88d0b2d8734f4d84a53cb623b0d41e3d3ac5d851d8a97cc18d12808bfb5d0211

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 19:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 7.3MB
Sample260812-x6c3datdlc
SHA256 88d0b2d8734f4d84a53cb623b0d41e3d3ac5d851d8a97cc18d12808bfb5d0211
MD5 0a6904efbe99a04b606434a7027e04b0
SHA1 b2d6b5cfd28d8afbf565c673cf24d8ba5478d0ba
SHA512 0a48e96f51e8c644d8f6ab626e3dc1ae9fc5983b6f2a1afc4b0499b1eb423fc09ee8d8b5ace649e049ac8c4b611dac3fe1f246034039c6ee439678d98bc14181
SSDEEP 49152:PabH/MLhT/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKK6:hmWQtZ/K0tGOFWVRuLftCT
TLSH
T1F2765A13F6E940E9E0AAD178DF3586219B727C5A8BF1A4DF324036D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1816	UpdatAuto.exe
4676	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
1340	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6064	sc.exe
2336	sc.exe
2644	sc.exe
460	sc.exe
2264	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5996	cmd.exe
1100	cmd.exe
4328	cmd.exe
968	cmd.exe
1204	cmd.exe
3472	cmd.exe
4468	cmd.exe
352	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310364734526628"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
3088	chrome.exe
3088	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe
Token: SeShutdownPrivilege	4520	chrome.exe
Token: SeCreatePagefilePrivilege	4520	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4520	chrome.exe
4520	chrome.exe
4520	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
1816	UpdatAuto.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 4468	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	90
PID 3512 wrote to memory of 1816	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	92
PID 1816 wrote to memory of 352	1816	UpdatAuto.exe	93
PID 3512 wrote to memory of 4676	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	95
PID 4676 wrote to memory of 1340	4676	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	96
PID 4676 wrote to memory of 4520	4676	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe	97
PID 3512 wrote to memory of 964	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	98
PID 3512 wrote to memory of 3472	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	99
PID 3512 wrote to memory of 1204	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	100
PID 3512 wrote to memory of 968	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	101
PID 3512 wrote to memory of 4328	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	102
PID 3512 wrote to memory of 1100	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	103
PID 3512 wrote to memory of 5996	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	104
PID 4520 wrote to memory of 2924	4520	chrome.exe	111
PID 3512 wrote to memory of 460	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	113
PID 3512 wrote to memory of 2644	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	114
PID 3512 wrote to memory of 2336	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	115
PID 3512 wrote to memory of 6064	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	116
PID 3512 wrote to memory of 2264	3512	2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	117
PID 4520 wrote to memory of 4932	4520	chrome.exe	123
PID 4520 wrote to memory of 5092	4520	chrome.exe	125
PID 4520 wrote to memory of 5092	4520	chrome.exe	125
PID 4520 wrote to memory of 4596	4520	chrome.exe	124
PID 4520 wrote to memory of 4596	4520	chrome.exe	124
PID 4520 wrote to memory of 2668	4520	chrome.exe	127
PID 4520 wrote to memory of 5068	4520	chrome.exe	128
PID 4520 wrote to memory of 2668	4520	chrome.exe	127
PID 4520 wrote to memory of 5068	4520	chrome.exe	128
PID 4328 wrote to memory of 2100	4328	cmd.exe	129
PID 3472 wrote to memory of 1832	3472	cmd.exe	130
PID 1100 wrote to memory of 4952	1100	cmd.exe	131
PID 968 wrote to memory of 5220	968	cmd.exe	132
PID 4520 wrote to memory of 5896	4520	chrome.exe	133
PID 4520 wrote to memory of 5896	4520	chrome.exe	133
PID 1204 wrote to memory of 5004	1204	cmd.exe	134
PID 5996 wrote to memory of 3228	5996	cmd.exe	135
PID 964 wrote to memory of 4616	964	cmd.exe	136
PID 2100 wrote to memory of 5112	2100	net.exe	137
PID 4520 wrote to memory of 2440	4520	chrome.exe	138
PID 4520 wrote to memory of 2440	4520	chrome.exe	138
PID 4616 wrote to memory of 1924	4616	net.exe	139
PID 1832 wrote to memory of 3352	1832	net.exe	140
PID 5004 wrote to memory of 2512	5004	net.exe	141
PID 5220 wrote to memory of 3492	5220	net.exe	142
PID 4952 wrote to memory of 5720	4952	net.exe	143
PID 3228 wrote to memory of 420	3228	net.exe	144
PID 4520 wrote to memory of 2712	4520	chrome.exe	146
PID 4520 wrote to memory of 1208	4520	chrome.exe	147
PID 4520 wrote to memory of 1208	4520	chrome.exe	147
PID 4520 wrote to memory of 2588	4520	chrome.exe	148
PID 4520 wrote to memory of 2588	4520	chrome.exe	148
PID 4520 wrote to memory of 2964	4520	chrome.exe	149
PID 4520 wrote to memory of 2964	4520	chrome.exe	149
PID 4520 wrote to memory of 1736	4520	chrome.exe	150
PID 1736 wrote to memory of 4308	1736	chrmstp.exe	152
PID 1736 wrote to memory of 4184	1736	chrmstp.exe	153
PID 4184 wrote to memory of 2248	4184	chrmstp.exe	154
PID 4520 wrote to memory of 4612	4520	chrome.exe	156
PID 4520 wrote to memory of 112	4520	chrome.exe	157
PID 4520 wrote to memory of 4612	4520	chrome.exe	156
PID 4520 wrote to memory of 112	4520	chrome.exe	157
PID 4520 wrote to memory of 3984	4520	chrome.exe	159
PID 4520 wrote to memory of 2516	4520	chrome.exe	158
PID 4520 wrote to memory of 3984	4520	chrome.exe	159

C:\Users\Admin\AppData\Local\Temp\2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4468
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:352
- C:\Users\Admin\AppData\Local\Temp\2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Users\Admin\AppData\Local\Temp\2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
    C:\Users\Admin\AppData\Local\Temp\2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff60e75b618,0x7ff60e75b628,0x7ff60e75b638
    3⤵
    - Executes dropped EXE
    PID:1340
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4520
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd27cac728,0x7ffd27cac734,0x7ffd27cac740
      4⤵
      PID:2924
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,17038117907427989057,6141492656105631006,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:11
      4⤵
      System Time Discovery
      PID:4932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,13302348483469946915,3587695066519151346,262144 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
      4⤵
      PID:4596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,15885898011770613181,8620787309313646546,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:13
      4⤵
      PID:5092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,9661059836613916176,13694975901720354763,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
      4⤵
      PID:2668
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,9703335597576458991,2372055980416955188,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:5068
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,3799667065697776832,1746358554625549606,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
      4⤵
      PID:5896
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4616,i,3626761233407615867,8153799184747991101,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:14
      4⤵
      PID:2440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,8015286533470049537,8669694356143680929,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
      4⤵
      PID:2712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5464,i,4123446735535463670,2697429895992953519,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
      4⤵
      PID:1208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5428,i,4330579878184803304,10216940821318149521,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:2588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5756,i,17537574497816288933,5183092147924047525,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
      4⤵
      PID:2964
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:1736
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7895755a0,0x7ff7895755ac,0x7ff7895755b8
        5⤵
        Drops file in Windows directory
        
        PID:4308
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4184
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7895755a0,0x7ff7895755ac,0x7ff7895755b8
        6⤵
        Drops file in Windows directory
        
        PID:2248
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5416,i,16286886626268813021,13819345692367110173,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
      4⤵
      PID:4612
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5456,i,6550580494278923676,5298482235414177906,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5728,i,18320183787984320165,3752875590095251372,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
      4⤵
      PID:2516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5560,i,2561027305479101556,3574844620457501906,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
      4⤵
      PID:3984
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5912,i,1010872257129553384,12444976813456348294,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
      4⤵
      PID:4536
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6036,i,8353525316571044739,6320149230286044211,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
      4⤵
      PID:5532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,8149397496242269884,16532800349603964295,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
      4⤵
      PID:3532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,8375643844740994485,7024477028480412701,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5524,i,3092078181672465778,16209338068176737396,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:9
      4⤵
      PID:3088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,14919850729745549931,11611881690572066714,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
      4⤵
      PID:5628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,11965032182892306344,8131265955186512805,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:1264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5636,i,3572867640986096675,403772638041833649,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
      4⤵
      PID:1804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5652,i,9240270596396471992,9691763557552445218,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:9
      4⤵
      PID:264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5672,i,9337248981608506954,15687171842815736145,2097152 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
      4⤵
      PID:1808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,6058994503766361051,16901068832019714465,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:5928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5568,i,2000690943985023755,7861344322734341580,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
      4⤵
      PID:2732
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5960,i,2329838320112372424,11627292099166404702,524288 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
      4⤵
      PID:2572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6124,i,634986543882261543,8885460152260669509,262144 --field-trial-handle=1928,i,16794125710848515081,11926736949418960707,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3088
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:964
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      System Location Discovery: System Language Discovery
      PID:1924
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1832
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      PID:3352
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5004
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:2512
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:968
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5220
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      System Location Discovery: System Language Discovery
      PID:3492
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2100
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      System Location Discovery: System Language Discovery
      PID:5112
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4952
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      System Location Discovery: System Language Discovery
      PID:5720
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3228
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:420
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:460
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2644
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2336
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:6064
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  - System Location Discovery: System Language Discovery
  PID:2264

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:5804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 3.5MB
SHA256 b11bc88ace53cfbe796a163eb58351c0ebb1f9b8c5319591568b13a965b33be4
MD5 5d05c431c161b5d6813fc24e8dd89d5d
SHA1 916fdec689079ca1d1b53d6321e88cc02d17adb7
SHA512 45589232d0cf931697b33c8af26c4a548257ae9bb9972de18a6eb3531f210b48d6cfcf30aae96311ffe2e154e1edb713d700436be29b27896111319ca273e4ed
SSDEEP 12288:P4Ryed8I7r/7mHecnhzd5sXZNYVLeyUji0h90ZD0wxpGZIVuKrHs:P4R5CIH/7ELzd5c0Le5ji0hmxNrM
TLSH
T19E063A12F6648736D073C0B9C5D2965AE9313C550B30D9CB5385FB683E37BE2AA36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 3.9MB
SHA256 77f2deeb32d368a8af1af40f7d1c19c12713fc9c4c96645993c6c6dd6aa7062a
MD5 17e012d98d9bd9aa58f50e2abe09ee62
SHA1 83da7bb704997e40a48ee81f7350eb4b3d4ab360
SHA512 6f5ffe21e1c9862c2766c8a53c3361bc66b234789950b9370b67c5af7358be3655f8be5c1e82a07f1318ebfee93296dd23919dc594fb5b8c613030ff0ede0f6d
SSDEEP 24576:P4R5CIH/7ELzd5Ia7/ezSC6vUyD/aqgrvWx6q8wyu:PabH/YLhx/ezSC6vUzPvMHjy
TLSH
T1C4160916F5788327D0B2C0BAC5D6A65AFD3238460B3089CB4346A76C3D377E6963573A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 3.7MB
SHA256 e118ef3a0f1faacb3ab8f8307db96e86113112a57fbb28bf74a4d2b2a227a30c
MD5 06e93bea4fdf943739b514d5f671d482
SHA1 30a0f940802bebfa5a688e50e3f18010780d3c77
SHA512 899bf53a95c3609a2f9db1a5f4a64f798d376c109b56118ed87976d518693e38d127203bae60a87a00247dc83ebeec0d6d13e3649e4044a4993666e4a65e0410
SSDEEP 12288:P4Ryed8I7r/7mCecnhzd5AVJjBq33vb5O8M+l1D0hwsEBoW/lx4Zf0Im98:P4R5CIH/71Lzd5AVbqPb88hv/l+7
TLSH
T11D062A66F6648235D073C0B9C5D2965AEE323C410B30C9CB5385A72D2E777E6EA36732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 3.0MB
SHA256 0cb359d162384b8687c83f303f1fb912b5af6b528087f3863ef1ae33cf9359f5
MD5 eb6d3c54076e6dd675394b0f9b28b2c5
SHA1 5b0a502b6b9812f8b2c9af501a0071181eb5596a
SHA512 91f54ec1a46d64f68cfa020e50a62d79c1604977cf31b70964233692b9980f367c97bd3268b51cb3ac30bbb8345256d5b0809962a38a670ce08865f11eb30fed
SSDEEP 6144:P4RywzYmqBml6I7r/7mpeqtiHMdDNvhz4gP9MnLau8ea7:P4Ryed8I7r/7mpecnhzd5ea
TLSH
T15BE54B13A608586EE897C07979668116A9217D350760FCCFA3C07F162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 4.7MB
SHA256 cb969e1aff6b6cd702cbf66f307621f26c08262f12c65324eed912a998b523ea
MD5 983f184509ee1e704c93602d033d7888
SHA1 6e0fb62006caa7e482ee07d374fb2a3ad73b03da
SHA512 888e8330d850fbb731e264f7dc88d21db97250bb518f10d14397e6a48546fea30c692a33ab81173713bfd6430943aafe9f26b0720fb967ed155a8d3b7057e151
SSDEEP 24576:P4R5CIH/7KLzd5/wvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL01:PabH/mLh568Qg55nhoeWu7PNU3/Q
TLSH
T19E360733B2E600A9D44DD1769F468722A6E17C758FA0E7DB824173161FB2AD07B3970B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 6.5MB
SHA256 91beac59afc1647a4598a37ce1df9e156a86c4d35419fcb5958171151e057579
MD5 deb8bb629b0587ff451f4c96af522324
SHA1 b33ca99a1d5f26866f2751487d3f207d69c4ea02
SHA512 25a6393aa25a960e7e7718b2a981117b69cee29b641a45ed34f5350f978d19e70d2ed1aa2cd10b88617bf6c7e311f00023114c0809b490e1bef3ee8a9595086b
SSDEEP 49152:PabH/mLh/3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/nhs:3sy5112gYy5azzVvf69nLKnhZO
TLSH
T10F666A13F29900E8D05DD1B9974A9232EA72BC474B31B6DF0A9077522E7BEE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 5.3MB
SHA256 072a1f1174ee9926ab86f48ffcfa968118eeb8c76261700013e57c3bc279ce6d
MD5 1424e317e54c345bcc939cd0ed8c6376
SHA1 b03e4f110b763477d5a41e45981e4fce1d1d914e
SHA512 0adcbe6c5f1081f3e2076f9451ec81dd47f3342c4ac9c93b626221d492fd0b427ba71bf8328d8e13503770adeaf0e74b5cb54e76289ad2ef512e1d57b4b70491
SSDEEP 49152:PabH/mLh6B+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:32u6Jm0xd2d3
TLSH
T135467C13F29901E8D06AD078974A9233F962BC590B30B6DF0B9077562E77EE4AB3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1736_13431036473895864.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\1736_13431036473895864.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

4184_13431036473708501.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4184_13431036473708501.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 4.4MB
SHA256 afa6119be1e8e367152817eff4d07682386891200ae93afe20e608edca5857a6
MD5 8ac1d127c83a0382d7a4d3e7ac7e1412
SHA1 6a3cf25a41909108ae3ed0814f5c2e793d53ad75
SHA512 6bc3421d978566f3d42e4a55e72d48acbeade19d1c887a5906e95a8118863a5b8798f93c6fbd0440a0e0f8551649cb813e64d8ec157a185b412dfed877774d68
SSDEEP 49152:PabH/mLhHhtSn8EApI0fig1giDn0AP5w2:3oX2iwphX
TLSH
T1B5268C13F29840E9D05AC178D7568632E972BC150B34BAEF0790B7562E7BBE06B3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 3.1MB
SHA256 d43958a96d8742e2cf538464dcedc0fa02f1a32e26b856216654fa696d9c9a3d
MD5 9025285cde60cab0f9fef43575258ad6
SHA1 c3a152670770880b67a46d510e38254db91c1574
SHA512 d932540920eb63b4e4a7210009b81e5c449efbb4c2150445b34099baad798a8707cf3f817f00d2cad3c2ed3f21659d2ae96f43ac9478339a00f1dacc6d6bba35
SSDEEP 6144:P4RywzYmqBml6I7r/7mHeqtiHMdDNvhz4gP9MnLau8B3psmeI+sQFqT3Qi:P4Ryed8I7r/7mHecnhzd5qXsf3z
TLSH
T1A2E5F712E60844A9D45E8175EB568116B6237C6507E0E9CB63C0FB3E2F366D1BEF4B0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 3.1MB
SHA256 b74232c43a9f87d3faf385559fc9272af479c1e63660a68ba4dfe1efa5242fae
MD5 b55295190726de63d4ae24950d2053d3
SHA1 7e64d2bb751c84c028b5062cf1fbbbeb8a628401
SHA512 5a9727876ac83c770d1b4e60b342c89b864f44ca609ad64e004dc445606d98d3fa9c349a7276e8b5f0a43637be7d733f8652736dda6f3b02689c186ef0a850b1
SSDEEP 6144:P4RywzYmqBml6I7r/7mxeqtiHMdDNvhz4gP9MnLau85JJ:P4Ryed8I7r/7mxecnhzd55r
TLSH
T166E55C13A60844AEE897C17869628116F9317D750760F8DFA3C4BB162D337D2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 3.1MB
SHA256 2614615b18629a14c38bdefd779c46780b293b441fb64627d7627092d18abf88
MD5 6584de8423144502d5cd7d686d4a11e6
SHA1 f2807675f5d67172baaaf81c428fbcf7627662ba
SHA512 138a3623b6df57a0d80ec214726aee5c06f9b700e66705033b5dc9cc18e9e103fff240ced9adad4f3a26acd25017e79b4e9f56aa8bff77f8c4f6a629c00c24a5
SSDEEP 6144:P4RywzYmqBml6I7r/7mLeqtiHMdDNvhz4gP9MnLau8nk3nkraVT8:P4Ryed8I7r/7mLecnhzd5nqnkraG
TLSH
T166E55B13A60844AEE897C17969628116F9317D350760F8DFA3C47B162D33BD2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 3.1MB
SHA256 c982c09914a7e536e7f1ea3152dfc543954c1f91a2e0fc9394e974e7dcc652b7
MD5 75ab971611e4ea6776d832e529e247ec
SHA1 9849d71ac3541c43650e72228e008213371e43a9
SHA512 ff663e31a4ed2f76b163acefb7f62cc84683323a3211f36527b48be01c23df1655ae04d1b78061b935e878cdfa68f06f588640cb7df109f71c29fae0f6ffa179
SSDEEP 6144:P4RywzYmqBml6I7r/7m9eqtiHMdDNvhz4gP9MnLau8Npw5ySuJQX0:P4Ryed8I7r/7m9ecnhzd5NpIyvJd
TLSH
T1F1E55C13A60844AEE897C17869668116F9317D750760F8DFA3C07B162D337E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c9fdc8221801ca7391dcb047b27b8a42731972fc6422a1b5fd58e342a5148247
MD5 a02e5a7350afe7841404a43f7606e245
SHA1 a48b9e11a5d0bf6e394509e0706b222ab6766d44
SHA512 2f74d7c40f0ce3ddb9a95234605081a278f8e6677f5e4069f733bc8f22098af428820f88f80bddfc4325c99a7d181f5942bb089f33567a3836315acdae8931cc
TLSH
T10251BEF3C7E4967E851192F49B206E1FDE6D0A24132C3D52C8D4AF5B63E2872D20129E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 56ec0da94d9dfcc35ae7e0b6473e25f506de54bd3ffd029d796f8202288b26fb
MD5 79994e9789894c0da3a9c43e32438935
SHA1 fb13dfff577467864b53d9c5af270f407160d35f
SHA512 4b46c15181fa94861afdfd57271b8ffe17a1a84ae9311dc0b3b5fab169b612fd61aeb957419244ea2a2def8b6de55bd8acff3fe70dffab684ed0039157fa7c49
SSDEEP 192:MRCeUeq1v7y7pAPRp2OXsb+WNnTL2cGBXmkwviyIsnAUge:MRCJdFaUXxXwH2HBXmae
TLSH
T1FC32962DEA14757B9CCBD22AEA297A93D3F5103571A41E84EAFC852C14EB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 f2fc0ea04907db182ac30e36311411b90acceca4909bb98c85a0fa3196770867
MD5 c50e2c2bc6b890e1caf2c8c91f017569
SHA1 163fba52a0ea8fedb360723b9ee85e440f67ca44
SHA512 4f9c48faf1c0ee82bf7d8ddacf10b6bb244fd4d994fe30a8a39c97981f4384151e7df5c54d92f26860405a5b55cb6d904a0925a17cb5c48c168d2439b651ba5e
SSDEEP 192:MRCeUuSwKPq1v7y7pAPRp2OXsb+WNnTL2tGBXmkw+iyIsnAUgE:MRCJJ5yFaUXxXwH2QBXmnE
TLSH
T1B442972DEA14797B9CCBE22AEA197B93D7F5103534E41E84EAFC892C15EB5CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c411.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe59c411.TMP
Size 3KB
SHA256 f6ba1978087c104692c3c1f2613e583b35c1ce068053fc9391699fad81fa7738
MD5 1c179e5c61ab8f08eb2ecda4bab7c285
SHA1 ab7299cbca1b40f9466f5982e52cfa5b3cea8e6a
SHA512 334304c68256a32d4cc8f17e98804fb57e92a45ff84164f5edafebffccbf509113a0c1c58d24bf4e3700a28e2102a7fc3ef3dd93539831c2bb4b1fefcae7fb7e
TLSH
T1DF617228C0A84C9B0DB5B7357C2A0B83FA62422B6240181B7ABD0A8D4F7757F5542F9F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 14KB
SHA256 db32a877d702aab71552ed4b5485dac56f4ab0229c0168226aca46700cdcce93
MD5 ea9caa7bc0f65539f39d57da2e0b3773
SHA1 622bccaaaa899f6ee0c6870598d8286155a2dc49
SHA512 b9d0ba094805a218ff16885b9df4339b32319e025395192d77e99fb02b5859a1a3dc327ac119c90d0762ce43b873a3ec37f6cfa99d0be8440328e558dc1aab5e
SSDEEP 384:/9j0X7KxkXqKf/pUZNCgVLH2HfgslGE7pLuLci3yTXOD0b+ErU3+E/w:/d0X7KxkXqKf/pUZNCgVLH2HfgssE7pv
TLSH
T15662F967AC4C9E3B0F98D588DD177A4FADB5024662ED886493FE582503D4BCE110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 5fe7e4a4766964816eda10c88527edab556085da7ab27f9a5ba58ecf778bbf4f
MD5 a40e67f4d3c3075f13e4214d72164ea6
SHA1 8b514cf0d00f87b80b6200d56d7caf3d20d3216b
SHA512 1c55f579e63c0f83d9e20a855cf65c399a985c60a83da004324123ebc3dc9ef1190b44024c91cf297f6945cbb83f44d519cfac70d4c3616fca8ec5f4e77b615b
TLSH
T136B01204C087AB40DF4085B01159504832509E32A0501B0387E06995CC430D44253908
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 70f65b49369ccf42d611357b1bc40539e5df2f3aef693320b264b9aab15b0036
MD5 881c5eef9d8c970fdfe126f9f143b806
SHA1 7bc8432bfc496982b3d7a6aa8426b448fe117355
SHA512 6edd55d848c84457746a79df21fdf6f3fc23229aba87fde2d5f2e7f4b325463efab9cbc34f7c2db9a326982db2d2c150c6c4e8459a4fdfed8ccee6804cfd3dbf
TLSH
T1CAA0021847C11C53DE4972B0A9B64662265948351F59830374A5495CD86F3C0451510C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a53ee.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a53ee.TMP
Size 48B
SHA256 08426949c662a3e44d9824081662babf9fe4ff7934215910925e57278a2ee4f4
MD5 a3de9af93e6fd43b75aad0187dc58f71
SHA1 8a47a1f99b16df61b30d09a746e38ad9259368f8
SHA512 6847707cf35206bf9d343f79e1af9b5575a8cd933c9ecca818baf4443ba0d0a7e58e76a9a6934d614de7cb75adb597e40c407bf3e76dd61c5f4e3ee8cc6005f2
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 409830aa05543ac214804a3de503d19d1a494f58616abde225257fb4cef914a4
MD5 c119f30f2885f7cff66a8ed74058877e
SHA1 a0618bf72f35425f5b1cb4a5d4f4b78b9bb76609
SHA512 06e0e9ef71d0019dca1e301b5fd1f64bbc5d3c63fdad829461140a59ad3b5aa8d78a907aa33b7b571e9bc5aefaf157d492d9c9489a97c2e698c3ecdf24d6fa2b
SSDEEP 3072:qXofMI/fkRSHjxWQ5EyBr4WeXBZHLm8v25LmFi7N:qXYM+fk+jxWQ5Em0fXjHLi5yFyN
TLSH
T1F9D3127078C539E10D7F9295152B3D239FA8D04BD0999A0EFEA7AB4F324AE5C6F03425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 dbfcff7bf2607e3e127b76a28767f11a220cffb700faeece3f04f21ebc21f39a
MD5 1473b95103a6a1f8c8321bfdfb1bff47
SHA1 efaa7ea739be60e8b7510a12ad7df762e17364c1
SHA512 4fc72e67edc2d28c0944c6954aa18407a2acf3ad6a4bcff133857c637e5bdcebdfa905f7f5de7b2639c1c23847ed9974d564ad9238fd85382b145bfa1362a571
SSDEEP 3072:7XofMI/fkRSHjxWQ5EyBr4WeXBZHLm8v25LmFi7N:7XYM+fk+jxWQ5Em0fXjHLi5yFyN
TLSH
T167D3127078C539E10D7F9294152F3D239FA8C04BD099960EFEA7AB4F724AE9C6B03425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 9a302c2755df8587253f0c15653817e577c2d43d1b0d43c63d2e1371d1dfd63e
MD5 25a0fcf1aec0a84b908b6a8d956d793b
SHA1 d3a137a71dfd73013fc4b8e57fbc67d2c6097742
SHA512 972fbf9dcd5e8f8045dfa42651f4fdd612a0680c30d97d4c7b4c6a1841105cf33c18892dcbb2daf9c77dfffa01cb2def389a874e929be5aaa3611f2d686d2cdc
SSDEEP 3072:azXofMI/fkRSHjxWQ5EyBr4WeXBZHLm8v25LmFi7N:azXYM+fk+jxWQ5Em0fXjHLi5yFyN
TLSH
T1D9C3126068C439F14A6F9299453F3D739F98804AD095860EFEA7AB5F364AF6C2B02435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 faa095b6b7c279b522b8d0bc53671e50a122179171f15f7598145eddd9facc9e
MD5 35133315f0846695f94dd09a43fe8c3c
SHA1 fe5575297fd3d84daf62e1eefb2f31b39645b3d5
SHA512 96895c4cffc5f2dd9f26779acd61503a2cdfa8f4b32b050f958abc8917daf8aaf63307c91e5365f91d325214022e58e17c325661aaa5a433b9cd6d137ea86186
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5CmDLB6nGyvn0b4T8hybJv4a:xC0ITo+TQ0InDUDJ1PPb4T8hybl
TLSH
T148A1F935E0284D774476D446F1626A83CFB9706BD972AFD0EAD90E0D15FB4EC1341627
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 126KB
SHA256 5a281d24348443bff183b7182af968814bc64acb961755db2ecc657a4ec2c989
MD5 5cf597b68134d81646e57183f2bef448
SHA1 25837f0f14dfdbe0d6010d2270616231cd4433c6
SHA512 49fb4329e09f1bbe083ec73f53af758a5ab7626a6515fa232ba989543a072c331819f4c44893d33b0496e429fbdae2384f2b9d58f4256a0353bc55d98a0c2ddd
SSDEEP 3072:FzXofMI/fkRSHjxWQ5EyBr4WeXBZHLm8v25LmFi7N:FzXYM+fk+jxWQ5Em0fXjHLi5yFyN
TLSH
T104C3125068C539F14A6FA2D9453F3D739F98804AD095860EFEA7AB4F364AF6C3B02435
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-12_0a6904efbe99a04b606434a7027e04b0_cobalt-strike_elex_hijackloader_icedid_njrat_vidar~4.exe
Size 4.3MB
SHA256 8f745e3d26aa25d46265f4eaf80001b61bd27db33c1f995a6f912dc8dd79f8a0
MD5 354d72cff0de750875d2af3d8d3532a4
SHA1 590a43bde0cd6fa985d4c20bcd97515f7d756689
SHA512 514db3a6dd0572243d4737f626ac0f6da4f4311300cc1e8eb0e677457b3d8ed516772f804fef24f61cbeafc9a225e3891d138c14882df197678daf3124fc3373
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T129264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4520_835817761\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 3.0MB
SHA256 1a248b6d23a74a5a6ce16e2c4b090b2806f540fbbe2a4397edb6f52eb270c45f
MD5 681d2c3d56a9b7f6d17a94ce557f66e2
SHA1 843a494b26e7b5056169a62a0ab4f6eedf6fe42c
SHA512 a58c8e2f93021c7cfdebee46259a39cf2a72e4d1a89686b52754f7f05dd35a97e213b931bcde54fe56b10907efe07e6bbe3744d307f1ba8cd1ab5aff77188614
SSDEEP 6144:P4RywzYmqBml6I7r/7m7eqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7m7ecnhzd5p
TLSH
T159E54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 66e017db243603bf913e10b20e597b154e9bcb16c7b9d1142274998882f19ed3
MD5 88cee8f69dada10bd44b4840437f8fd7
SHA1 36a253e440c7507fe9f78f5e2a450552bf940efa
SHA512 6443d7384f85086876c58dd0a97c21879d3145191a3c992fb05fa4c7e86699e196395ab1ca3f13413b34d987096d4059193533499beb5c22d2ec6d335b1d9091
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 00b2cd545832085c0be8fbf2a8b667e7f2a59720859d4fbeed459fc45ed02716
MD5 61bc22d12b831ed8e4ecd8c1b5424274
SHA1 a7371fa24d1056e0643f3f2a873fce4834ba6561
SHA512 7eedd76e17225f3be717c96572614d41075a41cf156b76befc68eaefe52a8ee40ceaf17edfcd0a0e47821b36d7a985de5c9971cfea894af36cf0ce7f3f8cb779
SSDEEP 96:raIRhCf/KSa13hK2LK2CGOWpucpt1vhfORRgLLdgxhK3iK3n8:m2M/CFYGr1Idm8
TLSH
T16DD19FDA8F0289BF3BC19B6B334336956DA7540BC7E4647237EBA106B0CA974051F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 eea17cdb28f3533775fa28fece671c095de6e0eebb3000dfb7af89c73565c0a3
MD5 ff4f274eb277e733b97a4fb8333b3bc6
SHA1 fa7b5b1d863ae2d3cdfed31c1adbe9ea92706d11
SHA512 eeeb11023eea59c81f84210242e38708eedcd9d99ef02b0953844b4ddcf8c4e3c560ab007271dc20a6c03d977dcec87fa1a956d4137ab459dd27d57d0ee417b0
SSDEEP 6144:P4RywzYmqBml6I7r/7mHeqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7mHecnhzd5p
TLSH
T1C1E54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 0ee14ebae7eabd2dbf89863608244ee4d96681399f29e2833769f225c3ca83eb
MD5 5bc488452df83ac194cf924e49d39577
SHA1 565e63891a53e63acdba9e62e9f2b2e8fd115aab
SHA512 57cef2314418c43c02cec58f8e9e6f9fc4bb2bc3230eb5b57ac2b9f38f0ca2baf6d2abd9b35ab67dd941db687f74c04da27a49d7486c0e92abccca8a652fae90
SSDEEP 6144:P4RywzYmqBml6I7r/7mCeqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7mCecnhzd5p
TLSH
T121E54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 b8f28b8ab2517f2118c292da3a56487747b6bee805388af7ace1ccf1ca45deea
MD5 4ee912cc71fd2732eb14ba002dca1626
SHA1 4beb6c8e4bd982930edf198b24cffe0ff38c3f3a
SHA512 75fbc0f5d7f11a9542927d7a47a27544ab4af91e2189596bb02be9b25675d1d500d8375fcf5c82553ff09fd7a828d828a29a73dc1fb0fbd80464c15af63b3732
SSDEEP 6144:P4RywzYmqBml6I7r/7mxeqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7mxecnhzd5p
TLSH
T1FBE54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 e9ee38451dcb8b84a56f5e0b77f81ce9bf114b5f10e91cb1b7f7abf14d940082
MD5 3c0fecc3918aee5e27895cd07db9f78a
SHA1 e5e98561168841f514825f90ac6a5ef3774f4fa9
SHA512 ea15b6f0120a85b02f94a110068fe4afd757d6cde87c6753b5607d6bf7f7f89480d961eca6b34236fe13fabf51b412dabde09d926d6b1c2e644e9d370bcea34a
SSDEEP 6144:P4RywzYmqBml6I7r/7mLeqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7mLecnhzd5p
TLSH
T1BEE54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 801b8572605f311c149ae3a1ec3ae7092ddb4250cd1ea7b224404016012e28f4
MD5 62398d13946cee5d8982af52908cb497
SHA1 01837eb6b4fb7ac7cf236e4c79f329b51703bb4e
SHA512 06030e3e21e8810e00c869e88d4c204220ec9dc0cd7eee3f654bf8091a5ad36c4b73f11f6404d6ee29b6aebe2dc4e5c93040d01e0e8be89824ffffc63c41aa01
SSDEEP 6144:P4RywzYmqBml6I7r/7m9eqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7m9ecnhzd5p
TLSH
T1C5E54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 849e8bd0249b09f6b46d58586c4d885dad21e9f96eef1ed4a134724f6c4047ba
MD5 b913efa6283e06edda2f6aab4a20ada9
SHA1 dccaf08aed8ae3e8b8a1db52828c960b7f7453dc
SHA512 7cf7efbd0127a4e3ed91c0019535698630b03961e6d3d5d728f4142e0d4d226c3d8d61bbe16b4be383f51b8e6dd3157aa0287e0fc03813f98f1de2f08c19e2e7
SSDEEP 6144:P4RywzYmqBml6I7r/7mPeqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7mPecnhzd5p
TLSH
T1CEE54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 841e3a8efc29fcd0370192b47f07398180084f0aafb9619ba2f412a1c4066127
MD5 b55fac4ad282bc29d23b3050a8eab541
SHA1 3a58719619bff94c3e03461b29a501e042aec78f
SHA512 e428c4dc7a3bb8802435c8341203637df43085f7fbca76338da991a10059ff11e5864944725217c322de9a60c0b055c9e2290a8946773d5a23d85dd1ffececa2
SSDEEP 6144:P4RywzYmqBml6I7r/7m9eqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7m9ecnhzd5p
TLSH
T13AE54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 ae32086bd7d857aa919b9bfa10e78a6bbb423bec60bd96d05d7852b431b9a92f
MD5 678a929ee70dc30e6487bfe4bb155a11
SHA1 56badbf857b748b8ac0a1aab43d8cb7602dcc4d3
SHA512 f04e2ddde9fb829eeee6b236fce81db290f72af8452f97fdd8b1d87b05b70b0ca570bf58c00a6dd63fb81cc84a0cf7d1c3f21ceeebcb26cbd66be758f9cbe137
SSDEEP 6144:P4RywzYmqBml6I7r/7mHeqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7mHecnhzd5p
TLSH
T1A4E54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 3.0MB
SHA256 2f9b954cecfab690340f01c3e510ef5ca39e5ab993a3ff7c46a0655f00426afa
MD5 19db69ea008cf58fcf7de2736f7f942f
SHA1 c1864d076420bf31ba34ccca215c238e23ca17bf
SHA512 1acc15449e2698c8f68398e54bbdde067b11f4b7cff0b570009216b21742398446ffd8258e8426e3a8111b809cf434ed93749bca7ca28c98d11b8c5e528c094b
SSDEEP 6144:P4RywzYmqBml6I7r/7mpeqtiHMdDNvhz4gP9MnLau8p:P4Ryed8I7r/7mpecnhzd5p
TLSH
T15FE54B23A608586ED897C07969668116A9217D350770FCCFB3C07B162D377E2BBB4B4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download