neshta | 24dc3bb199ae613ac76d76f5e83a12458abc696fba57d9427900a138664b6e67

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
19/05/2026, 15:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
Size 5.2MB
Sample260519-sgx9ssh14q
SHA256 24dc3bb199ae613ac76d76f5e83a12458abc696fba57d9427900a138664b6e67
MD5 8e13eea8a19814572713f118fbce7cfe
SHA1 2d29f7a8f25f0c82c363978c5f35db05aa1b533c
SHA512 32507141403953ccf367d37888b966d0ae5455f8c432846283f4a82e7beb2c2291983cc3c6ef2c3bf92c6487956ea49056ae395e54e87d31b5cb33e8f29fa2d2
SSDEEP 49152:jeRJtZrZUhqBleebd1psOwwgy+VExVo5aNG89j97s5u7PaSZFTPkXG5lad3w6GDf:AcwBBhDhwd3bGD+l8VSBsP8UX
TLSH
T1D7466C13F2AA41D8E06ED1B997365332B976BC554B3079EF02507B241E72EE05B38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 6 IoCs

resource	yara_rule
behavioral2/files/0x00060000000279ae-41.dat	family_neshta
behavioral2/memory/2028-206-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2028-230-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2028-239-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2028-240-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/2028-242-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Executes dropped EXE 2 IoCs

pid	Process
1352	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
2804	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MI9C33~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\identity_helper.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeComRegisterShellARM64.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~4.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Google\Update\DISABL~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\PWAHEL~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\BHO\ie_to_edge_stub.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_pwa_launcher.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~2.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MICROS~2.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MIA062~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\NOTIFI~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ExtExport.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\msedge.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\msedge.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\MSEDGE~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\PWAHEL~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13195~1.65\MI391D~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\INSTAL~1\setup.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedge_proxy.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\notification_click_helper.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\cookie_exporter.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\Application\139034~1.125\msedgewebview2.exe	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\MICROS~1.EXE	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\svchost.com	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2224	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238051443800159"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4024	chrome.exe
4024	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe
Token: SeShutdownPrivilege	4036	chrome.exe
Token: SeCreatePagefilePrivilege	4036	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4036	chrome.exe
4036	chrome.exe
4036	chrome.exe
1480	chrmstp.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1352	2028	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe	80
PID 1352 wrote to memory of 2804	1352	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe	81
PID 1352 wrote to memory of 4036	1352	2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe	82
PID 4036 wrote to memory of 4400	4036	chrome.exe	83
PID 4036 wrote to memory of 3796	4036	chrome.exe	84
PID 4036 wrote to memory of 3796	4036	chrome.exe	84
PID 4036 wrote to memory of 2224	4036	chrome.exe	85
PID 4036 wrote to memory of 3532	4036	chrome.exe	87
PID 4036 wrote to memory of 3532	4036	chrome.exe	87
PID 4036 wrote to memory of 2716	4036	chrome.exe	89
PID 4036 wrote to memory of 2716	4036	chrome.exe	89
PID 4036 wrote to memory of 3264	4036	chrome.exe	88
PID 4036 wrote to memory of 3264	4036	chrome.exe	88
PID 4036 wrote to memory of 4540	4036	chrome.exe	91
PID 4036 wrote to memory of 4540	4036	chrome.exe	91
PID 4036 wrote to memory of 756	4036	chrome.exe	92
PID 4036 wrote to memory of 756	4036	chrome.exe	92
PID 4036 wrote to memory of 3448	4036	chrome.exe	94
PID 4036 wrote to memory of 4504	4036	chrome.exe	95
PID 4504 wrote to memory of 5056	4504	chrmstp.exe	97
PID 4504 wrote to memory of 1480	4504	chrmstp.exe	98
PID 1480 wrote to memory of 1128	1480	chrmstp.exe	99
PID 4036 wrote to memory of 2188	4036	chrome.exe	100
PID 4036 wrote to memory of 3164	4036	chrome.exe	101
PID 4036 wrote to memory of 2356	4036	chrome.exe	102
PID 4036 wrote to memory of 4024	4036	chrome.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1352
- - C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=128.0.6583.1 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff688add2a8,0x7ff688add2b4,0x7ff688add278
    3⤵
    - Executes dropped EXE
    PID:2804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4fa3c728,0x7ffb4fa3c734,0x7ffb4fa3c740
      4⤵
      PID:4400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,2350699803949313779,3856989779331877212,262144 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
      4⤵
      PID:3796
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1480,i,17772378957959842767,7834761636127239037,524288 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2284 /prefetch:11
      4⤵
      System Time Discovery
      PID:2224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,14987023781306435306,8786500448666496754,524288 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2728 /prefetch:13
      4⤵
      PID:3532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,11751081567657846166,16540477703834293104,2097152 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:3264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,12831513336611204933,9439693941714216612,2097152 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      PID:2716
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,3009094343522032210,4774050863834537834,2097152 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4228 /prefetch:9
      4⤵
      PID:4540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,634960737289469570,6456399614076094056,2097152 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4752 /prefetch:1
      4⤵
      PID:756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,6575702643094292341,11166313166408159223,524288 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5436 /prefetch:14
      4⤵
      PID:3448
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4504
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7478055a0,0x7ff7478055ac,0x7ff7478055b8
        5⤵
        Drops file in Windows directory
        
        PID:5056
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1480
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7478055a0,0x7ff7478055ac,0x7ff7478055b8
        6⤵
        Drops file in Windows directory
        
        PID:1128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5800,i,4056016953653056013,12244587546572014844,524288 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:14
      4⤵
      PID:2188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5828,i,3925265246571522321,1083279335701528291,524288 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:3164
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,8051878801972416315,17514153384323744910,524288 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:14
      4⤵
      PID:2356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5412,i,11330176348135668457,15479407855217912700,262144 --field-trial-handle=1964,i,7038039864404835274,8247841153705285407,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=760 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4024

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1480_13423805144660857.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1480_13423805144660857.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

4504_13423805144771885.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4504_13423805144771885.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 db1c0ac2d59dc903b3d97110c1e0a55b6f2d9bb2b48309e4b410d61dcc8aa42c
MD5 c2bec69f0da59e4b81d226a73cd2484a
SHA1 2648a24bbeed54ec12eb0d18dd566cfdc9bb3112
SHA512 dadd3ecd43a878c233c58c03d1d82002b2b7769f511d76c1b7369c560e7a5eddce1c5a4775c97feb3987584d57bfd4858f4ad59ec008abb8e041cce042bee4e9
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8f26a01dffefab66e8baca661c9c8b4b7cf6f92b0f0e99dd7f90f17cb0086a01
MD5 2af56e0c8afde113e7b08aed87975a00
SHA1 345531c2ad37c588c527f417fbd0bae21fe20e3b
SHA512 b63f7728d4afb2b97ae3280d606131ac7ba72bc330b9ebfdeef0d0e977008d3d3df07628803f20659661adf7af87201bb1359bb587e0e621b0bb611318215a7d
TLSH
T1F2F0F9A6C922EC3718FD0B2970A44746EB9013A72B41899F3B3C520D8FB263B469582C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 6d57ba840cac4ecbf7f0709283ad12334de97039482610109fe66cb639eefb8c
MD5 8abd34af2c8f3c31b167e47018d29703
SHA1 cc8c41cd3c81d5be4500877799ec962f1efb1100
SHA512 44235f85097233d0b412b87e280d9122708bd525862101faa0b90315889b3f684b70ae1e525ecca13c76392f26d3dd831924d5283e8272e88ee5bc4c4404f94b
TLSH
T1CF51AEB3C7D88A7D881152F4AB256E1FCE390E14532C3D56C8D4AF4F53E2872D20168E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a9c22d73c07c1c7792cdc4d45bc265202094cdf7006e6a93f570c11fb81f892d
MD5 bfe85a460295150ce0864ff1c9694c1c
SHA1 8f4a30852c3170a76094284a2d506ac3917036e9
SHA512 b1604a849ebf84f92ee5cf6e29091fdb940e54fba2126656e8c34ef7944f4ab245dc2099a6668c70bc83c9e7e1537d015b3d8a8556b644b53e0ce4db1f41eaf9
TLSH
T1B1818DB7C3E88A7D841156F4AB256E1FDE390A14132C3C56C8D8AF4F53E69B2D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 4a3cd0631c682d35b733e0302336ec556ebc975869029e6abc1924970cd9a302
MD5 af2ace5e0d51f8f7dfdf01dfee28a739
SHA1 69793bc91aaad44c983e8af429bd30877d1ce445
SHA512 b44aadd1971cd60c6ba6ca22d9e56bcf6328f257b1a0a4e79496ea94539d121f12b00ff2f57bb856f254b6be7a1243650d50f901447cb6ca42c0cc3f873aede2
SSDEEP 192:2R0nPZNkxv7QwPRpd7Xsb+WNn7z2qZ2/e8biyIsnAUgraJ:2R0nx2hvX1Xwv262+e
TLSH
T1AD42D72EB990683B6EDAD719F9667753DBF0202121902E80DBFCCA6C14D79CC621702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 90e6b80bdb29fe5b9b42eb1fe818364bba0b6e1e43f632d336b2cb0071d16e02
MD5 4041589bf6756fc2fe2e6762995747a4
SHA1 f69e34cccb8425788396697a1ac33d73ff236b4e
SHA512 c5ad9b78013abf95b1b53d6413bfbc924adf5385f6fba9a310e529f46c87219275574436f1bc7c08dbc24156c38f0d9ce6bdbea2ef4cda5e6b7894a458155895
SSDEEP 192:2R0nPZNkxv7Q9PRp27Xsb+WNn7z22Z2/e85iyIsnAUgtaJ:2R0nx2hQXIXwv2u2E8
TLSH
T15E32B62EBA94743B5EDAD31AFA767753DBF1202121942E80DAFCC96C14D79CC621702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7d82e1823dcce015a949b20422b91cb47f90137602a85e0c8c5ba54dd1503468
MD5 d12c2cac6721a254261bf44d33055063
SHA1 b8726deadc74be6ddb7ffa5dcb8437b7a8754ecd
SHA512 498a70d050b7153558c7726bc4ae29f01e1f09f5b5ad445bdde922b5da36ca8ed1240bbe1ae290d5901ebecec8feb0893180efff24cf828471f1ce827cd92cd9
SSDEEP 192:2R0neIZNkxv7QwPRpd7Xsb+WNn7z2qZ2/e8biyIsnAUgraJ:2R0ne02hvX1Xwv262+e
TLSH
T1C842C72EB990683B6DDAD719F9667753DBF0202121902E84DAFCCA6C14D79CC621703B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe589c3b.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe589c3b.TMP
Size 3KB
SHA256 557414f58775aa13c7a30858cb515c702bb26ae1d22e669a71f74b687b25f808
MD5 ae2f367411273968396bc8a33e9c3611
SHA1 34fd4e1e7ac9db94f89abc44c462e19fde43722a
SHA512 c3ede4af0e5327e4b425ece77d8404831f3f2fc2ca26e95845c4141537d669f5810cc856606a2dc04a1dcb3b3ced29d075790fb9b807b81ca5ea6329f1267465
TLSH
T1F0615069C1B89DB31DF13B76752A0780FA91463F198064023ABD46CC4F73977D085F5A
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 86a708718cf15f4439caa697f6058448e2b7016cb1cef9cd2e54315587d87208
MD5 c23047ed70b8fe98404f2d539506eb71
SHA1 777411f14fab3beefe67a6f475f14f7e6e56c013
SHA512 0a47725dfc0cd3a51a0c13fc01329dccf73a0e6fe775075f027ab629f4c8fde68db8b61d4cd2ce4269a02632bafb0dcbc043ec6377186b9c4b1d39ea91b3d0ec
SSDEEP 384:8mjoj7KxkXqKf/pUZNCgVLH2HfgslTg97pLuLcSjuvXODof+ErU3i4JHGtovIld:8Goj7KxkXqKf/pUZNCgVLH2HfgsZg97V
TLSH
T1C77208676C4C9E370F94CACCD8167B4F9DB5014B65EE886483FA982903D5BDB110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 93b4f348777ae15cba64f2617d719071ab3b5a95bc82ff337a0193297c4f8866
MD5 54b662cbc90fd11b21edc60c6030299b
SHA1 2d7c1e1b6b22d710181ae67200e0f7c99a0f7374
SHA512 c10dec9990dab6fcee801c2f0ae2462f11cedcd028ebab4bb001b21a684465bf2c9ce4d94907743a4569938e8da44a6b768402c625d47ccb6a20d7b5fb9a7d34
TLSH
T198B01250C001A212C04202F41182149871189F15960E171543F4AB668825152C014160
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dc13.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dc13.TMP
Size 96B
SHA256 9a36a48dfe93568d5e35f623ea99ce9d98eccf894bcd1481a17880943eaa26c7
MD5 b0cc1185484122eb8694a202b6f8cccd
SHA1 7b404b30214dfa73dcda30fcca4e8ad59598baec
SHA512 db10105d8ce278a6ff0322c369268e450993363462a0cb119a59192f7848c38e8732f02b6c263af7f4debfaee3fe156717012cfc7c10a1039b56206bcfd6a813
TLSH
T1C1B02220C0023202C00203B02EC0ACE8B230CF20EA030202B2E00A22CC203200330020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 312KB
SHA256 11f57153db39562460f5a971fc219847e846679b401c7a76077b6500bfa50d9b
MD5 221af271a440807b870f5887918692e8
SHA1 5a312fa6be71c40d878fa27eafe274eb92e6bf2c
SHA512 ccc10764224f8538425e66974c6c487805875699fa5450eb4625c241ce3805e0e20a5faf80e7b36d7ebe12c33c9120982a8212b4868b8c0fa53c1f7299018bb4
SSDEEP 6144:JpVLY4+we/hc0cAC1iLMkqVW9F/OTa1hZJphSSdOb2Hm7Rkm1tYpBeh2BAoK:JpVj+5hbC1q0W9km/ddOb2G9oBGcAoK
TLSH
T1506423379CAA3E717E6D276C664F4D4E0FF01C639C649F8F5992670492D899C2B8C838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 75c4c8f781a26eaeb6677134d3b4255c44bfda7591952a42de90c21b200e0451
MD5 7a367b0b434d373561f7e034a83e70bd
SHA1 72bdeade1fdb0026fef041b84b9998c8bd4cb686
SHA512 d02054c7bc84ded536f6d95dfe422fa8d8817be03c3884055a591987a856590f8a6d1fe268819d08f664a4007fbc39bde2d614ea756c2be48f157a67bd8b73da
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:wm7Rkm1tYpBeh2BAoi
TLSH
T1E8C312375E70E9365979AB0EB48E0B1F2EF149A6C930DE92C8D85A0437E97CC1A45E34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 b1de52c48d1f24026129294a30dd8f721abf419e8211b7c13d3e08ebeff63fe6
MD5 a9e798b7352cf116b45eb3e5efaad90f
SHA1 94e5058a62d808193dfd2ca16b3bc2c2f0ba764b
SHA512 409261024c6a21cce7e34523c01e6a978a72ed275ebdd9a96f9449f665a7f985b11813a36a2b5dd78b29feb51c4e2c175c1c1cfce2907e1f35726a255b1d31dd
SSDEEP 6144:+IkqVW9F/OTa1hZJphSSdOb2Hm7Rkm1tYpBeh2BAoK:+J0W9km/ddOb2G9oBGcAoK
TLSH
T14F34233BACDA3EB2BE9D275D654F0D4B1EF10C12DD645EA6CCD1670463E47A80B89838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 228KB
SHA256 9a7e24fc9f7970e6e8578673d6f946d1248fdf51b1368ac9e886add160ee94b9
MD5 f14bed89a06bab18d211b0f8f8977b60
SHA1 57a6f1c91836577e8fffcfb3caa2949d14e84011
SHA512 305f2c3f6d7a2cc6114dedae9c349cad0b7636f16c76127c04e380737311b71a279797f138b1fcac18917b519632a1dbcb1a6d811453d77083e2d90b1a1acc1a
SSDEEP 6144:nIkqVW9F/OTa1hZJphSSdOb2Hm7Rkm1tYpBeh2BAoK:nJ0W9km/ddOb2G9oBGcAoK
TLSH
T11E34232BACDA3EB3BE9D275D654F0D4B1EF10C12DD645E66CCD1670463E47A80B89838
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-05-19_8e13eea8a19814572713f118fbce7cfe_cobalt-strike_elex_glassworm_hijackloader_icedid_neshta_njrat_vidar.exe
Size 5.2MB
SHA256 ba501c7298d373d6a6bd624ad2573f877713075273d09e37e402553d75da8509
MD5 f121bb75e643b4c44dbe5dea54e39487
SHA1 05be6300d96f3db303bc707859d673c8979eeee4
SHA512 0f6f5a588fda969f3989b3441bfbcbab6ebbdb8ffd3bea0637f108ac296ae65908f1ecf1acb1f724b1787087b5dd87aed2dfb6b8945ba757a53139edaed62530
SSDEEP 49152:peRJtZrZUhqBleebd1psOwwgy+VExVo5aNG89j97s5u7PaSZFTPkXG5lad3w6GDt:mcwBBhDhwd3bGD+l8VSBsP8Ul
TLSH
T127466C13F2AA41D8E06ED1B997365332B976BC554B3079EF02507B241E72EE05B38F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 a2c6a370986d0b47cb095780cf3c3cdb71dae706fd278cca67a1cc4a6e33f40d
MD5 be641df2371a8d5bab084fea83fdbb59
SHA1 369e0c5eb0faee76d6ef4414fdcf9da440f665d5
SHA512 0146ab55964ff97a2113f25a8c4e69d247670e51f6fc62dbb71cc3f90b9e4017b56977cca7e074aacffcf821fb6d310b14d7a4677861187907fe711522d2ab89
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 fcf94c735540560817d1d8ac593bf560f347cbad75f79302e07cd4b4a12fcdbe
MD5 38efd516345694556828027ffb768a8b
SHA1 2a5fd3730414ed6dbd0fc0474e541b2726c45310
SHA512 c15f8c9440f1c6b1bc98d4f8c61481874f1f1248d14cd4c8a400d3e3fb033065de6158093a18d85df95d4b86672284d82cf633a847fcf3732d7e54a3a472a317
SSDEEP 96:EaYekUrMv9Z28hK3fK3yY62R3Wr5UOhK22AK2EHYX39pJzmmv9bThK3hK3o8:75JMH83SR3CUAqHYRm8KJ8
TLSH
T18A12BFEE8E0348AF3BC28B6B334322616DE72409C7D455B23BDB9111F0CEA65151F9A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2028-230-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2028-239-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2028-240-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2028-242-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/2028-206-0x0000000000400000-0x000000000041B000-memory.dmp

Download