014782c01993f6abdd0eed17463eb2056d49cf9ecdf3acf28571811b6db8a14c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Size 6.2MB
Sample260723-hlps4sshme
SHA256 014782c01993f6abdd0eed17463eb2056d49cf9ecdf3acf28571811b6db8a14c
MD5 90cedb5499c6a453d9971d6ffff0f282
SHA1 f2236b55daa5468a0a1228d70b01719e690326b4
SHA512 6ec79b47f17b44448bdf8a2af314553adb76afb291a54702924578f7e005557ca3f6ae881a0a31f7ec641b0891f6ee9be66196f8848e8568eb93672a96b963b5
SSDEEP 49152:wabH/dkmI1zgjI45TMwwapIgTN/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uOS:LI19LapIxWQtZ/K0tGOFWVRuLftCT
TLSH
T124666B13F2E500A9E19AD174DF2583319BA27C698BF1A6EF314072D52F72AD07B38716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4948	UpdatAuto.exe
4600	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
2296	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\SendSet.doc	UpdatAuto.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3156	sc.exe
1116	sc.exe
1592	sc.exe
2856	sc.exe
4432	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2308	cmd.exe
1088	cmd.exe
2472	cmd.exe
3672	cmd.exe
3724	cmd.exe
4220	cmd.exe
436	cmd.exe
4576	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4724	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292629953550211"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
892	chrome.exe
3784	chrome.exe
3784	chrome.exe
2200	chrome.exe
2200	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe
Token: SeShutdownPrivilege	3784	chrome.exe
Token: SeCreatePagefilePrivilege	3784	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3784	chrome.exe
3784	chrome.exe
3784	chrome.exe
2980	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
4948	UpdatAuto.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4576	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	87
PID 4652 wrote to memory of 4948	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	89
PID 4948 wrote to memory of 2308	4948	UpdatAuto.exe	90
PID 4652 wrote to memory of 4600	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	92
PID 4600 wrote to memory of 2296	4600	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe	93
PID 4600 wrote to memory of 3784	4600	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe	94
PID 4652 wrote to memory of 1504	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	95
PID 4652 wrote to memory of 436	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	96
PID 4652 wrote to memory of 4220	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	97
PID 4652 wrote to memory of 3724	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	98
PID 4652 wrote to memory of 3672	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	99
PID 4652 wrote to memory of 2472	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	100
PID 4652 wrote to memory of 1088	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	101
PID 3784 wrote to memory of 892	3784	chrome.exe	102
PID 4652 wrote to memory of 1592	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	103
PID 4652 wrote to memory of 2856	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	104
PID 4652 wrote to memory of 1116	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	106
PID 4652 wrote to memory of 3156	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	107
PID 4652 wrote to memory of 4432	4652	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	108
PID 2472 wrote to memory of 4288	2472	cmd.exe	120
PID 1504 wrote to memory of 4524	1504	cmd.exe	121
PID 1088 wrote to memory of 2640	1088	cmd.exe	122
PID 4288 wrote to memory of 1696	4288	net.exe	123
PID 4524 wrote to memory of 1432	4524	net.exe	124
PID 2640 wrote to memory of 2572	2640	net.exe	125
PID 3784 wrote to memory of 4724	3784	chrome.exe	126
PID 3784 wrote to memory of 4508	3784	chrome.exe	127
PID 3784 wrote to memory of 4508	3784	chrome.exe	127
PID 3784 wrote to memory of 2752	3784	chrome.exe	128
PID 3784 wrote to memory of 2752	3784	chrome.exe	128
PID 3784 wrote to memory of 1792	3784	chrome.exe	130
PID 3784 wrote to memory of 4068	3784	chrome.exe	131
PID 3784 wrote to memory of 1792	3784	chrome.exe	130
PID 3784 wrote to memory of 4068	3784	chrome.exe	131
PID 3784 wrote to memory of 4964	3784	chrome.exe	132
PID 3784 wrote to memory of 4964	3784	chrome.exe	132
PID 3672 wrote to memory of 2228	3672	cmd.exe	133
PID 436 wrote to memory of 1736	436	cmd.exe	134
PID 4220 wrote to memory of 916	4220	cmd.exe	135
PID 1736 wrote to memory of 2980	1736	net.exe	148
PID 3724 wrote to memory of 944	3724	cmd.exe	137
PID 2228 wrote to memory of 3384	2228	net.exe	138
PID 3784 wrote to memory of 4560	3784	chrome.exe	139
PID 3784 wrote to memory of 4560	3784	chrome.exe	139
PID 944 wrote to memory of 2428	944	net.exe	140
PID 916 wrote to memory of 2708	916	net.exe	149
PID 3784 wrote to memory of 4172	3784	chrome.exe	143
PID 3784 wrote to memory of 4428	3784	chrome.exe	144
PID 4172 wrote to memory of 2608	4172	chrmstp.exe	147
PID 4172 wrote to memory of 2980	4172	chrmstp.exe	148
PID 2980 wrote to memory of 2708	2980	chrmstp.exe	149
PID 3784 wrote to memory of 3488	3784	chrome.exe	151
PID 3784 wrote to memory of 3992	3784	chrome.exe	152
PID 3784 wrote to memory of 1652	3784	chrome.exe	153
PID 892 wrote to memory of 840	892	chrome.exe	160
PID 3784 wrote to memory of 2200	3784	chrome.exe	162

C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4576
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2308
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
  2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff61a63b618,0x7ff61a63b628,0x7ff61a63b638
    3⤵
    - Executes dropped EXE
    PID:2296
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffefcc7c728,0x7ffefcc7c734,0x7ffefcc7c740
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:892
    - - C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 892 -s 580
        5⤵
        
        PID:840
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2000,i,12554080362084816181,8008921574517520047,524288 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:3
      4⤵
      System Time Discovery
      PID:4724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,2675305747240555370,13796432094894315698,262144 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:4508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,15930553863973351145,4065705213955792944,524288 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:8
      4⤵
      PID:2752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3144,i,3089425339419456649,412506327191774721,2097152 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3212 /prefetch:1
      4⤵
      PID:1792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3148,i,12657826045433560102,17489250400225989111,2097152 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:4068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4228,i,12631834357228400867,16228448805012859150,2097152 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4232 /prefetch:2
      4⤵
      PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4432,i,9650335688249911560,2366771199924012296,2097152 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      PID:4560
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4172
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7348655a0,0x7ff7348655ac,0x7ff7348655b8
        5⤵
        Drops file in Program Files directory
        
        PID:2608
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2980
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x270,0x274,0x278,0x24c,0x22c,0x7ff7348655a0,0x7ff7348655ac,0x7ff7348655b8
        6⤵
        Drops file in Program Files directory
        
        PID:2708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5532,i,14076689918786171674,6493560138121292335,524288 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5580 /prefetch:8
      4⤵
      PID:4428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,18103869934980824748,6366190877585396890,524288 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5688 /prefetch:8
      4⤵
      PID:3488
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,7214802737789878851,18143461471263997682,524288 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5676 /prefetch:8
      4⤵
      PID:3992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,2869291778923047329,8515192432012761954,524288 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:8
      4⤵
      PID:1652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3324,i,4230520718492687246,13842458262946892041,262144 --field-trial-handle=2088,i,14564397403232319005,10892576753782999909,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3328 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2200
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4524
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1432
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:436
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:2980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:916
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2708
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2428
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:3384
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2472
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4288
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:1696
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1088
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2572
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1592
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2856
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1116
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3156
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4432

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.5MB
SHA256 6019b553439ca5708a5d800cca5b3f4b64aee4a6fa8b308c3b60054e32ddb2f7
MD5 2e57f11ef6be3e223842e0e22ef9a9af
SHA1 fca9280f2db9e3f6fbbbb84bf5fcdc9d2c9950a6
SHA512 2a071c8cdd28c8adc0b065ccc2bf0ad1945e0eeb65cc18bb12710776fe00e29f0510119cfc44d1488e5119cca2c8ee3084cac1c2e863bdbc598b9e4b9d7058d2
SSDEEP 49152:wabH/ZkmI1zgjI45TMwwapIgTIPji0Aj:fI19LapIrjo
TLSH
T1FDC52922B1F20065C19AC071CF56862597E13C798FF1C7EBB245B2D92F726D07A3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.9MB
SHA256 c5d21c20886169f6f455855beac1b5db93bc8282549b800de1552f7aa2dbbc3e
MD5 8c264754c900699f0af8bbfe136d9317
SHA1 0e5e866f0d774e22b723e0563657ef11cc0e99e5
SHA512 11f3c0f84d9654189d76c92b0c316ccf5c2e9b2997d171eab46fa81011fb664b333b8a5f6fa6f6aa19471bc721a8e6732f0cc6842840337a3feb5f90bc2a979e
SSDEEP 49152:wabH/ZkmI1zgjI45TMwwapIgTr/ezSC6vUzPvMHjy:fI19LapIkezSC6v2XMH
TLSH
T1EBE53A22B1F14166C1AAC075CF969625EBE13C698FF086EB7205B3D82F336D0763571A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.6MB
SHA256 e6c820837bf157a378e63600fd6a9b61a8d555048ff1b6c66f5647550741e0ed
MD5 264dcea50371b983e06970041cab996d
SHA1 6d79601a15a0b7ae734659658f465fa8bc09b26e
SHA512 796356e72875690a2dde0b018ced389183f0dfbac114c570cd252d945a4e87e984314af53e1723fc5a102e5427c8737329b3091386dcad49879ee11a9f9e163f
SSDEEP 49152:wabH/8kmI1zgjI45TMwwapIgTkVO88hXl+:wI19LapIw/h1+
TLSH
T1CAD52922B1F14065D1AAC071CF52862597E23C698FF1C7EBB245B3C92F726D0763A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.0MB
SHA256 c2c275c0c40241ff652c6ea4765442831881dcd1bfae91d70105927b2fc7b919
MD5 85f3e4c137bc9700d4a052f1aef4097f
SHA1 6ce57a628a999eadd39a30a1d6696260f0ad86b4
SHA512 e3084b30784799ec3aab2b49a475593966296b2f3645b388b88cff46f7732334580c2ec098916f1905cf0fc9c6482503c92572eca2b7e42ea1ecc9bb06f2a0b6
SSDEEP 24576:w4R5CIH/7Ok20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJ6a:wabH/qkmI1zgjI45TMwwapIgT
TLSH
T1D795F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 e2fbd63c02b5359c151edbd45b5dbdb2570dae63d3e383f72e5370d493ca4059
MD5 707288ea22fe5427c640129deb8effce
SHA1 9098d4ea544e5e33feb3a5d6eda201db7091dcf5
SHA512 23c7a7f635b642b4f2e8db1444812e6b8016b0d5b968b9cf03f912cdefa6812f690a3b0251fd73bb57ef1d7d43bee87181a3bbd0cac85f38fe2f9d859bfeaa55
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 8.0MB
SHA256 5131179998b395dd586398dcf8c255b56ee4ce4cfeb6b39c239eca82d6d7fb99
MD5 77253aaf72360bcaf56ddc8190c84711
SHA1 bc5fb6943d07f42475d1bad281aa4f81e3d6678a
SHA512 47427e2c0ff6f14428026114b840e82aec596b74ca9a317150ce28a9a2c4aebab4a20602d4f91d49fd563e50a5dbe2ab3e1a0cc8817ae36d01c8340c0fb86a0b
SSDEEP 98304:+I19LapItQRQyi36YOcP+Lvw2gAf+PN34:R9cIEQyiKaUX+PNo
TLSH
T12F866C13F2F500A9E05ED574CF2992329BA17C5A8BF093EF359436E51A729D07B38B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.7MB
SHA256 0e09c3e814459c9afc705fff14a12c488b0bb6bff464b38d77c04c13c979e2b6
MD5 ccabf3b9c5ccbe37acac9e3034c28b67
SHA1 59dabebcfaa758df80d265494f8324340c850fe9
SHA512 2b9f7b520391c1911758c4b4911bc63ef39b1b0c3e99a668389c06e0a60c1bb7e88f77d3aa73d7dc19d0f19855f0deea5659e62c446f2ce8460565d33f6f28f6
SSDEEP 49152:wabH/GkmI1zgjI45TMwwapIgTb68Qg55nhoeWu7PNU3/Q:+I19LapI0thHRc/Q
TLSH
T1A406F63372E20099C58D9072DF46873197D17C798FF1D7EBA14572CA2B72AD07A3A60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.4MB
SHA256 aff6c0d820b01ccab49d09b00e141f10aaae00a239ad6c54cb797b19e6936989
MD5 aec176b4a27ff1e0c1a59d6d8ec4486d
SHA1 4282554e41217c99e329aa91cd980afb489528db
SHA512 bcea907c3c6f066258b6d88b8776c586ae2349b77ded30e823cc4d0f2458cbae67aea16048b36b8249577e38c41e679987e074a8219f9b2d24676c0a5756c5dd
SSDEEP 98304:+I19LapIry5112gYy5azzVvf69nLKnhZO:R9cIGLIHuWhs
TLSH
T1F5464923B2E500D9D059D075CF4A8232EBA17C6A8BF1A6EF264073C52F76AD07B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.6MB
SHA256 b59a351d8cc7876cbe7f866039da6ac3bbaa1fb0ac07db88db3aeb5153400461
MD5 a408e445f1665d409a1cc456bb37012a
SHA1 1aaee4f6f4e05034dc9a518b7826a1566be0b286
SHA512 98e2883f056e5e02ffed46dae5f3263c306b5f628b30fa552aa71a84a2c566c043a4c5e00a8a62c4bd87180b96a7d4d1c5ce6201294a3d35c4f34769586c5e06
SSDEEP 49152:wabH/GkmI1zgjI45TMwwapIgT21hpsNoJpF1A6GU44CwH7R4xu:+I19LapILmifP5R7
TLSH
T1EE064A23B2E20099D199D035DF168231A7E17C698FF197EB664072C92F73AD07B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 3.8MB
SHA256 d31d9936935e3c7c6386fc65851c0ed57690baa82dc50324141ba1fc4c6546e9
MD5 0623c0b1cad5dd6ad5fcc445d889c9b6
SHA1 2c424d53609d033ddaa48872b5c3951e7c9d1709
SHA512 3bbe12cddca6c6632d5e144cfc8808789ea8442976f79f5840fc64a5e25fe9006c9108055880c6a2bda3752cf2b8da52ce3e06d97865c85d52e903e4cfcf8ef3
SSDEEP 49152:wabH/GkmI1zgjI45TMwwapIgTfSuZQIY0Be2K8RVtOnks6NMHq6:+I19LapIY5dKCi616
TLSH
T184064A23B2E600A9D1AED035CF55823197E17C698FF196EF624072C92F72AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.4MB
SHA256 5e718b80b64edf1a1aba6163146da6dcd443a8a08a667b0aabd6d86c84d1b3a2
MD5 fcdcdf154fdf58129a6766052820b4d1
SHA1 7740ed264b716f47188a38883a5016cdf64126a8
SHA512 756bbc1355f87dd1ba1b627a80e4bc2cfeb2cbab902be5dc8eb251d5f904964c1c4147dbbb1786bfa895abdf0df42e321d0d7898f73e4cecb40c0fc5c93e9357
SSDEEP 49152:wabH/GkmI1zgjI45TMwwapIgTRhtSn8EApI0fig1giDn0AP5w2:+I19LapIFX2iwphX
TLSH
T181F54923B2E20099D199D071CF168631A7E17C698FF197EB764072C92F72AD07B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.0MB
SHA256 fea47d95cc9d1d64de49b6e116ef2a30eac9e1d7718a99e56fbefef0b3b900f7
MD5 e3562ba54396a6e233167c57ac240c35
SHA1 7c157fdd94a9caaac2af0e4f341e9f487916da14
SHA512 4ca84adcf5a01d1f67ea225007f6b70ec634c215317339308d26eae986274a1ad8ea36e2abb65f1d09572fcedd78ce1b93945e7f00fd6a1be4967da285d1344c
SSDEEP 24576:w4R5CIH/72k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJt7:wabH/ykmI1zgjI45TMwwapIgTh
TLSH
T1C9A5F63271E2049AD69A9031DF16863197D13C798FF1D7FBB24572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.0MB
SHA256 9bda74de585f82478bfa4abc3cb8216adf76b5a98aec710591d2cbcf33815d3f
MD5 4a6ec8ec05bed854ef4f22e5164db14d
SHA1 acc321011eeb6d953cac5e88da30623b7003fdca
SHA512 493e80b3547074f755906838feb0351d47e64ea55f34887b1a4029a622d8c7392893797b316f9b7ca1edeca436c5b496ebe8e70e934deff372e644f60bc73dfa
SSDEEP 24576:w4R5CIH/72k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJ7x:wabH/ykmI1zgjI45TMwwapIgTl
TLSH
T1DBA5F63271E2049AD69A9031DF16863197D13C798FF1D7FBB24572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SendSet.exe

Path C:\Program Files\SendSet.exe
Size 2.9MB
SHA256 0d4e533a436cabfc507213a44d2552f90ab3414d59ea9316a7ae61735d9038e9
MD5 6d4f07381c75b59d1ec2fc7bc5d7b6bf
SHA1 4186e647bb4ba1f828b63f146d641f15e088e7cd
SHA512 99a4853c12bc7b10b937c0fc032f3aa8811cc2b944055657a29458ca0fdcd79860e6779b8e7db15736734ad8e290fe4460d4383c46accb882a1723aee7dd8753
SSDEEP 49152:wabH/NkmI1zgjI45TMwwapIgTTIJwI3ATcU3PofNHwYc3T:7I19LapIdJwAAT8Hq3T
TLSH
T19DE57A3272E2049AD69A9031DF16863597D13C798FF1C7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 5bc7575290cea9f87d88971c800597646eda50372587ce978123c3ffd8563821
MD5 3335de780159285b58d9da9cf8ea2dc7
SHA1 d994ca3c40df814ebe9ccec860f8297bf16a1f57
SHA512 383a29ce27d8ca4f8076d36c3e573da00fa38636ed9a01fe26351326c38f7b030b0670d96d8ac4e96a664d314d3aa78c6a079631c8eecb60c990d4190ab7a592
SSDEEP 96:fMyayFTqXO3jeEXjhK3sK3NJ1+/cHUwChK2lK2cqlIWqsvc/jrThK36K3380:G+l3pPUC/fzmsvs5CR
TLSH
T18712ABDA4E02486F3B828B6B338332545E9B240AD7E465723BDF9155F0CE979012FDA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.1MB
SHA256 731de3a4be828e23db29149f3f64f735e11a4327c80218f8731c3434560fc6b7
MD5 bf8db2fb515c90645f7e06e4ee50da5f
SHA1 bc2196e6cf9b797d18dd8bc83801472833b64376
SHA512 a2e0b34545e370537e6535eb72c7a49c80dfc150fac1d0f467e010db26b8cff85843a82c5b51850b6d7bb03fda4ecdac782ae8e31635bd5fb96b49a24ece151b
SSDEEP 24576:w4R5CIH/7Fk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJdD:wabH/ZkmI1zgjI45TMwwapIgTd
TLSH
T117A5F722B1E20499C69D9031DF158631A7D23C798FF1D3A7B185F2ED2B725C07AB960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.0MB
SHA256 f1d3d98e8a60269b1eaa3333d217e1bfe664fdbe795a45230c374a80fe868526
MD5 a1b186f3b9b69a898a62d0d6ad489742
SHA1 99e8033440a58f15097aaaf7b69e7df33773bdb9
SHA512 afb6d4305f061567f11c10f37c3eaa5657a5e5b58200f5ce3e95416e173a2a74b24d3163500396584d83a9195d5b02a0fd353db2bdbd328bf1e03c65e3352ed0
SSDEEP 24576:w4R5CIH/72k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJJ:wabH/ykmI1zgjI45TMwwapIgTZ
TLSH
T1E6A5073271E2049AD69A9031DF16863197D13C798FF1D7FBB24572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.0MB
SHA256 b6fe3fa2bdbd935e8f2939fa276caa17900653fbc4eb9a330e0ea0f6319a62fa
MD5 9dfe2aafa8187ab05220c78e297dee44
SHA1 38fea43ff248519f25944ce46997041ef942ff96
SHA512 1d19f9269b363d0aff10bc65f691abaa82bf9c1538320ad6d8c5d6237ba6a02573a857f040e11c22588ea881d9490365529f93c5f639b417be50ef99311aaeff
SSDEEP 24576:w4R5CIH/7Bk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJLj:wabH/NkmI1zgjI45TMwwapIgT7j
TLSH
T187A5073271E2049AD69A9031DF16863197D13C798FF1D7FBB24572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.0MB
SHA256 992fc5427ca840b8920037fed9ca2999875a8dfa40a84540664805840226bd8d
MD5 fa0c0aa6e256fc69ef9e06b210d960b4
SHA1 6ac8915ae46a094a81b2de7303221af69e661ea3
SHA512 2ff29f207087698cf743e92346a1ae6478d83c2dad785632c6f79c4e40f0794bfb5f8a981c9c54c4d997c1e77dedb40143675ece80b4cb70e9fd417e57115dfe
SSDEEP 24576:w4R5CIH/7ik20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJJjv:wabH/GkmI1zgjI45TMwwapIgT5D
TLSH
T16DA5063271E2049AD69A9031DF16863197D13C798FF1D7FBB24572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 aaf079ed9afc9a46283c1f073ab5a7d641290078f9a4f9cf3731bc5ee3bcd574
MD5 88706e65fc1745821f56d27cbfe98427
SHA1 9be8743a9a2dec74f7c21de7f2a7e29408d25ee9
SHA512 349b21ed55502fa3439d34dfff2ff1ecbd828e3fd02fda86bb4dd113bc2f526b59ca9e2ac8340a2077bb222196238dba3f19262ef11d39414234fd2545242a17
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 37f4c40f57208f031bcce39249b8e624996e58188bd33129dfb172b981197eda
MD5 bfd7d6118bcc4026edf8c8150c9963e1
SHA1 0b1055d9a3445ddc2a05d7794125c3b9a2d44dc1
SHA512 b52b16ac75716cd99e10100324852b25f326c52a02caf939f52da712a2b3114e103a7598c39b2f93e51e1ced8259a158c549dab9620c7d58b8318adb4e2a0282
TLSH
T191E02BAEC8219C2708FD1B2871100746E74113177F91CC4F3A3E960D8FB5A3A466687C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 09a782c49c27530b413a0f56284857d638e6a2e105098272f115f51097efdab0
MD5 075dbba128869c2a1252859a1270af7d
SHA1 b34b33d0d4ccf4983c1d429e87e771b22274aac3
SHA512 121614894ee0d4c9d00e9015c44cfb30aea773ccbfac6f11b12d89eb681f48f8937a261ebccb74bc44a7f32817cd4b26a67a3c49b1253971c3ee3d8e7013b19d
TLSH
T16F517BF7D3E4856D851166E4AB217E2FCE7D0A18522C3C66C8D4BE5B53E2872D20178E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 d0bfcdf3dd93500f4bab7c3f5c636f934d5d82994685a8438323f83880d25bfc
MD5 6a0efafe37bfac50d55b0dba63d647d5
SHA1 e4095b9b444485afacd199c12cb1d5dd59e88b8c
SHA512 20f40e92d348609e34b33d5b8ea0be97093f0b403611c6cb78f4c8eca5c2d1933a679567a20674d596f709b7be8dcabb5415a6e1d8ecac936e3e51f0c901621f
SSDEEP 192:URfvy0mRv7E9PRp2DXsb+WNn9i2dK2Kf1ENiyIsnAUgtaJ:URfvCBUX4XwM2g2Kf1x8
TLSH
T1F432D82EEA61697B6CDBC229FA217B43D2F5203175C51E84E6FC8A1C14DB6CC231B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 6bf7d229212128b17c56d33fbbc35a3fea4eca9ad5fda7f642ad28efd9631689
MD5 d6310e9b89debf57094d0fe809617cc0
SHA1 4727070e48e8403c930ef1cd80261028be16ddfb
SHA512 b3af768c0ece4bd944f8473e0c857b724b3b15db16a1ef83da8f5534d3f4ef43f97d7d0f9a7d89221716221b85df8348cf5c927fd548c8491650ad724834fd07
SSDEEP 192:URfvy0mRv7EqPRpEDXsb+WNn9i2gK2Kf1ETiyIsnAUgraJ:URfvCBRX+XwM2D2Kf11e
TLSH
T18F42C72EEA21697B6CDBD229FA117B53D2F4203175D51E84E6FC8A1C15EB6CC231B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58f911.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58f911.TMP
Size 3KB
SHA256 02e201a163f14f883bf6f3a744fdda134490cbd7ac1f746a330bb623ec8a7b4c
MD5 e1cf936866127bb6945b0142837afa3d
SHA1 b3a433fa8cae574fb7fe8f7a0d42f24ebc4d5587
SHA512 64da674cb8552dccd83598784a4f75a72eed5b2b7c29ba8ac891937c0ad2deadae507e573fad3d7250d95cc6020660731b8af3f4c129c59b0ff7ad91091046c9
TLSH
T111611068C0780CB71DB3677574390F81FE42832F22516C167A7E168D5FB286B8182F9E
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 844d3ec03467232c0b0b31852592e1d5bfd1b998c353219bbfd11d0dd2534c85
MD5 248039e3512518ae98cef47428956f17
SHA1 6b50102f479957e0c5bdc48e63949ea63a96eae7
SHA512 56f6fa2b67411fc0644fb1c73d9ea2b6838fd695e4701b9f0083f58780d47178025347ce2472b1dab91a02f1555f53e8546aeb65ea769478c186dc3b4f42e72a
SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcSjzOXODR0+ErU3DTHGENMAYw:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7p4
TLSH
T13872E9676C4C9E770F94C6CCD8267F4FADB5024B66E9886483FA582503D5BCE110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 39df40106a304cfd0492a7f0c5565e7651f1c93495c212a73d9bccdc694007bf
MD5 17a8aa8bc273bf964d4fd59842082eb9
SHA1 085d2ef4c02635694a19a08bbf4627dc3370bbb9
SHA512 32ce62990142446966ed49907cf8286afdbf2349b7a0c178b26aae95ae5edf7ea70a31a0216bd212ab62048f2dd4faa86cd6061e62240ff16828717d56b3043e
TLSH
T167B012908442A171C03303F8234634887114AF20970A170143E06922C8251D0C414091
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5927b2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5927b2.TMP
Size 96B
SHA256 feb6b02e53a013256feb436e79bbb8eb23114821deb650e011faa79a796853b0
MD5 ae6568f3d4becf97cc694b64ee38f30f
SHA1 c5d52a9b4d717388cb246112c2211360af5b9aa0
SHA512 adc54f02262797af9260dbd73e0e4d37da76a5e87775b0e0010c2df4610dde644f90988e6b7c51f92f2c988b52acbf871927ee1b32fd4b066e26eb06ae96cd86
TLSH
T1A2B0025AC14A726AC14203F12D99A5E87164DF2DC603161792F02AA6DC656E04527974
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 6b8f38f2125ee750a286d754eb78090db25a27f9bda473c1c66b59b0a899da55
MD5 18bd2e2e0f372dd47e5d33a4890fbad0
SHA1 8fc089fea7ddf127957eda9c7538f9068b6a7635
SHA512 8036653167a9cf151f6f278b03a743cb4e6bc98e90547bc8b5cdd003c5284e651a13b2286caac713b4f5238b9c0d8d5573f56ce575a89ab3c287fef59797e18b
SSDEEP 6144:Flzg8JWg8lpU1ToakZQ2CZom7IaFmUi21rSm8uUVNSlzY+:F2MW1OMakZQ2CZom7IKfi21b8j8zr
TLSH
T1A4342214EE627DBBDE498244B6593F0E0EA41D42E2F5C65743A299C06DCE2C31F83B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 bf64b0f9b7bc7f8898125416e136862111dc30aa4dbcb697dce75a418a542fcd
MD5 6b9c3b1e86b2a8ad52c1068295f2d89e
SHA1 d192f2763fc36b162aa15e529cb1cb36a119d2d1
SHA512 0da644bf74c1884f4583d078828db10f07d34d5d1e541510b1f2026b9a89b6fce94391a4b60b03da8c5e28a784fb644eb91f1f81bf920ffd7b164671aab23b37
SSDEEP 3072:SRFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:MFmUi21rSm8uUVNSlzY/
TLSH
T1BDC31300BAE3E8F2EE5930447BEE2A145D6C0D818291C6415273AD419DEF3C71FAAB39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 88910a9e45d766356e6769bade0db83a528631c5150329a06893dff637fb7521
MD5 979aa994bb0955909db7cd2b54c12eb8
SHA1 b8f44874e8d87db651839b3cac2bda318c32e842
SHA512 d615038d5c26ef221e69ddd8ab03b6dd5e018099e320b7d5c84dad2a968471115f6aedbd888de8fdbc2de0f1a3cfb7177471881932671f6989cc35d3a62114b2
SSDEEP 6144:Wlzg8JWg8lpU1ToakZQ2CZom7IaFmUi21rSm8uUVNSlzY+:W2MW1OMakZQ2CZom7IKfi21b8j8zr
TLSH
T119342214EE667DBBDF498244B6593F0E0EA41D42E2F1C64743A699C46DCE2C71B83B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 a92c8ff6208b2bba31c6d342480aa4a0998fa86756950985e14a0dc814446bf1
MD5 728ded41a9e362f77479fb329888609f
SHA1 81f435b49619e203155d60562b163865964c9dbf
SHA512 5614171eba61aaffd297ebde25ef91f56a2de724f8d573797d3a6d8a8a906b1620b41480afd5c1eb575c10cd40b175c3dcdcf36f4b2b9a54fc3b35adba98f9a6
SSDEEP 6144:tlzg8JWg8lpU1ToakZQ2CZom7IaFmUi21rSm8uUVNSlzY+:t2MW1OMakZQ2CZom7IKfi21b8j8zr
TLSH
T119342214AE667DBBDE4D8244B6593F0E0EA41D42E2F1C64743A699C46DCE2C71B83B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 1.9MB
SHA256 bc122b14af3327a47bdf920cc9a54bbf514bffbfedfad95080e6c389d3af6128
MD5 366eb08626854acbd4851d9915f8bdce
SHA1 42cdc67d0b81023805f7119a0d101e379198eeca
SHA512 5a3856fd9073f95ad1b19bacff29f709e3f8e5aa324c0982c1e64186eae1625e71611622f30477ca43e0c192d152772c3b26be3c4acfad2457223facaeab7cca
SSDEEP 24576:w4R5CIH/7xk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/dkmI1zgjI45TMwwapIgT9
TLSH
T10195F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 25ec5a22f11187dd37ef47a0ed3df8acb8e0108c8614a6ac5eb50b0b7a09fbcc
MD5 cfbb3fe9b2b0e8998b06d4b6d0623e59
SHA1 36659e41d5f6c3e6804f08235f5ca28d6ff99933
SHA512 5eb5d6bcfa39a55600f7c98e5a9a6aa74a798dc93fcc209936500df06d61f82f4de82411aeb03a26b41779fad0c674911e59fe2220519fb1a0a529e2d4506a8b
SSDEEP 24576:w4R5CIH/7wk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/8kmI1zgjI45TMwwapIgT9
TLSH
T10E95F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 c1970527627f33bbe1cc61ae560bd910757ea287e2118195c514437370cd58ab
MD5 90bcf5203433f2518188da5fef2f2ec9
SHA1 2892338ade6d6a4b6a938750d8e55b0fb5eced02
SHA512 527643a8f3b7071458f4ba1c625bd72867d0af2160aa591d9d69fa4b9edc7297b53f43e88a5420312ef00a50ff459d51fc1a8f39909ff54c00318d95a237ca51
SSDEEP 24576:w4R5CIH/7Ok20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/qkmI1zgjI45TMwwapIgT9
TLSH
T11095F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 559773a8f94acc1729c84bf7acff78e4aed266626637f26e1f55e4bc4a2a6118
MD5 e61b69027622095b05a46757eee27644
SHA1 1ec1b70b5a9ae3ba69c173df616a3439b2adae0d
SHA512 9d99827fe67c2337a802878e2c723563edd74a7592618963bd70f2ecb3a01c1228ec0e1297f8c7835ace5be1ddc7903e4471c04d5479ada7eae42b06b6f116e9
SSDEEP 24576:w4R5CIH/7Fk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/ZkmI1zgjI45TMwwapIgT9
TLSH
T11D95F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 7ccced8a5c8d8a97caba5e1a2eb3b77ce27ffc70d0bac9b984116c4edb34e9ef
MD5 12654f9567ddd3ecc1e38f6795fbd59f
SHA1 a9d0f146dee345f892979ddc88d161a9b929948e
SHA512 d6ce978e71f658a50638dcdf81daf8d3dd5136cb36ad95b3eea6e4d2a7f4913f1b9a2a7fe4873ef22432f01a6da19ba4de8c40ad72ac6fc8c1873ee5df7462f0
SSDEEP 24576:w4R5CIH/72k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/ykmI1zgjI45TMwwapIgT9
TLSH
T1A795F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 86a17d854361ff3adcbd4bea3dc704ee4d9e13da066e5ba5185178588cd9de84
MD5 8d112ecb207657da7e5ba62c366513cc
SHA1 ddcab0cbf7396f7ea13f445cec25cd8c05475054
SHA512 14764879414ce3c234784cbb5f77a7a278665fb65717c1d513636ded690312c71fa5c13c7e14b89aedf2a79ba9ac26812248352490244adce3cf9d383debc796
SSDEEP 24576:w4R5CIH/7ik20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/GkmI1zgjI45TMwwapIgT9
TLSH
T16E95F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 0fe0db2544fa16518558811fc2fc45e7cc09c7c9783e873fd70fadd610c8a69c
MD5 466e6c5334a2d866a16597784b7d33da
SHA1 36c493e830f628189df6144c441e2717a23209b2
SHA512 9ab21294e207c9883f81da3eb9f6fd83964da49559793fc220d5ff825f94f0a8cc22eb5e3ab1efc11c2728f803ec6da5193f972abbcec87bb2013e1f1a5af1db
SSDEEP 24576:w4R5CIH/79k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/RkmI1zgjI45TMwwapIgT9
TLSH
T13D95F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 e677e896ca65959183234970760fd7e6c965709389d4d8960138aa837fe377c7
MD5 d696bb017b97d12726232254a5d6abc6
SHA1 4e120b5825e6d6ea179e24d222466f7e9fc3cecb
SHA512 63200164885dc1420252f855aada70fb7d52dadd5a6a2d5fcd689b3da79b0341a19164837126830575d9ea89c9cdf778f33bb078b16cc9dff6b29601d355d79e
SSDEEP 24576:w4R5CIH/7ik20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/GkmI1zgjI45TMwwapIgT9
TLSH
T16F95F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 a6833bbb53fbfe3e32b64bbb63b942bcf1f1337fb9d1f4c21e6c86846d79bb60
MD5 5840ca03c5cba0477f849e427f94ad92
SHA1 6427788e1f720d995c72e93b241b8ff7a665e097
SHA512 4e431dba89dc94df796171c6fa026d90cf7309a9d25973cb6027129a548ab6147031de4df2a7a8d537094125b55db473c66b19a1fa88cc67f9fcab0fdd3d4a8f
SSDEEP 24576:w4R5CIH/7Bk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/NkmI1zgjI45TMwwapIgT9
TLSH
T13695F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 dc6f2c9d70ddbaff7b9f9631838ef40a1292a0d40b1d7e14493a337badff1644
MD5 c1f269b5a6a5379112815db1380dda3d
SHA1 7f9991bcbce48cc435a08d258ba4842d9152bc4d
SHA512 f1888c087e7790690a622aed0154c8cb71cfeaa9b72b728ce931b18b3f0c5aef3d2a773de0339ecfcef76b762242dd8ce028a0c0d7dbdba7fce3e2474b1a8278
SSDEEP 24576:w4R5CIH/7Fk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/ZkmI1zgjI45TMwwapIgT9
TLSH
T16595F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download