neshta | eca28864b66dafa3ff667d68558e59e4ec47417e4922edc272622479a0c289bd

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Size 7.3MB
Sample260812-tgbapsbl3s
SHA256 eca28864b66dafa3ff667d68558e59e4ec47417e4922edc272622479a0c289bd
MD5 3e755bbde7edfaa99dfe3822ee1705b4
SHA1 3587bb151b11e9afa1d81f5206e6817459e02c6b
SHA512 6921e0e80d9058b40b52c449ab9c1c9ff384f7cdf5a8e779b1b58a944cc75e12f923207813d3d730b16053bcb47ce137b25228df2ebee3d9ff08fc59467bfee0
SSDEEP 49152:cS5hTqk4i0LVXaj7DW0RbRtVbj4AOh9j+8lJSBaz4Pdc8cXucIlNHLIlCTg0QKBo:34XUjwAY68lcY49NrpJ8q4PA5qPXzH
TLSH
T195766C53F2B501E8D05ED9B4CF3A52329A357C4A4BB092EF269436E11A75ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery neshta persistence spyware stealer

Malware Config

Signatures

Family: Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
persistence spyware neshta

Detect Neshta payload 7 IoCs

resource	yara_rule
behavioral2/files/0x0007000000018909-19.dat	family_neshta
behavioral2/memory/5040-249-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5040-652-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5040-928-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5040-952-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5040-1006-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta
behavioral2/memory/5040-1008-0x0000000000400000-0x000000000041B000-memory.dmp	family_neshta

Executes dropped EXE 2 IoCs

pid	Process
2892	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
2004	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Modifies system executable filetype association 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_pwa_launcher.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wabmig.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Oracle\Java\javapath\javaws.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Google\GOOGLE~1\141073~1.0\DISABL~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{61087~1\VCREDI~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\MICROS~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{D87AE~1\WINDOW~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevated_tracing_service.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_proxy.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedge_proxy.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\FULLTR~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\BHO\ie_to_edge_stub.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\UNINST~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmplayer.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\64BITM~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\elevation_service.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~4.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~1\MpCmdRun.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{5625B~1\WINDOW~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedgewebview2.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_helper.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MID1AD~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WI8A19~1\ImagingDevices.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\setup_wm.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\MICROS~1\CLICKT~1\{9AC08~1\INTEGR~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~3.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{EF5AF~1\WINDOW~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\iexplore.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\cookie_exporter.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\identity_helper.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\INSTAL~1\setup.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MICROS~2.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MI391D~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MICROS~2.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\msedgewebview2.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~2\13195~1.65\MIA062~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~2\wab.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmpconfig.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\WINDOW~4\wmprph.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\INTERN~1\ieinstal.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\139034~1.125\msedge_pwa_launcher.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\PWAHEL~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EdgeCore\122023~1.106\notification_click_helper.exe	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\PROGRA~2\MICROS~1\EDGEUP~1\13185~1.27\MIA062~1.EXE	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\svchost.com	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2652	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310240950227327"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 1 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*"	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
5904	chrome.exe
5904	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe
Token: SeShutdownPrivilege	4504	chrome.exe
Token: SeCreatePagefilePrivilege	4504	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4504	chrome.exe
4504	chrome.exe
4504	chrome.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 2892	5040	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe	88
PID 2892 wrote to memory of 2004	2892	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe	89
PID 2892 wrote to memory of 4504	2892	2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe	90
PID 4504 wrote to memory of 2376	4504	chrome.exe	91
PID 4504 wrote to memory of 3980	4504	chrome.exe	92
PID 4504 wrote to memory of 2652	4504	chrome.exe	93
PID 4504 wrote to memory of 3980	4504	chrome.exe	92
PID 4504 wrote to memory of 5560	4504	chrome.exe	94
PID 4504 wrote to memory of 5560	4504	chrome.exe	94
PID 4504 wrote to memory of 4156	4504	chrome.exe	96
PID 4504 wrote to memory of 4156	4504	chrome.exe	96
PID 4504 wrote to memory of 1108	4504	chrome.exe	97
PID 4504 wrote to memory of 1108	4504	chrome.exe	97
PID 4504 wrote to memory of 2608	4504	chrome.exe	98
PID 4504 wrote to memory of 2608	4504	chrome.exe	98
PID 4504 wrote to memory of 3260	4504	chrome.exe	99
PID 4504 wrote to memory of 3260	4504	chrome.exe	99
PID 4504 wrote to memory of 2188	4504	chrome.exe	101
PID 4504 wrote to memory of 3900	4504	chrome.exe	103
PID 4504 wrote to memory of 1120	4504	chrome.exe	104
PID 4504 wrote to memory of 3900	4504	chrome.exe	103
PID 4504 wrote to memory of 1120	4504	chrome.exe	104
PID 4504 wrote to memory of 1544	4504	chrome.exe	105
PID 4504 wrote to memory of 1232	4504	chrome.exe	106
PID 4504 wrote to memory of 1544	4504	chrome.exe	105
PID 4504 wrote to memory of 1232	4504	chrome.exe	106
PID 4504 wrote to memory of 4544	4504	chrome.exe	107
PID 4504 wrote to memory of 4544	4504	chrome.exe	107
PID 4504 wrote to memory of 5488	4504	chrome.exe	108
PID 5488 wrote to memory of 3328	5488	chrmstp.exe	110
PID 5488 wrote to memory of 2632	5488	chrmstp.exe	111
PID 2632 wrote to memory of 5952	2632	chrmstp.exe	113
PID 4504 wrote to memory of 4604	4504	chrome.exe	115
PID 4504 wrote to memory of 5224	4504	chrome.exe	116
PID 4504 wrote to memory of 4604	4504	chrome.exe	115
PID 4504 wrote to memory of 5224	4504	chrome.exe	116
PID 4504 wrote to memory of 3676	4504	chrome.exe	117
PID 4504 wrote to memory of 4312	4504	chrome.exe	118
PID 4504 wrote to memory of 3676	4504	chrome.exe	117
PID 4504 wrote to memory of 4312	4504	chrome.exe	118
PID 4504 wrote to memory of 2724	4504	chrome.exe	119
PID 4504 wrote to memory of 2724	4504	chrome.exe	119
PID 4504 wrote to memory of 4676	4504	chrome.exe	120
PID 4504 wrote to memory of 4676	4504	chrome.exe	120
PID 4504 wrote to memory of 1860	4504	chrome.exe	121
PID 4504 wrote to memory of 1860	4504	chrome.exe	121
PID 4504 wrote to memory of 4632	4504	chrome.exe	123
PID 4504 wrote to memory of 4632	4504	chrome.exe	123
PID 4504 wrote to memory of 1272	4504	chrome.exe	124
PID 4504 wrote to memory of 1272	4504	chrome.exe	124
PID 4504 wrote to memory of 2492	4504	chrome.exe	125
PID 4504 wrote to memory of 2492	4504	chrome.exe	125
PID 4504 wrote to memory of 3864	4504	chrome.exe	126
PID 4504 wrote to memory of 3864	4504	chrome.exe	126
PID 4504 wrote to memory of 4756	4504	chrome.exe	127
PID 4504 wrote to memory of 4756	4504	chrome.exe	127
PID 4504 wrote to memory of 3168	4504	chrome.exe	129
PID 4504 wrote to memory of 1348	4504	chrome.exe	130
PID 4504 wrote to memory of 1504	4504	chrome.exe	131
PID 4504 wrote to memory of 5904	4504	chrome.exe	132

C:\Users\Admin\AppData\Local\Temp\2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe"
1⤵
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
  "C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
    C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=151.0.7922.108 --attachment=C:\Windows\SystemTemp\chrome_installer.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater.log --attachment=C:\Users\Admin\AppData\Local\Google\GoogleUpdater\updater_history.jsonl --initial-client-data=0x294,0x298,0x29c,0x270,0x2a0,0x7ff607564708,0x7ff607564718,0x7ff607564728
    3⤵
    - Executes dropped EXE
    PID:2004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffdef63c728,0x7ffdef63c734,0x7ffdef63c740
      4⤵
      PID:2376
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1656,i,92742269641624843,14861313306168200563,262144 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:3980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,7647477641310742174,8529541647405563693,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:11
      4⤵
      System Time Discovery
      PID:2652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2088,i,7840898251733083219,7246170939894305203,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
      4⤵
      PID:5560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,14223949184616536675,2762544756375438185,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      PID:4156
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,12327332732976539048,17749654458265063248,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:1108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4660,i,13172719627906261174,9817369348450981217,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:2608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4808,i,5346787607998650477,17695624614782243286,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
      4⤵
      PID:3260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,8477301267209908031,11217001661119846453,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
      4⤵
      PID:2188
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5620,i,18217471889721805061,14439445522298252785,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:1
      4⤵
      PID:3900
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5608,i,9765965037465612222,7706153837380082845,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
      4⤵
      PID:1120
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5908,i,6390294512469961251,4766538705244415788,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
      4⤵
      PID:1544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5672,i,18402879993744833044,16233995422098546032,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
      4⤵
      PID:1232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5944,i,15611475042777777695,621129864370722191,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:5488
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7114555a0,0x7ff7114555ac,0x7ff7114555b8
        5⤵
        Drops file in Windows directory
        
        PID:3328
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:2632
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7114555a0,0x7ff7114555ac,0x7ff7114555b8
        6⤵
        Drops file in Windows directory
        
        PID:5952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5964,i,7604103200178757069,14636005398970869961,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
      4⤵
      PID:4604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6372,i,2244116796168057176,9363903101794302098,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
      4⤵
      PID:5224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5888,i,3238818178940169083,14803540974804017463,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
      4⤵
      PID:3676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5948,i,11030136404534609790,4613493478859253765,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
      4⤵
      PID:4312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,9620335892801967377,13697764172131635853,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:2724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,9947182194537794165,11932055924881137523,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
      4⤵
      PID:4676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6096,i,17666135726362597690,3581319609077763078,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:9
      4⤵
      PID:1860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6180,i,16621395079649150877,14580102827577188680,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
      4⤵
      PID:4632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5696,i,15081975059956024781,4764699153104243619,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
      4⤵
      PID:1272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6140,i,10686753973683878403,15232233305488068440,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
      4⤵
      PID:2492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5684,i,16084984985049513916,17441464842605115783,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:1
      4⤵
      PID:3864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5660,i,7500896082375742808,8572888266784112942,2097152 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:9
      4⤵
      PID:4756
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,4499058372909802472,12720720711232039111,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
      4⤵
      PID:3168
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,9533211979927543057,4213585832972954818,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
      4⤵
      PID:1348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6008,i,3626582071565591658,971364452827172628,524288 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
      4⤵
      PID:1504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6028,i,1945436518138337020,4705714454454358084,262144 --field-trial-handle=2324,i,3434393825417220301,6520835623575929571,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5904

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ACROTE~1.EXE

Path C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE
Size 86KB
SHA256 ded54d1fcca07b6bff2bc3b9a1131eac29ff1f836e5d7a7c5c325ec5abe96e29
MD5 3b73078a714bf61d1c19ebc3afc0e454
SHA1 9abeabd74613a2f533e2244c9ee6f967188e4e7e
SHA512 75959d4e8a7649c3268b551a2a378e6d27c0bfb03d2422ebeeb67b0a3f78c079473214057518930f2d72773ce79b106fd2d78405e8e3d8883459dcbb49c163c4
SSDEEP 1536:JxqjQ+P04wsmJCNgh/sE/EkHd0Ci2zkQASqk+H6L2C:sr85CysEM6GC+QA8+HlC
TLSH
T17493AE13FAF18872D1621BF89C29E359C93F7A306E3056A7A3E40D5D5D747C26C2924B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2632_13431024095283243.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2632_13431024095283243.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

5488_13431024095339234.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5488_13431024095339234.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 f96467cc76ded029506471a02f78cafe26b8a65a799a3914265b1f5c0497b5a2
MD5 eb46038d9fb86bd59ec05f0963f3d282
SHA1 36938b8681fbe531eecdf9587e3fc1d6ea1fd1a6
SHA512 27c25b50ef70fb6c8461e8895a524b826a19c3360678625cdae215e26650d4d1d83e65e39b26ce59818711ccd12c318fb91c7ad39525809491ddf04982641c99
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 289a49c5236a72399a4775ebf2d26d80f28f49f6eb25756f5de04829292dc4e4
MD5 73055d523d49020ac1dd010a200e3f83
SHA1 be7bf9ef0b9ad019d402c286e6f9a7c6f0beaffe
SHA512 4e4de6c9871a2ce2e7ee1b292d56b283929837ffc2c7707d4ad0677e241220500ad8a73205e61687289a740aaddd810f069be499dff477d1901dd6684dc7a081
TLSH
T18F51CDB7C7D88A7DC81192F49B256E2FDD6D0A18132C3C62C9D8AE4F53E2872D21134E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 93b5e167330244d9a0e8cfbfa980823df4275610d84655266ec9102b1819d3e4
MD5 0d08b7db038b4fa33d8e2796bc0f642f
SHA1 44bbdb293285687b77ffc1f2c4b48974af158867
SHA512 15dfda9380b363cbf4f068669ce3f06cdf443d1d128c185b5ad0e8d39178989bc897895c58d56ed4976997a999cda2a1089409b9b2776c75260f221b0f5e1d52
SSDEEP 192:DRmsRxv7yvAPRp29Xsb+WNny62qAD2o6kiyIsnAUgR:DRmsRh26XiXw32qG2omR
TLSH
T1FC32A42DA918747B5CDBE22AEE617B57D7F6102125D02E84E7FC883C18E76CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 cfd8808b9c7f868fcc3a7725f6682afccef0546dba7d2905fd7a8d2907944789
MD5 c6920a29ba60d2b5cdb88d840fa523f1
SHA1 a1d5a5dbc023333006afbd488c3b1dd1bfc68cb5
SHA512 32982b225bb807fe915fe848f0db88881bd6d65f78e4b96546496ef42f660f3c97e2ffe99ee965c773025b5fcb7bcc9c3a765b547e49efd986cb3c2485ce8484
SSDEEP 192:DRmsujSRxv7ypAPRp29Xsb+WNny62qAD2o6kiyIsnAUge:DRmsTRh2UXiXw32qG2ome
TLSH
T15A32B42DAA18757B5CDBE21AEE657B53D7F6102124D42E80EBFC883C18E76CD2223417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59f1f7.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe59f1f7.TMP
Size 3KB
SHA256 af2a2cf045da381443ea35533bfbe98e68a998c91f5080adce3f5f539ac7d5a3
MD5 1a5538503e50ae98b2ca5b6cc993d726
SHA1 082982418712c7e799d7be65100ee0a86ed2d0bb
SHA512 379f03b8b14ed0c38e2f0cbc7847cc1e93a57d226d67e3a298d647a7efa97ff11f536edd76a2231413f134abbc11fa030d0af32c8f10d7c6585f251407e89002
TLSH
T19E6153AEC4685C970CB2BB75787A0782FD61463F4595280A3A7D19CC0FB7DA74084FAB
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 945555a06d4094a2c44959e3d2eb3529eebb5338d0ac4738d2dd5241ff83f612
MD5 cc8bb397ee463ff20366a4df55d57eef
SHA1 265187b9465c9aa9b791002c1e7b0c668c9b3b2c
SHA512 847230635489ca199988a9500d0ca2602b3d898cfb9177f30f03c106fcc1eab10a6715dc7685afa4504dd5c945beaab312fe138ae46195329426090631852931
SSDEEP 192:e3Q4K6NE+97KxkXqK4I40pUZNCgVLHrKHfFKslE/PRXzKD/8E+d+ErUkKN9t7vNf:WQjZ07KxkXqKf/pUZNCgVLH2HfgslSRU
TLSH
T18B32D967A48E9E3F4FD8D90DDC52AF8BACF5019662780C2493FB6D0403957CA114A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 09b32e9f5b045eea852053f2669de6ecde978680ae144d613af5f4a6894d158c
MD5 54ab0abff765ed5c31de9988ad479df0
SHA1 c58e2d69025943182c78199747b410c85e195f5e
SHA512 f2220833bec8fa277e193a12c554356b19f55480d47a23d28fae42ed62d4eaec4253c921307eb8b6d350a4aa2ab613f201a257273ede1aabff5ae109a77f8b0c
TLSH
T161B01214804B5B20D80081F02319504832329E31A050174383F0A9D6CC530D04353108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 f2117fdc29dc47c694aa7c08db1716be9f39f35a2d76d181544bfee7034f57e3
MD5 87cd1c9fe0e92650b5721c9f64841007
SHA1 75a037bc2101f879e5fa643c7d25b4f080e113f8
SHA512 2c5158cae04ea4ad71bf6f6105c9dca789a565c9af1b311d3873d95b5996e3c6cfd11a33bab2a6887c8e927189bf57d7812518b6bec8823a814c31ca8bd8a89c
TLSH
T19AA0021091F58C16DD014270707B0A412B51A8E62992431394E60894C89F1C182A2510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8166.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a8166.TMP
Size 48B
SHA256 00f498366d3d9e99ddbe08a93ae5929ac84d05de611773d3ba064347ea338459
MD5 ed2b1fe580efafd7c1285b5966c48b5b
SHA1 c0bcb6d5e075be02aa743c3e6a792ca213a87c65
SHA512 80a7f7ad6dba949e6f6efd4601661a48be02426b314d6e0832d528134a017dc1acd7727ca15113cacfb7527f483e1f1ff7075130557ff47696b8b3f14f2ae0b9
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 da9f79ba7dd71e89bb88dcc9028d63fd7c3a7e39e8ca95c34114fa769e5b52c5
MD5 1fb9f17af1a943af86ccf106211962cb
SHA1 4cbf710b7137c9315a5bfe40cd0f124e211fb04d
SHA512 401f5a6cde9109b8baed64256cc47a0ec8bd2e70aed0d3deea48598e9cd272ec1f08632f7657c5414d8c9fed0708aef01bcaa2337ebad6d72a9fa799e2d788fe
SSDEEP 3072:4jyipVv/+bzUz7sxmT4zxHKmcHTxmmS+t3x9czDGYmlpkXaa:geUz7sIT4zBj23SGBkXh
TLSH
T1C3D312FDF826FDB3DC3A1218068B28496D4290AF90556733DADDAD4A17076DC2327872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 3af5fc84f779d5408cc584dad9bfef9d947aebd7a77a056dad0e02eef01d46ac
MD5 facd478b1276ba826154c245a6edb1fb
SHA1 491e21b00a53d51f37bda8585ef972e1572342ea
SHA512 64a2678564c421272c6ad4c76ac62c38b4945870f915a2d178d519ce5ead74987f9bcc932a542e47364a6700f817c2e32dc07d7bec59e6dc469ec7697563eb7e
SSDEEP 3072:TjyipVv/+bzUz7sxmT4zxHKmcHTxmmS+t3x9czDGYmlpkXaa:/eUz7sIT4zBj23SGBkXh
TLSH
T144C312FAFC25FEB3D8395328064F284E6E4280AF90551773D7DEAD5B17076982227872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 de04dbdf05a72b1afa97a9d9f16e8c9a4e58003d69f8516ce3b3e8325f421b1c
MD5 00d5356bdefb20969dc313e883915c01
SHA1 a708120bb2a51a49e01adafc4ec6f52094dcb296
SHA512 fdf8fd8d306803c6a74ccf14f94c945c092bb5a8a7238ccda83a7cfc62214b514bb5dada06073e77ce0b39adfe75e7d85b0cf76c9362eeeb7cd8955fd1072c43
SSDEEP 96:xC0d+EZUAbKFKu0d6aF7QuGJfmbE13IERDotok5OlD+B60GyvnnXzlbKmb0v4a:xC0PtbKFKu00UUSb/iDUD++ECXzlbK7
TLSH
T15AA12C72A4698D735979E54ABDA22E03CF74E12B9E229F54D9CD0F0C04F71E81342627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 fd9e833b55b606215e6fcb6ce35c76eaafcd273cf9becc03d5f04e97ad6bb5cc
MD5 36f91d0bff5b7e76affea3671fd4332d
SHA1 4a97b342b2504d081a2173fe8e96e8df3f6f63e8
SHA512 a29f3d7a8e7eb30b5fd912cac1802baa98fc7d2516db6a7a6239e643e90cd093d624a768465709f2e1fe885fc9d78a63f346eeed2bb66dff0a56a8e8bd7ce017
SSDEEP 3072:JjyipVv/+bzUz7sxmT4zxHKmcHTxmmS+t3x9czDGYmlpkXaa:5eUz7sIT4zBj23SGBkXh
TLSH
T170C312FAFC25FEB3D8395228064B284E6E4280AF80551773D7DEA95B17076982227872
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe

Path C:\Users\Admin\AppData\Local\Temp\3582-490\2026-08-12_3e755bbde7edfaa99dfe3822ee1705b4_cobalt-strike_elex_glassworm_icedid_neshta_njrat_ransomhub.exe
Size 7.2MB
SHA256 d9b3b694b8d0e0e0ee3e603f04b887ce617c744770c8cb741f952b7ffa76fd04
MD5 12f65cf3b79719ea1a4b4d1fc9d0feb3
SHA1 0f193c09741448585c1bf5cb25e606fe2bf37711
SHA512 41d5762a3d8dc7aef437e8ea5d7dd70aae6736320a294deaaabb9a3069e6c62b7dff70576a6db85cf9387ff968635ba998a1e8b95b60fd086eb3bec9ea7b7ef2
SSDEEP 49152:zS5hTqk4i0LVXaj7DW0RbRtVbj4AOh9j+8lJSBaz4Pdc8cXucIlNHLIlCTg0QKBD:O4XUjwAY68lcY49NrpJ8q4PA5qPXz8
TLSH
T175766C53F2B501E8D05ED9B4CF3A52329A357C4A4BB092EF269436E11A75ED47B3CB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4504_2118057793\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 a048e1535e30da74cb7e6e78c1f6aa26539095310a91ab26d04af7563f4d8af5
MD5 ff1c488c2cccf4a3dffc1333c85cfc83
SHA1 0090a8cdd41e1472840d7d2ccc80a954224cd8fe
SHA512 89dd364de04caca621785d3c1e61f2701a3480672e74778f0449cb1b36cc2edb44b2a1d9fa6b48a177ec46a3100c813fd3a32a96641a5cf4fa7a74a7819ed595
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 5KB
SHA256 6ed363f5e7609a8bc5d920820f12d1f665a56721bc8c62e45bab0c43226c0423
MD5 f89a939a01926d506865ca4687c5255e
SHA1 9e5659df9cb41e83fc8e748a374e82771630d0d7
SHA512 dd3287ad44018a1f25239c34d169cbe8a99078a591530c2a6104473e0bdfc4ed9f37bdc01e0e152806c00cb6253307b0ed0f4fec5a17075be9fd65b90c2f0e1d
SSDEEP 96:xna1zeXQdTf6GahK2AK2SGtSgzZDMOTXApz8:41vduGk80R8
TLSH
T17DB1B0DA8E0284FF3AC28F7B334331A56D67540EC6E8A57237DBA506B0CA974051F1A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 60cb6ccd24958146df77d64a5f1f16ffd4be1da1f12bafd0f8338253f6d0fec4
MD5 6a07bfd4990965686b0499c838f75da6
SHA1 a8c64ce6cfe10f99566b50eca6b111bf4ee354cf
SHA512 3f5fd363a205ddc102ad99070ea3533c63ac42571bb232fa9901b317e53ce76a2b65ae0799ef1baf8b15473fc16c7138d6d771cbf0c6b67f18a381078eb33f4c
SSDEEP 96:xna1zeXQdTf6GahK2AK2SGtSgzZDMOTXApzOs21chOXi400M4mIhK3Y2K3+pO6O0:41vduGk80RzG+l7
TLSH
T17DE1ADDA9E0245BF3BC19F2B334331566E57540AC6E8657237DFA106B0CA978051F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5040-952-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5040-928-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5040-652-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5040-249-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5040-1006-0x0000000000400000-0x000000000041B000-memory.dmp

Download

memory/5040-1008-0x0000000000400000-0x000000000041B000-memory.dmp

Download