6caef65c0a08e26997dd195267f68b2e7630737a3260ac0425bfe1d438024688

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 11.2MB
Sample260804-p8c66axtfx
SHA256 6caef65c0a08e26997dd195267f68b2e7630737a3260ac0425bfe1d438024688
MD5 14c0e8fe43c0b62bed6bd692d25dbcc2
SHA1 019d1863521cf3e900428905e91d94f2cf5705f7
SHA512 b47522bed20f8437ede1e0e1d6119e3d59e7ee22383ad83afa2965c7eb768ee7f4baee35c700eafbb674fea64baba3bf5c711c9243bf3b60df10335bb0e18be1
SSDEEP 98304:t+r0oAaldmdmnpS0oAaldmdmnpl2880bWQtZ/K0tGOFWVRuLftCT:t+4Kmd0BKmd0X2X2WyZ/K0ttYVAAT
TLSH
T19DC65A03F29444E9E15AD134DE668232AB32BC594BF1A5FF328076D92E73AD07B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3008	UpdatAuto.exe
5760	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
3732	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3404	sc.exe
1892	sc.exe
5504	sc.exe
5036	sc.exe
1352	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
352	cmd.exe
1176	cmd.exe
3076	cmd.exe
2824	cmd.exe
204	cmd.exe
256	cmd.exe
240	cmd.exe
292	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4472	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303220005583919"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
612	chrome.exe
612	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe
Token: SeShutdownPrivilege	2116	chrome.exe
Token: SeCreatePagefilePrivilege	2116	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2116	chrome.exe
2116	chrome.exe
2116	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
3008	UpdatAuto.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 3076	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1404 wrote to memory of 3008	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 3008 wrote to memory of 2824	3008	UpdatAuto.exe	92
PID 1404 wrote to memory of 5760	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 5760 wrote to memory of 3732	5760	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	95
PID 5760 wrote to memory of 2116	5760	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	96
PID 1404 wrote to memory of 5320	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	97
PID 1404 wrote to memory of 1176	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 1404 wrote to memory of 352	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 1404 wrote to memory of 292	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 1404 wrote to memory of 240	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 1404 wrote to memory of 256	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 1404 wrote to memory of 204	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	103
PID 2116 wrote to memory of 5876	2116	chrome.exe	104
PID 1404 wrote to memory of 3404	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	112
PID 1404 wrote to memory of 1352	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	113
PID 1404 wrote to memory of 5036	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	114
PID 1404 wrote to memory of 5504	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	115
PID 1404 wrote to memory of 1892	1404	2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	116
PID 2116 wrote to memory of 1128	2116	chrome.exe	122
PID 2116 wrote to memory of 1128	2116	chrome.exe	122
PID 2116 wrote to memory of 4472	2116	chrome.exe	123
PID 2116 wrote to memory of 2100	2116	chrome.exe	126
PID 2116 wrote to memory of 2088	2116	chrome.exe	127
PID 2116 wrote to memory of 2100	2116	chrome.exe	126
PID 2116 wrote to memory of 2088	2116	chrome.exe	127
PID 2116 wrote to memory of 4624	2116	chrome.exe	125
PID 2116 wrote to memory of 4624	2116	chrome.exe	125
PID 240 wrote to memory of 1960	240	cmd.exe	128
PID 1960 wrote to memory of 5568	1960	net.exe	129
PID 2116 wrote to memory of 5020	2116	chrome.exe	130
PID 2116 wrote to memory of 5020	2116	chrome.exe	130
PID 292 wrote to memory of 4264	292	cmd.exe	131
PID 1176 wrote to memory of 5192	1176	cmd.exe	132
PID 5320 wrote to memory of 4060	5320	cmd.exe	133
PID 256 wrote to memory of 4732	256	cmd.exe	135
PID 4060 wrote to memory of 1220	4060	net.exe	136
PID 4264 wrote to memory of 2700	4264	net.exe	137
PID 204 wrote to memory of 1888	204	cmd.exe	138
PID 352 wrote to memory of 4464	352	cmd.exe	134
PID 5192 wrote to memory of 4092	5192	net.exe	139
PID 4732 wrote to memory of 4204	4732	net.exe	140
PID 1888 wrote to memory of 6108	1888	net.exe	142
PID 4464 wrote to memory of 2916	4464	net.exe	143
PID 2116 wrote to memory of 5908	2116	chrome.exe	144
PID 2116 wrote to memory of 5908	2116	chrome.exe	144
PID 2116 wrote to memory of 1548	2116	chrome.exe	145
PID 2116 wrote to memory of 4544	2116	chrome.exe	146
PID 2116 wrote to memory of 5864	2116	chrome.exe	147
PID 2116 wrote to memory of 4544	2116	chrome.exe	146
PID 2116 wrote to memory of 5864	2116	chrome.exe	147
PID 2116 wrote to memory of 4908	2116	chrome.exe	149
PID 4908 wrote to memory of 3300	4908	chrmstp.exe	151
PID 4908 wrote to memory of 2440	4908	chrmstp.exe	152
PID 2440 wrote to memory of 2520	2440	chrmstp.exe	154
PID 2116 wrote to memory of 1152	2116	chrome.exe	155
PID 2116 wrote to memory of 3528	2116	chrome.exe	156
PID 2116 wrote to memory of 1048	2116	chrome.exe	157
PID 2116 wrote to memory of 1152	2116	chrome.exe	155
PID 2116 wrote to memory of 3528	2116	chrome.exe	156
PID 2116 wrote to memory of 1048	2116	chrome.exe	157
PID 2116 wrote to memory of 380	2116	chrome.exe	169
PID 2116 wrote to memory of 380	2116	chrome.exe	169
PID 2116 wrote to memory of 3412	2116	chrome.exe	159

C:\Users\Admin\AppData\Local\Temp\2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3076
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2824
- C:\Users\Admin\AppData\Local\Temp\2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Users\Admin\AppData\Local\Temp\2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff7f2cab618,0x7ff7f2cab628,0x7ff7f2cab638
    3⤵
    - Executes dropped EXE
    PID:3732
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc28b6c728,0x7ffc28b6c734,0x7ffc28b6c740
      4⤵
      PID:5876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,7479190507491301882,3279348217556793147,262144 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
      4⤵
      PID:1128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1488,i,6337595178615145929,677084720592456637,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:11
      4⤵
      System Time Discovery
      PID:4472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2328,i,9821138419847688257,10768319852692650138,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
      4⤵
      PID:4624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3092,i,16853182756179050739,16287344726810996984,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:1
      4⤵
      PID:2100
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,14769941959203562822,11095989522596626082,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:1
      4⤵
      PID:2088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4592,i,16581584593866183690,11743964143526173832,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:1
      4⤵
      PID:5020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,1700581500782550941,6444247204834423120,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:5908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,7314444505001229109,1911321809488034160,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
      4⤵
      PID:1548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5460,i,4089571411218705339,11397945076152277759,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:1
      4⤵
      PID:4544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5472,i,10571887123685079280,13774879899782643002,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:5864
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:4908
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7d5c755a0,0x7ff7d5c755ac,0x7ff7d5c755b8
        5⤵
        Drops file in Windows directory
        
        PID:3300
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2440
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7d5c755a0,0x7ff7d5c755ac,0x7ff7d5c755b8
        6⤵
        Drops file in Windows directory
        
        PID:2520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5524,i,8776855628333477891,921032606249685659,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
      4⤵
      PID:1152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,5730972594136733574,7245592635341381723,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
      4⤵
      PID:3528
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5464,i,13186470310953648345,5728179256810620420,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
      4⤵
      PID:1048
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5500,i,6184087346739464084,13050510707809020121,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
      4⤵
      PID:380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5460,i,16014378216500200868,17307896242501801738,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
      4⤵
      PID:3412
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5760,i,9307477786589818846,9225618644742788116,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
      4⤵
      PID:3292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6340,i,12630533227511805212,8908072697798631513,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
      4⤵
      PID:3056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,4490713975983592119,13051944935570014450,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
      4⤵
      PID:4980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4628,i,2462958322284764271,12049635115081953001,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:5848
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=4760,i,2313270092220071775,8547955106432944664,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:9
      4⤵
      PID:1476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4632,i,1070354643745127594,8912155952752456865,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
      4⤵
      PID:4872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,684822919347493707,6647604591547586752,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
      4⤵
      PID:4428
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,16647188924710284445,1748086750054015228,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
      4⤵
      PID:380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6504,i,13484731387478666158,4972696289843234957,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
      4⤵
      PID:3176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6352,i,6934032920608069318,54211482622921414,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
      4⤵
      PID:5248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4440,i,16386267764016548442,13020824559815439935,524288 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
      4⤵
      PID:2968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5640,i,14166527803002678246,15390561197307256551,2097152 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:9
      4⤵
      PID:2040
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5936,i,1167982571398023336,4254781506598828388,262144 --field-trial-handle=1912,i,4543128911596132445,12418659922506309663,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:612
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5320
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1220
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2916
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:292
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2700
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:5568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:256
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4732
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:4204
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1888
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:6108
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:3404
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1352
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5036
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:5504
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:1892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 7.4MB
SHA256 e852a6df6712f7d5eda292fd2b69c7bdae3b82aadc668273fac71d82c6d2535b
MD5 d1ef9d0139288b3aa38d2e7ad7dede69
SHA1 ea1e5adc6400c9380eb8b2504b5e172121956ffc
SHA512 d3700eb5871916fb74e8dc8c623619ef0457b8379551e141d84dd75b4c5b41016a2aed72935cbc5586ded9d85e2ef763d8bc27632096050d94cb78daf93194ee
SSDEEP 98304:Z+r0oAaldmdmnpS0oAaldmdmnpl2880Jjo:Z+4Kmd0BKmd0X2XIo
TLSH
T1EA765A13B29448A9D15AC034DE96C236EB317C994BF1A5FB3290B6D92E33BD07B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 7.8MB
SHA256 43c55780de6f46ed7c6de93d167a87ab8229d73d03bf10f7c2258624a5061f33
MD5 fe28e86d78c9b5615e88d46cecee4496
SHA1 f01fe20a70c63a56037030849eba12ed6325c1ce
SHA512 ce0d23fa79fde6aaa0f437598c65d747567f92abcca1c7be4ed723863edb29d27fa7894fbe795e564d44c07cc3f2c95b6cd95e7f1742a5e8934932bed0769bb3
SSDEEP 98304:Z+r0oAaldmdmnpS0oAaldmdmnpl2880CezSC6v2XMH:Z+4Kmd0BKmd0X2Xg
TLSH
T185865A13B2A445A6D06AC074CE96D236EB327C494BF195FB3280B6D92E33BD07B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 7.6MB
SHA256 8430c0c0a2288c42b4786bb0b72491ff82cdce78379dd0305208570d2d579891
MD5 6a69e2a3194af39f55dd873778ee180a
SHA1 3dfc964fdcc266c04e5eb02879fbdd913b8f8f59
SHA512 47702c92e8c6dddc2e0630c823ffcefec7a1315aa1ff61f7f44623a789e16c11d0b7c409c5fe7f8f9b9627f0d5728db531416b4c0dbd31d6b7c57900f7ca2fda
SSDEEP 98304:O+r0oAaldmdmnpS0oAaldmdmnpl2880+/h1+:O+4Kmd0BKmd0X2Xr/h1+
TLSH
T18B865A13B29448A9D15AC034DE96C236EB327C594BF1A5FB3280B6D92E73BD07B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 6.9MB
SHA256 d9a36fb4da65011e342c65cf9c929e0757cf5afe4dfc3b2f0bebab1f2fe494a9
MD5 ca5bfd8fea972ae73999b246959ae501
SHA1 818eda549b60a1ddd37d13caeed5aa3716efd986
SHA512 8201ec9d46cfbbc6debe3fca5a6b4144a3bc1cf3bc2e7939f33b2297aa4e820a2ed8d8459d4693e7b5241255a4cca58f04c47115e0791d1c9f1bb80c2e461ab5
SSDEEP 49152:wabH/NfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHH1:P+r0oAaldmdmnpS0oAaldmdmnpl2880
TLSH
T10D765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 8.6MB
SHA256 e677585e7291b65b381e14f3fefede323fc92f2d6632409317e1d6e85be65806
MD5 4e0050df13e4d08387bd8a6c35dceb5a
SHA1 27a3c09a6914fe580f127d7a6ddb242cc099aa23
SHA512 e47117ed1c31d122b9cddcbbcc91127dbaa0c68adf31bd7e51f690e0e26e54d579dcd5267a730c02a42fca50e4bb43de95e764ad6c400091bfc19d99501829e0
SSDEEP 98304:j+r0oAaldmdmnpS0oAaldmdmnpl2880mthHRc/Q:j+4Kmd0BKmd0X2XNthHf
TLSH
T18A965913B29544A9D05AC034DF56C232E7A17C694BF1E6FB3280B6D92E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 10.4MB
SHA256 662178f909507f2b197fbcfc7435b778242cce9c0bbe3896486b9283b6169d3e
MD5 29f215bb2b3f7bc2696225f003eda918
SHA1 fe0c67192453dd2439cc8979ae7313f8ad2a1718
SHA512 f180005b7f295a41abfd7a3b913b3f7f4704d49c8a38773bbeaa3022f39c2da5ccc424b9c6c3686408566e8865cd2e1a39c75511428c116e68a060627d635856
SSDEEP 98304:j+r0oAaldmdmnpS0oAaldmdmnpl2880Ry5112gYy5azzVvf69nLKnhZO:j+4Kmd0BKmd0X2XdLIHuWhs
TLSH
T171B66B13F29444E9D05AC174DE46C232EB21BC4A4BF1A6FF2690B6D92E73AD07B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 9.2MB
SHA256 6ccf0431102d2e92e52925349a58803cf8554b0aae386b7b038c806d265c69b6
MD5 e5b66b7680cec9ad6b10b1037a790999
SHA1 72c3c2cdd62745a131c7db17bfb7bce487763566
SHA512 57f3fa1fc2b2a6712b21db09460789ecb7600c5ffc342299c4c25417f676cbd26b24248b4815ca676796c05e415a0c9ba1eb228c4fd1ffae93f1cfea7be4b3c7
SSDEEP 98304:j+r0oAaldmdmnpS0oAaldmdmnpl28803u6Jm0xd2d3:j+4Kmd0BKmd0X2XV6Jm0G
TLSH
T1FBA66A03B29544E9D05AC034DE56C232EB22BC594BF1A6FF3690B6D92E73AD07B39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 8.5MB
SHA256 07ee4232603fdab6a888a82c4ff892973e3adf7afcad585222188bd09a28d433
MD5 a013b5282396517dbd347dd2a9edc321
SHA1 b8c07ed0dfd2a676e3985bfd4fe56d344cbacdc8
SHA512 7ecd22db98463f23eaf1f59111c8da84dde739745a6da5c0d3756b3909562ed145a5aa31da08cb587ca2e82438026f28584edff5240548a11099789d0a9b0e09
SSDEEP 98304:j+r0oAaldmdmnpS0oAaldmdmnpl2880BmifP5R7:j+4Kmd0BKmd0X2XmfPf
TLSH
T1C6966A13B29444E9D15AC034DE56C232EB22BC594BF1A6FF3290B6D92E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2440_13430322001120649.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2440_13430322001120649.pma
Size 696B
SHA256 9f2ad4b7c86375e322d10ec24fee8be47600c46a9091eab89a236a9acc519a66
MD5 696ef545c40d36cb671402f221cc92b6
SHA1 bc11a3133f33ce74437f4f52e657e06fc7cf2086
SHA512 829de25f1f7235a722019a09c286554390e30afcd66e3c3a8502c6da538ba6a6e16145405a7e4559ffa116fb68d2a6460be86eae16cccc36d09741ebcaf5b371
TLSH
T1D201C94AA3144F67CC468D3584BE27512BB5FA501F821BBF7B10724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

4908_13430322001318379.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4908_13430322001318379.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 8.3MB
SHA256 c62357ac46d44afd686dea9c799dab74b8f8a9d68a1cb3eb18ec8c5d20e36f51
MD5 b08610e86ead6f60a59eb2f51aedd013
SHA1 d7ba3dde2f70ab6dd48617a3b1e90a8991d4c543
SHA512 ad31f7d95d67bbbaf79ac20190b44e6a39594d49507986453cdfe52f613d0e6330abbd4a94676c6c5419c27fc7c241e5c7c71f3f2ab10917248843c8028b2cc0
SSDEEP 98304:H+r0oAaldmdmnpS0oAaldmdmnpl2880TX2iwphX:H+4Kmd0BKmd0X2Xs2iw3
TLSH
T10F966A13A29448E9D15AC034DE56C232EB22BC594BF1A5FF3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 7.0MB
SHA256 342d66cb63824914b78ef97a25dd9e40be2aabb9446bc363e80ce046a4fff754
MD5 1adb7be41f9e3a767164e9ab6c198be9
SHA1 d11a77b20b5b88469699cbce903fece1604cb612
SHA512 134a052dd28fa6bbf1c89ad214cfa812d5865b87f35218994ef9502354e6296d112218841750c175f09cf37780eea97ea36ea03ae618b32b98384e52bc539d74
SSDEEP 49152:wabH/XfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHB:Z+r0oAaldmdmnpS0oAaldmdmnpl2880K
TLSH
T108765A03E29448E9D15AC034DE56C231EB227C5D4BF1A5FB3290B6E92E73AD03B79716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 7.0MB
SHA256 d5af96a02eb12528c01187ab6d508472decf9846c1a0ede3f08a4051bc4c8711
MD5 4b41c45038073f278bd2266df00723e0
SHA1 7ad2dfe05f8e58dd1d4713156e99faec2a6e145c
SHA512 3d494fb3a9a5b1501989c0239b7f7d5043c098e166e4e8d6f5778b2005f53205c52291c1a0db32a187e571ebf6b725aa750ff3ae9a74536472b58185d219f6c8
SSDEEP 49152:wabH/7fuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHH1:9+r0oAaldmdmnpS0oAaldmdmnpl2880C
TLSH
T180765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 7.0MB
SHA256 bfde3e3924cc3289b6c5feca001f1d9caeaf18530bc17305abc1e4421d8f57f1
MD5 590a30afe99978f924fa3ac215b57ecb
SHA1 a71b2e2343ac30e45885d226be799fa78e1fe565
SHA512 c712dd598d7dcd965246c3140bcfca8348881a30fde77a37c7e15a52eb5b4b32a0336035055b59959a2c0f80480f303d8b10fcb9097fd23a58b9326c83bf7147
SSDEEP 98304:H+r0oAaldmdmnpS0oAaldmdmnpl2880Sj:H+4Kmd0BKmd0X2XDj
TLSH
T130765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 7.0MB
SHA256 e586e8ef7fc1c0888523a9fe47889837426d65771c1c3e01a5a9df9397a78b80
MD5 bc44887e9375c06bb98e50658f088ebf
SHA1 2e2184fa74d9af12c9efcf21ad10b0f09e4750a2
SHA512 ce4f225ae931b5f5e9afd3e2e3f4469b189e9b764dff26c72c96b0dc6ea5d34e45c7bbb1011093f8ce621a9d544b42738c1321bf6209cfbd8096255560b6052b
SSDEEP 98304:j+r0oAaldmdmnpS0oAaldmdmnpl2880ID:j+4Kmd0BKmd0X2XxD
TLSH
T133765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 cab39ec6f4eb63d064c26cff4d6b8280dafd6cdf860f324d588a5b48e9a4004b
MD5 54f91bccd4e156eea9e77ab5636c095d
SHA1 c26344a294afc1f85144197baab316e80094e0a4
SHA512 04d1f4d3c8a8a86b933b604aabb3ec320ef3a2bf2d504956730fba8a67135c6ed9ca42db4fcceaa442433ed2683209381f81a31bd00baa75b1158f4b5444c09e
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

28968ae7-951a-4ba8-831f-b69caf0e6a90.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\28968ae7-951a-4ba8-831f-b69caf0e6a90.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 250f040bc15322d4ff9107c3ef46c3466676e013d6c0c0db36b8615b07fb2786
MD5 62e52c17a744acc3e111e271cc251685
SHA1 d9bb8eaf31ee8eeeb696c93eebf8cf5bf77721d6
SHA512 fcc6ff19ddcd0509f14caf7969aa4de513bef135b36724196e82c3186ceea1a870abe076fd4cf9c8ef7751c8e3cb3bdd2a84216ad22938ffac5450af09ab3624
TLSH
T148518BB7D7D88A6DC41152F5DB217E2BCE2D0A28522C3C66C8D8AF5B57E2872D20074E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 2b439f1988a6d1f55e5b9f534f924e2fd60d5ea3386fedd600c980772258eaec
MD5 0cc0760daf28f9f1f271ae1c841146c1
SHA1 9e13064710b275d17570e2ec22d33ddb2456d6ae
SHA512 c58c5cd52648766cc4e985217b8af8a58d2c0c8e7f0ac8ca68f560f08a7261b7726017655d89e65c0ed60ff3d70cfd369694287040b70828ba440dba66ba52f4
SSDEEP 192:ZRcmOtv7cXvAPRp2sXsb+WNnhopdJ2R4hxD4eI2s2+D0Yz+iyIsnAUge:ZRcmONu6XXXwhMJ2RMm2EHe
TLSH
T1EB32832DA924753B9CDBD22DEB367B53D6F6203530A02E90E6F8957C14E75CC222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 131dbb1b96baded1a211cba63b6c6c2f20771d87e7089326e65863dffd72ba50
MD5 58f46ea129088763809d53ede8c50c23
SHA1 563551e61f8a4912edff6474459f2a03b9fc2715
SHA512 401523af99fa3067f41c62f425e28bd030e80b833803c8b58185669725a0b8dbf7f55b4aceafe1f1b5d7926ae8d3a619db04b7d1154e6a5f39d6d6df1e99c420
SSDEEP 192:ZRcmY4Getv7cXpAPRp2sXsb+WNnhopdJ2R4hxD4eI2s2+D0Yz+iyIsnAUge:ZRcm/xNuUXXXwhMJ2RMm2EHe
TLSH
T10A32942DA914753B9CDBD26DEB267B53D6F6203530E42D90EAF8957C10E75CC222B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe598320.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe598320.TMP
Size 3KB
SHA256 c5991544f1fb7d68922c13183667fc265ec756af18ab18652c8fb80c7c74afa1
MD5 7685b0f456361fecad4d39e4314d6e37
SHA1 1daadd9d4d32635a4302600a4b16680e0f1820af
SHA512 880d86b1bdfb3139adb3a5730c62a02b0688fad7df3f3050232a40d580d7fb514fca06053106bd4aa435f9ebc62bb8ea70cd1949b6bdc44ebbca63f50c06403a
TLSH
T12361626EC5641CBB0DB2B37978391742FEA2172B1941AD0A3D7E46CC0FB18278040FA6
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 cc791cbf57d7e8ce1f2de4edce646299f89432f9f52f1f394796a0e5faa40481
MD5 6e962e3be3090089a9738f361f442554
SHA1 74ccd811a68dd7bd7858b79d078675098d6b2d86
SHA512 7966115d2fbd89c541849b5a27156cb8a733817a53ab016caa4cc96cbb3ba2ee7053e977a8fa381fd47b7c8426a5f4c4ab2dfa42870d2d71ebe1506df1bc6c33
SSDEEP 192:ecP4K63X7KxkXqK4I40pUZNCgVLHrKHfFKslEirxXzKD/6h+ErUkKN9Yr0XAn5xF:ZPjwX7KxkXqKf/pUZNCgVLH2Hfgsljxz
TLSH
T1A132E927A48D5A3F0FD8D50DDC126F4B6DB5029377681D2492FB9D0803A97CE214A6F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fedbb3679c9f834b36e6f1626b92d79a735839356d6de78f4608e25adfe19ce1
MD5 0ba0080a9f093e4d253fb34baa19460d
SHA1 66c9341688de5b1fd2c8deca0befd178772a348a
SHA512 f65a700f0532637b427effd6d3bc5375a4ba49840c4b6effeab2a3e7f2a64c9d9333ef8bbdbdb21d58066d65dcf4cf589dcd21ca32188081f91a39309c5688f9
TLSH
T1E8B01218C04B1701DC4082F01105508423505E31A4008B0383F0E996CC530D04352904
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 deb1ed917e6e923605bea0f7dd77570a9e4a3a7cf456ef9dc147a8e790785e09
MD5 299b7517aff660375675f66253207ada
SHA1 31dc1d78585ca9a54252a3c33409daf75a7efd40
SHA512 263eb3808b3495d841b917b704291ed162491e8ffb24d56a2640e7e3d9f883b248527c25e8eeeea271815ae41ad28d87d56a501a0d81d70af4f5ddb6ae7f13bd
TLSH
T12EA0029441D49411FD144AB961660992B6918C142951835366DB0454889F5D04605100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a77c1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a77c1.TMP
Size 48B
SHA256 847b5a309a7fa3bcae8141cadefe365af2a684a59c97e09ea8ceadba58a79122
MD5 94f45270419ca43e133d36a9dbae72c9
SHA1 7f11e26d42e30045f29a87564ce660d7af4428a0
SHA512 800a2799b0eded81bc220b068827321bca1999ff13086e2c9d43d291648cd9dabd359d0771fdd65d0904708a0512f83fd05749bc144254a0aabe0097833ac8bd
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 1a66c8e7a6c09e39cf43fd00e321b3b032c5f222f12851aa7630089a1d707554
MD5 457001cd8585953ac800cc55b8f25a77
SHA1 a80feaf99f50c643673be1ed12c7ae4c69c133ae
SHA512 77be405ee13458f06ba890d0e35f66c6616834c41da1bdc148923a7192abbfb520cb0fd1f404f277df6ad60e4440968a1cfb66afcdf5fe2fae048a14e21567db
SSDEEP 3072:yGNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72N:ytOlsPQCfjiXVzoJHg6JOMxheoPq
TLSH
T11BC312658D241D7F4D74AA1A75198E47FBC4889DB78E6FE0C3C2269A231F0D4AF4331A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 173KB
SHA256 c3f63d0889cb9a39485e2ee35d22bb9e8716637288607b0c3d931328c838a2f4
MD5 3363aebce4ef7958bf148b24707c1a42
SHA1 462cfec169a0c4d65b402b81d78abe19f48e1a43
SHA512 0452398daadd0735767503c0c3b44185f76f433b7d51ae9985b2f977b089fb52512540bf52256353d90151dd76b9a9e008d142f0dda350253724c3061a4385b5
SSDEEP 3072:yYd0Q2ObHvSJbNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72N:yzQXHvSJsOlsPQCfjiXVzoJHg6JOMxhG
TLSH
T1C20412779D255DAB4D30AA0631294F43EDC88A5BA74E7EB843C1379E132F4E07B03666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 be24ca26d7d1d89deb4d46af9e2caa31311b40302ac5db68a4447368b0d5e315
MD5 f2a5a889d733222252fc2828868dff27
SHA1 abc40376104488a5dcf582d2c488609d7d204d1c
SHA512 fe719dba1d66615115819d266ffdfa5a719aff5cc509b8b2644d35d5e8efe19b4907e1651e4c2a35a31d2cf3cc228444bceb49c317e360d91caf5aa8b363d40d
SSDEEP 96:BC0d+hDK+UyKovbfaNQYYeteRDotok52qDKB6WGyvUU+gsbL/Mmv4a:BC0qDHUgvIdaDUDXaCI+gsbL/N
TLSH
T1D2A12932B46D4DB75A76D949F9662E43CEB4612BEA31BE84D9DE0E0C11EB0EC1302653
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 0242bbd9c40187117b22cad55fde000b6d467ce30644037d52ef604179feb44d
MD5 b63da65928d2e3ea44d293fb25550c21
SHA1 a9182df4f33ff9256ece4be6321ac572759c703e
SHA512 3e5e41a95d8f64a9bb8bb1dd76cb9db5b3500f092c98d2b6a09bbc0514aa0123ee328b621c2d9f34c625182e5d9e45c4564be36b8e52f60b1d171339ac927bcf
SSDEEP 3072:5GNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72N:5tOlsPQCfjiXVzoJHg6JOMxheoPq
TLSH
T1CCC312658D241D7F4D74AA1A75198E47FBC4889DB78E6FE0C3C2269A231F0D4AF4331A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 8e132625f489cd52e2f28238eff9d4923d16b0d946c8937836c6bafeb8c177c5
MD5 8c0492188a9a96059e577020a5695bea
SHA1 d6746797b131ab47ab017dd16421b9bf84c4e0c3
SHA512 856da78692152d852daf64de190f26a2020ea8cbf71293d925ccbac386c6b5831c59c8168c8a49a90b10e8f0acfa7c49680e1f463ac8aad472d7f1a244e42447
SSDEEP 3072:y5GNbnXONOOYvPsX/QCMKxc2iXV1FoJHg60gOMxheoP0L+v72N:y5tOlsPQCfjiXVzoJHg6JOMxheoPq
TLSH
T1F8C312768C241DBF5D34690A75158E47FEC4889EBB4A7FA0C3C12A9A131F0D4AF4371A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-03_14c0e8fe43c0b62bed6bd692d25dbcc2_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2116_2083898341\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 6.9MB
SHA256 15085db0b245406989f2e6defede05b2d63b6d45bf0b1878d006ecb96aa947d5
MD5 db1757b94870fa0056fdef772c5a8a04
SHA1 c1d8e07bea9214a47ed13954b60c424ef1713473
SHA512 286fd15d45d9e7099af8c6852e8ff3fff9eae8367b948ff690ceb5ee60f13065268257d3f212c74a40c22f10b1baa1fb02ae11a1030e439097e6bb1adf173cb1
SSDEEP 49152:wabH/rfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:t+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T1A2765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 e93d3b9dbdfb606a802e01fd7849ea8cd9d4b5fa0785f86016267ad2064899d2
MD5 9bb04a5727ff484e204cd807a187489a
SHA1 7f973c35ab42c191e26f9c42ec90dbba9d4219ad
SHA512 11df3d54dbe28771bcfb7717dda0387b246063877ae97de49c6ffa6c8e43f4b0a870f9ae83b247057f91238010d9bfd6ed18418c02f1809a2c9fbc9f5ef609d0
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 c82f68bf42f7392e13b054bc57d6dcedb23ab709538693011a33d7635622797a
MD5 5bb7df9ce250eda55bad1685a24e0ef2
SHA1 69c62bec4425ecabe7d083d5590a86c8cf11f74d
SHA512 427b53182f6beab92632c20ec4f1cb2063960397972342105e4f642cb1751c1c83b27d94e62b7f47b5f2f06a02bf930f1583441ae71981baeea29dabed1e883d
SSDEEP 96:3at3R+ouvM+K6hK2vK2ilZFjqozj79dHEIqhK3AK3F/0:q1Xu1l0PvOvE8
TLSH
T13DD17ED69F0248AF7AC1DB6B334321916D67600FCAE8A47277EB6506B0CE664001F5EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 3d370aa139934b4fd488ba950662bbc42649c80eac7d55a018c4c9169b509335
MD5 6ac1f5963d3e2fee10269370dd6a987b
SHA1 8d6e9a662b32a757f1a40b6a2f9d8af2c3acd03b
SHA512 5c28a59fd8552037f6cb924759fe59ba8d2995d3c45b34874dd9e57c548cf4ae761d46bad185294e28ed506749d4457f02c0b76d4596143f16b9352a5e4cd155
SSDEEP 49152:wabH/XfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:Z+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T1E5765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 5da74c0ac3ff641b37ac79773d0bed83f101ff7a3ae998a2144290bf253e7d8a
MD5 bcffe4dee8e4df041801f7654bdc26d0
SHA1 512058f671754f9aacf2232da08d358d1a13fa86
SHA512 3711622aa7b78f0c173c40d1f26655b3d32e2f0e1a52ef1cb865b4411d38342f12ae38a29984850a163f4a3430bdebb99e0e9763beb9e89fdaa24e9b0eb1b345
SSDEEP 49152:wabH/QfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:O+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T1E1765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 87b45dd6cc74151a10b7dcd9eea24731bcdbb63e50d8261d3ae619f981f058ff
MD5 7b7af27503eab32003c3890399e48e30
SHA1 4e6ff4724678bdb6d38e90f3ceb242ebac7bcc7b
SHA512 a12ab9b562d8c6ca99968527f502797192764e7e075ef1a4782582b4d9575713f0b3bf823ed6652ad80b9e7f8226e706d523f44284f807506dca150e4e5a918c
SSDEEP 49152:wabH/7fuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:9+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T14D765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 14396f29b3caf685b25b211e40195e5d12d02f7d3d2e6c3073a7166bc5fc65d1
MD5 6d754334e4b0b9405c439159eabc50d9
SHA1 fd608c34fcb4f7c39ba07e7e89c18243c07665b6
SHA512 9615181f3b0622a636440493ffc3515482034e977cc0a277f0c8d1a99d0c72da1ef38244ad7f1965adbe055ac18d6381b356e501f6e792bfe73d5d50664b17bf
SSDEEP 49152:wabH/VfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:H+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T1C4765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 c7710e2758cd3239b5de07d455633008ba0b13ba47a7ebec0c2b8499ed186484
MD5 84384313a350e94dbf7ad099e7675c39
SHA1 4c39eac2a52e4e085574304fff35795109f30cd2
SHA512 fc656d5f01bb1529123ff1b3ab7101ac8f6733ce34c141072456fab7b4394046f1ab730d51684e577bb98bafebf68d15d6877c56a901826f86e0a2f28d90f98f
SSDEEP 49152:wabH/ffuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:x+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T10C765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 b3df37a0b23e91b190afae6ced82765660b0c99608467234f9babcf8820b5dae
MD5 04b8e39b9667754cb68f770cf74d942b
SHA1 003842665a872844995382fe029941111ee15688
SHA512 da9284337cb058b1874263f960079d0a288cc8e689d8771503dcef3b2f90f6c3815fceaadb756a0d46217a86d01ca26d7bf787f284f0be38957f97d70371dceb
SSDEEP 49152:wabH/xfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:j+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T133765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 241f69c30091ceab381ca7b273f4ac32f969852a656edc5ed9ec1eeec80b8ece
MD5 829810185c50de5dce76ddc78b539deb
SHA1 7a87782f3009762ae85f39250671cbd06418b888
SHA512 d105520b49d0347a1d30d8a01231c76e00a7546eb04306b6c993dbc77c9f8c955abe54b4617f518e82a708ba88010756126b7b541f1df363e1656934d7d1342b
SSDEEP 49152:wabH/xfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:j+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T1FF765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 8f0807d2c58fdb3340c90e82b682328ca8d762ca3bcc60705b2fd50dc9fa7c11
MD5 ca5476403d9ce3f2002d08bef2afd5f8
SHA1 c8620b753fce54e242e7f0dd375dab481e0948f9
SHA512 cf383e845c6042f4614ea2ac960cf67fe0ee335a2136c5e63256e1c37a5e97f452baf0f16628f1e374f2cd72096b8468a9f446ccf1dc36d0c3e309064fcb4708
SSDEEP 49152:wabH/XfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:Z+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T1C2765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.9MB
SHA256 05c92b39383ce212033adfd840d939e527df2caa381e35fa28440bc5b5d358c0
MD5 f70ede94653d3005c0b3bad5d5af57c2
SHA1 750920e51f0a1be2eb482114ab8af6514d8046a6
SHA512 84beddd2501b0ea335f990ea966e9e71df0ad1c51d6ac6eaf4e92b05222d4fd3e6d305770017b80f84afc74f177144f7606164397254479aaf65661acd262a0e
SSDEEP 49152:wabH/NfuBfuF+Cq99LyHHI+t6O8N+ailEy6dmpzeioK2enVzG1nkyH+Cq99LyHHx:P+r0oAaldmdmnpS0oAaldmdmnpl2880g
TLSH
T125765A03A29448E9D15AC034DE56C236EB21BC9D4BF1A5FB3290B6D92E73BD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download