8db6bbbcdb40b749c21f86135049746ae3a996a3dad290add8b6651697a8671d

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 7.1MB
Sample260813-klmpvsvhjd
SHA256 8db6bbbcdb40b749c21f86135049746ae3a996a3dad290add8b6651697a8671d
MD5 982fb23ed60219733ff75bb22d338798
SHA1 a4fa7077e77cdde0080bb7c789b24502fd8b796b
SHA512 84027f8a387d8de2c6de5357bc9e837c95d5d9eeb580a7a6dac79df4b089a411323cf492c4d7a6935d00aad20df92b1f0f494950e07ba60f876d2e5f19fb64fc
SSDEEP 49152:BmrU3KyUmgjI45TMwwapIgTYTCTlGnPwPszWh/KCGZd0qgNEf16lhulJLirHJIZ9:Bu8LapIsaWQtZ/K0tGOFWVRuLftCT+
TLSH
T125767C13F2A500E9E1AAD178CE659231EB727C594BF165EF324076D42E37AE07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Drivers\ETC\HOSTS	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Executes dropped EXE 2 IoCs

pid	Process
1728	wkw4D2.tmp
2608	wkw4D2.tmp

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\System Database Administration = "C:\\Windows\\system32\\systemDA.exe"	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ReadMe.2.txt	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\systemDA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\nCalc.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\lzsys.sys	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\lesys.sys	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\clicktorun\Anal Pleasure 3.dvd.mpg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fil-ph\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ne-np\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ur-pk\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\1033\Internet Explorer 7.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\satin\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\as-in\Jenna Jameson screensaver HOT XXX.scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknav\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\nb-no\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\16\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilesx86\microsoft sql server\130\shared\Anal Pleasure 3.dvd.mpg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ko-kr\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\euro\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\en-us\Anal Pleasure 3.dvd.mpg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\16\bin\Jenna Jameson screensaver HOT XXX.scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\af-za\Norton AntiVirus 2006 BETA.exec:\program files\common files\microsoft shared\ink\am-et\Norton AntiVirus 2006 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\nn-no\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\tr\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\pixel\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\enfr\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\fren\Anal Pleasure 3.dvd.mpg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Internet Explorer 7.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\level\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\Jenna Jameson screensaver HOT XXX.scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\qps-plocm\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\lists\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\sl-si\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ca-es\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\sonora\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ta-in\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\it\Internet Explorer 7.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\aftrnoon\Playboy centerfold.jpeg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\axis\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\equation\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilesx86\microsoft sql server\130\shared\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\gu-in\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\cascade\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\af-za\Internet Explorer 7.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\af-za\Windows XP activation crack.zip .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\aftrnoon\Anal Pleasure 3.dvd.mpg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\blends\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\esen\Anal Pleasure 3.dvd.mpg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\js\nls\hu-hu\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\af-za\Firm ass gets pumped.avi .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\ja-jp\Jenna Jameson screensaver HOT XXX.scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\smart tag\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\dw\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\clicktorun\Visual Basic.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\msinfo\fr-fr\Anal Pleasure 3.dvd.mpg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Visual Basic.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\clicktorun\Firm ass gets pumped.avi .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ja\Internet Explorer 7.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\euro\Jenna Jameson screensaver HOT XXX.scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\web server extensions\16\bin\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\themes\dark\Anal Pleasure 3.dvd.mpg .pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\gl-es\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	\??\c:\program files\common files\microsoft shared\ink\ro-ro\How to make crystal meth.doc .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File created	C:\Windows\Detroit.zip	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3584	5660	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3512	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310841271500300"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

NTFS ADS 64 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\quad\Adobe Photoshop 7 Illegal Beta.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\16\bin\1033\Norton AntiVirus 2006 BETA.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\Windows XP activation crack.zip .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\gl-es\Adobe Photoshop 7 Illegal Beta.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\kxZ™€èdc:\program files\common files\microsoft shared\ink\kk-kz\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\edid_njrat_vdc:\program files\common files\microsoft shared\ink\mr-in\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\€c:\program files\dotnet\shared\micrc:\program files\dotnet\shared\microsoft.window¼UÂuxZ™Xèdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ja\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\edid_njrat_vdc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba7.1\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\@Ödc:\program files\microsoft office\root\vfs\programfilesx64\microsoft sql server\130\shared\Windows Longhorn serial.txt .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ic:\program files\windows media player\network sharing\Firm ass gets pumped.avi .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\af-za\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\kxZ™€èdc:\program files\common files\microsoft shared\ink\fil-ph\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\DVD Xcopy PRO crack.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\1033\Weed growing for dummies.ebook.pdf .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\033\Anal Pleasure 3.dvd.mpg .pifc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\resources\Internet Explorer 7.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\»pZ™Ðàdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\eclipse\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\ricepapr\Adobe Photoshop 7 Illegal Beta.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\translat\Adobe Photoshop 7 Illegal Beta.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\kxZ™€èdc:\program files\common files\microsoft shared\ink\de-de\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\et-ee\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\edid_njrat_vdc:\program files\common files\microsoft shared\ink\languagemodel\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\sr-cyrl-ba\Adobe Photoshop 7 Illegal Beta.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\›uZ™ðådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hant\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\sZ™`ãdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\textconv\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\€ädc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\iris\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\vba\vba6\Internet Explorer 7.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\sv-se\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\aftrnoon\DVD Xcopy PRO crack.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\compass\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\xoc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\web server extensions\16\bin\1033\DVD Xcopy PRO crack.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\microsoft office\root\vfs\programfilesx64\microsoft sql server\130\shared\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\edid_njrat_vdc:\program files\common files\microsoft shared\vsto\10.0\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\€c:\program files\dotnet\shared\micrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\tr\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\»pZ™Ðàdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\water\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\.jpeg .pifc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\portal\Visual Basic.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ac:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\css\Adobe Photoshop 7 Illegal Beta.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\€c:\program files (x86)\adobe\acrobat reader dc\reader\webresources\resource0\static\js\plugins\unified-share\images\themes\dark\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\sk-sk\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\kxZ™€èdc:\program files\common files\microsoft shared\msinfo\it-it\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\"çdc:\program files\common files\microsoft shared\vsto\Hot young babes have an orgy.rar .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\€c:\program files\dotnet\shared\micrc:\program files\dotnet\shared\microsoft.window¼UÂuxZ™Xèdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\fr\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ac:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\textconv\Adobe Photoshop 7 Illegal Beta.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ja\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\edid_njrat_vdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\datamodel\resources\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\hotoshop 7 Illegal Beta.exec:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\Àîdc:\program files\common files\microsoft shared\clicktorun\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\ink\vi-vn\Adobe Photoshop 7 Illegal Beta.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ûzZ™ëdc:\program files\common files\microsoft shared\vc\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\edid_njrat_vdc:\program files\microsoft office\root\vfs\programfilescommonx86\microsoft shared\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\common files\microsoft shared\ink\cy-gb\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\ka-ge\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\msinfo\de-de\DVD Xcopy PRO crack.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ édc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\zh-hans\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\+NZ™@Þdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\office setup controller\office.en-us\Windows XP SP3 leaked.pif	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Adobe Photoshop 7 Illegal Beta.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\0ìdc:\program files\common files\microsoft shared\ink\hu-hu\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\edid_njrat_vdc:\program files\common files\microsoft shared\ink\ml-in\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\edid_njrat_vdc:\program files\common files\microsoft shared\ink\nb-no\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\€c:\program files\common files\microc:\program files\common files\microsoft shared\msinfo\uk-ua\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\r 7.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\equation\Hot young babes have an orgy.rar .scr	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ler\office.en-us\Adobe Photoshop 7 Illegal Beta.exec:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\office setup controller\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\€ädc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\ripple\WinRAR 4 BETA.exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\themes16\watermar\Windows Longhorn beta version 7781 LEAKED.n3ro.iso .cmd	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Users\Admin\AppData\Local\Temp\ oc:\program files\common files\microsoft shared\clicktorun\WinAmp 5.rar .exe	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe
Token: SeShutdownPrivilege	3272	chrome.exe
Token: SeCreatePagefilePrivilege	3272	chrome.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3272	chrome.exe
3272	chrome.exe
3272	chrome.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5660 wrote to memory of 1728	5660	2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	89
PID 1728 wrote to memory of 2608	1728	wkw4D2.tmp	90
PID 1728 wrote to memory of 3272	1728	wkw4D2.tmp	91
PID 3272 wrote to memory of 3468	3272	chrome.exe	92
PID 3272 wrote to memory of 5912	3272	chrome.exe	93
PID 3272 wrote to memory of 5912	3272	chrome.exe	93
PID 3272 wrote to memory of 3512	3272	chrome.exe	95
PID 3272 wrote to memory of 260	3272	chrome.exe	96
PID 3272 wrote to memory of 260	3272	chrome.exe	96
PID 3272 wrote to memory of 4780	3272	chrome.exe	98
PID 3272 wrote to memory of 4872	3272	chrome.exe	97
PID 3272 wrote to memory of 4780	3272	chrome.exe	98
PID 3272 wrote to memory of 4872	3272	chrome.exe	97
PID 3272 wrote to memory of 4708	3272	chrome.exe	99
PID 3272 wrote to memory of 4708	3272	chrome.exe	99
PID 3272 wrote to memory of 3084	3272	chrome.exe	102
PID 3272 wrote to memory of 2036	3272	chrome.exe	103
PID 3272 wrote to memory of 2036	3272	chrome.exe	103
PID 3272 wrote to memory of 5164	3272	chrome.exe	104
PID 3272 wrote to memory of 5164	3272	chrome.exe	104
PID 3272 wrote to memory of 2136	3272	chrome.exe	106
PID 2136 wrote to memory of 5264	2136	chrmstp.exe	107
PID 2136 wrote to memory of 3284	2136	chrmstp.exe	109
PID 3284 wrote to memory of 3644	3284	chrmstp.exe	110
PID 3272 wrote to memory of 2936	3272	chrome.exe	114
PID 3272 wrote to memory of 4052	3272	chrome.exe	116
PID 3272 wrote to memory of 3104	3272	chrome.exe	115
PID 3272 wrote to memory of 608	3272	chrome.exe	117
PID 3272 wrote to memory of 1360	3272	chrome.exe	118
PID 3272 wrote to memory of 2936	3272	chrome.exe	114
PID 3272 wrote to memory of 3104	3272	chrome.exe	115
PID 3272 wrote to memory of 4964	3272	chrome.exe	122
PID 3272 wrote to memory of 4964	3272	chrome.exe	122
PID 3272 wrote to memory of 4420	3272	chrome.exe	123
PID 3272 wrote to memory of 4420	3272	chrome.exe	123
PID 3272 wrote to memory of 6032	3272	chrome.exe	124
PID 3272 wrote to memory of 6032	3272	chrome.exe	124
PID 3272 wrote to memory of 3928	3272	chrome.exe	125
PID 3272 wrote to memory of 3928	3272	chrome.exe	125
PID 3272 wrote to memory of 2072	3272	chrome.exe	126
PID 3272 wrote to memory of 2072	3272	chrome.exe	126
PID 3272 wrote to memory of 1012	3272	chrome.exe	127
PID 3272 wrote to memory of 1012	3272	chrome.exe	127
PID 3272 wrote to memory of 1116	3272	chrome.exe	128
PID 3272 wrote to memory of 1116	3272	chrome.exe	128
PID 3272 wrote to memory of 4476	3272	chrome.exe	129
PID 3272 wrote to memory of 4476	3272	chrome.exe	129
PID 3272 wrote to memory of 2936	3272	chrome.exe	130
PID 3272 wrote to memory of 2936	3272	chrome.exe	130
PID 3272 wrote to memory of 1128	3272	chrome.exe	132
PID 3272 wrote to memory of 1128	3272	chrome.exe	132
PID 3272 wrote to memory of 4420	3272	chrome.exe	133
PID 3272 wrote to memory of 4420	3272	chrome.exe	133
PID 3272 wrote to memory of 5200	3272	chrome.exe	134
PID 3272 wrote to memory of 5200	3272	chrome.exe	134
PID 3272 wrote to memory of 4876	3272	chrome.exe	135
PID 3272 wrote to memory of 4876	3272	chrome.exe	135
PID 3272 wrote to memory of 2484	3272	chrome.exe	136
PID 3272 wrote to memory of 2484	3272	chrome.exe	136
PID 3272 wrote to memory of 4464	3272	chrome.exe	137

C:\Users\Admin\AppData\Local\Temp\2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_982fb23ed60219733ff75bb22d338798_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5660
- C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
  C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
    C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2cc,0x2d0,0x2d4,0x2a8,0x2d8,0x7ff69433b618,0x7ff69433b628,0x7ff69433b638
    3⤵
    - Executes dropped EXE
    PID:2608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3272
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffc68c8c728,0x7ffc68c8c734,0x7ffc68c8c740
      4⤵
      PID:3468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,3493492937022191262,17755012989302297152,262144 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:2
      4⤵
      PID:5912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1492,i,2312711834785269583,5754002767770682892,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:11
      4⤵
      System Time Discovery
      PID:3512
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2300,i,6514811695209941670,11390800315912040406,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
      4⤵
      PID:260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,7776738804901263672,8105545253413580267,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:1
      4⤵
      PID:4872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3244,i,2861831669037309279,15196457124683121443,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:4780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,14911575795900252560,2884384636215957925,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
      4⤵
      PID:4708
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,4717765098296316014,17554977127333878439,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      PID:3084
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5680,i,10909887511640081261,965236753865310778,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
      4⤵
      PID:2036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5668,i,14352965838569015766,11370505123405066034,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
      4⤵
      PID:5164
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:2136
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7ae6755a0,0x7ff7ae6755ac,0x7ff7ae6755b8
        5⤵
        Drops file in Windows directory
        
        PID:5264
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:3284
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff7ae6755a0,0x7ff7ae6755ac,0x7ff7ae6755b8
        6⤵
        Drops file in Windows directory
        
        PID:3644
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5660,i,14538268313325871827,8400036655009742499,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:1
      4⤵
      PID:2936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6064,i,13093450597256805820,5608749715216107777,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:14
      4⤵
      PID:3104
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,6746847197294563116,5122509276247651429,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
      4⤵
      PID:4052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6100,i,4157518499849253276,11161229556442138452,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
      4⤵
      PID:608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6108,i,15297525045348187552,11496949169838433693,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
      4⤵
      PID:1360
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5772,i,11265629056847348533,13618809243973069549,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:1
      4⤵
      PID:4964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6296,i,1009851782455823594,14138488558092016,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:1
      4⤵
      PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6208,i,16282990918519163600,3150724955664177811,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:1
      4⤵
      PID:6032
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5668,i,9416749726955722806,354388128941385129,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
      4⤵
      PID:3928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6436,i,14236749728870784589,6638829028081963225,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
      4⤵
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,18110102522502093654,3763943115344626373,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:1012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6220,i,15314511099842253578,8296813301364751287,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:1116
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,1652208320042667488,14581441840069119249,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
      4⤵
      PID:4476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5432,i,18009424379347413247,17382176211990361983,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:9
      4⤵
      PID:2936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,17404153965428316720,5329098368432956587,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:14
      4⤵
      PID:1128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4644,i,1699526616416293903,14575346080582065119,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:4420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5272,i,3634057594059057480,12401006138413048020,524288 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:14
      4⤵
      PID:5200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5844,i,12970582353246089465,9944825875529681383,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5532,i,10521513346963127956,4537930419719166226,2097152 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:9
      4⤵
      PID:2484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5900,i,6660582272948981128,3995685193892914360,262144 --field-trial-handle=1908,i,1712134824621752229,11725064471190027672,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:10
      4⤵
      PID:4464
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5660 -s 2644
  2⤵
  - Program crash
  PID:3584

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5660 -ip 5660
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2136_13431084122811462.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2136_13431084122811462.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

3284_13431084122754878.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3284_13431084122754878.pma
Size 696B
SHA256 be928347764631f42ab2cf3fc0fec2d6539e3d5e2990d0c538e368d225928335
MD5 e5c4256413f91c99ee550f65ac3b5998
SHA1 a1296d2d28e74ff29d13849f458caaac7942254e
SHA512 37c0ca35d6dc474a1cf4615b8183f55ee4dbcb33ab14855dac50a7abf77b024314c66e4edb0e124bc9c97397834443c3c5d1f641db5bfccc0a25c1474013b9c3
TLSH
T12E010E46A3144F77CC428D3588FE27552BB0FA902B821BBF7B54724F3E021C89E9D168
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 a46870a4f28554c5509a47642c26ea22c1a78e05fb0f2dc74fed97e95994a6d9
MD5 506af1388af22dbe29616f39ea82bc4f
SHA1 9cff40cb637867de4dc78249328adafda4abf41e
SHA512 866f5b5c612958f2c3ed7dad6f23775e511c08b2d1dea6ee850f4c0aabca1ff7f59dfdc560fb41ed601c52c6436ffef557f055f81a1bd5cd77066bfe003fe327
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9d426560129c827b5dc218d0f9f2d9351dd1051276092cc9da6c7dafb8baf7fa
MD5 95d9d797a322cef0bc4cd09658b60532
SHA1 f55d5d05d463f74ddb63cb86941a71d6be936d03
SHA512 274410aef2aaf458169b7364913848d5a3a412ece3cbcc2e2e7cfc148092ea1301eb6c3c52f7f74b9ec0ae0cdac7a80ff5754f346c2dc5f00e6487ad488e7c0b
TLSH
T1BB517AB3D7D4967DC85156F49A257E2FCD2E0A18122C3C56C8D8AE5B53F2872D20138E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 bd573025d2376d018136c801ba11cdafe2b107549bfa2245da56ea0058f27033
MD5 06b1790c47ec1d4a3b8059d070356adb
SHA1 832dd1ec2b8c9a37cc43630a84a7ed530aa3344f
SHA512 5ae472350c3ce0922d003c783f81e447ed4ae79c68b7dd9f21ab31d881d761c5a31a271f70cd23d3573cfe9bbc3812fd41205041c0d8f4a2699966312b8a0051
SSDEEP 192:WRpqmqv7byvAPRp2VXsb+WNnbX2Bk/1mKtiyIsnAUgR:WRpqmmq6XeXw722/1+R
TLSH
T162328429F954757B9DCBD32BE921BA13D3F5202520D42E84DBFC892C15E76CD2227817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 53398c619c99d89a4c688547cfd9568828e75cae7011af11d172244ec13e5629
MD5 b02680ccb987a705d5135d036e5cc344
SHA1 73c0049ea0296bc6abfcc6fca3e704ef7fad6823
SHA512 65d9f4104a7b29fea2fba66b003505c533547accac6af777a6693390e762f7a7c5726e2df8e451e80dc1d40dbf19ad4500d92fec0e88f2c6f22ec08da7ff3520
SSDEEP 192:WRpqZpqv7bypAPRp2VXsb+WNnbX26Tk/1mKdiyIsnAUgE:WRpq/mqUXeXw72h/12E
TLSH
T12B42A429F944797B9DCAE21AF922BA63D7F5202520D02E84DBFC892C15E76CD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5961be.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5961be.TMP
Size 3KB
SHA256 f6ba1978087c104692c3c1f2613e583b35c1ce068053fc9391699fad81fa7738
MD5 1c179e5c61ab8f08eb2ecda4bab7c285
SHA1 ab7299cbca1b40f9466f5982e52cfa5b3cea8e6a
SHA512 334304c68256a32d4cc8f17e98804fb57e92a45ff84164f5edafebffccbf509113a0c1c58d24bf4e3700a28e2102a7fc3ef3dd93539831c2bb4b1fefcae7fb7e
TLSH
T1DF617228C0A84C9B0DB5B7357C2A0B83FA62422B6240181B7ABD0A8D4F7757F5542F9F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 85e93e7c7421935f0911b856282522aa7697c7f7f3e4e91fe9b68bdb1dee2254
MD5 17b14bf97159ca9e7782c9d7e031bfcd
SHA1 5412ddbb770ca1e448ec81ffd24d22720b4873e0
SHA512 fa87b1df3588a9d8536d2ca0322b2c03b19cf27561fcd164ff9c5ff208fc0e27dc790a5315f566f02886adf9352dd827c1148a40ca6a9d5dc8c58be7d73dfc76
SSDEEP 192:e294K6vX7KxkXqK4I40pUZNCgVLHrKHfFKslEClTXzKD/cb+ErUkKN9G6jBTK8/T:/9j0X7KxkXqKf/pUZNCgVLH2HfgslNT+
TLSH
T1B332D827A48D9A3F4FD8D519DC036F8B6DF5019272780C24A7FF5D0403A978E115A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 120B
SHA256 0a49025cf30941e3ddd3167df501467660203681ec5512b4377748b876aa153e
MD5 2ee834e9ae842dda7df4f311ec6c3fb6
SHA1 36655f13da729928b9e045adef7804dec76680c1
SHA512 1d4d7c221cdee87b9dcf743ee9f25aa3c64269c48c21fd46cdb01611a2d934fb9fc7be247380b0ee50bfe4915be8a865d2987c404adca020ece59f547df47b51
TLSH
T17DB0120480472720D90083B02206504432105E31901057038BE05A99DC631E04353618
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e14871d132ed976433450f3df783c448db85052f7575d7b24ee1db564e2a6ee6
MD5 b14861ea91ccf361f5ba8b493c53f806
SHA1 e870b7192db8c05f2bb72b5071582eff7aae322f
SHA512 d592ccfc8f1a2d4a9802f023397cd42739ba0823b62f928529e08c47f42b1bf889dcbafeb1437a00add036283f75a6b2e5213a439606b29abd6e4bccdc681d1a
TLSH
T1ACA0027175C40427DD91427074E315492B62AD5B2D594B135FF51E84A97B5D44282901
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7bce708d7780bf7f55c890ba2a2bb8df9facaf33161d35cc2b661537e4a4b2d8
MD5 34b779dd82bae2877294da11d9e512a3
SHA1 ae0c54212bb1fbad1222a9a34adbadf61d2c9fae
SHA512 81ce6a6be988bfaa7ed97bb204ac46eb21b7b534e4b30cfaf7606174b0b0a88e3a714422a3c129b7014c2c0b2b407fdbfe509408377e789667de897805fa02f8
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 127KB
SHA256 92e7a95d68969988493939182e630c9e9ed7416113e4d844f606457270740788
MD5 a66f42b0ffd3ebfa1995665ec6930f8e
SHA1 a6f72af36ad3cc96cf8c8615b514fb74c457b303
SHA512 aa1ab1f18496a6070ae7c8d893f73c12234d7338f342173d6998a8b213273e2abaf6df1dc3cf28241daa2738e70aa1e5e9146844888e48dc97ec8f0b1f65c412
SSDEEP 3072:LALNCljgYqRpdyldRr4uhvCHQ/alry7yVYiOJ7X:LONEgYEpdyldRr4JQory7s8
TLSH
T167D312A6ECEC2C637FB48100B3F4570DDEAD45E8C5A0616AD7A1AF06427D9FE17E0849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 372876914e1271d30ba5d96aa6f8f68ee86be7fba6c1f04ee364033ad60b3a17
MD5 f854e628d47cf8a0cbd5614adb59487c
SHA1 51787cca869b67b9593df0b0c274d977233bd2f8
SHA512 0764124af009eb6e5bfbb48781d8572d59967571099556d07a03b77a9e63ee12ef71c133920e65fafcf9c854a580d26b0e93091ab6be1eca23cde15f0d7184d2
SSDEEP 3072:IGLNCljgYqRpdyldRr4uhvCHQ/alry7yVYiOJ7X:fNEgYEpdyldRr4JQory7s8
TLSH
T136D312B5ECEC2CA32EB44100B3E4570DDDBD45E7D460B169DBA46E05823D9FE17E1849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 081a437bfadace3b532a5b7fc162c2ad040413f00c9a7c74aec1da9ca8e1ada0
MD5 df7dbf3940bd82039c178da5d070b845
SHA1 caab74355282421356e314de22b8572533921679
SHA512 50b856fa4024b6ebc6ff04cd74849455d2250fbfe9e78d3707cc03f9bf2e96a6d35eedb1d71b91bb4a2ed774ba37f2f649f046e45979a8b65a97217cf0d115bc
SSDEEP 96:WC6nHd+r2io+TJ/E0f6m934qMkSl8h4otop5cicDNB6SGyvn0SvQxwzQ3hjm+9WO:WC6HITo+TQ0IiiU2WTWPSIxbhjm+9W5E
TLSH
T192C12A31A46C6C7746B3A446B1223A57CEB43067D981AFA4EBE90F1C02EB4EC1352922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 bde1b957de190c25d440524f9bd6052cc7c7234cbd02825619565890b16b7a86
MD5 c54b52be324b5e6322f01eee883e9a66
SHA1 440d7a997e38847f2d2f8d04b5d915aee94d1803
SHA512 687a668bbf81beac0282f84497359c70bd7387021f2bbd17639719ca01ac4732ee5d70bd4f782550d70dc0bfce7216272b199e98249a12883f9694303375f2b4
SSDEEP 96:xC0d+r2io+TJ/E0f6m934zM4RDotok5cmDNB6nGyvn0b4T8WybJv4a:xC0ITo+TQ0InDUDLTPPb4T8Wybl
TLSH
T168A10735A0684CB74066D44AB1627A43CFB87067E9A2AF90EAED0E0D15F70E81352A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3272_1881174511\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

wkw4D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
Size 4.3MB
SHA256 a8c4ca099a07dbd87d9045f22be0e4acb34857323b8633d7fac46c97dc41d6ef
MD5 c451c81ed46b64c08d9db05237dcee8d
SHA1 ac63c873facf263439de14edde1b03f51514e0fe
SHA512 55649b927b706ba5fdda88539236e8344df8ed7ae6cb2976b8bff1b71bb1ba2dd88d3aea488ad178f6b184941ea38cdf49a19fbedc98bd8bff2fa6039c6fe763
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T1D2264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 66e017db243603bf913e10b20e597b154e9bcb16c7b9d1142274998882f19ed3
MD5 88cee8f69dada10bd44b4840437f8fd7
SHA1 36a253e440c7507fe9f78f5e2a450552bf940efa
SHA512 6443d7384f85086876c58dd0a97c21879d3145191a3c992fb05fa4c7e86699e196395ab1ca3f13413b34d987096d4059193533499beb5c22d2ec6d335b1d9091
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 d8a20c0ab35a6807218221354d331813cca8c88987e37203b336d9b1fc3f0f54
MD5 1776174ee96d628dcc9ef0010b91cca5
SHA1 467f84a0fb7dee87fedeb3de6eddbb654468f24e
SHA512 b767ddb260775c3e47824e1324cdea9feabf0fe04c5895eebe6904ea6c69c89ca33c790c01aa65c96dbfe7dfcbe6ee760613f18e02ce070f3be6df71e7080787
SSDEEP 96:raIRhCf/KSa13hK2LK2CGOWpucJ2lDavWS0hK3JK3B20:m2M/CFYGJ2HOwP
TLSH
T159D18CDA8F0249BF3AC19F6B334335A56DA7640AC7D8647237EB9106B0CA974041F5AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 562B
SHA256 cd07a70adb52818e35a7f1b65003d52312db3cc94be39d122df80505ae53434f
MD5 3d14375356670ba597a088815bbe3a4b
SHA1 70aafa0b21db8a74bc54b451a381579ab4633b0c
SHA512 69e95df896f658e017d6bcae9018e4c2bf7a8d445903d2f1affcc97a0af8d6ce5e2fdf36ee1a24877808bac9fe733b44b8996eff1aaf36c804f0f0b84a6296dc
TLSH
T132F07E7B6809C4FE6377A7544039137BD417E225824FDCCA0CA882A3A1B0FCAB9080F8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5660-0-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/5660-3-0x00000000006B0000-0x00000000006C3000-memory.dmp

Download