 8dccda52cf233b4c6220daad12d9d9d73157069c
SHA512 445d26f66856c7716db2fbd00d8e2967f574efc6e752a9294339fc81d4edea3ed7798bd5e255933d88142bbf3da995ed534873df51ff33759be5faf3ba307c7c
SSDEEP 192:DRL6/2REFv7dA79PRp2DXsb+WNnMb27F92PyPNrkwtaXiyIsnAUgtaJ:DRLED1haXoXwg27X2PyJNaC8
TLSH
T1BB32D77EB924783B5CCBC61AF965B693D3F61022B1902E80FAF8862C15D75CC222B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eeca77afb0db2673aa284b9645fcb4dcdf7b8075bfdf8d2e9d7ce0e2c528abca
MD5 f52a6bb50852b6581c15b6b775b5bdff
SHA1 ac025f2c15784ba3eb3ce8572f8aa70c4b060125
SHA512 292358c01b9aba39b9f326fdb5e346569d52d3b31d05399f3a79d873dbdcc297cbe54449084ab31b37613016bc0eea6fb30883ff4b00f19ec415cf5c629ada4f
SSDEEP 192:DRL6/2REFv7dA7rkPRp3DXsb+WNnMb2R92PyPNrkwta9iyIsnAUgraJ:DRLED1hsWXzXwg2T2PyJNage
TLSH
T16E42E77EB914783B5CCBC61AF965BB93D3F51022A1902E80FAFC8A2C15D75CC222B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe584801.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe584801.TMP
Size 3KB
SHA256 15954fd91b5261c07a31aae9dea90739517ab305d71c02d01cd136ad21daff6f
MD5 b0fc42aedc9a02bb50e5974e1f3723b5
SHA1 3b5f35cf2f23ca838b06c5d962b47a90deb79a25
SHA512 c41be981db14ed5b6e13f5cfa40a9f915787e9e4a26e485fecbfc092e72d5779810524137df4e4ef3e22439a872a8ea43fbb5d4b9a3ed526dfef37f339deb841
TLSH
T14C617419C0E54CBB5DB57B24B4680782FED7433F010018867ABE598C0FB6D2BD082F6A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 5ab444414a02d4891c7cbb4db3735bec720facb3265bdedc915a68f6beef1cd9
MD5 191a425abbe14997e55d6c34d96395de
SHA1 567b4a799716eb9b3db36abe7163a0aaec1148fd
SHA512 d0c7f690ea61add197a2dbd706250b5de93bf454a11e6e82e25faa2759a36b7158f1e02247d411bcd65234e3d4eb5605c539a97b277b15db18786f9fbc17ab4a
SSDEEP 384:UujAr7KxkXqKf/pUZNCgVLH2Hfgsl+m7pLuLcifmnXODAH+ErU3xWHGWmvhxVtfC:UeAr7KxkXqKf/pUZNCgVLH2Hfgsgm7p/
TLSH
T15D720A677C4C9E770F94CACCD8167A4FADF6024B65E9889583FA982903C5ACF11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 49e0696b4bf53798c0771bd9c1649433f13a9e1bbadc9410b3db2307d7066b0c
MD5 d2ba0916eaf56849780209893b7996dd
SHA1 1349bbd2231c0f22a6afb59d63079f7087f3624d
SHA512 01549b0006d8d35cb8ba8279b31e32d5043c0e76ed876e7faf7d9a95bf0e515f900f9d233af166b51cab8ef1e16d50950c73bd01b339f5ca7db10769333d0ad7
TLSH
T14EB0121084435601C04302B0218218D87298EF10CB05130193E46971ED261B18215150
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58749e.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58749e.TMP
Size 96B
SHA256 236d5b3a8bd476d04ee303608246329cf7dfd8bd4a7531fa90d24ceb671c40f6
MD5 3a30602319d837db3100c4dc468e72a8
SHA1 fad5bed7c974628dfa462f42fbd79bb6b60b7037
SHA512 bf3b061ede86ebc6b5c49780ceb03fbf5af03a49e7b6da7cc32bdadf1935affd747d80059cae91ebec20de6b10a19fd12c2c176b2c52a7ce88b0a2a6b05d2d7b
TLSH
T1E2B02200C002A322C00203F03083BAE830F0CF28C2032302A2E00A23CC323300232230
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 7fee6ef8b422d36bd616075b0caa868ae337ded74a72196f5e0d4a877f2bdcce
MD5 38f80a45f21659ce08c238ae58365959
SHA1 da8c29cfbf66d641ff910db250fe11403960d696
SHA512 55740f4ad8aaa91ef4b31d0e05f082e8764fb4a0ec89d5c36d333674f1c2f9253babb2ba4179a444934b562542e03138f719a0c42ff6b02e7ec3e318f2cbe4ef
SSDEEP 3072:A7hV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/M++J3qUQm08KMWF0bFTcVHr6zI5:An6OgB2HWv3G8YnOnU++JjcMW2VcVLl5
TLSH
T133141235491ABC78232EE381D01F1D848DE2DCAF9949A4F871937B4E02E9341678FD6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 201KB
SHA256 234d14b9a6578bf59683125aa1928e6b5cdba78cae863691f012691cb194b11e
MD5 147fd301cdbb3a4f76e052178f481d4a
SHA1 cb802463e01067e0a94c41bcb448fdb7b173913a
SHA512 b1479d5b80781f0cb2df06b47b6e0706862e9a23bff78b28c79b9d780fcd12211eafe0a4591378c737c893a4a0f5849c1417b7ccab99062fda676d190485c829
SSDEEP 3072:7EhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/M++J3qUQm08KMWF0bFTcVHr6zI5:7i6OgB2HWv3G8YnOnU++JjcMW2VcVLl5
TLSH
T1781412268A19BC78232EE3D2D01F1D858DD29CAF895564F8B193774F02EA341278FD6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 202KB
SHA256 f30075fba8e1cb11d89088d885da86801090aa539cf6aa3ae85bdcd027188556
MD5 7362b875429ee09e34bd7514f567da5d
SHA1 faa35c102e45dded4d7ba96dd7a061bc143282cb
SHA512 196c1bd7906de8774d6e658a1d3d2e1aaa8fd00f6b5ccf54ff61ee9213fdf081b5eb119ad95728c1939ccd0a357845606e3c7d9d4a6925a3e5ab8f77ebeb03d4
SSDEEP 3072:AOuhV6OCPdZBpMKAVtKsdkv30rniRYVxuRHH/M++J3qUQm08KMWF0bFTcVHr6zI5:A16OgB2HWv3G8YnOnU++JjcMW2VcVLl5
TLSH
T1F0141235491ABC78236EE381D01F1D848DE2ECAF9949A4F871937B4E02E9341678FD6D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 b3c72b0796b7dbbbffaa58ce84fd2fff29573f7cbd8202d9220db8b652d1201e
MD5 6b0ccce096893b4fd4db96aa65531a05
SHA1 b122f7d3a9c588c635a6bfb135ca2a43bdbfcdce
SHA512 0dc739e79fe0be392a2878b3f25e4fd02ac211cf70561d97a892cab9b74e92df74d6648b638adb3e234b43bf6d3fbfd9c90d984fecf355d460f29a9dd07d0be0
SSDEEP 1536:4LiP++SKG0qRilWUATqUd408KMYbF5ITGkbEKTldfQVHV+Y6zIFNxZ:gI++J3qUQm08KMWF0bFTcVHr6zgZ
TLSH
T1969302B9991E7D79636ED396A0179CAC8CD3DCCE1510517C30C76F0E14BA3A2A31B8A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-11_9ae8ef8be6ccfa036106261896a3883c_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 608KB
SHA256 8883a5166cf9f2eb1b8c692e54f37e4dc388e5b606b08bd71efec6460444aa4e
MD5 c2c79eb526542130e6593a359d80329f
SHA1 2a3781cf020d7eab6935425391e6bec0136d54b3
SHA512 8bed48945c139bc46f24b5d42174ee4c82bbb71ea66b074a3cad67730f859bdeea5bd3c5fd967ce53e27b75c298d6c29819a60fa3f6d43961ea5eb3f7944bd77
SSDEEP 6144:P4RywzYmqBml6I7r/7m6GltPLZffh7vFh4ZrMy2ZUg:P4Ryed8I7r/7m6GXL1fh7NhO0ZUg
TLSH
T192D4F921A794505AF073CAB17C7481166E367E710A509E5FB3807B4D2A71AE3FDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 1aabdcfd3e20364df4f852615989c3cee07e9809d42626876fd3476598a191ff
MD5 6df8022e05265ba987c21aa88ad7c86b
SHA1 b1b44bcc5cfd667297738aa4324fbe74e7e85b0b
SHA512 65404bbc0bfe1a9d2a9817f7b9071c81fd852e985479dfbba8751166e4e843071405b3cd475dc8fe36d2fc64aa9c780695d5f55727df165721338cb4abc584d0
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 33b28525f72cca0cfa2784ad924ed4d0f4f622b2f5010b2725e61da382e698a2
MD5 14f7a788d538c7ff6fc7f9e4dd0c16fb
SHA1 33b5f8d4ebb0e9d3a8bb91dc2e69e53d95e75e57
SHA512 93bf4f3f700230a79837e7cc7456fd43ce9a4c484425cc479e0702fdf34231773f88de9166a9bfbdb7fad57005a69ce657919addc5f99d1e38346c1a8ff219a3
SSDEEP 192:PyDY9AGWSXRwJ3AY2RUFFgfbY/PAQFAcJXBfGARgXGzzy9E1eiAlztb/wK8Xh0/S:PyU9AGWSXRwJ3AY2RUFFgfbY/PAQFAcd
TLSH
T1A812AED68E02486F7B829F6B335332506D9B240BC7E4A5B277DB5202F0CAA65051F6B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 608KB
SHA256 f2dd227938e70af813720d8e508a7741d390d9191a182bcc47970e1d60323cf5
MD5 b00afb8ba5c9fa42f2130664fb307265
SHA1 588dfbe3a7a335b4ab0a137ce08106971b54b01a
SHA512 4460bf8812f27df093f861f73183a7f4bde48de2aba5410db8cd9d1263d77835536c0c1ebea34527e0d35093951395ace5645961fb7314fa8b7956baa089a949
SSDEEP 6144:P4RywzYmqBml6I7r/7mpGltPLZffh7vFh4ZrMy2ZUg:P4Ryed8I7r/7mpGXL1fh7NhO0ZUg
TLSH
T14ED4F921A794505AF073CAB17C7481166E367E710A509E5FB3807B4D2A71AE3FDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 608KB
SHA256 6de8fb7f04f90ac31db95b3f8bcc4fac6398f9328b8ac2a4c71adc35cb6e5fdc
MD5 66ef3384c81e328a6bbb31045b3c2c35
SHA1 3e7c0259b742a3553a3a49aa95956608b5a17d59
SHA512 193a4dbdcf1789c274e4e43303ad718e260b5b805bffe79275a7bfb58c282fe67bd6412d74793b05a4e3f12caf9c98fbf2359d310c4e0f833a13faa9e3039968
SSDEEP 6144:P4RywzYmqBml6I7r/7m1GltPLZffh7vFh4ZrMy2ZUg:P4Ryed8I7r/7m1GXL1fh7NhO0ZUg
TLSH
T11FD4F921B794505AF073CAB17C748116AE267E7106509E5FB3807B4D2A71AE3FDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 608KB
SHA256 5fceb2baa6d3d460180528e4e14c5c119fe0b542b03476c775dec919647bad07
MD5 0fc8712a41ada5d71b56fae0a045b5ff
SHA1 2e2e898ff407177ca375d66cd1f75d8f0b16e3d2
SHA512 d90803c9bd98918adf4db73974a423a3368bccf42dbf303e63d75c71152906d75eb51165b78b7ac01a59ae87655ef7f9127e9b6051b6ad72e8400ce19c996c49
SSDEEP 6144:P4RywzYmqBml6I7r/7mZGltPLZffh7vFh4ZrMy2ZUg:P4Ryed8I7r/7mZGXL1fh7NhO0ZUg
TLSH
T1C5D4F921B794505AF073CAB17C748116AE267E7106509E5FB3807B4D2A71AE3FDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 608KB
SHA256 bf71df67d35e85280fd29ebb76fe81abf56bf58d56947d7a301eb572467b6aba
MD5 d45576cd81550ae59258c1c2e53d8bfa
SHA1 d705e05512eebde6e89066e9d266a4fa332f5128
SHA512 5a9a448b6213a0962d4929142b3b66ede5a3aa3ee4b0932c66875e0ead5a99792d0621f0e2a0c848801a98afa5a417e28f8faade532d458beced65dcbe13e184
SSDEEP 6144:P4RywzYmqBml6I7r/7mdGltPLZffh7vFh4ZrMy2ZUg:P4Ryed8I7r/7mdGXL1fh7NhO0ZUg
TLSH
T110D4F921B794505AF073CAB17C748116AE267E7106509E5FB3807B4D2A71AE3FDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 608KB
SHA256 af0588650432643b16162df84a7860c5046469aaaf139e197e127750f3de69f6
MD5 54f60f61a9b8099c9eb4731c50ef0da0
SHA1 d062a59ca907883d7276cd01fb11058a411f92fe
SHA512 c852aa5f588299d276aa61b49d77cabacbc35e5ed97ee3877b8a8400a2eb11d069fb47c0ab97d3bc0c1dc8c4e00e3dcb4ac72be9740165951cdc71e2f41f630e
SSDEEP 6144:P4RywzYmqBml6I7r/7mBGltPLZffh7vFh4ZrMy2ZUg:P4Ryed8I7r/7mBGXL1fh7NhO0ZUg
TLSH
T153D4F921B794505AF073CAB17C748116AE267E7106509E5FB3807B4D2A71AE3FDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 608KB
SHA256 1bc1ba9363d30dceac6247820609da2ead5d3b548a78800e6836dcc41d3795ed
MD5 a3e7f571822bf8bff2aa940061793c66
SHA1 215006e3b6c77e6c5004da9776826daceec57a6e
SHA512 03b2dfbfa73e3a4d9c55e2d1594aa262e27a4380c3f4b409719e5231d47a6c28ee23f07374d8f94def37850751899cdfcd0b16208a8c167d5a0d95d4b08b009f
SSDEEP 6144:P4RywzYmqBml6I7r/7mBGltPLZffh7vFh4ZrMy2ZUg:P4Ryed8I7r/7mBGXL1fh7NhO0ZUg
TLSH
T19CD4F921B794505AF073CAB17C748116AE267E7106509E5FB3807B4D2A71AE3FDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 608KB
SHA256 e5a771a3269a2e1cc5ce357ae38bb01ede9d2ed92e8b2289f1739e5e11554048
MD5 9c1049f5f2c5cc202c899bbbb88f5da1
SHA1 8ba377abd9201558a2a500e86d8b59630e2e1b91
SHA512 c34a2f7c4de293f5eb919ca3a0c47b8ab1a059630bb8bfe3e5787b0465471524ba299eeb683a93eceab84c015e072d047c5f937de8f55967a9d9e61464926aa3
SSDEEP 6144:P4RywzYmqBml6I7r/7m2GltPLZffh7vFh4ZrMy2ZUg:P4Ryed8I7r/7m2GXL1fh7NhO0ZUg
TLSH
T156D4F921A794505AF073CAB17C7481166E367E710A509E5FB3807B4D2A71AE3FDB0B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1584-222-0x000002BE56230000-0x000002BE563CA000-memory.dmp

Download

memory/1792-115-0x000001AF05220000-0x000001AF053BA000-memory.dmp

Download

memory/2052-30-0x0000024F23090000-0x0000024F2322A000-memory.dmp

Download

memory/2124-223-0x000001C0E60C0000-0x000001C0E625A000-memory.dmp

Download

memory/2192-204-0x0000026E29A20000-0x0000026E29BBA000-memory.dmp

Download

memory/2216-111-0x000001A0A98D0000-0x000001A0A9A6A000-memory.dmp

Download

memory/4288-53-0x000001B812980000-0x000001B812B1A000-memory.dmp

Download