9b4bef8caa9b845047fba55efdab8c1db8c3c2a077f646f51c924026f2cedcc6

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 05:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 10.4MB
Sample260806-ftc36stdpa
SHA256 9b4bef8caa9b845047fba55efdab8c1db8c3c2a077f646f51c924026f2cedcc6
MD5 c81ca08b709b4f79fcc5cd1ec8020cdd
SHA1 150ca29423e08e9abcc0874aa572049b2848609b
SHA512 4f478169aa64c750db26d39793403eff3d306f3f56cd894042fe1227cfcfe75ebcde45732adddc1d8175ee105b7bfd25a35a014d6eaf32d75cc94f4f7746642b
SSDEEP 98304:zLapINLapIy0oAaldmdmnpRWQtZ/K0tGOFWVRuLftCT:zcINcI3Kmd0HWyZ/K0ttYVAAT
TLSH
T110B64923B1E600A9E199D035CF26973197A27C698FF1A2EF314076D52F72AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4440	UpdatAuto.exe
4816	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
2584	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\UnregisterFind.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
732	sc.exe
2588	sc.exe
2616	sc.exe
4796	sc.exe
2532	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3096	cmd.exe
3032	cmd.exe
4140	cmd.exe
4392	cmd.exe
3524	cmd.exe
5024	cmd.exe
1744	cmd.exe
1760	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2672	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304665885116671"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
5584	chrome.exe
5584	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe
Token: SeShutdownPrivilege	3864	chrome.exe
Token: SeCreatePagefilePrivilege	3864	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3864	chrome.exe
3864	chrome.exe
3864	chrome.exe
3972	chrmstp.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4440	UpdatAuto.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2956 wrote to memory of 4140	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	85
PID 2956 wrote to memory of 4440	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	91
PID 4440 wrote to memory of 4392	4440	UpdatAuto.exe	92
PID 2956 wrote to memory of 4816	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	94
PID 4816 wrote to memory of 2584	4816	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	95
PID 4816 wrote to memory of 3864	4816	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	96
PID 3864 wrote to memory of 2440	3864	chrome.exe	97
PID 2956 wrote to memory of 2644	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 2956 wrote to memory of 3032	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 2956 wrote to memory of 3096	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 2956 wrote to memory of 1760	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 2956 wrote to memory of 1744	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 2956 wrote to memory of 5024	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	103
PID 2956 wrote to memory of 3524	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	104
PID 2956 wrote to memory of 732	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	105
PID 2956 wrote to memory of 2588	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	140
PID 2956 wrote to memory of 2532	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	107
PID 2956 wrote to memory of 4796	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	108
PID 2956 wrote to memory of 2616	2956	2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	110
PID 2644 wrote to memory of 2624	2644	cmd.exe	122
PID 2624 wrote to memory of 380	2624	net.exe	123
PID 3096 wrote to memory of 1552	3096	cmd.exe	124
PID 1552 wrote to memory of 1080	1552	net.exe	125
PID 3864 wrote to memory of 2404	3864	chrome.exe	127
PID 3864 wrote to memory of 2672	3864	chrome.exe	126
PID 3864 wrote to memory of 2404	3864	chrome.exe	127
PID 3864 wrote to memory of 2144	3864	chrome.exe	128
PID 3864 wrote to memory of 2144	3864	chrome.exe	128
PID 1744 wrote to memory of 2668	1744	cmd.exe	129
PID 3864 wrote to memory of 4368	3864	chrome.exe	131
PID 3864 wrote to memory of 4368	3864	chrome.exe	131
PID 3864 wrote to memory of 1408	3864	chrome.exe	132
PID 3864 wrote to memory of 1408	3864	chrome.exe	132
PID 3032 wrote to memory of 4544	3032	cmd.exe	133
PID 3864 wrote to memory of 4112	3864	chrome.exe	134
PID 3864 wrote to memory of 4112	3864	chrome.exe	134
PID 2668 wrote to memory of 5048	2668	net.exe	135
PID 3864 wrote to memory of 5032	3864	chrome.exe	136
PID 3864 wrote to memory of 5032	3864	chrome.exe	136
PID 4544 wrote to memory of 1732	4544	net.exe	137
PID 3524 wrote to memory of 3856	3524	cmd.exe	138
PID 5024 wrote to memory of 3428	5024	cmd.exe	139
PID 1760 wrote to memory of 2588	1760	cmd.exe	140
PID 3856 wrote to memory of 1492	3856	net.exe	141
PID 3428 wrote to memory of 1008	3428	net.exe	142
PID 2588 wrote to memory of 2492	2588	net.exe	143
PID 3864 wrote to memory of 3764	3864	chrome.exe	145
PID 3864 wrote to memory of 1252	3864	chrome.exe	147
PID 1252 wrote to memory of 2024	1252	chrmstp.exe	148
PID 1252 wrote to memory of 3972	1252	chrmstp.exe	150
PID 3972 wrote to memory of 4420	3972	chrmstp.exe	151
PID 3864 wrote to memory of 4252	3864	chrome.exe	154
PID 3864 wrote to memory of 3300	3864	chrome.exe	155
PID 3864 wrote to memory of 1432	3864	chrome.exe	156
PID 3864 wrote to memory of 5584	3864	chrome.exe	165

C:\Users\Admin\AppData\Local\Temp\2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4140
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4392
- C:\Users\Admin\AppData\Local\Temp\2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4816
- - C:\Users\Admin\AppData\Local\Temp\2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x274,0x278,0x27c,0x250,0x280,0x7ff6b5a4b618,0x7ff6b5a4b628,0x7ff6b5a4b638
    3⤵
    - Executes dropped EXE
    PID:2584
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffebea4c728,0x7ffebea4c734,0x7ffebea4c740
      4⤵
      PID:2440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,599996965638363504,11616182108044979762,524288 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:3
      4⤵
      System Time Discovery
      PID:2672
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,11660061237159933280,13929974383986559143,262144 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=296 /prefetch:2
      4⤵
      PID:2404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,12782536180961448727,792796767065364367,524288 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2544 /prefetch:8
      4⤵
      PID:2144
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,6385322025878835873,12669655095132677434,2097152 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3196 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3204,i,3145519364676225309,2960964241671772370,2097152 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:1
      4⤵
      PID:1408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4312,i,13995257151549023637,17357061180427894921,2097152 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4324 /prefetch:2
      4⤵
      PID:4112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,13933313185372369574,7937309938156538280,2097152 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4652 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,4856306861316689012,15118632286245722402,524288 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:8
      4⤵
      PID:3764
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:1252
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7f36055a0,0x7ff7f36055ac,0x7ff7f36055b8
        5⤵
        
        PID:2024
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3972
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff7f36055a0,0x7ff7f36055ac,0x7ff7f36055b8
        6⤵
        
        PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,13606373297144820485,3305873346047355735,524288 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5232 /prefetch:8
      4⤵
      PID:4252
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5524,i,3068230645883630808,17218689260933545704,524288 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=208 /prefetch:8
      4⤵
      PID:3300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5520,i,5476786743382141624,9511350840579589450,524288 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5796 /prefetch:8
      4⤵
      PID:1432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5788,i,12668628876328914812,11785257684307534833,262144 --field-trial-handle=1964,i,9069739012258042024,9247909065736743325,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5892 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5584
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2624
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:380
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4544
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:1732
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3096
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1552
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2588
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:2492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2668
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:5048
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5024
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:1008
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3856
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:1492
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:732
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2588
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2532
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:4796
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2616

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 6.6MB
SHA256 2c80f5a8aaab9aaed237dfa82b9efc181bbd2e8bf28d0b1b77d9a128601674aa
MD5 4e41bfc9ce898835f01a2b56f95e9188
SHA1 0f6ab7b9bbb9b745ce88b03852495392806d5c6a
SHA512 20e5f26e4afe98e37bab46d270d5e2a96c6df02be0af22d8dc6859574054aacc1e7c4de7e4a1b7605f5df9920d1caca8c93d9fef71b12cb90287ba4e079eaca4
SSDEEP 49152:PabH/AgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyb:HLapINLapIy0oAaldmdmnpLjo
TLSH
T1C0663923B1A204AAE159D031CF46973597E13C6D8FF192FB7144B6C92B72AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 7.0MB
SHA256 39c1c29bd203f9c5868dbe36601cb97e1f0e5d93ba57a4513cc217197c298104
MD5 cb70887260ea3a232e15879d4efc66aa
SHA1 5c7933eca0ff74d88b8f726e356c86506104d8fa
SHA512 be79774e84a141c72c45eb4d602d573ff45887c06da327a507c460cde9b7667632818fef383e8d4b5302de6b2b520e87f0d1fc9f39f07390b961d84921257bc8
SSDEEP 98304:HLapINLapIy0oAaldmdmnpEezSC6v2XMH:HcINcI3Kmd09
TLSH
T160763923B1A104AAE199D071CF469735A7E13C6D8FF192EB7145B2C92F326D03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 6.8MB
SHA256 a7cbc2068a7ab6ba67cf5667ce65f1a96e4992539d7bb4e409e633956cd3be86
MD5 68dbba2b3d4f64b3ac3f7018dacf5eb2
SHA1 75939673a896aad196ca3b2aced78ce16f638f94
SHA512 6ec76161b1901856855291cc9cb1dfac4879af4e6920a9f502b8b88673279637df74ddf35491391f08b2a1489f09754ffb961183a7bfac8c08b96cfec03e4a6e
SSDEEP 49152:PabH/AgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyS:HLapINLapIy0oAaldmdmnpQ/h1+
TLSH
T110662823B1A204AAE159D031CF46973597E13C6D8FF192FB7144B6C92B72AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 6.1MB
SHA256 e3b87a22ecd93112e46c0c032763208a01164e26afa31ad0b0ca1cb6a27ef3c3
MD5 02dfa80d2df94516850ca34fe3ae428d
SHA1 e6fe4bd95627decebd681b09a8894f82055f9d8c
SHA512 27e60cecac4f89ff7fba73a6928b2bdab1612e2f60aadd113de782a0448619bad06ffbb6c396d4144968e5a690b7be21e8fce9680a4b33fd18a14783996bc0f9
SSDEEP 49152:PabH/dgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyy:uLapINLapIy0oAaldmdmnp
TLSH
T1DB561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 49d875191f8eb029f3456c342648cce20b5d46effd58dce8578b877ebc893b11
MD5 c42f25f4215b26b6eb4711aa9923f6f6
SHA1 281f60ffa628cda02d81cc50ced5bc2255210134
SHA512 02d8cf1d41295b23293b35dda823cd4fc1c0f451099298aa09f650d7c301a79ec34610f03b900b8869b52e552f694a116fab70354f05ea061293a587ed65a447
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 12.1MB
SHA256 a260e35c0264183cc9f5fa88140c0d592cb1a9589444c5e82ebce79628138dca
MD5 3f8b680a77ce341603076ffb9aad6544
SHA1 51bc1e342d549101c973a1fdaa6b89740d5bdea2
SHA512 8d45da62f4315a86e0642e64ce4f7948537550ad4d8a25dda45fd61ec7013b68cb67c7406736ad30508ca420930d25f12200853bdd086f1316f658b23b33847a
SSDEEP 98304:iLapINLapIy0oAaldmdmnpNQRQyi36YOcP+Lvw2gAf+PN34:icINcI3Kmd0iQyiKaUX+PNo
TLSH
T12DD65B13B2E100A9E05ED474CF2A933197A17C6E8BF192EF358476D52B729D03B39B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 7.8MB
SHA256 0d4a10b6ac1bcc818707b7f88cba4240810e1dee8eb5d916d1aa4cb786ce062f
MD5 d26862c865a75bbf293586300bd39ae9
SHA1 fe431cc4c36b41ca4d89da83c771562a2e958295
SHA512 700d976f5b2f35f853b24b159d532dc2aea1aec6e822feed29be4da15331b4f9b2c785c626f3de8670d4c790e79358008eade968fe943b6f64a65d7088b93120
SSDEEP 49152:PabH/hgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyJ:iLapINLapIy0oAaldmdmnpUthHRc/Q
TLSH
T152862823B1E204AAE189D071DF06973197D17C698FF193EB714576C92B72AD03B3A70A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 9.5MB
SHA256 a91b7f9b0afd7648be79f62961188c2e30e231fe6f27ae01032226128167b5d5
MD5 d4520efbd30cc07712a09feb54c84666
SHA1 16f7c8bfa77789858d4664d78d0c9361ed33250b
SHA512 bba4beaf1b996204cd9aec2262c81d1292c00f9c84fe1ba5dd3df617351e17863bd7f9673057c5b392d79a1036e2ed40f647f731b0a87eb4a248459aff7c7c92
SSDEEP 98304:iLapINLapIy0oAaldmdmnpLy5112gYy5azzVvf69nLKnhZO:icINcI3Kmd0wLIHuWhs
TLSH
T146A63923B1A600D9E149D075CF469331E7A17C6A8FF1A2EF364076D52B72AE03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 7.7MB
SHA256 f46421a6f48662d27bb48d913b89b34a10376ee0df7f2dbc83257a260362f8bf
MD5 068ef8f1f83e210de70b65046af4028c
SHA1 41042a6277e9103f0954ac7bcd542cf35ea42c2d
SHA512 14456268cad3ffbaf83a2eb4e51890f001ea69a7d8dd386171156e1dfb6c6387d93b4938d308e29f8f81849c34f6fdf13e77f57b4712268c0ff384d6c5032c6e
SSDEEP 49152:PabH/hgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyC:iLapINLapIy0oAaldmdmnprmifP5R7
TLSH
T18A863923B1A204A9E159D035CF06973197E17C6D8FF192EF764476C92B72AE03B3970A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 7.9MB
SHA256 55e783b1b180ffb648628f8df58cd3d98f528870f0b855e7ef101ca540001815
MD5 395aa61e5bd8235d2c5cf83711de291d
SHA1 e24d513fa39495f2e4b4a72a1a9997247a938f04
SHA512 ce323e0c7a2dbcfdce9407d9d30d0111324761a08543b6226c85a2b5663da755c3914becfbadf389a12b3715af457c374b069b6a144db736485e1011fee48fdc
SSDEEP 49152:PabH/hgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyG:iLapINLapIy0oAaldmdmnp45dKCi616
TLSH
T196863923B1E204A9E199D035CF16973197E17C698FF192EF354076C92B72AE03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 7.5MB
SHA256 8d067ed969c104808dcf5d9bd704942b5af7581cee7db72fc9308b6f33f89db9
MD5 c007ac835e5804d3153399035f916685
SHA1 37b3167aef21b869957f6c968894f30d06eceb62
SHA512 363ff5cc799a2fc76a2433ab323abbd56f1887cff074c2b27e8028d1bbd45a296cf022e418961154ccbef67b37dedb7fad48eb1bc62da75d5aedab995ed583d8
SSDEEP 49152:PabH/hgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEy5:iLapINLapIy0oAaldmdmnplX2iwphX
TLSH
T197862823B1A2049AE159D031CF06973197E17C6D8FF192FB764476C92B72AE03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 6.1MB
SHA256 3b906d6e61610929432bc0fe0cef8499f8bf5fc0a13617f9201822e5b6b3654e
MD5 007c4e894398eac96afca7a9b91fc64e
SHA1 0ff9cc9293b41d0899263a63465a00942346d443
SHA512 5d62f6f1301ed6d605a67ed077ff7547455f95074dab3cfa34d9dd1eded78326575d45d58523a6d8c460d1adc3935a9050158cd5f802077caaa0b59a6d7e38eb
SSDEEP 49152:PabH/VgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyx:WLapINLapIy0oAaldmdmnpo
TLSH
T175561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 6.1MB
SHA256 2ffc446c2e6fa8000dbcb58456f5e0d71ff6dba09e8f9c9f6047dc740b4c46cf
MD5 0beb62f8fb8c1227e6e5f71161135bce
SHA1 71cd32224b9f2fed3e9a57b498b51b1deecf7868
SHA512 8b4a301241486b2656ce29720c97deafb6e2c59fe68875a54d9bd4b340ad2f23c5fbc8f896c81cd20a8bc4e5b6db6f3790edf1b0f70a86693f7b8829f75e87e8
SSDEEP 49152:PabH/VgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyV:WLapINLapIy0oAaldmdmnpw
TLSH
T147561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 6.1MB
SHA256 48448369cf573487b9a1d6793d0c07d01fb53db934dccebb42ac975829476c4d
MD5 c5303cd0b8b8d5c4630e4ccb712b9cd3
SHA1 4a3d477a3a5fe744468361ea531d016dcfb88934
SHA512 c025896c7b76a60db20c2ee90596071b4da6d1c4ae45513107c1144fe6cb051923b98cfbc4e45c68a02eb596b9110bab069cd615992ce3cd2b82a0e42dcacfa5
SSDEEP 49152:PabH/VgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEym:WLapINLapIy0oAaldmdmnp7
TLSH
T188561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 15f1df80b5e762c8ff28131efa0367ffae489c61c85941e15cbe9990cb7632c7
MD5 deff6d9053eaeb83911e402c98fc481f
SHA1 f5c8e6bf3b5ecbd2de5c55b09cb6d0b696debf28
SHA512 9bd67d9e656fe2299e627d807e8a739b1be3b01188033929f8d6ebd5bdbb3076f976552c98a8156156ecb81863efeffcb1edbf059b79d5d895c25119f821d319
SSDEEP 96:THapn9cfpYpkCohK3ZEK3TzjLrSphKq83bhK2hK2kq32+uj/RrUgnND3hK3tK3gA:WJCpNiEezjnahqriPrVy5A
TLSH
T1E3127CAA9F02486F3B81CF6B339335655DAB200ACBE454723BDBD105F0DEA65012F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 6.2MB
SHA256 d14120bf8de456a484576e2946ee22afde45edb5afd5c297c2b635f40601dd87
MD5 5ab2595138c8574cd75cc3c44a9de25c
SHA1 0cf740c60907adeed4a5745a741419fb0c637a54
SHA512 a7f47ef2a7ce7f14ff30bbf829ccc3dcc55756c5cd6695fa573423d0cf4d4b8e8a91e84980e042cba25a7556d6e2203bbf728ab8c0ddb6a9e6e6730fbea8db04
SSDEEP 49152:PabH/pgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyt:6LapINLapIy0oAaldmdmnpU
TLSH
T107661823B1A2049AE24DD031DF069731A7D27C6D8FF192FB7184B6D92B725D03B7960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 6.1MB
SHA256 1a2f6951a2be422ca75aa452c03d1535e35c767161596a08d7fe520dd096ecb0
MD5 2a4e0a39de8c2c1da01622c1ed8ba893
SHA1 7aba4d8cc7091e38dd234466408b63d6e548395b
SHA512 0baa0e1204b6ee19d434dae89aa64ac1d1703f07447d7e474160d08be73c167409a374d547d4ae8f83fabe9c4da04ab5c22c7cd48c92cceb355f5795df912d96
SSDEEP 49152:PabH/VgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyJ:WLapINLapIy0oAaldmdmnpk
TLSH
T130561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 6.2MB
SHA256 2bc099522723def4a19df9f624f90039112cfe352786fcc525e166b0bd2cd5df
MD5 59236c3c57a8f68615e9271d1dda8404
SHA1 80b808d74fc1270042f5f895f93e13c2e0c26b99
SHA512 f209ab49602b87f373e021086f710d7a1fc84bfa0c1f9e71e7241c37d88a88c1a0554cbfaca3f6c19990eafa9af06932c0e2fa5f5afec301475c4092ac1abab3
SSDEEP 49152:PabH/VgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyf:WLapINLapIy0oAaldmdmnpQj
TLSH
T133561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 6.1MB
SHA256 ea7fd1681b78e87a2bb46491023df4f996b7e9c75976be71803c1f705a1bb78f
MD5 dc706325dce322613b36c9586b7ddf80
SHA1 10c116cd4f2256c38619d254ddc77fa2f4e2ca1c
SHA512 f25ea4d2418b433eb24f2cde35dbff9a00999d255fdb81b357199b4bc9c2b6f5887da99e00e71ed2a3e69118e0aa0ee1455bdfd2018cca603a67e52ed8b0e0f7
SSDEEP 49152:PabH/hgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyp:iLapINLapIy0oAaldmdmnpCD
TLSH
T19C561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f46e987b393cd6609db2cfb81579623e6c1ff06cd5d0bb36f4f71348130de12b
MD5 37aee978b623a4a7825596a618a1dfde
SHA1 d7fcbead61319a98385cd4a3418cdc496d781a38
SHA512 b612325b6d6695670405a660640e2eb9f75d9065559194886b0ca8b67700037a92093fff9fe8eae3977455db1ae834eaff016ea1090be69bb683328dd3352109
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 24e98fc43a1ca918e53b1e212faa3a782de28a0b09c35b69775acbe454540c1b
MD5 b83d6d22508900cffea2e536ce21211d
SHA1 c3471dad40c86d1835bab98b11bee61e118fff4d
SHA512 561c95241073916d624990f9a23187e753438ce10cbd7af67b9db51e9511c0ad4efc91a8c484afa7a065613d4885e189252d6ec1cb76c1c7dd138e0bb5f63f1b
TLSH
T17AE02B69C821BC3749FD0B1860150649E750135B2A82594F7B3D910CCFB462741C6C6C
MD5 SHA1 SHA512 TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1145c8307559df0d26ce4dac99a61c315e3e2187ff2655ec66f3fb7da7c83b2d
MD5 a02f26ea30f833e3daceb274c26d3a01
SHA1 bea461f93810e841838adac20071eb1d466c0983
SHA512 3418ef1a80e3db9d298c7a31a567d0d33e0d2c18663463ba06fdfad23edc5814aeddd474be10fb7ba505210bc305c253312f44321637f841b55270179d959f39
TLSH
T177518EF7D3E49A7D851196F4DB156E1FCE6D0A24032C3C62C8D8AE5B43E2872D20174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 8f744982ddc82776944652be583bb22f6e8490782cf26eafb3956cde8e8a3737
MD5 c814887ed98733d163af4e0e033a28a5
SHA1 e5f6043d1d5e198dc8effef4d7a28c3202cc041a
SHA512 5d0df3efddc80dacc075f2dda40afc0c11c4888fd0b789d97f041f1a01e1534b83d5ee2a3a0fda06a0f1b77b7b69a86a8deaeba0478ba88831a5f169424992a3
SSDEEP 192:cRo3d7WoeeEv7Eh9PRp2FXsb+WNnET2RJxckw4aN18iyIsnAUgraJ:cRo3ngAPXqXww26Yahe
TLSH
T10842D62DAD10793BACCAD669F9267713D3F5212121902EC4E7FCEA2C14EB5CC2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 22b082f8962ad1b3621333d6d7b4d729a74cfd6596da1ec1e8fe1dd5d4ffc952
MD5 98e1cca8c31e0a63cfaa203ac065e282
SHA1 3b4b50f6f9052e73ed4dd6726e0b223d69fce3cd
SHA512 35d3041e933104581dc6ef178ad0c5173d45586ebb146ce339833f8210a17c66ae8d274296e1411396f9b154223c065dc9f94442dda1a2c7975bbfe123ee1dcb
SSDEEP 192:cRo3d7WoeeEv7EhFPRpfFXsb+WNnET2Umexckw4aN1oiyIsnAUgraJ:cRo3ngAnX9Xww2UkYa9e
TLSH
T1CA42C52DAD11B93BACCAD669F9267753D3F5213121902E84E7FCEA2C14EB5CC2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 b1e47c18a5e54297db8cb1492e57f8f0a8aa930e3f43726e2186b1bd0247f3f4
MD5 77868d194637348760d36fe1857256fa
SHA1 396bbe7635a25cbc3f0971f49fcd541909fc1c70
SHA512 7e55374942aac2605da359a15a0db2af255758cc674aafdd59c360efd77e27a378457a1ad5b15ec1f033a3da5eee0b857478a7402629d25aacd10958671ab0ae
SSDEEP 192:cRo3BeEv7Eh9PRp2FXsb+WNnET2oxckw4aN1JiyIsnAUgtaJ:cRo3ggAPXqXww2bYag8
TLSH
T1AF32B52DAE10793B6DCBC659FA267613D3F5112121942EC4E7FCE92C14E75CC622B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5866e3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5866e3.TMP
Size 3KB
SHA256 9c815dbdca5de73b12ef02fc1884494aebc2630ed8f18c18f88eef235a5caaca
MD5 a4e63742265c9fc4baea61374a1aaaab
SHA1 59b83bd43e8acbeea1b455872a78a001bd3bcfa3
SHA512 a362e58cd9357ee53b44019654146112af0751237d349933df0090a959be7fc310c50a3e3b0670bdf4fbb16d25a15f1c72a08bd8981c2a5f0ad4f8adb95be114
TLSH
T107612E5DC0B44CB71DB277B678BD0B85FA60123B159028167E7E4ACE4F75D278084FAA
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 379d96542283773f422c052abe7293924621df1604b63c9a59676e1514d2db6c
MD5 d066f854d368cbebca026e5da297c2c3
SHA1 4f2f84d54b0a8dfd273bbdb70bcde51ad5e2f12f
SHA512 613285c6b38983d33fb336394c5eff7edb692f60dfa433defdbf45524dd1c84cadfc8cba744a39b1c75482b318f7db6eaaae9842cfa8649a9ad00cece8442e41
SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcSjCDXODUr+ErU3/NHGcmyqOqjmo:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7pF
TLSH
T15A7209676C4C9E370F94C6CCD8267F4F9DB5024B65E9886483FA9C2903D5ACB114A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 10ec3f83e3e02b567944c3fd81df9a3c498c28a9707d1846f97e34147e747574
MD5 fcf76ed99057b6ce45b56385d7115730
SHA1 609703f24f28f46a1aa7248951f6386f1ae96a53
SHA512 cb7e74471924e10b75bc718aafc36888f54b31c5acc87ffab80aad5d02e8a3729a631a7e95b7256be6574322075d70bc21e57cfd96e61f3d15a9d8cc005b7467
TLSH
T18FB0125080015155C01606F42143148CB1189F30D60B1705D3E469E2C825590C028190
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589b80.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589b80.TMP
Size 96B
SHA256 6289bde6a1282a49d28076410d1a8c65301e4e99b191742552d1a3f2508b4b43
MD5 13e6e9ea5e6c4097585c0e2d2353c07e
SHA1 c02d2b0d4742f66d4bdd5cc9cdb79e6f68f6a769
SHA512 20f2000efc01e98cd5529361bda7581d8251ea7f5f8cdf404e981859010e0cfbf9c3919f087d8dfdb1f26fde1b8044eb2e8ff112039af7bf05ebc42ea0a2e53c
TLSH
T1E3B00295C6426226C45203B82995B9EC7160DF36F603621792F43BB6ED3977045296A0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 5ca97cb332f606d54f1f6c4bc04b51b641a938576a0a7e64aca5b013fa958a07
MD5 869dbc2bc4b23d437618d904f73a5a69
SHA1 4d968f8e6add5b195edd1633383c91dbed89b84d
SHA512 953b26e9c075a762d82971bd9b72342ecd50ebcd80af522986160a3a6ca58f612fa6fca94c1fc930d22779d9afb8f2b8c6faaef8b514192f0948ba4f85459fd0
SSDEEP 3072:HQcHIEJLSuoarx9OjuHuBeqkcpw3ciUmerUeGm7D5Lk17ox1tIpud63U8BehbCB3:w9EbXvHuBzkcphKm7Rkm1tYpBeh2BAoJ
TLSH
T1903423224EB1F9762995FFAD300F0E1E1B729E630D24E991DD905E081AE9BCD16CDC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 9dc00c6136e56871fb086fd896574d20f2db150aaa976f833ce5c68f6acb5594
MD5 8f32756fe5dc885e3409a7a72395912e
SHA1 5edb3e69229cc8b915fb8c5b24fd4e786b667f1d
SHA512 cd739528c0db1180c92fb6fc0565f880a461364f408a10cf3adc5f8d9c2187730b0dba23b1b62038f55a0420e12fc24371f05b369d557017165c1b22174365aa
SSDEEP 3072:oQcHIEJLSuoarx9OjuHuBeqkcpw3ciUmerUeGm7D5Lk17ox1tIpud63U8BehbCB3:n9EbXvHuBzkcphKm7Rkm1tYpBeh2BAoJ
TLSH
T1C53423224EB1F9762995FFAD300F0E1E1B729E630D24E991DD905E081AE9BCD16CDC74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 ad46cd6bb553d913c2f38911746ad450d9bdf9bdbd58036b0d1ccfabdf1d9798
MD5 126da5f191ebad54b24942ad4889150a
SHA1 3970292d7c93b9f8241d5128d363ace18ef92dc1
SHA512 3b7f5983885db5c9ace9b879778fd2063dfc048c9337a7950690fa12d8baa45ba666642bdee8fd2f383e03bbc8cb9aa53d0af1f0d18f5a679b5f70b1f52e47e4
SSDEEP 3072:hGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:wm7Rkm1tYpBeh2BAoK
TLSH
T102C3123B5D65E9779979BB0EB08E0B1F1EF149A2D920DE92C8D86A0437F97CD0A04D34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 280KB
SHA256 550c6ea67c0d89b4d14ecd44379b63baaae0c6e4a728d0dab6d59409c5c232af
MD5 94a4a2adb1b5d0658f6d426fa060514b
SHA1 cb0989fc8035eb66cc26e48fb262446876269995
SHA512 875db6efeb9ab1f89d8c089526ecf10b9d9abbf20ad14ff119d534124608ceb3b1c47e7f176c444ba528f4e88f4f9500846b464f322784d66ff9283237ee4705
SSDEEP 6144:4YiSpnaxq+T9EbXvHuBzkcphKm7Rkm1tYpBeh2BAoJ:49S29ETfgk0hF9oBGcAoJ
TLSH
T1675423265DB1FD3969997B5E300F061A0F61AF234E54FD91FC805E082BEE78D2D89874
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-06_c81ca08b709b4f79fcc5cd1ec8020cdd_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 6.1MB
SHA256 d7e532e01d0ed71a3d76de4cade7a0e10d2406789dfe35b997bfe6980e12b39d
MD5 895bca62418421685fe2b3f352bd6e7b
SHA1 1be9e341deb5fe04503d25e8817bdcb78a374329
SHA512 841cf4f1ec9b231dfd4d05a9dc95fd836aef874ef1a81599aab47856b13a6beef4a74d4abf084438f0205e0279df3bbd2b782141d96759dc7cf6b46f35fc4174
SSDEEP 49152:PabH/8gjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyN:zLapINLapIy0oAaldmdmnpW
TLSH
T1F8561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.1MB
SHA256 d1d01987a626e163c012ed3c0f06b2d7b40344535a04b5c67e2fc21de17ba6bb
MD5 81ebafdb142e1a3cf6b63a32fc743bd7
SHA1 e2bd82d55a9f2c12146599fb7b1cae1ce8d8f581
SHA512 cd93264ede31113c4c5c558e4abdc6634ac70ff0209d7e880f9aef4eb122a546acc8d34d3ec249daabef77189390940e66bed8cb224f69f1956ea51572a8f460
SSDEEP 49152:PabH/dgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyN:uLapINLapIy0oAaldmdmnpW
TLSH
T1FD561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.1MB
SHA256 fcdde7edc6b30adc8cec571089687fbe696c560542ba58a8100aca4a7dcd8601
MD5 b709c0efdfa0ea0c4a91b636a09225c3
SHA1 411f1e1e1ffe8f2295dff81a65d7560310304553
SHA512 1ad34b4ad9dac52225a486b674356e97e0e3b44ce4203df68089b54ab68887a4b6fbb265cea49c44444ad14979c0b4c932d1a46c188db3d5d34f2f5d5ee790ee
SSDEEP 49152:PabH/pgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyN:6LapINLapIy0oAaldmdmnpW
TLSH
T1EC561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.1MB
SHA256 0197fa750b485ce9c0bc7be036af221f3a290c27598c3dcc49ceb183d1f2ad40
MD5 cbf6312d9bbc36881ed1a36579a69d7d
SHA1 7e8bd144b6f7201b4ff1de6316d8ec171683b3b7
SHA512 03e74a03468ed197ea0cbec8978733d879ef96b99f7c704cb2ad215438cce270b9c2f4bf17a8949ee83d3cf7398dc35d9680b0eb8aa81e7f1293220b525fe1c2
SSDEEP 49152:PabH/VgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyN:WLapINLapIy0oAaldmdmnpW
TLSH
T194561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.1MB
SHA256 654adcda9615821d043c670c4236f119bcd6855068cd9e154604fe26dba0ad12
MD5 c59d9c703d8b52f0af64fe37e208d94a
SHA1 69fef26757ffebbd12eb9f46a50eb1394d92a6bd
SHA512 3def6a11e90f557fdc0ca8a7a7b3a56b97873f2736dd7c73ede5ff3e381b314a6c53adc05bc40ea8244b1530f4ce02d80c5a99d1aa4cd166cc2c603e71aab7b2
SSDEEP 49152:PabH/hgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyN:iLapINLapIy0oAaldmdmnpW
TLSH
T11A561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.1MB
SHA256 8ada35d4a355939a3d38df578cfbb8360b60ea8df48e5f3a88b157e5a251aec6
MD5 0fe54664efb44137aa221e581b7ee83e
SHA1 a72a183515aadad1126750bbe0908011d5e7f68a
SHA512 b61a1db688134533eb218a0604df96e1460d02bbba92788aa9bc8088d9f42db05530f59bc118149c54a952d6dbe03a9b1286b54ee4b8a55f8c7f149a8fd4c282
SSDEEP 49152:PabH/hgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyN:iLapINLapIy0oAaldmdmnpW
TLSH
T1C0561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.1MB
SHA256 f628d66c7837ea78e08258ecb728a030b534e8f6f95ca1a685154220e575c758
MD5 a8414825efe5d6e5db2ca02231942d64
SHA1 31d00d4614cb74b7762a7a8e27a216c2f8dcaeec
SHA512 58e5580d4dacd1d71b5ae5bd9e099cfa809cdd03f29b8505f73bc24e337eeaaea2953a8e390bda413f195b4352ac07bc58d1d4c3bdad2f8adaad5ca5f4ebd3fb
SSDEEP 49152:PabH/lgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyN:GLapINLapIy0oAaldmdmnpW
TLSH
T133561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 6.1MB
SHA256 331551ebe731272c2131049049b647e5dfb704f2e61ba5aa224b5a56e646c3d7
MD5 84e426c319f3a1629fa5305d73d653be
SHA1 8f16e7b97b4e7205760e11a0ffc48b6cad4a16d0
SHA512 18495db9063a6513dd6ffa7bd07182e6eef7a4b43453c9a27eee4d232135def6128b8d5719498cbe9abbf42d07c89142a255999f059541f9de5cde5a6bffe49e
SSDEEP 49152:PabH/AgjI45TMwwapIgTgabH/AgjI45TMwwapIgTc+Cq99LyHHI+t6O8N+ailEyN:HLapINLapIy0oAaldmdmnpW
TLSH
T1D7561823B1E204AAE289D031DF06973597D17C6D8FF192FB754476C92B72AD03B3960A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download