014782c01993f6abdd0eed17463eb2056d49cf9ecdf3acf28571811b6db8a14c

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 06:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Size 6.2MB
Sample260723-hlps4sshme
SHA256 014782c01993f6abdd0eed17463eb2056d49cf9ecdf3acf28571811b6db8a14c
MD5 90cedb5499c6a453d9971d6ffff0f282
SHA1 f2236b55daa5468a0a1228d70b01719e690326b4
SHA512 6ec79b47f17b44448bdf8a2af314553adb76afb291a54702924578f7e005557ca3f6ae881a0a31f7ec641b0891f6ee9be66196f8848e8568eb93672a96b963b5
SSDEEP 49152:wabH/dkmI1zgjI45TMwwapIgTN/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uOS:LI19LapIxWQtZ/K0tGOFWVRuLftCT
TLSH
T124666B13F2E500A9E19AD174DF2583319BA27C698BF1A6EF314072D52F72AD07B38716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3248	UpdatAuto.exe
2036	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
5108	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4456	sc.exe
5884	sc.exe
3860	sc.exe
2428	sc.exe
2540	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe
620	cmd.exe
2304	cmd.exe
1312	cmd.exe
5652	cmd.exe
612	cmd.exe
5312	cmd.exe
1148	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5784	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292629991722584"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5160	chrome.exe
5160	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe
Token: SeShutdownPrivilege	5772	chrome.exe
Token: SeCreatePagefilePrivilege	5772	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5772	chrome.exe
5772	chrome.exe
5772	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
3248	UpdatAuto.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5312	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	88
PID 5856 wrote to memory of 3248	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	90
PID 3248 wrote to memory of 1148	3248	UpdatAuto.exe	91
PID 5856 wrote to memory of 2036	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	93
PID 2036 wrote to memory of 5108	2036	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe	94
PID 2036 wrote to memory of 5772	2036	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe	95
PID 5856 wrote to memory of 472	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	96
PID 5856 wrote to memory of 4588	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	97
PID 5856 wrote to memory of 612	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	98
PID 5856 wrote to memory of 5652	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	99
PID 5856 wrote to memory of 1312	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	100
PID 5856 wrote to memory of 2304	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	101
PID 5856 wrote to memory of 620	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	102
PID 5772 wrote to memory of 5064	5772	chrome.exe	103
PID 5856 wrote to memory of 4456	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	111
PID 5856 wrote to memory of 2540	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	112
PID 5856 wrote to memory of 2428	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	113
PID 5856 wrote to memory of 3860	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	114
PID 5856 wrote to memory of 5884	5856	2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe	115
PID 5772 wrote to memory of 5784	5772	chrome.exe	121
PID 5772 wrote to memory of 5872	5772	chrome.exe	124
PID 5772 wrote to memory of 5872	5772	chrome.exe	124
PID 5772 wrote to memory of 2756	5772	chrome.exe	122
PID 5772 wrote to memory of 2756	5772	chrome.exe	122
PID 5772 wrote to memory of 1752	5772	chrome.exe	125
PID 5772 wrote to memory of 1752	5772	chrome.exe	125
PID 5772 wrote to memory of 3552	5772	chrome.exe	126
PID 5772 wrote to memory of 3552	5772	chrome.exe	126
PID 5772 wrote to memory of 4768	5772	chrome.exe	127
PID 5772 wrote to memory of 4768	5772	chrome.exe	127
PID 620 wrote to memory of 340	620	cmd.exe	129
PID 612 wrote to memory of 2108	612	cmd.exe	128
PID 2304 wrote to memory of 1392	2304	cmd.exe	130
PID 4588 wrote to memory of 1608	4588	cmd.exe	131
PID 472 wrote to memory of 4256	472	cmd.exe	132
PID 1312 wrote to memory of 4840	1312	cmd.exe	133
PID 340 wrote to memory of 244	340	net.exe	136
PID 2108 wrote to memory of 4796	2108	net.exe	134
PID 1392 wrote to memory of 3296	1392	net.exe	135
PID 5652 wrote to memory of 596	5652	cmd.exe	137
PID 1608 wrote to memory of 4136	1608	net.exe	138
PID 4256 wrote to memory of 4892	4256	net.exe	139
PID 5772 wrote to memory of 2032	5772	chrome.exe	141
PID 5772 wrote to memory of 2032	5772	chrome.exe	141
PID 4840 wrote to memory of 4644	4840	net.exe	142
PID 596 wrote to memory of 924	596	net.exe	149
PID 5772 wrote to memory of 4380	5772	chrome.exe	144
PID 5772 wrote to memory of 3748	5772	chrome.exe	145
PID 5772 wrote to memory of 3748	5772	chrome.exe	145
PID 5772 wrote to memory of 5836	5772	chrome.exe	146
PID 5772 wrote to memory of 5836	5772	chrome.exe	146
PID 5772 wrote to memory of 1284	5772	chrome.exe	148
PID 1284 wrote to memory of 5320	1284	chrmstp.exe	150
PID 5772 wrote to memory of 1560	5772	chrome.exe	152
PID 1284 wrote to memory of 1532	1284	chrmstp.exe	151
PID 5772 wrote to memory of 5552	5772	chrome.exe	153
PID 5772 wrote to memory of 1560	5772	chrome.exe	152
PID 5772 wrote to memory of 5708	5772	chrome.exe	154
PID 5772 wrote to memory of 5552	5772	chrome.exe	153
PID 5772 wrote to memory of 5708	5772	chrome.exe	154
PID 1532 wrote to memory of 6012	1532	chrmstp.exe	156
PID 5772 wrote to memory of 776	5772	chrome.exe	157
PID 5772 wrote to memory of 776	5772	chrome.exe	157
PID 5772 wrote to memory of 1472	5772	chrome.exe	158

C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:5312
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3248
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1148
- C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
  2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff66087b618,0x7ff66087b628,0x7ff66087b638
    3⤵
    - Executes dropped EXE
    PID:5108
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5772
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x138,0x13c,0x140,0x114,0x144,0x7ffdec33c728,0x7ffdec33c734,0x7ffdec33c740
      4⤵
      PID:5064
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1484,i,2566156082614467041,16520462627365726763,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:11
      4⤵
      System Time Discovery
      PID:5784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,17338272878158336960,1469355561950482417,262144 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
      4⤵
      PID:2756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2036,i,12279150682161084231,7041627253201750073,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
      4⤵
      PID:5872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,6655534613121364221,7817350193391187515,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:1752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,6109506614512189339,15301538694265022274,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
      4⤵
      PID:3552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4656,i,10329155621983873198,6614774710968632532,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
      4⤵
      PID:4768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4832,i,4239362832501065744,11298649735625345499,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
      4⤵
      PID:2032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5344,i,17903265624309463621,13937262285096509022,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5416,i,2443517644662596111,1226809936855319777,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:1
      4⤵
      PID:3748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5484,i,9781747263917229401,12912844594537803962,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
      4⤵
      PID:5836
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1284
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6d65d55a0,0x7ff6d65d55ac,0x7ff6d65d55b8
        5⤵
        Drops file in Windows directory
        
        PID:5320
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:1532
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6d65d55a0,0x7ff6d65d55ac,0x7ff6d65d55b8
        6⤵
        Drops file in Windows directory
        
        PID:6012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5808,i,1687292768973506581,2370555741215240442,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      PID:1560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5792,i,14533884098807336644,9038673589637351848,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
      4⤵
      PID:5552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5752,i,9003783415600607946,12612430062498914704,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
      4⤵
      PID:5708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6180,i,13651161732871143781,7873526490508799351,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
      4⤵
      PID:776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5484,i,2893027960893657509,2344971834447661789,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5516,i,6781737901384761080,13241330018207391647,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
      4⤵
      PID:2224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6180,i,6967973246639172719,725158718413576894,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:4536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,6817623328883355451,5027430388851917584,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:1092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4664,i,9023821824980477224,6737033679909856020,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
      4⤵
      PID:864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4688,i,16579021725769022968,966280006848814149,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:9
      4⤵
      PID:3696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,12237924095228056631,8151016626737351461,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
      4⤵
      PID:3752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5576,i,3297354879813517966,7644515527838468396,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
      4⤵
      PID:1224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6376,i,15675076578734691779,11135738391497764838,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
      4⤵
      PID:4440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5372,i,8846020895465140010,10613890662108473475,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:4660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5292,i,2719481671439763066,4180524522029058555,2097152 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:9
      4⤵
      PID:4336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4680,i,13944422124177091521,13213091461227163540,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:14
      4⤵
      PID:1352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6380,i,10047603176469186007,5953276020139292433,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,17223335369593196578,15120713827435325275,524288 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
      4⤵
      PID:2420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6540,i,13180676344587163465,5323461286764226447,262144 --field-trial-handle=2464,i,7316856078421200256,5307740911665097667,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5160
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:472
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4256
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:4892
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4136
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4840
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1392
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:3296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:340
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:244
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4456
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2540
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2428
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3860
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5884

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.5MB
SHA256 6019b553439ca5708a5d800cca5b3f4b64aee4a6fa8b308c3b60054e32ddb2f7
MD5 2e57f11ef6be3e223842e0e22ef9a9af
SHA1 fca9280f2db9e3f6fbbbb84bf5fcdc9d2c9950a6
SHA512 2a071c8cdd28c8adc0b065ccc2bf0ad1945e0eeb65cc18bb12710776fe00e29f0510119cfc44d1488e5119cca2c8ee3084cac1c2e863bdbc598b9e4b9d7058d2
SSDEEP 49152:wabH/ZkmI1zgjI45TMwwapIgTIPji0Aj:fI19LapIrjo
TLSH
T1FDC52922B1F20065C19AC071CF56862597E13C798FF1C7EBB245B2D92F726D07A3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.9MB
SHA256 c5d21c20886169f6f455855beac1b5db93bc8282549b800de1552f7aa2dbbc3e
MD5 8c264754c900699f0af8bbfe136d9317
SHA1 0e5e866f0d774e22b723e0563657ef11cc0e99e5
SHA512 11f3c0f84d9654189d76c92b0c316ccf5c2e9b2997d171eab46fa81011fb664b333b8a5f6fa6f6aa19471bc721a8e6732f0cc6842840337a3feb5f90bc2a979e
SSDEEP 49152:wabH/ZkmI1zgjI45TMwwapIgTr/ezSC6vUzPvMHjy:fI19LapIkezSC6v2XMH
TLSH
T1EBE53A22B1F14166C1AAC075CF969625EBE13C698FF086EB7205B3D82F336D0763571A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.6MB
SHA256 e6c820837bf157a378e63600fd6a9b61a8d555048ff1b6c66f5647550741e0ed
MD5 264dcea50371b983e06970041cab996d
SHA1 6d79601a15a0b7ae734659658f465fa8bc09b26e
SHA512 796356e72875690a2dde0b018ced389183f0dfbac114c570cd252d945a4e87e984314af53e1723fc5a102e5427c8737329b3091386dcad49879ee11a9f9e163f
SSDEEP 49152:wabH/8kmI1zgjI45TMwwapIgTkVO88hXl+:wI19LapIw/h1+
TLSH
T1CAD52922B1F14065D1AAC071CF52862597E23C698FF1C7EBB245B3C92F726D0763A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.0MB
SHA256 c2c275c0c40241ff652c6ea4765442831881dcd1bfae91d70105927b2fc7b919
MD5 85f3e4c137bc9700d4a052f1aef4097f
SHA1 6ce57a628a999eadd39a30a1d6696260f0ad86b4
SHA512 e3084b30784799ec3aab2b49a475593966296b2f3645b388b88cff46f7732334580c2ec098916f1905cf0fc9c6482503c92572eca2b7e42ea1ecc9bb06f2a0b6
SSDEEP 24576:w4R5CIH/7Ok20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJ6a:wabH/qkmI1zgjI45TMwwapIgT
TLSH
T1D795F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.7MB
SHA256 b7e4b4b020778e36e6627c6a1575d89adef626e5c445c1309484c27573e6e256
MD5 66c7b714d1b4eb8965e668b77ed609ff
SHA1 707e4263ab309117720656711025a887c3bf3fe3
SHA512 7c6878a5a2e6ff02668101d339f23aeacfdbb4c5978c66188ab94a4be55630983f809ca5970e4adee3117705376d17467ec90c3c7c89faf3f30fe7dd635b2301
SSDEEP 49152:wabH/RkmI1zgjI45TMwwapIgTb68Qg55nhoeWu7PNU3/Q:HI19LapI0thHRc/Q
TLSH
T13F06F63371E20099C58D9072DF46873197D17C798FF1D7EBA14572CA2BB2AD07A3A60A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.4MB
SHA256 6b250804b6be627ff69edc45c3263dca85456323352bc88b0263b39f2c8a1caf
MD5 34f8f6d1ad09288331fd058c75654d23
SHA1 2d17eb9c17793899468c6dee64edc2e9f2efdb82
SHA512 526802d7279597c6aca925df2d521b843a415867c0795236c3644a92c93324a5ca3551ab5935a2292abe65b3c2a10292c26bcf05cd1ab7139209185340278b21
SSDEEP 98304:HI19LapIry5112gYy5azzVvf69nLKnhZO:G9cIGLIHuWhs
TLSH
T10F464923B2E500D9D059D075CF4A8232EBA17C6A8BF1A6EF264073C52F76AD07B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.2MB
SHA256 af668d292c87163989cdcb43fa50054171f83d775fdcb505fb18cc358142dbf6
MD5 30fc367b342043350f09cbc527d70a62
SHA1 045434fd5433bced9cd846bdcefe2b8562e4f324
SHA512 63e0a90ec289d100441551fe15b825612540931bb75f2617e06bfed915507036d4ea4b0f61e6ee47a3e80671d016c3d922aae02e3c9177532c644551538dc2e1
SSDEEP 49152:wabH/RkmI1zgjI45TMwwapIgTUB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:HI19LapIFu6Jm0xd2d3
TLSH
T1A9165B23B1E200D9D09ED075DF069232A7E17C698FF1A7EB664072C52B72AD07B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1284_13429262999596243.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1284_13429262999596243.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

1532_13429262999562898.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1532_13429262999562898.pma
Size 696B
SHA256 872b27c7d34b90e166c984599b4742029eafa99d4430f11360fb2a03ea9298a8
MD5 283972fd28d44abbf0a935a1a8e066b6
SHA1 68c310ecfb47b4a3fdc748739a75675099ee26c1
SHA512 f114aeca95850c8b0590be1356d1f0efd953eb33a5635484d73aa285bfdea985ea73f1c9031330ffe68b318c01f3f3682afda7221ef86b28359f96042d6b63fd
TLSH
T1FB01C94AA3144F67CC468D3684BE27912BB5FA502B821BBF7B10724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.4MB
SHA256 0cc33e21749ce9a6c73d49698230e834395064fc233019955a66591d47adb4b7
MD5 4ba7c9342e3c294f80825103dcf3a65c
SHA1 91c07382326b5cd3e53e6d783c83291ed176449e
SHA512 a525803781192074ebed41bec0375e25ff6705f4afc9871e2db9f90c064175237f09b73a2f09e11f36f4644f15b3a7ef913b62db97fcf4063e3b31b346d8b49f
SSDEEP 49152:wabH/RkmI1zgjI45TMwwapIgTRhtSn8EApI0fig1giDn0AP5w2:HI19LapIFX2iwphX
TLSH
T1B5F54923B2E20099D199D071CF168631A7E17C698FF197EB764072C92F72AD07B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 2.1MB
SHA256 731de3a4be828e23db29149f3f64f735e11a4327c80218f8731c3434560fc6b7
MD5 bf8db2fb515c90645f7e06e4ee50da5f
SHA1 bc2196e6cf9b797d18dd8bc83801472833b64376
SHA512 a2e0b34545e370537e6535eb72c7a49c80dfc150fac1d0f467e010db26b8cff85843a82c5b51850b6d7bb03fda4ecdac782ae8e31635bd5fb96b49a24ece151b
SSDEEP 24576:w4R5CIH/7Fk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJdD:wabH/ZkmI1zgjI45TMwwapIgTd
TLSH
T117A5F722B1E20499C69D9031DF158631A7D23C798FF1D3A7B185F2ED2B725C07AB960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.0MB
SHA256 a8de831359fdccc648409b230c0b190d91f32984797079accaa9f5c1cdcf857d
MD5 5d743724833256bc26cde70a8cc0ec20
SHA1 aabdccca168214b6a65b06b42e62b2d10696951a
SHA512 dc2a01815843651b1c5b43fe8cba502d670d46868d8ffc7584bce050fd0ab878d325b3f6bc52f300966d6db3df2a0c27e4efccd4beb9564d85927c5587207572
SSDEEP 24576:w4R5CIH/7Bk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJJ:wabH/NkmI1zgjI45TMwwapIgTZ
TLSH
T16EA5073271E2049AD69A9031DF16863197D13C798FF1D7FBB24572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.0MB
SHA256 99e05450eba356ce9aa946cd2ce6960391820072c3d0bb6678231acf8a9130ea
MD5 b0254ec852b4ac4bab4d00aed30bae34
SHA1 f271cdba3409567c7ddbacf8524bd28dc90b28a3
SHA512 4d8c1e7988e0e3a6f67be881404175218a665724e0a4d6ef9701e65c240245b054ec17dba410a8c4b40816d68d22d1adaf8a2d13c82faf5584ca6491ddfbf403
SSDEEP 24576:w4R5CIH/72k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJLj:wabH/ykmI1zgjI45TMwwapIgT7j
TLSH
T164A5073271E2049AD69A9031DF16863197D13C798FF1D7FBB24572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.0MB
SHA256 d87c2e91cbfa02d9447c74d27c53e70556952240999727d5aaeb1cf3325db78c
MD5 877c247acba0a490e7a1c9a78e22930f
SHA1 4fe1fa02f057a418e03c90241b6871c689dfd1e1
SHA512 bb41f97a84f29ae41a7c41ff83b83f3f692bde9e728c4086501daf3eacd1566e77c231615e3236f51405a2549227380f3d1d4421ee13d34e6807d3f2588c86e6
SSDEEP 24576:w4R5CIH/79k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJJjv:wabH/RkmI1zgjI45TMwwapIgT5D
TLSH
T1F1A5063271E2049AD69A9031DF16863197D13C798FF1D7FBB24572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b3640a0fbf727ccded0f13bf4bcf638b7a59787e97d9362d58aa539c96c2744e
MD5 90bda241bdd991a97d7632319488b19a
SHA1 761d8712c3d94e88c0463a0514d66aeb5f098cc2
SHA512 07f28b8ae4d46f7ae6898c4ed39fa8771b56057e38afcaa6afadbf9151891727d4c6e39afab833a7d9ea0a1c430082f7197a753a6c455327000441403ca50d2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 97e5a5dbb53780758a256028f94881fcd1028c331196a9d4c17e3d09f67ccd22
MD5 fef8007486395fd47982f14e5cd90359
SHA1 b61c6805ebba046383a647bfd6d16a753af5f4b1
SHA512 568b525009e4ea1efd6635dd15fa6eb221c2f5d44bde24a7459bce67b3ebd14279481b428e24756cca616528f18ea802705246308627426cc94c9370190141f8
TLSH
T17D518AF7C3D8866DC91562F49B217E1FDE2D0A18522C3C66C8D4BE4B53F2872D20168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9edf52a63a276a2e633b598e8846b9856a152fb66246cae503ed8eb327ceff53
MD5 f377910971d779da983c26eac7ca62cc
SHA1 03eca74dcb7aec5b094cb9007cae847fde82945d
SHA512 343bc80b3154dbad0373570433363657f8364292ad70bdd82c0aed5e2ea7ce03437c564fd6d779ccd53e0d083d8ed9d45350ef85e9809c52cc84028ee2e18744
SSDEEP 192:dRRuyO8v7zpAPRp2HXsb+WNnJfNf2ppV3MkwriyIsnAUge:dRRujovUXoXwJ1f2po2e
TLSH
T14E32C52EED24793B5CCAD62AFA257A43D3F6143670911E84E6FCCA1C11D75CC222B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59ccbc.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe59ccbc.TMP
Size 3KB
SHA256 40a47d066ae589ed7705099781c3ca476562b191acf56a39964e10f1dc470c0f
MD5 4ca6c9b1dc1b2942172d6fa0543969cb
SHA1 490d9229c8a0fe2178372b1cc89f5aa00df26a66
SHA512 37632dad50fb6879824c310b12cb40587ea3c059aab052bd6db0afbc7c418e12484174fb9accec87185a1a5e6989367fa724311250628225a1538ce0f17db7b2
TLSH
T15361202DD8644CAB0DB26775B87A07C1F996463F12505D1A3C7E0A8E0F72DAB4181FAE
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 35b881c5babd0758a4ec4d85fb221f91290c588491831f8b843bf28a1da6a890
MD5 404af39a5cf3f457fcb82ea2f57990e3
SHA1 4d9741e39d92b464234159ab43acc687498dd995
SHA512 d90aabbcab2f8b4d972d8edc211f081a1be7b8d38ea9488f9082e25c45b17c0cb70f6b942eb8b56026ca6d7eaccb7d5a21fa3853583577eea72946551d82b653
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2Hfgslt17pLuLci3U1XODmd+ErU3Xt3rsgq:MKm97KxkXqKf/pUZNCgVLH2HfgsX17p1
TLSH
T14562E967BC4C9E7B0F94C98CDD177A8FACB9024762ED886492FB581503D5ACE110A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b83d808317fef1efbe0d70402f1e629d9892ca615fe704652ae9d3aecf162cf9
MD5 51844ad60f756ba18311f254260ebdad
SHA1 e9ccfa23c437dfabb611f68fc5d644063468f69c
SHA512 0af1de9c672f61d0ee5c06133d347976b4c90c2e0fa7ea3ec1a4c0db9f08346af3b267dc6e0d2aa579889e3d27b93b7d390bb1827786b9fd07d03eebf5e91637
TLSH
T140B01204C08B1B60E9C082B02109704532559E31A0400B07C3E05995DC871E04252104
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8cc48accc657c5ef2a155ae217a6d3d0cd3260bcbe8c276a188b40b5523f10a1
MD5 196a82f8ca6030cd1705c97599638617
SHA1 d9cbdac50110b6f3670bf7855ebb373ef7515cad
SHA512 d22e4e192503ff17f50dabe50bd90075008b9a10300db5896a543387390d0beda29eda414569881c3a6db470ca8b164e72442f32cba049bc75af15b25152ac90
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b5a1c12eb19dbd3e612f78cde35009aaadf9d87a8f659668df032c9a7b30eb4a
MD5 85e92a0fd0851e8a4a22d8fdeef06195
SHA1 df6933edb5ffa6c9bed40754cc6eca4962a4e010
SHA512 9727dfcbac45db281e0e1f095a5ca84aca3faf30a48084d74efd42c24a363d2bda26518c6e60ea150111a07e8e11c393dff2c85b59637e37c647b92e2f07d281
TLSH
T13FA0025041C52CD6ED9442786075755536534D185562835354A11444CD5F3C04221A04
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 1bd26e96478c0809bc477ca6f6262ba646ed483cab22be2cc80b05372edbdc18
MD5 ebaecf2d8a587de4438369ffa4a56de7
SHA1 bdc9c779276c8677988742ebcc88e144236b94a7
SHA512 cc31b2619057540c25a3de4326e466b2fcaf97f69880e04dc53c9cce3152ba3de6cc0b6306661feef023d26c0ae8ed5d3616a0f5b7bd5e9c9fe356563287e34f
SSDEEP 3072:mb7LBZJ/3ONGl4seGWg8C28gLxU1Q867IDoxZc59MCZom7I6:alzg8JWg8lpU1ToakZQ2CZom7I6
TLSH
T14DC31274AD182D4F8E6AC345B1053F0F0EB17D4BF9F9966E8A984DC8658A8DB174322C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 2e90623313b0c55c0d3fdd97c194ede9de1ca99af78710aec485be869a6481e1
MD5 2dafae118b6f78931edfc632c8503a7c
SHA1 8f0a14ccf9e91ae4a1f2b239cab20dc9c57bf05d
SHA512 f88fee0ed61ad97767169821be07d7f6592c609e537b478b05c5193da8fc486de8a017465459d64d7bceae9476db9f3c47d47139b99831b1b6e8c08e6756de13
SSDEEP 3072:5b7LBZJ/3ONGl4seGWg8C28gLxU1Q867IDoxZc59MCZom7I6:Blzg8JWg8lpU1ToakZQ2CZom7I6
TLSH
T1E8C31278ED282D5FCA5AC345F1043F0F0AA17D4FF9F5866F86D849C865C68A7168362C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 76bea9e73a4052db0b0c6bc02a66f4cc7b0110166af8700c447043f530be37dc
MD5 c6797183fd561938a2c1e1e259c37859
SHA1 4a5ab49a1822f5008bf22725a2a2b2837d1395d1
SHA512 602de73bd3da5e17ce8d0568c89b64eaa63196596e9a777f89575c9ebf93e4090b33605a26efc95350152d62fb345db25efd5674535da309c970799940ad9df0
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5UxHDUmB6eGyvkonhoob1v4a:MC0HJm5FHuPgXDUD8FW8nKobZ
TLSH
T115A13AB1A4BD4CB719B7D645F8822A83DEA4A22BA991EF80D9DD4F0C01F31D81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 5b1e861a5029ad8893d1cc0dcd5c5877db9c19a5afc06439c7be56a9ba7fa87e
MD5 989b94418f2299f96b300084760dbfe3
SHA1 fe88db859db62f6644077587bc1cb6602024a294
SHA512 4520a08e10c8e426c7c0d3f773d724005d02c354c8542f2751f58211264eb081d0e57bf8ba2667df7026c4d4419349b4a18cd4dca7a117e2cca713cd7c8b70b8
SSDEEP 3072:5b7LBZJ/3ONGl4seGWg8C28gLxU1Q867IDoxZc59MCZom7I6:Blzg8JWg8lpU1ToakZQ2CZom7I6
TLSH
T15FC31274AD182D4F8E6AC345B1053F0F0EB17D4BF9F9966E8AD84DC865898DB1B4322C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 f7d59f54b90d1fd50ee47f34a24509f096201c871518e8125025fa9e8f047f87
MD5 efa33bf77889425ffe88f51da4ce48dd
SHA1 7b09dbe3800be4ef693b25c0557a0a8967a6e93c
SHA512 65d01f29a54e181271acfd06f22551a8a3b4c2ecc35eec74977677dceea09b9a990e5591fcef487a6a5b2b82ed29bc3a1660b1259a50a168efa6b7a7a7c63ad2
SSDEEP 3072:Mb7LBZJ/3ONGl4seGWg8C28gLxU1Q867IDoxZc59MCZom7I6:olzg8JWg8lpU1ToakZQ2CZom7I6
TLSH
T16CC31278ED282D5FCA5AC345F1043F0F0AA17D4FF9F5866F86D84AC865C68A7168362C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_90cedb5499c6a453d9971d6ffff0f282_cobalt-strike_elex_hijackloader_icedid_njrat_redline-ste~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5772_433030796\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 1.9MB
SHA256 bc122b14af3327a47bdf920cc9a54bbf514bffbfedfad95080e6c389d3af6128
MD5 366eb08626854acbd4851d9915f8bdce
SHA1 42cdc67d0b81023805f7119a0d101e379198eeca
SHA512 5a3856fd9073f95ad1b19bacff29f709e3f8e5aa324c0982c1e64186eae1625e71611622f30477ca43e0c192d152772c3b26be3c4acfad2457223facaeab7cca
SSDEEP 24576:w4R5CIH/7xk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/dkmI1zgjI45TMwwapIgT9
TLSH
T10195F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 8c8f023e8571238b5da916d457275e7bb34ac064caf5cc52ddeee584144a8aa9
MD5 1146a38f2fe543c9723a70dac28cc20c
SHA1 37cdc1b5a046d20e49ca1b48ba183282d29dedbb
SHA512 5f8c02745b6c5e3b8d79449790f0302fde094553cecd1d3b5b904ade886da7113e22439249d4d424e414e288a99290996cf9333e86150ac9415aaa68b15cdb69
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 37eec9d76c69974129d57b9d5dfc123fba066ad036a9adcd4a25598ff715b1d4
MD5 1bd8a35a49c1bd966c4520d352752c0c
SHA1 c8ead0e39e6e6e9364ebef8ef1e2a9a785a442df
SHA512 b04d059bc245553a62531856d051f27220ee2885571dbf6580cb6c4466fe7ab39e79fb5ac2a2033a5b30d5880e92b2e8a7d8e1062acdf3a60255260f34653a34
SSDEEP 96:UHaunJU4KQMvNCwBhK26K2fFMe5lsF6lmsTvssXv3hK3uK3Tq0:U6coj1YJ46p5yj
TLSH
T146D19D968E0248FF7BC28B7B338331556E5B640AC7D4A4723BDB9206F0CE974051F5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 559773a8f94acc1729c84bf7acff78e4aed266626637f26e1f55e4bc4a2a6118
MD5 e61b69027622095b05a46757eee27644
SHA1 1ec1b70b5a9ae3ba69c173df616a3439b2adae0d
SHA512 9d99827fe67c2337a802878e2c723563edd74a7592618963bd70f2ecb3a01c1228ec0e1297f8c7835ace5be1ddc7903e4471c04d5479ada7eae42b06b6f116e9
SSDEEP 24576:w4R5CIH/7Fk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/ZkmI1zgjI45TMwwapIgT9
TLSH
T11D95F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 25ec5a22f11187dd37ef47a0ed3df8acb8e0108c8614a6ac5eb50b0b7a09fbcc
MD5 cfbb3fe9b2b0e8998b06d4b6d0623e59
SHA1 36659e41d5f6c3e6804f08235f5ca28d6ff99933
SHA512 5eb5d6bcfa39a55600f7c98e5a9a6aa74a798dc93fcc209936500df06d61f82f4de82411aeb03a26b41779fad0c674911e59fe2220519fb1a0a529e2d4506a8b
SSDEEP 24576:w4R5CIH/7wk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/8kmI1zgjI45TMwwapIgT9
TLSH
T10E95F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 c01494605f4490b77c3ecc97b54cf32e5b6e9a0cfffac8e861c2583772832fb0
MD5 9ef13a0f33a82b71640021d17c15c14a
SHA1 6c71f70ce06e9afe7a0cd3ed39fc65081ff4db5a
SHA512 f36ed68a4b7b943cbc7d6559f2e67635dfc7bb48694a719b1413d62e8e143e75ec93c0ebae7f2ada3421d452b56739b0cf7bf3c432c0eccc890843c780832914
SSDEEP 24576:w4R5CIH/79k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/RkmI1zgjI45TMwwapIgT9
TLSH
T1C595F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 a6833bbb53fbfe3e32b64bbb63b942bcf1f1337fb9d1f4c21e6c86846d79bb60
MD5 5840ca03c5cba0477f849e427f94ad92
SHA1 6427788e1f720d995c72e93b241b8ff7a665e097
SHA512 4e431dba89dc94df796171c6fa026d90cf7309a9d25973cb6027129a548ab6147031de4df2a7a8d537094125b55db473c66b19a1fa88cc67f9fcab0fdd3d4a8f
SSDEEP 24576:w4R5CIH/7Bk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/NkmI1zgjI45TMwwapIgT9
TLSH
T13695F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 0fe0db2544fa16518558811fc2fc45e7cc09c7c9783e873fd70fadd610c8a69c
MD5 466e6c5334a2d866a16597784b7d33da
SHA1 36c493e830f628189df6144c441e2717a23209b2
SHA512 9ab21294e207c9883f81da3eb9f6fd83964da49559793fc220d5ff825f94f0a8cc22eb5e3ab1efc11c2728f803ec6da5193f972abbcec87bb2013e1f1a5af1db
SSDEEP 24576:w4R5CIH/79k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/RkmI1zgjI45TMwwapIgT9
TLSH
T13D95F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 7ccced8a5c8d8a97caba5e1a2eb3b77ce27ffc70d0bac9b984116c4edb34e9ef
MD5 12654f9567ddd3ecc1e38f6795fbd59f
SHA1 a9d0f146dee345f892979ddc88d161a9b929948e
SHA512 d6ce978e71f658a50638dcdf81daf8d3dd5136cb36ad95b3eea6e4d2a7f4913f1b9a2a7fe4873ef22432f01a6da19ba4de8c40ad72ac6fc8c1873ee5df7462f0
SSDEEP 24576:w4R5CIH/72k20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/ykmI1zgjI45TMwwapIgT9
TLSH
T1A795F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 dc6f2c9d70ddbaff7b9f9631838ef40a1292a0d40b1d7e14493a337badff1644
MD5 c1f269b5a6a5379112815db1380dda3d
SHA1 7f9991bcbce48cc435a08d258ba4842d9152bc4d
SHA512 f1888c087e7790690a622aed0154c8cb71cfeaa9b72b728ce931b18b3f0c5aef3d2a773de0339ecfcef76b762242dd8ce028a0c0d7dbdba7fce3e2474b1a8278
SSDEEP 24576:w4R5CIH/7Fk20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/ZkmI1zgjI45TMwwapIgT9
TLSH
T16595F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.9MB
SHA256 c1970527627f33bbe1cc61ae560bd910757ea287e2118195c514437370cd58ab
MD5 90bcf5203433f2518188da5fef2f2ec9
SHA1 2892338ade6d6a4b6a938750d8e55b0fb5eced02
SHA512 527643a8f3b7071458f4ba1c625bd72867d0af2160aa591d9d69fa4b9edc7297b53f43e88a5420312ef00a50ff459d51fc1a8f39909ff54c00318d95a237ca51
SSDEEP 24576:w4R5CIH/7Ok20GtI1zgjI45bl9Mbonwap41+zzPTThwv3EJN:wabH/qkmI1zgjI45TMwwapIgT9
TLSH
T11095F63272E2049AD69A9031DF16863197D13C798FF1D7FBB14572C92B729C07A39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download