43702672b38b233052eacc38721b14ffd3f481075c66fc285ba7dec74cc97952

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Size 9.5MB
Sample260601-e64wzsew5q
SHA256 43702672b38b233052eacc38721b14ffd3f481075c66fc285ba7dec74cc97952
MD5 9710e0ae4fb49f5e39cf219689792e1b
SHA1 0f6dfc5169c003deb7672cfd113540cc36ca2c35
SHA512 85b35a7ce354017cd6861a7de5160e0182426dd3c2d5316bc0e0c2e5a31107bfa5778e919b04f57170bf83a73c5e7e812c3c2ee5e668274689b0c1454a8d771e
SSDEEP 98304:aCuCwCuCqtLapIxWQtZ/K0tGOFWVRuLftCT:frtr2cIxWyZ/K0ttYVAAT
TLSH
T1BAA64B23B19100B9F459D936CF16B324AA617C598FF299DFA2483AD82F725F03B34365
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4276	UpdatAuto.exe
4628	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
4840	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\kinit.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3700	sc.exe
1544	sc.exe
876	sc.exe
4328	sc.exe
4084	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1160	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134247620614097895"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
2564	chrome.exe
2564	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe
Token: SeShutdownPrivilege	4076	chrome.exe
Token: SeCreatePagefilePrivilege	4076	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
4076	chrome.exe
4076	chrome.exe
4076	chrome.exe
3776	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
4276	UpdatAuto.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 4820	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	80
PID 3416 wrote to memory of 4276	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	82
PID 4276 wrote to memory of 2380	4276	UpdatAuto.exe	83
PID 3416 wrote to memory of 4628	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	85
PID 4628 wrote to memory of 4840	4628	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe	86
PID 4628 wrote to memory of 4076	4628	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe	87
PID 4076 wrote to memory of 3356	4076	chrome.exe	88
PID 3416 wrote to memory of 3604	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	89
PID 3416 wrote to memory of 4956	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	90
PID 3416 wrote to memory of 2492	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	92
PID 3416 wrote to memory of 1724	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	94
PID 3416 wrote to memory of 2192	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	96
PID 3416 wrote to memory of 4000	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	98
PID 3416 wrote to memory of 3784	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	99
PID 3416 wrote to memory of 4084	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	101
PID 3416 wrote to memory of 4328	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	102
PID 3416 wrote to memory of 876	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	103
PID 3416 wrote to memory of 1544	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	104
PID 3416 wrote to memory of 3700	3416	2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe	105
PID 4076 wrote to memory of 1972	4076	chrome.exe	113
PID 4076 wrote to memory of 1160	4076	chrome.exe	114
PID 4076 wrote to memory of 1972	4076	chrome.exe	113
PID 4076 wrote to memory of 3116	4076	chrome.exe	116
PID 4076 wrote to memory of 3116	4076	chrome.exe	116
PID 4076 wrote to memory of 2436	4076	chrome.exe	119
PID 4076 wrote to memory of 2436	4076	chrome.exe	119
PID 4076 wrote to memory of 4572	4076	chrome.exe	118
PID 4076 wrote to memory of 4572	4076	chrome.exe	118
PID 4076 wrote to memory of 2684	4076	chrome.exe	120
PID 4076 wrote to memory of 2684	4076	chrome.exe	120
PID 2192 wrote to memory of 4512	2192	cmd.exe	121
PID 1724 wrote to memory of 4708	1724	cmd.exe	122
PID 4076 wrote to memory of 4204	4076	chrome.exe	124
PID 4076 wrote to memory of 4204	4076	chrome.exe	124
PID 4000 wrote to memory of 1628	4000	cmd.exe	123
PID 3784 wrote to memory of 1064	3784	cmd.exe	127
PID 3604 wrote to memory of 5016	3604	cmd.exe	125
PID 4956 wrote to memory of 1764	4956	cmd.exe	126
PID 4512 wrote to memory of 1072	4512	net.exe	128
PID 4708 wrote to memory of 2940	4708	net.exe	129
PID 2492 wrote to memory of 4880	2492	cmd.exe	130
PID 1628 wrote to memory of 3852	1628	net.exe	132
PID 1064 wrote to memory of 4156	1064	net.exe	133
PID 1764 wrote to memory of 1420	1764	net.exe	131
PID 5016 wrote to memory of 2104	5016	net.exe	134
PID 4880 wrote to memory of 4872	4880	net.exe	135
PID 4076 wrote to memory of 2328	4076	chrome.exe	137
PID 4076 wrote to memory of 1264	4076	chrome.exe	138
PID 1264 wrote to memory of 4176	1264	chrmstp.exe	139
PID 1264 wrote to memory of 3776	1264	chrmstp.exe	140
PID 3776 wrote to memory of 4364	3776	chrmstp.exe	141
PID 4076 wrote to memory of 4964	4076	chrome.exe	143
PID 4076 wrote to memory of 1416	4076	chrome.exe	144
PID 4076 wrote to memory of 5044	4076	chrome.exe	145
PID 4076 wrote to memory of 2564	4076	chrome.exe	146

C:\Users\Admin\AppData\Local\Temp\2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4820
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2380
- C:\Users\Admin\AppData\Local\Temp\2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
  2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Users\Admin\AppData\Local\Temp\2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x298,0x29c,0x2a0,0x274,0x2a4,0x7ff7a7bbb618,0x7ff7a7bbb628,0x7ff7a7bbb638
    3⤵
    - Executes dropped EXE
    PID:4840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc568c728,0x7ffdc568c734,0x7ffdc568c740
      4⤵
      PID:3356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,11982343365355220447,12464232623737721123,262144 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1964 /prefetch:2
      4⤵
      PID:1972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1468,i,3473253665757689529,12306255390269092262,524288 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2168 /prefetch:11
      4⤵
      System Time Discovery
      PID:1160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,10084985289468457824,182240040097216383,524288 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2568 /prefetch:13
      4⤵
      PID:3116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,12483006785570599978,15930009645626148128,2097152 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3216 /prefetch:1
      4⤵
      PID:4572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,8200263398864504781,17486092907297449570,2097152 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:2436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4448,i,15608941434236855431,4758346640926390434,2097152 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4452 /prefetch:9
      4⤵
      PID:2684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4400,i,11518088086837312747,9903922959686589474,2097152 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      PID:4204
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5484,i,2463708447762525493,76689109279006755,524288 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5488 /prefetch:14
      4⤵
      PID:2328
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1264
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7acfd55a0,0x7ff7acfd55ac,0x7ff7acfd55b8
        5⤵
        Drops file in Windows directory
        
        PID:4176
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3776
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff7acfd55a0,0x7ff7acfd55ac,0x7ff7acfd55b8
        6⤵
        Drops file in Windows directory
        
        PID:4364
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5820,i,4399065015068011972,13531402372483223070,524288 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5824 /prefetch:14
      4⤵
      PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,11919258682054386279,18248804790403480006,524288 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5888 /prefetch:14
      4⤵
      PID:1416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,9848119268121595134,2686450075725644016,524288 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5844 /prefetch:14
      4⤵
      PID:5044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4464,i,17045115908521010666,9023584875126595412,262144 --field-trial-handle=1972,i,12023192968856225391,13023820448988683840,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5832 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2564
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5016
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:2104
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1420
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1724
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4708
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:1072
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4000
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1628
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:3852
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1064
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4156
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4084
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4328
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:876
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1544
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:440

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 5.8MB
SHA256 ce9ad8b6096a02d40eba5c42844544a605e09500c93dfb1d954e320d382b9ba7
MD5 7d72e123648b0748baac2c71ea82c01d
SHA1 cbe283dbb893aca95069a05b4da1b930bad8a4c0
SHA512 ce29246ec434dfd0480c1144abfb9057c7fc068cf8658825fc199fbe1658997606ea10547e310311214564187f04f8d6beede51f14b63a8cc6d06f67f12411af
SSDEEP 49152:PabH/MYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgn:mCuCwCuCqtLapIrjo
TLSH
T1305608227151457AF808DD36CB46B328A6603C598FF289CFE2497BDC6BB61F03A35365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 6.2MB
SHA256 c591bb8d64e996b3dcc3d15f1ef45098898dffac414de562c98023c90469ab0c
MD5 1dec65e9f30aaa2d02cba21a5e43cf78
SHA1 9b314c477d968a3e9825462f5590ea5b5c7aca79
SHA512 b989f3308091cdc94b3da82fb9ebaef8b23a391db2870da66d82fc6085cd95c00f8a652ccee9f474852d78b856c142bf744bc2b7250e354b53fca4250542fbbb
SSDEEP 49152:PabH/MYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgs:mCuCwCuCqtLapIkezSC6v2XMH
TLSH
T1446618227111453AF455DC76CB46B328AA603C598FF289CFE2097BDC6BB22F07A35365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 5.9MB
SHA256 e168704dd7403dee85acaa65e120087588413d4a99348515e5df94b776414afb
MD5 d8f5e4efcc267ea61966e53212d0afb1
SHA1 b85dec25f4c1dbf736a176b56a228f6ea6b1016a
SHA512 8551c8d4cfa818d3dc3229dc900cff15e0c89fc9a33da5a4d5a6a5506020b3673cf4ceb5de09a9267a1ceb0f860466040397cc862ee47fa7a16c020231b8b3dc
SSDEEP 49152:PabH/9Yfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgW:NCuCwCuCqtLapIw/h1+
TLSH
T1DA5607227111453AF818DD36CB46B328A6603C598FF289CFE2497BDC6BB61F07A35365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 5.2MB
SHA256 1e4355c8a5bae3fd32aef3321d07bd9b66fe8c6e0b8e98431bc420ce5ab42e53
MD5 9d931bdf31d1b339102a73b2ed16f2a9
SHA1 e47060f8cdda14527d650387f26b87fed6ea1ecc
SHA512 344486fc8f70bf123387ec90c4f949e8d09231abab0f08dfd6ca10823179a2535eec00b911a195f3007cc2624322b420f883f60277f37b621a09008f1e56626f
SSDEEP 49152:PabH/7Yfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgT:XCuCwCuCqtLapI
TLSH
T1734608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 11.3MB
SHA256 7f17cb34fb58e3d99f987d124e2ee758f38ad65d17c3063f2521694e6dd32b46
MD5 b5aeeb451f885ce05d26943caa8c4eaa
SHA1 e12b1e3111af8262e87e7f1da87a6b0d2edafb3a
SHA512 3cb0cec6345c44afe00faca2186b757dcad545a3fdb00b5510b5d00abf275c52149fac01017e2a0e214d1be107c69c67666f09bf99222a130732db2e1a47fcea
SSDEEP 98304:fCuCwCuCqtLapItQRQyi36YOcP+Lvw2gAf+PN34:Krtr2cIEQyiKaUX+PNo
TLSH
T19DC66C13B26100B9F459DD75CF2A7325A6607C5A8FF186DFA1483AD92B729F03B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 6.9MB
SHA256 5aea8d0d9c2c2f1845d3b645b7361abff572fca759c6c35df5e906ac2121e358
MD5 04e88c13b8190d338a29ad828e89a4f6
SHA1 753d0dacc86451b49e1790e3beba8caff69ef345
SHA512 f49a11918c046ffc8b0302e38714dbdfaa2ea155a0b8539ec25fe7106364e7b1446d0f5f3c4426cba4885a3d3a250cd966fa5f5bc5a1c7d81437bf595fa508b4
SSDEEP 49152:PabH/UYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgl:eCuCwCuCqtLapI0thHRc/Q
TLSH
T11476092271910479F448DD36CB06B328A6903C698FF28ADFD2097ADD6BB65F03B35359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 8.7MB
SHA256 f7d33393770f0887534b132aca3b5aef9096bb2353041db135ebe478eb6ad65b
MD5 ad945c94d62715c69d9ab88f7bbf7a99
SHA1 5e26cdbdbfab24f3c00477da0fd5c073868da6f5
SHA512 a7bb01c446b43aea2c8c2a57f05d11047c315192b7a281e3bc71e6bf54adab298586e1a900a1a02333aefd8fdfd76cf9312d0353e75df9e83460c138347cbcce
SSDEEP 98304:fCuCwCuCqtLapIry5112gYy5azzVvf69nLKnhZO:Krtr2cIGLIHuWhs
TLSH
T11C964B23B15100B9F408DD76CB0AB325A6607C558FF29ACF96487BD92BB66F03B39315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 7.5MB
SHA256 f65a7aec86fc2fd6c34a4ad8fe0023ff50eeda3cfb103025950808155aba5e7b
MD5 cb2079b6e7dc3f2942af2e1eba026fd5
SHA1 fce8760ff4bef3001c3dcdcebe425f630f539a86
SHA512 4715db5bae127492107839f2836e1326721fd30f4809e243c50e63d581fa1c45a7f26379748d7c1dbb06e27cd176c44f36dca755abc16e59ff731c1e22537757
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgl:fCuCwCuCqtLapIFu6Jm0xd2d3
TLSH
T168863A22B15100B9F408DD36CB0AB329A6607C598FF299DFD2487ADD2BB65F03B39355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 6.9MB
SHA256 8596ffa3cf33f376f3975b6e959d17d21ba527132860a19e2ef8edb940ea0f8b
MD5 e5cebfc4e018ffc94c4d2725c087733b
SHA1 5fdb89faa2c9f2962a035cc8d9823b322b50c8f3
SHA512 a837eae06dfab0c8b35fba6406696456c7e790b2fe32a1f71532d0121972076b01906391b7f97f1d08053b16e9e429aec15b348dd390eddf474b2a0191dda48f
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIg+:fCuCwCuCqtLapILmifP5R7
TLSH
T1AF76292271510479F408DD36CB0AB328A6603C598FF29ADFE2487ADD6BB66F03B35355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 7.1MB
SHA256 a6fc15fa292af7cd057b5b0d0550e835116a530b861473b0c503260b33f1404f
MD5 811015ecccee50ebcfd507c98ffabc8f
SHA1 47b8ca62a30c44c888b91d820114d44cfb987508
SHA512 7efacb81e938cf0636e866b7363126826c5e60f0ac308a68a7fdb363ffee55d0b5604dfd174c79aca9e9babbd3309621412a9e5acf06445185292e8c4db4fa66
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgC:fCuCwCuCqtLapIY5dKCi616
TLSH
T11E76392271510079F459DD32CB1AB328A6607C598FF289CFD2483ADD6BB66F03B39365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 6.7MB
SHA256 a6b082743b322acaf309e5068248e273979d642c3598a244d2b90114d81870a1
MD5 a7125aeee494c0e81b118c4987b66e62
SHA1 fa0ab0dc5d9113eca729bd14c637cc9f841bdef1
SHA512 a8b9769cb430606430e5bccf2393555a6c1d0707f767b99e3bea33471e891df20ff5d023af527221e1bef096cee18143d4c267865da133d6d20c96f85caf9a1e
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgN:fCuCwCuCqtLapIFX2iwphX
TLSH
T12B66292271510479F408DD36CB0AB328A6607C598FF28ADFE2487ADD6BB66F03B35355
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 5.3MB
SHA256 9bad9a0aae54e3967740f5f8b539f8089f9705429c7561b591bd6a84e9e98a8a
MD5 7f92a0bfe47a8aae56ff1a6c10ed7ac3
SHA1 74044436bcee5638fdec1d66439e2e6821ced170
SHA512 c2dff51393dc16d346197d6b6e04b149128a6cac976c3b6d89c01b2f42443f5e556d128cb33848c43fcd837dec9449c0bbd3726448447af8a20ce5381e41a63b
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgl:fCuCwCuCqtLapII
TLSH
T1774608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 5.3MB
SHA256 371421a33d0950c9da15a7fcea8b4f834a4a13f03d2f32a9d8b6c65bd346c1c5
MD5 b064448d396945f12ea598395d5c66f4
SHA1 8cf98820fd383a112e3e2f253303623bd1418eae
SHA512 ab4784f35b81ad8cd20dee64b81594bebdedd5ebff8f94694e14a6215ce40af5a77f510314f5ee0b970836630cff47b2b7b10637dca26313d683d2ddcc2afff0
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgJ:fCuCwCuCqtLapIQ
TLSH
T1C24608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 5.3MB
SHA256 a52867afbad9e7288f407099a54b3e9fc4d4ff43c060244c6ea3ba34204f87a8
MD5 28b5e74a04b826779e45c847832a0a6e
SHA1 f6ec2b209486f5d6f48c48865a71fd2ec298e2e7
SHA512 157d6b076278636819e02d89fed53c1f33c10ffc680921854f59e466ca73241ba5cdfee1d65c2a058424685aa947fa58a1ed00df89061be2900be365d78672e2
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgq:fCuCwCuCqtLapIb
TLSH
T1964608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 5.4MB
SHA256 c531e12e6430be91dd66efb7859f2782472c300d6735c106fbb2d3e84651e171
MD5 6f3a9f80b35504276cd384ba180881bf
SHA1 fb87195fb8ad1af5343bdbecac496dbb3bf55e3b
SHA512 77a4c94ac585fbade0852f6fff24cb0e77d19346dbfae82ada233cdded2d2ea8e565b260ed03d48152b0592303fef1b5c7453573d049f5d99605ea725bbcb792
SSDEEP 49152:PabH/MYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgh:mCuCwCuCqtLapI0
TLSH
T1AF46F8227151057AF808DD32CB06B328B6503C598FF2899FE2497AED6BB61F03B75356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 5.3MB
SHA256 7f47f61fe233772c8891760f1e81cb1852b7a490108c103b0620ae5e03c1d5ae
MD5 1d835307abddcf2b514f3758725550f6
SHA1 8419d7d2f3976c47d0353c26683a5b6bd631cb2f
SHA512 adb0e3f6c203ded40d36e4960e9893a45b829c51afe33811d3080fbb496a6d609e28f49a0a4045e0e527c945fe5738ff68fb124015b9639cbacaa3746467f768
SSDEEP 49152:PabH/AYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgV:KCuCwCuCqtLapIE
TLSH
T10E4608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD6BB61F03F75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 5.3MB
SHA256 5aef9632894ca32a56a41062fbd0604cd37cd778f839f34adf6525ed90f8c94f
MD5 ab7a4566c44bf5a15b2fd39943706b3c
SHA1 77945ba6ca4a65df55a5082b8f5400b408a7c1fd
SHA512 76fbe17357f9e19bbc50798ecd6d9a9f811544a2ee32bc5071287ed762131bb890d9fccb9024054276e01e7454b632ae61627874154372f2584f18ca7fadb6ce
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIg7:fCuCwCuCqtLapIwj
TLSH
T1D34608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD6BB61F03F75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 5.3MB
SHA256 7fe38f2f22e2e19712610b463a84176e8615088ad8cf9dd78e00f5eca137ed14
MD5 fec1544fa87efe8eb6674b18bee63a70
SHA1 954d36b40769912387d2290abd4b8d1af9fd1f59
SHA512 b98a6f9f6af25b2503b3965964655657df25d00d8499de63b0716c99eb85847e00f4ec3f94fdc030c704e41c960d69cd094c4d57a751cf79222eb4bce5096f76
SSDEEP 49152:PabH/UYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIg1:eCuCwCuCqtLapIiD
TLSH
T1BF4608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD6BB61F03F75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e478499-fc10-49de-a26b-4b5cd29a04b8.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\1e478499-fc10-49de-a26b-4b5cd29a04b8.tmp
Size 232KB
SHA256 da32eb2b26c5b4dcfc5fb45003c9deb158ed2dbdb43b942f7bf937b3d8621dd7
MD5 d1acedae1419689966c14962aea471fd
SHA1 e897a5f97fe0ba59e36a14c00e411c363df8fe1f
SHA512 4bcf5e7ee72fe5239ca30f254af7b362d7f4de388db6c6b2004741a8819c240ad46341a6d4952b48ba49c7486f56e467275fe087c2732a54f0064d0598ab122c
SSDEEP 6144:1VFm4vCuuwbzIUqSs1qKUwCcmXKegIh6jh9Jvexh9:12zwbzIUfIUwCHHgVUx7
TLSH
T159341369B99F3DE584FC28F271573282568193C20E11BD4E84CA8F4B5AEEDA44EDFC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 1e4f54776b1b40b456dd805327615b3c5deffcf2db33e589d5bc6b52bbcd1933
MD5 56b10e1e74b6706b57dde96bf766dbf9
SHA1 56a34e375e70b12c244295648d6e0641f33011f6
SHA512 cf469396d294424e4fef7dd376eea71d95d97f34c8e8a07031474ca3189e64ade1b89bd27e7df381f2778fea721f119ccd253914777f827b6f0f4644ac130a61
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 45ce2d3b2c5ee309f155233ed9bc400b2a3bc7d1be231fcf50a19358035466dd
MD5 62dc3647642579d4cbf9cce7fd77a8b0
SHA1 cf9765dd3eb55a5a7a3fd1d3789fa2cd62981d5f
SHA512 542208ea85eb3316e13b86058deac4d2b50bfa0de899a81fa993045bc57891b51eb496652f1d13ca43fe281dc73257f010d9296048ddba11892d0efa39b7edcf
TLSH
T156F0D1A6CD21AC3718FD1B2C21641B46F760136B2B80499F3A3D920D8FB567B468586C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 b5e703e37d4d72501c402246c1a087dbe2579d75ac4d040baa6e0d6508a2c84f
MD5 b1699df648d52c5fd4020de2efdb54ac
SHA1 dc49fa802d0d28af768ea44523e9ca1c5a52d6e6
SHA512 9a84c511e2550e5db681e814c4ba10890899b12a9112a46e7e2727c5d6c35a8d9d945a0726ad293d8232e50165186a7add7ea118d2e536d5afc3a2ebaab4f9bb
TLSH
T15C516AF7C3D88A6D891192F4AB25AE1FCE290E54532D3C56C8D4AF4F53E2872D21068E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 1ff308e125f4ea630c7bb6940dbdcad48560fdb149fd1a10a6eb839b8448295c
MD5 e66a37f8a121fbeeccc683b9af13c55a
SHA1 126d89410b8a6c87d5f5e2b09421e60e7bd4c3f7
SHA512 e3bac5b4b80137938b992805920955343b08e8ccc5467c88fdc4a48a0a38f3332c40834a130f5d8ca8738d6ff11755d7e5a40fd3580775921574dc97ced1f143
SSDEEP 192:2RDajprmkv7e0LXPRp+5SXsb+WNnbA2FeIea2KwxiyIsnAUgraJ:2RDaN6A/zXXXw82Fb2se
TLSH
T14C42B62EAE18797B6CCAE61DFA657753D3F5102121902D80E6FC9B6C29DB5CC232701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c36d2b1a5b258ffdcd6394604eb863ce04c8f3d574f771268a8e7fb65bea4c51
MD5 31058496edb273b8cd629201a1ec0c90
SHA1 e5232a9963cf478f843930e235863d733131d245
SHA512 0c3d7b2d56bb2411c92813a8d0c9cc87a0f4e36835ab11259416f1b04334e87fd963bf9b3f4182ac141a978f0b4019123f612f39b74708dd9c18631ba601511e
SSDEEP 192:2RDajprmkv7e0L9PRp25SXsb+WNnbA2AeIea2Kw7iyIsnAUgtaJ:2RDaN6A/5XfXw82Ab2u8
TLSH
T11F32B72EAE18797B2CCBE21DFA657653D3F5102171942D80E6F897AC28DB5CC232741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f5a6.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58f5a6.TMP
Size 3KB
SHA256 c87b85b1eb5f90a885455c240e4ed0dfea3649c7c123f27a593ac609d0003f10
MD5 168c2ead4726dc01bfffdbb6f4e7e74e
SHA1 f7b55e9b4355a87efc64cbbe04dcecce676dc5db
SHA512 2ca247259532a2f86fc0b149765f9386c60d7eaa09591d1d87dfd9cdbff34690e2bfb158fdbf6c2d33d96e2f467794484558e079d012afe38639d0b409a7a189
TLSH
T1AC61502AD0A55D271DB13720B93A0782FF66527F59401C0B3E7D858C4FB296B8181F69
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 87abfd6483e055ddeb2f8fc2f483f91af443de3130ad7f6cceeeecc94a6c2511
MD5 04c2655e775a571e3b09dcdcd782d924
SHA1 84dda5dbd4088a2a3591384e8279d568339c383c
SHA512 38ea57f7244c49bbd8e846e3f0d5342b6c186f24c011ef661cc6a4f6836da0e0f816f76146075af79a69abcd50476432db60bf14c0daf6c81fe144ac588ce833
SSDEEP 384:fFjLm7KxkXqKf/pUZNCgVLH2Hfgsl+27pLuLcSjBsXODLi+ErU3ZSHG7Ep83wCv:fVLm7KxkXqKf/pUZNCgVLH2Hfgs427p+
TLSH
T18C7208676C4C9E370F94D6C8D8267B4FADB5024B65DD886493FA982903D4BCF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7d341a9c94383b4d587a605f943cc694b8064e5e2f2cab6607f1a712e9d6d994
MD5 d240a148ddcc120fda12800d7e0d1f6a
SHA1 b1955c82e26d0f50930586dada12dee5f12ba4e8
SHA512 a215ea84cda8c16d460df79e4f2c24eb474313cc2b37c53df8e1b7696fa5408af731b8c69fb9a84173765667185e4d395af6b8a687120686fe21bf5bf9de6f00
TLSH
T10DB01240D4116201C01B03FC5747249871149F22FA0F170243E06D22C835191C0140E1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592418.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592418.TMP
Size 96B
SHA256 f61489d7b152e912bbbd53ab1f0ecc9b1aae52eeb9c04374dae8c1ca3364bab7
MD5 a815894bd5300732a88c791561b2851a
SHA1 eaa1cdba81fdd86eb51fbb63c26195a5de04f4d8
SHA512 d4a00583126bba6c78a2d6accb529d3d27d55cf7aa6025a5b9339f1b81e21e8c646ede5ce28fad6be699f328900e22313b6abc70959d9690517cff4ced948ec2
TLSH
T198B02228C0022202C03203B028EA80E83020EF2AEAC3030282E08A23CC382202E20020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 af1796d4db2dfeb2ccaecb810ee6d69cd6bdd32749c10aa9e9737d5f71936245
MD5 2a8eb0269df1a66da5d0335f3b7abb72
SHA1 2386a6b75e3d53cf85f2a8ab06551a0ebd81e883
SHA512 6e914d57a747f87af4af18db0ce763f5ba8e4455af07301da3aa06df74049fad7d12f8dfad3b7af1eb0c6fbe365f03c9529fc0ffa09d71cdda73bbfd6521caf2
SSDEEP 6144:IVFm4vCuuwbzIUqSs1qKUwCcmXKegIh6jh9Jvexh9:I2zwbzIUfIUwCHHgVUx7
TLSH
T17C341369B99F3DE584FC28F271573282568193C20E11BD4E84CA8F4B59EEDA44EDFC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 ae182d5ff22d2a17d32ad3bc67f6338d80730bc2b516cecb4a249ea68588d639
MD5 5df5477997b2b3c463f959090aee866d
SHA1 029811116c6056b8c5d493df5c081bdd97a1ae7d
SHA512 2bd3454e5ae8da67c5a6a69bcd2452e94eeebe76b0f9594122df4f52336678f72a3c760d20365329654a754c3bed6d4589e27da4851e81d002e30d17e8f909e5
SSDEEP 6144:+VFm4vCuuwbzIUqSs1qKUwCcmXKegIh6jh9Jvexh9:+2zwbzIUfIUwCHHgVUx7
TLSH
T1BC341379B99F2DD944BC28B2315332824D81D3C30E15BD4E84CA8F479ADE9E88E9FC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 233KB
SHA256 384383d43a70eca5a41f5966bcf7d725608d91c00d16e76fdb3a1103c6874268
MD5 32369f71b76badae4bd8f906d79b05c4
SHA1 47c433dcf30389518c818c8d86c0e92092139259
SHA512 c498cc154167bdb0040b9df6e5da82e131b1f489fa7798daadecfd519c3315eebe55a4a13ddd5f7ac385fc0bf3947bf49e7d76a8c5f008f36bb2fde7b5e4f96f
SSDEEP 6144:KVFm4vCuuwbzIUqSs1qKUwCcmXKegIh6jh9Jvexh9:K2zwbzIUfIUwCHHgVUx7
TLSH
T15F341379B99F3DD944BC28B2314332824D9193D30E15BD4E84CA8F479ADE9A88E9FC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 a7eda7d89cb1ad563d6e0575b03fdb250fe1852fff361272954d344b875db4fb
MD5 fd649d656defd49b31801fda451fd1b1
SHA1 2edda47cf7aacc6a722506a1103ba8c00e524683
SHA512 83eea1b807f4826618b0454b1a34c4e04b9dbb62c438b8887316f1d4f0b69901d9be6b6f23ab63b1356e54aa96dfe64c1032b7faff049548629b093fced420df
SSDEEP 3072:e8uwLcXcgVXruSixWgL0rF6jh9JDvexqw/w5nP:owCcmXKegIh6jh9JvexhQ
TLSH
T19AB3125A28273DA68CBC6EB37457338286A357A26C05F14E90CCDF0B45DDDB415EB8B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-06-01_9710e0ae4fb49f5e39cf219689792e1b_cobalt-strike_elex_hijackloader_icedid_njrat_redline-stealer_rhadamanthys_vidar~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 5.2MB
SHA256 43499a033ce17e9301a7fe0908fdb938b8fef92665e0cf918a2fa3ef88323b5a
MD5 1297a18393a96db652b52e83f5a1b17a
SHA1 0b90f5af49dcfa1ad42e43424bccb8721af309ff
SHA512 5c2c6994852175cad06639c35f921b03f1e687722350af116293182a6ee7b98b1b4ee3602a81ce4586d7578dbc85a5d35ad3ae6be1ff649d97a48b285a33cbd7
SSDEEP 49152:PabH/QYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:aCuCwCuCqtLapI2
TLSH
T1F94608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 1a72bf137bb3ac525baf8770182676633b898a71052d3b4cc8dfa6989cd03794
MD5 afb41ae3b7ecd58f71553cdf6abdc2df
SHA1 85da19560e07047fdded7e417328ae556905ac2d
SHA512 6afa7806fcfc174c79dec4a3e11c7b3c98d58985be81aa89a3595d8aa08937ed3ff73fd21e8e17852a76a33fbf276d4297dfea5477cc786b247677f40f5e6737
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 8KB
SHA256 63b16b94480df34e8b2bc84677c22b7d3095ae51a955a05f289aae80733f35a6
MD5 5911e9caf9dd198600a04f45b3edc2d6
SHA1 156d8c3901570530c8055d3176b5c51e52ab075a
SHA512 5fb1f9720f4d17b1a1a78db18726efae0835e712eac1ff6cdf94b200657ec40d8211ffbc64e5ae86029ba0f7a79cc64d2a0351559f62632e80d7363b6e703148
SSDEEP 96:kaglb4qaJmxXp0WhK3dK3Q63aLo3x0GhK2/K26EhZz274zebMRddhK3rK3q30:bganm/axnLktc/4ze04TE
TLSH
T13212D29A5F02487F3B818F6B334722746EAB250AC7D855723BEF9115F0CAA65041FDA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 29f28f3e904fe3ee5130e9f7a3393ebf17f6ff8b8403551b935df6e661fe8e51
MD5 5f6d15fe2a826fdf086fdb16307aa85a
SHA1 e28039d82e94ec391da939079b2a28b19c46cddf
SHA512 bede6517e779ba54afa8ce1cf4867b6cc6d5e14172a9adf6ff9a41b977e7d5f3ddec4a51b8aab7a2aa9744d0a802a16cfb86502fa0bc8e129ba9b730db9a1acb
SSDEEP 49152:PabH/MYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:mCuCwCuCqtLapI2
TLSH
T1924608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 1d420f892c6554ec25cc1b94faef9acff1d097cc97bb4fe61472d40627827712
MD5 536085ac3f1d44965fe754182cfbab36
SHA1 635f1f29609f03db9e352974efd327894528b7c4
SHA512 cf3ae17bc13dcd265bc833d1c4cf43202653cc5b0fdc681dd450301d27c16dc44e49f94f7ef31d56635e10df9897fb208fd9bfa7361cceb19d90eb0a185eb8cd
SSDEEP 49152:PabH/9Yfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:NCuCwCuCqtLapI2
TLSH
T1444608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 dc2eaf1998847f18023367b9066d05ad553fa9a4d38191279128ae27f525c31a
MD5 1e263ba4dbd3394d229d6b80815158d3
SHA1 ac0a7982913c40e4c24eab84fc3b6131edf8619b
SHA512 431960daa0dcbe55f705664627e98bd9716b7b9229a3b09dfedf6da139a04da4bebe7912b6ac6bd7888184f21e0df8772fe61388119ac4f5c04f439e0ef50b6c
SSDEEP 49152:PabH/7Yfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:XCuCwCuCqtLapI2
TLSH
T1D14608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 cc6fa96baf03b8cbb11f4d27dfa26faf071b5a3471cebda06e4475e84c1f89b9
MD5 ff63ff9ddf41b25cc78f3c509b608e1c
SHA1 f35c6fbf006bd8e0d758d5c7c1fbebd06a3cdad4
SHA512 58558e3e46eee110a376db68b9f17dc22731b3d4f927447d50d167f1d9bb20c123ead65278cdb4ac9c6393b39ce2419b5a4ac246360cac5b14fe4110fe9576eb
SSDEEP 49152:PabH/UYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:eCuCwCuCqtLapI2
TLSH
T18C4608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 21c6679557acd25f74ca932df37b2687c1458b7c729b5d6f0871f049d0b0f1b0
MD5 a8afe0b39e7ad6760073ee0378f18688
SHA1 a5c375ae50d38f3ebfe5c8ccb8ff2662b196bf5b
SHA512 e1304dcd985dda4eae2aa955194eafc0bf1bd36149f4e2d255f4bd006e8fd80d5061fb4aaf57bba46300531087464786a1b0162dbeb21a943242d57d1cccbcf8
SSDEEP 49152:PabH/AYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:KCuCwCuCqtLapI2
TLSH
T1C24608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 76669d9932d7377dd8e8b5edca0277ac1113f3fce5d5364afcadd9aa4d79d697
MD5 caaea02fd42a49e47f00e1cf7c1ada8a
SHA1 4373bc5644a3e2ad51790a99b19ad346f6383783
SHA512 e22d91236506e32fc1c157e85b7a3407b005aacd2885722fe72a0dcdf03ae69126714a188f1ab1ef5255172844132ef62a54b8dbcb299e112548f0fed864781a
SSDEEP 49152:PabH/UYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:eCuCwCuCqtLapI2
TLSH
T19A4608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 9d4c9858efb9d4e38e69f0e1af4a27c9abd38bfc031c8e2bd770803d777e4e33
MD5 cd64da1497ff67e95a506399bc30ef90
SHA1 286f2867f162fce084d49d77ca51434cf8ac0a09
SHA512 af3b576aa9d60ed0414ccc84e752408459692acb0a8dfc605778ae607e6bb7508709a5e9e578ae79085793d422aea28a81925f18a288adef1d1bb7f76637c78c
SSDEEP 49152:PabH/zYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:fCuCwCuCqtLapI2
TLSH
T1AA4608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 d00947608e11829e5d4a0ec467920dc67c1fe55483423cff10e9d8f0b978d10e
MD5 cbd07c6e80f1f439d91544f854537b63
SHA1 431b86e7c2c4e221b200e1eeaf2eaba17abb924c
SHA512 e2f8f81f40027bbed856fb0121afddf936a31b8e261e4c1f7f436571bee881e26ad6161b0a15b6fd1e0044e3a0f6d961c1cdbe90bc93b6d8aa7b33865499e4b1
SSDEEP 49152:PabH/DYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:vCuCwCuCqtLapI2
TLSH
T1194608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 5.2MB
SHA256 c62971fc0c39c486924e1ad14c419f25f80ccc765a6dab2163a71ada449e5b8f
MD5 f6042d3f56659ef574ed396fa9ee8f69
SHA1 18dd64f1ee6fa88fc470c97d9b377b2209d540b6
SHA512 a664078f6652fc67de4c4fc0fb916c05ae573a473f614b89e6e7d6b35be44fb10c268dc2fef95a8a5f21149adafe1de018515c83aec7bffc73d3b73f17f045a9
SSDEEP 49152:PabH/MYfk5fuvabH/tYfk5fuWabH/iYfk5fuvabH/tYfk5fuxjgjI45TMwwapIgR:mCuCwCuCqtLapI2
TLSH
T19C4608227151457AF808DD32CB0AB328A6503C598FF2899FE2493ADD7BB61F03B75365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download