neshta | 65e12a53d186234f387a5a373388573013461ae499c034d44298e1aa1b010e3d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Size 7.4MB
Sample260809-t4bvrabd53
SHA256 65e12a53d186234f387a5a373388573013461ae499c034d44298e1aa1b010e3d
MD5 71f263700bc4c7c00285e49fea86a4e1
SHA1 def63699644882c7c015f8d6df2ccba5a5f6ee04
SHA512 e5bd3c2563f623734df704d3ee0e61a33df9b9d5402c52fce58a3207b2ccc0aa60b60fed472be5ab5684d7798def047edb0d8209d5b4d2c71c886066a5b26ff7
SSDEEP 49152:64A+w1GH+zNsGRFpYiUan8Rb281FL6n+M7UxRQO5J6uqQW8v10eyGx4yJFBYwyI7:yrzXpkF0J99JIgGW45jxvdz4uzBGo
TLSH
T17D767C13F2A501FCD05ED974CF3A56329A317C4A4BB092EF269836E11A75ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 5 IoCs

resource	yara_rule
behavioral1/files/0x00060000000202c7-37.dat	family_neshta
behavioral1/memory/4116-199-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/4116-224-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/4116-778-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral1/memory/4116-806-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Executes dropped EXE 2 IoCs

pid	Process
2204	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
3796	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ielowutil.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~2.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MID1AD~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\notification_click_helper.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\pwahelper.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MI9C33~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaw.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13147~1.37\MICROS~4.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpshare.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\BHO\ie_to_edge_stub.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\IDENTI~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\MSEDGE~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\java.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\132029~1.140\COOKIE~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmlaunch.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\msedge.exe	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\svchost.com	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3408	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307669916435786"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
1436	chrome.exe
1436	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe
Token: SeShutdownPrivilege	3832	chrome.exe
Token: SeCreatePagefilePrivilege	3832	chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3832	chrome.exe
3832	chrome.exe
3832	chrome.exe
3440	chrmstp.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2204	4116	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe	86
PID 2204 wrote to memory of 3796	2204	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe	87
PID 2204 wrote to memory of 3832	2204	2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe	88
PID 3832 wrote to memory of 4312	3832	chrome.exe	89
PID 3832 wrote to memory of 3408	3832	chrome.exe	91
PID 3832 wrote to memory of 3296	3832	chrome.exe	92
PID 3832 wrote to memory of 3296	3832	chrome.exe	92
PID 3832 wrote to memory of 1296	3832	chrome.exe	93
PID 3832 wrote to memory of 1296	3832	chrome.exe	93
PID 3832 wrote to memory of 1780	3832	chrome.exe	94
PID 3832 wrote to memory of 1780	3832	chrome.exe	94
PID 3832 wrote to memory of 4424	3832	chrome.exe	95
PID 3832 wrote to memory of 4424	3832	chrome.exe	95
PID 3832 wrote to memory of 632	3832	chrome.exe	96
PID 3832 wrote to memory of 632	3832	chrome.exe	96
PID 3832 wrote to memory of 5056	3832	chrome.exe	97
PID 3832 wrote to memory of 5056	3832	chrome.exe	97
PID 3832 wrote to memory of 4544	3832	chrome.exe	99
PID 3832 wrote to memory of 4936	3832	chrome.exe	102
PID 4936 wrote to memory of 5036	4936	chrmstp.exe	104
PID 4936 wrote to memory of 3440	4936	chrmstp.exe	105
PID 3440 wrote to memory of 3732	3440	chrmstp.exe	106
PID 3832 wrote to memory of 620	3832	chrome.exe	108
PID 3832 wrote to memory of 620	3832	chrome.exe	108
PID 3832 wrote to memory of 1708	3832	chrome.exe	109
PID 3832 wrote to memory of 1708	3832	chrome.exe	109
PID 3832 wrote to memory of 3708	3832	chrome.exe	110
PID 3832 wrote to memory of 3708	3832	chrome.exe	110
PID 3832 wrote to memory of 1972	3832	chrome.exe	111
PID 3832 wrote to memory of 1972	3832	chrome.exe	111
PID 3832 wrote to memory of 3420	3832	chrome.exe	112
PID 3832 wrote to memory of 3420	3832	chrome.exe	112
PID 3832 wrote to memory of 2096	3832	chrome.exe	113
PID 3832 wrote to memory of 2096	3832	chrome.exe	113
PID 3832 wrote to memory of 4136	3832	chrome.exe	114
PID 3832 wrote to memory of 4136	3832	chrome.exe	114
PID 3832 wrote to memory of 4468	3832	chrome.exe	115
PID 3832 wrote to memory of 4468	3832	chrome.exe	115
PID 3832 wrote to memory of 4456	3832	chrome.exe	118
PID 3832 wrote to memory of 4456	3832	chrome.exe	118
PID 3832 wrote to memory of 3304	3832	chrome.exe	119
PID 3832 wrote to memory of 1836	3832	chrome.exe	120
PID 3832 wrote to memory of 4352	3832	chrome.exe	121
PID 3832 wrote to memory of 1436	3832	chrome.exe	131

C:\Users\Admin\AppData\Local\Temp\2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe"
1⤵
- Checks computer location settings
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=150.0.7871.187 "--attachment=C:\Program Files\chrome_installer.log" --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x260,0x264,0x268,0x23c,0x26c,0x7ff662e49980,0x7ff662e4998c,0x7ff662e49998
    3⤵
    - Executes dropped EXE
    PID:3796
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3832
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa09ccc728,0x7ffa09ccc734,0x7ffa09ccc740
      4⤵
      PID:4312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1864,i,7719382023835230173,5190247868788781438,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3568 /prefetch:3
      4⤵
      System Time Discovery
      PID:3408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1692,i,13175282711302665346,2422080132660292806,262144 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:2
      4⤵
      PID:3296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2168,i,12049797449802177590,14685842200657805927,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2788 /prefetch:8
      4⤵
      PID:1296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2796,i,10653592562949366172,18379408595112067205,2097152 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3724 /prefetch:1
      4⤵
      PID:1780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2800,i,6521410602805029150,618596172429161650,2097152 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3760 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4488,i,7918793939668231996,11717306396505336459,2097152 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:1
      4⤵
      PID:632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,16864491809435801310,148956501195398108,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4636 /prefetch:8
      4⤵
      PID:5056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5264,i,882340001301966719,4721958132261318973,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5256 /prefetch:8
      4⤵
      PID:4544
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:4936
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6aaaa55a0,0x7ff6aaaa55ac,0x7ff6aaaa55b8
        5⤵
        Drops file in Program Files directory
        
        PID:5036
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:3440
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff6aaaa55a0,0x7ff6aaaa55ac,0x7ff6aaaa55b8
        6⤵
        Drops file in Program Files directory
        
        PID:3732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,2066515211761828753,1957469965099403627,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:8
      4⤵
      PID:620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5292,i,12851022639845914201,12730580656993551945,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5656 /prefetch:8
      4⤵
      PID:1708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5656,i,14533433469481388519,15343065628118668043,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
      4⤵
      PID:3708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5744,i,16995683018567471003,14608347659802278749,2097152 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5920 /prefetch:2
      4⤵
      PID:1972
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5660,i,14170943440258769564,9725358031072400611,2097152 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:1
      4⤵
      PID:3420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4500,i,941168102290462493,14149305554809738029,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:8
      4⤵
      PID:2096
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6148,i,15070048071751461930,4551908452018165681,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5560 /prefetch:8
      4⤵
      PID:4136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6172,i,6835985955488243226,14582105992311516364,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4508 /prefetch:8
      4⤵
      PID:4468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6168,i,8406263513745392310,10492301543119690555,2097152 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6212 /prefetch:2
      4⤵
      PID:4456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,7583747695908429116,903228571668238254,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4412 /prefetch:8
      4⤵
      PID:3304
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,6512324852172147806,9464437797653389439,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:8
      4⤵
      PID:1836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,16642888306029294383,15047167949296128921,524288 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5812 /prefetch:8
      4⤵
      PID:4352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5992,i,11853403990947811882,14760665017974285924,262144 --field-trial-handle=3408,i,11506288164505019062,9113459377386309365,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5916 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 1289d304557fd2502a619535c0e3582e37843722af3a479b8dd5aae20cac8480
MD5 59b6185e9cda84ec00c36dade1884021
SHA1 64be2e03ffb9c65fb8d2004507516768cbfb02b0
SHA512 5667c5e7afb57baffde51810ec3737e7bf151a26e6579dfba41be5c5aa22417bd9722db15855d83770f543ebf6ec6da6edf2c3344029ba7726d9b0a097a87529
MD5 SHA1 SHA512

Submit Download

3440_13430766991957147.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3440_13430766991957147.pma
Size 696B
SHA256 bdb30a960ba8830206fe28172fb87db24c9fb3aacae7172cf53e5b9257277ac5
MD5 bd07ca82edca802ea8662009b29d532e
SHA1 f247cab3f7cc1a3f83b9fde1e665520af581ec10
SHA512 5ce52c6ba502ee54b4312b3765e54913df47027e855f6b4292a348d174068f5f52859f50ec3da624c49844aeb158a94f240d7413ef376a4feac9eef89ed49069
TLSH
T1F501C94AA3144F67CC468E3584BE27512BB5FA501F821BBF7B10724F2E021C89E99168
MD5 SHA1 SHA512 TLSH

Submit Download

4936_13430766991996626.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4936_13430766991996626.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 7KB
SHA256 ce538290d208380fc866ea080856a43ea04f283ee5393c10281ea232ef8fd285
MD5 3543f939bbb140a67443b1cadd278ebc
SHA1 4588a2e5cc489cf2a25973503586389480aab1d4
SHA512 a8e3892d3e145ba075f972226120abadd1a7a65455f21548ab75feb84f203eb5fe47cdf050f47ef85d68c9a8bbc39f49d44e977ec3a0c61298f5e9949fdd8931
SSDEEP 96:XbaqLL32mxmwLThK3FK3Iii7OCFK/IIB1hK2DK2mgVWMti+B0:mmCm3+NhKPRgMi+C
TLSH
T11FF19DAE9E02486F3BC1DB2B336365516E7B2419C7D898723BDFD105F0CAA65001F6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 9KB
SHA256 584ca8334c099b2733a22f9a0f533dd1c0214c12d33a85954feeb590229dce48
MD5 87e5d1dd843d7cd38c13f14a69201b37
SHA1 44f42fdcf384ed40011f4a629817bd9609569d9e
SHA512 dd73ded950998c90f53212c9938ee96b48d418f635eab1fc6a9c51ecd7dece4a67f12f2b389f85560c2b07b0bf57e6bc892e29c12ff04be396bf809b6712adb6
SSDEEP 96:XbaqLL32mxmwLThK3FK3Iii7OCFK/IIB1hK2DK2mgVWMti+BcYiO4hK3eK3zi0:mmCm3+NhKPRgMi+u5Cr
TLSH
T1CE12BFAD9E02486F3BC1DB2B336365516E7B2419C7D8A8723BDFD105F0CAA64101F6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 2607de90f2293e5dc2145f6fcd437367df06b92c4cbd1178a397aeb171104cc7
MD5 79378c146f4914f6234384b7eac7b9c4
SHA1 c322f25f1eed4cacf423af69f92ef8925dd9a767
SHA512 244c38de19e19e6192d713fff9b9bdaeccc164f4339325c09055650b4d82894c3b77b392bcbc565f9d2c22ab1e325b03719962a3d6397b8271b54314cda6c45f
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 7bf776fbba5960022440d9e72d1178cf9abc3d462b3b838937c6cbd366432560
MD5 7a54a432e962bfd7e58846e69ed617fc
SHA1 78f1b1d3130df6cce070eb4381ef75a65773fff7
SHA512 a9053648c5845a82bef4e9e15fde006e545e9b7764df9593e0991cd22bae63fff5e7d37f702d7b52350297d51d538781df311926a1a71810580cd1d1afe39800
TLSH
T1DCE02BBAC9A1EC3B39FE171860558786F750535B2740895B7A3D950C8FF0B3B5A8A81C
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ba64c1863bc6f7ec25ca3a1f11ce37a4c93218cfe1b8c1b20832387879d7b1c0
MD5 b97ec3da2302ad12b19cfc21ef04d6ae
SHA1 697afe08ef95ffd8fdd12a75041667467d9fb127
SHA512 a697db53474a9ddaac5e40918ccc2ecfbfdbc37da5f97a05f29a54197e34320db8ebdfbddd3bf361e3d90abc019654b2e959bdbe04e60501b3c30cc8c4947ef4
TLSH
T17E416BF7C3E4867D891156F4AB156F1FCE2D0924432D3CA6C8D4AE5B93E2871D20169E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 25f34f57441de6e25c3aff215710ce27d693fa0e1175d04c436e105b735602fd
MD5 b7907edfc6e732a347d278e04693ba20
SHA1 7cb9b32451bc31d820ab623943404899cd31f786
SHA512 f280bdd5c3064da14fba355866100e4488c017c29b08c877f2185f3ba6ab1469d5c7cc1064f4e362cc9ec5661fffad55c3335e951b9e79f47e0a32a5f519fcd7
TLSH
T102417AF7D3E4D67D890152F4AB156F1FCE2D0924432D3CA6C8D4AE5B93E2871D20169E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 9b93fc9b19e2e12d2f430738d909d2e2831ccafdc229ad0eae2c8f0e2969e83f
MD5 96bab3915ce5e58b1e580e97a1159d81
SHA1 007347d5f4a5f5d04f4652ab8c9bebc4afb13974
SHA512 3cd43312fdb0db1c66ceb5edc30a9bfed8ab1334a3b659f56dc324b985e0d40ed51e7da2f8d7c2e4c215bd28f0390acd09fd081fd3c37c0cac31367988a2678f
SSDEEP 192:SRrz9Hv7gs9PRp2qXsb+WNnVj2p48jaa9MjUiyIsnAUge:SRrz9PEYXNXw52baaie
TLSH
T10F32B36DBA11793BACDBD31AFA257753D3F4202660982ED4E6F8A42C14D76CD222B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 c528a55c1d66087e33fda043982579b2b3d95d4603df3acfcb49030c54b6d35f
MD5 7358c20cc30a490dde55be4461e034a2
SHA1 70498fe142d62d62ca40428f94b7463baa5b526d
SHA512 64a3639573a000a8ed4354d6e59b5f2eedbfe3d7658ce18e97d6d603453e3e24e02f5622338aaeaa400bb9f6daf6a49d28654cfffe9483054332294b1cc8d530
SSDEEP 192:SRrztvWHv7gs9PRp2qXsb+WNnVj2848jaa9MWUiyIsnAUgE:SRrzkPEYXNXw52aaaBE
TLSH
T10832C62DBA017C3BACDBE35AFA267743D3F4202660942ED4E6F8952C15D76CD221B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 0833fc68041bda63506db28ca7781a9f82ec03a69782e718f834546d5522c36b
MD5 63c5cb856d89980d6f5318ce9bdcfea1
SHA1 ba6873ab702a9ace54409bc40bd670ec24bf6a82
SHA512 3bd280950a1b96d1e64bbc70e7fc5598e4da50258e68fa4b4c1431f0fa1ccfb896ca580a22475cb54d962cb1d4a36c2d1a015db40e069654ef0c063dad85381c
SSDEEP 192:SRrztvWHv7gsVPRpOqXsb+WNnVj2748jaa9MkUiyIsnAUgE:SRrzkPEYX1Xw52Naa9E
TLSH
T17242C629BA013C3BACDBE35AFA257753D3F4202660942ED4E6FC952C15E76CE121B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe58a5b1.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe58a5b1.TMP
Size 3KB
SHA256 c14b274f55dba116641a4a2b8f20bf465c66f99103845f98176802b5d543dbf2
MD5 3d5af0e311c3183a6037b89bbfd4df0a
SHA1 51d63a27c98a36af77f809343179c1035f3af6cd
SHA512 1899b0551f0c70d4610bc4c1874970c40fbcb786100967d054bac81236f79727c7d70c441f3fa854cce3677e0d7e7352409b082aa9761117e01632e3f7962d34
TLSH
T10B614158C5B84CBB4DF97774787A1B81F921113B06101C0A3ABE498C2F779AB8084F99
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 df3f3d7e8eb52eb11376e73179228426d3d2d5efef9c19d4d305887505e18b02
MD5 cf7fedf8f7d2c16e2ee32aeccb0d6abd
SHA1 c0965f169b36b690aaf700b8f80359944a908774
SHA512 0f7e0c7f513e4fbb8754c44a17604a17a368e18bf06088e8c92d246667c4707e4e019b978bfef2975410552144093cebfb7ef11074676b8e4908dde7b23f6a1f
SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9H9IB3Wh/+:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcx
TLSH
T16F32C727948D9A3F4FECD55CDC526F4F6DB1029272780C2896FB9C0403A97CE115A1AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 d37c19ebd74f35944bc6fd2036571cc4534cd9b6c85e99d632547a737abe9995
MD5 2a32f02adaa7f4060f60b704f4bd247a
SHA1 943eae2499960e40bd62e9497c12c2396c43c835
SHA512 3b40fbaf230cf83e331d08d04270ad0a80a4a0c2947ee592d7577d4e1d6787b074b204b037eb529b95fd13c934f3e599016759e1a756fc032f764ba744f626b7
TLSH
T190B01209808B5791E84085B41159944636507E319500570F87E05A95CC472D0425E214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 d4be569b2bf96ba55943dcdfb193ddd9851e248e85d335c9fb5f7f95c4651982
MD5 2ec1e7c1d2cfae6429909f2226aa7b95
SHA1 09b8de585cb231f35efe844611efde89e3bacce5
SHA512 56d55378eb7f282a80a398127ae897db494b126ae95b26e9e2961e1b38a8a67b10f39058cb86c3e1b509f6d4d0cce9eb96be1a3d298852e222d22af4320f5eed
TLSH
T131A0022051C81457DD405371F0B18991665388295DD1570B549609C7895F1C8D245124
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 236KB
SHA256 2aa5cf484863a9f90fef4e7a93dd9f955fae015eb16ac84d93a0cc1c90f844dd
MD5 0fb7fbfa4272a24f7a3a48501ed67c2e
SHA1 63d77ae30cab74c96773fecd4be3d5b1fb943741
SHA512 b2c2d0a95490a8ced1ecbedf8eb911a4c56fe34c75cfe3030ef3683af68d342cb7632d26c11ce11e3e89493c50f98dce8e57638c4a87a653150d8b240e07c8fe
SSDEEP 6144:V2YX4NwhgqKR4ILo59R57lOYo8+m7Rkm1tYpBeh2BAo6:V5oNweqYhLw/7l39oBGcAo6
TLSH
T18E342372DD326BB95CB9BFAF300C2A290FF1979AD568D942D8C47A04335E5984B0993C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 af88edd2e98785f8e48f439cc7669fa69793c414bd9ec682946434ee7d3bc86d
MD5 d5d37f7c18385b97cf3b84ecdc53fa05
SHA1 fd0c4052cee1aba51cd8c0db4e8b8d857edd5c42
SHA512 ed7be4ca6596f91b7a4c6eb9ce7174b37434c6a2fc6d5f034a455d7996bbe285fb6c663ef081e4c627ea585c186a43bf669d7270e918b8f11fdb1fe62e762384
SSDEEP 6144:EDiX4NwhgqKR4ILo59R57lOYo8+m7Rkm1tYpBeh2BAo6:YioNweqYhLw/7l39oBGcAo6
TLSH
T146342372DE326BB95CB9ABAF300D1F2A0FF29699D568E542C8D47A44335D6D80708D3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 13a171426622d5ce117eb4954b39b3cd6de9d33f7b8910eab1355e2c92d31290
MD5 2ced6918dfdc9db3dcc1043ea5617e74
SHA1 8e7f05c62bc8ef465c90be61ed4570d004e3e5ab
SHA512 d19ac04c2f0819368230294ee8db4c9f5f956a6f9bcbed5f1974f461365fc3eca6c9dac42ac85d0820f91f568e1ec69a2d31990ad2ee77c222937ed85703f752
SSDEEP 3072:FGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Mm7Rkm1tYpBeh2BAom
TLSH
T1BEC3123B5E71A9765979B74EB08E0B1F1EF14AA2C930DA52C8D86A0437FA7CC1A05934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 235KB
SHA256 7171e3348add0f66b12a9de09e829ae54b73b904b6351dbec3e21f7baaaa3f07
MD5 6f0eff74dc59c77cc123c92daf9ecf0a
SHA1 cc2d0cae82d1080eb761bd2d4d272d02f0099d40
SHA512 55ff24930d05d5d87ab108583c79ff238aa5ce38befe4c5419c628c797c815cfbe4ac8919f92fde6304bd56a28da4b94b3bc291a89312e9b74a09d1fa4be57bf
SSDEEP 6144:lDiX4NwhgqKR4ILo59R57lOYo8+m7Rkm1tYpBeh2BAo6:1ioNweqYhLw/7l39oBGcAo6
TLSH
T118342372DE326BB95CB9ABAF300D1F2A0FF29699D568E542C8D47A44331D6DC070893C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-09_71f263700bc4c7c00285e49fea86a4e1_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Size 7.3MB
SHA256 24f578dce8eca6ed1d0175e294482fe6145b442048e5e4f93bbfd2ad03f5ec29
MD5 ad005e6e5d91100b5f7eb549f0bced07
SHA1 6511d444de3f23eb8bee9bcbb4de55437379d10f
SHA512 d5f24155f1ad8fed7f70e40c12cb895ab160f3e0aa0b7630bf17cfc74ce5077170231f6b0a886f5784449723b67ca7e14f7ad3f01d60d31084a539e0f11557e6
SSDEEP 49152:B4A+w1GH+zNsGRFpYiUan8Rb281FL6n+M7UxRQO5J6uqQW8v10eyGx4yJFBYwyI0:hrzXpkF0J99JIgGW45jxvdz4uzBGj
TLSH
T1EA767C13F2A501FCD05ED974CF3A56329A317C4A4BB092EF269836E11A75ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5e02e57-45d5-4b81-b864-af54e779bd34.tmp

Path C:\Users\Admin\AppData\Local\Temp\c5e02e57-45d5-4b81-b864-af54e779bd34.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e68f3399-3964-4bc2-bc3d-d86068986859.tmp

Path C:\Users\Admin\AppData\Local\Temp\e68f3399-3964-4bc2-bc3d-d86068986859.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3832_1196473296\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4116-224-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4116-806-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4116-778-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/4116-199-0x0000000000400000-0x000000000041B000-memory.dmp

Download