0ffa87b70df78d3e13989ffc01aa5df7054cc824c12fef8c8a515b8ab7e0bc9e

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
Size 5.0MB
Sample260826-ryc5hs1bjc
SHA256 0ffa87b70df78d3e13989ffc01aa5df7054cc824c12fef8c8a515b8ab7e0bc9e
MD5 a61195f03ee9a62baf8a64e78d15cd59
SHA1 9a7b72c46aa9a239466376097734de60f70e6d73
SHA512 2d05c783ef7e485a32f6550b680a3a268c86bc78ee145aeafcc240c4214ef9b1ed264e3dc616787bed99add791675de24f338d221f4f8b78f12565010d9ac4fa
SSDEEP 49152:DHRaYSDA+ouZ/K0tDg/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vp:TRUZ/K0tzWQtZ/K0tGOFWVRuLftCTm
TLSH
T111366B13F6E940E8E0AAD178CF3692319B727C5A4BF1A5DF224072D51E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 12 IoCs

pid	Process
3244	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho
3332	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho
4252	chrome.exe
1088	chrome.exe
1292	chrome.exe
1332	chrome.sho
4220	chrome.sho
2632	chrome.sho
1684	chrome.sho
6004	chrome.sho
4724	chrome.sho
2296	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Shohdi.hdi	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	C:\Windows\SysWOW64\Shohdi.hdi	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\POWERPNT.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Mozilla Firefox\firefox.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zFM.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Google\Chrome\Application\chrome.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\VPREVIEW.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Java\jre-1.8\bin\ssvagent.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msoadfsb.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\7-Zip\Uninstall.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.sho	chrome.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\7-Zip\7zFM.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\7-Zip\7zG.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\bin\jconsole.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.sho	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5780	2296	WerFault.exe	137

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4632	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322285557625745"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe
Token: SeShutdownPrivilege	3404	chrome.exe
Token: SeCreatePagefilePrivilege	3404	chrome.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe
3404	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 3244	4224	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe	89
PID 3244 wrote to memory of 3332	3244	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho	90
PID 3244 wrote to memory of 3404	3244	2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho	91
PID 3404 wrote to memory of 3516	3404	chrome.exe	92
PID 3404 wrote to memory of 4632	3404	chrome.exe	93
PID 3404 wrote to memory of 1108	3404	chrome.exe	94
PID 3404 wrote to memory of 1108	3404	chrome.exe	94
PID 3404 wrote to memory of 3400	3404	chrome.exe	95
PID 3404 wrote to memory of 3400	3404	chrome.exe	95
PID 3404 wrote to memory of 5964	3404	chrome.exe	97
PID 3404 wrote to memory of 5964	3404	chrome.exe	97
PID 3404 wrote to memory of 2420	3404	chrome.exe	98
PID 3404 wrote to memory of 2420	3404	chrome.exe	98
PID 3404 wrote to memory of 1664	3404	chrome.exe	99
PID 3404 wrote to memory of 1664	3404	chrome.exe	99
PID 3404 wrote to memory of 3344	3404	chrome.exe	100
PID 3404 wrote to memory of 3344	3404	chrome.exe	100
PID 3404 wrote to memory of 3748	3404	chrome.exe	102
PID 3404 wrote to memory of 4312	3404	chrome.exe	103
PID 3404 wrote to memory of 4312	3404	chrome.exe	103
PID 3404 wrote to memory of 4700	3404	chrome.exe	104
PID 3404 wrote to memory of 4700	3404	chrome.exe	104
PID 3404 wrote to memory of 3280	3404	chrome.exe	106
PID 3280 wrote to memory of 5712	3280	chrmstp.exe	108
PID 3280 wrote to memory of 5616	3280	chrmstp.exe	109
PID 5616 wrote to memory of 2576	5616	chrmstp.exe	111
PID 3404 wrote to memory of 5380	3404	chrome.exe	112
PID 3404 wrote to memory of 5932	3404	chrome.exe	113
PID 3404 wrote to memory of 3588	3404	chrome.exe	114
PID 3404 wrote to memory of 5380	3404	chrome.exe	112
PID 3404 wrote to memory of 5932	3404	chrome.exe	113
PID 3404 wrote to memory of 3588	3404	chrome.exe	114
PID 3404 wrote to memory of 3800	3404	chrome.exe	115
PID 3404 wrote to memory of 3800	3404	chrome.exe	115
PID 3404 wrote to memory of 4220	3404	chrome.exe	116
PID 3404 wrote to memory of 1356	3404	chrome.exe	117
PID 3404 wrote to memory of 4380	3404	chrome.exe	118
PID 3404 wrote to memory of 4220	3404	chrome.exe	116
PID 3404 wrote to memory of 1020	3404	chrome.exe	119
PID 3404 wrote to memory of 1356	3404	chrome.exe	117
PID 3404 wrote to memory of 4380	3404	chrome.exe	118
PID 3404 wrote to memory of 1020	3404	chrome.exe	119
PID 3404 wrote to memory of 1752	3404	chrome.exe	120
PID 3404 wrote to memory of 3492	3404	chrome.exe	121
PID 3404 wrote to memory of 4176	3404	chrome.exe	122
PID 3404 wrote to memory of 1752	3404	chrome.exe	120
PID 3404 wrote to memory of 4232	3404	chrome.exe	123
PID 3404 wrote to memory of 3492	3404	chrome.exe	121
PID 3404 wrote to memory of 4176	3404	chrome.exe	122
PID 3404 wrote to memory of 4232	3404	chrome.exe	123
PID 3404 wrote to memory of 3224	3404	chrome.exe	124
PID 3404 wrote to memory of 1092	3404	chrome.exe	125
PID 3404 wrote to memory of 3224	3404	chrome.exe	124
PID 3404 wrote to memory of 1092	3404	chrome.exe	125
PID 3404 wrote to memory of 5548	3404	chrome.exe	126
PID 3404 wrote to memory of 5548	3404	chrome.exe	126
PID 3404 wrote to memory of 4252	3404	chrome.exe	128
PID 3404 wrote to memory of 1088	3404	chrome.exe	129
PID 3404 wrote to memory of 1292	3404	chrome.exe	130
PID 4252 wrote to memory of 1332	4252	chrome.exe	131
PID 1088 wrote to memory of 4220	1088	chrome.exe	132
PID 1292 wrote to memory of 2632	1292	chrome.exe	133
PID 1332 wrote to memory of 1684	1332	chrome.sho	134
PID 4220 wrote to memory of 6004	4220	chrome.sho	135

C:\Users\Admin\AppData\Local\Temp\2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho
  C:\Users\Admin\AppData\Local\Temp\2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Users\Admin\AppData\Local\Temp\2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho
    C:\Users\Admin\AppData\Local\Temp\2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x2c4,0x7ff692c7b618,0x7ff692c7b628,0x7ff692c7b638
    3⤵
    - Executes dropped EXE
    PID:3332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd72d8c728,0x7ffd72d8c734,0x7ffd72d8c740
      4⤵
      PID:3516
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,1141603080921651819,10299223231349528760,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
      4⤵
      System Time Discovery
      PID:4632
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1636,i,17960017060296726881,5460684676511875991,262144 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
      4⤵
      PID:1108
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2276,i,6247204851628338577,12850640369031902234,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:13
      4⤵
      PID:3400
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3208,i,9190032411292980163,7217768200171859702,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      PID:5964
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,2264301247199871794,2151205544541452333,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
      4⤵
      PID:2420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4660,i,17490440623709590303,4181847473481179598,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:14
      4⤵
      PID:1664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4832,i,1906075600043874808,12902770146322743314,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
      4⤵
      PID:3344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,17452453092094040968,3360324765118636668,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:3748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5452,i,13882560659558337413,10410850148707827358,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
      4⤵
      PID:4312
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5484,i,12376917464051582181,15350718926222575009,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
      4⤵
      PID:4700
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:3280
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff68ec455a0,0x7ff68ec455ac,0x7ff68ec455b8
        5⤵
        Drops file in Windows directory
        
        PID:5712
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:5616
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x274,0x26c,0x298,0x270,0x29c,0x7ff68ec455a0,0x7ff68ec455ac,0x7ff68ec455b8
        6⤵
        Drops file in Windows directory
        
        PID:2576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,15681562612085960239,14922896273110945561,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
      4⤵
      PID:5380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,3012835894291752815,4893278343190895354,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
      4⤵
      PID:5932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5740,i,15262102229874055772,3605292140283783898,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
      4⤵
      PID:3588
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5960,i,17279757917907862822,12268788121719852822,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
      4⤵
      PID:3800
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6364,i,11635644524509483393,16518123997022822457,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
      4⤵
      PID:4220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6472,i,17342844748003858873,8713401247294682529,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
      4⤵
      PID:1356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6452,i,7441023539780262509,14124617039372814874,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
      4⤵
      PID:4380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5780,i,2264758046779892512,4312723310463932061,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
      4⤵
      PID:1020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6436,i,12476491966520748084,4616963304385766896,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
      4⤵
      PID:1752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,6812067597931271005,14149531282136961276,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:14
      4⤵
      PID:3492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,3067156286743402808,286994194451617063,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
      4⤵
      PID:4176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6012,i,7555009384389557822,9293991725900069022,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
      4⤵
      PID:4232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5772,i,2442322989634242815,18054774109603771555,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:1
      4⤵
      PID:3224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6096,i,11767509664976100247,17618021900592979857,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:9
      4⤵
      PID:1092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5760,i,266486644041660806,3249721311745816166,2097152 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:9
      4⤵
      PID:5548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,3371807926163287120,11379228326189942140,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4252
    - - C:\Program Files\Google\Chrome\Application\chrome.sho
        
        "C:\Program Files\Google\Chrome\Application\chrome.sho"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1332
      - C:\Program Files\Google\Chrome\Application\chrome.sho
        
        "C:\Program Files\Google\Chrome\Application\chrome.sho" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd72d8c728,0x7ffd72d8c734,0x7ffd72d8c740
        6⤵
        Executes dropped EXE
        
        PID:1684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6796,i,16452897051834419912,15901688658758647901,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:14
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1088
    - - C:\Program Files\Google\Chrome\Application\chrome.sho
        
        "C:\Program Files\Google\Chrome\Application\chrome.sho"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4220
      - C:\Program Files\Google\Chrome\Application\chrome.sho
        
        "C:\Program Files\Google\Chrome\Application\chrome.sho" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffd72d8c728,0x7ffd72d8c734,0x7ffd72d8c740
        6⤵
        Executes dropped EXE
        
        PID:6004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6012,i,16113083527368207787,3167574879535506192,524288 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:14
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Program Files\Google\Chrome\Application\chrome.sho
        
        "C:\Program Files\Google\Chrome\Application\chrome.sho"
        5⤵
        Executes dropped EXE
        
        PID:2632
      - C:\Program Files\Google\Chrome\Application\chrome.sho
        
        "C:\Program Files\Google\Chrome\Application\chrome.sho" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffd72d8c728,0x7ffd72d8c734,0x7ffd72d8c740
        6⤵
        Executes dropped EXE
        
        PID:4724
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6480,i,9810383863036474502,2939571564803646071,262144 --field-trial-handle=1888,i,17267946911523709012,8937692853160422729,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:10
      4⤵
      Executes dropped EXE
      PID:2296
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2296 -s 280
        5⤵
        Program crash
        
        PID:5780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3248

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2296 -ip 2296
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3280_13432228556050828.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\3280_13432228556050828.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

5616_13432228556013858.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\5616_13432228556013858.pma
Size 696B
SHA256 3a18b755ce8e6ac5c27792bcc91357c684ee5ba3205eac7defdf9e025b786f6a
MD5 79197b2c64ef85c0ce54e61aeef35179
SHA1 cef2cd9543ecac5259e50b1ba6d6b65119627726
SHA512 5269f184a5772efe6711d98c5c7c0ab5bdb95a11c9ea699157688dc21de2534707e011b319a6e4ff1e7c9242927b3217686c79d3f7408007f9ae5408dfc2d4aa
TLSH
T1DB010E4AA3144F77CC468D3684FE2B552BF5FA502B821BBF7B10724F2E421C89ED9168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.7MB
SHA256 79b18c6204e9ac55f9eb540df0301a1392e681efae468f571b22edf084f131af
MD5 8ed6eb6db5d88481637dc97dc664204d
SHA1 c6c6ef8238951a2933b13559d25d49cbf1069193
SHA512 f6bd8c273fc5dc3818c038ad36a214bcb13ec1a0019048172053434891e45b369172d1c5f2a74d7a3c1c9ca462e7faa3ab788672943049b388910d646d5f763d
SSDEEP 49152:pHRaYSDA+ouZ/K0tDuyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcJ:pRUZ/K0tBm7vj1BDlZ0
TLSH
T14D068C13F2D940D8D059D079874A9232EA62BC594B31B6DF0A90BB562F7BFE06B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.sho

Path C:\Program Files\Google\Chrome\Application\chrome.sho
Size 3.1MB
SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
MD5 fa63967c128ae8a0849c916979790211
SHA1 7064ec510e9828d290aacdee2af26855ca816c84
SHA512 db167c33774c8032501e36488c9f6724a7394f9e7134a1c9235df8bc7f71658132bc39a84967cf98ef8a61e68ce2d4c813f156ae445a8f6273c811e746fe181f
SSDEEP 49152:VyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Um7vj1BDlZG
TLSH
T19DE58C13F2D940D8D059D079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 b3640a0fbf727ccded0f13bf4bcf638b7a59787e97d9362d58aa539c96c2744e
MD5 90bda241bdd991a97d7632319488b19a
SHA1 761d8712c3d94e88c0463a0514d66aeb5f098cc2
SHA512 07f28b8ae4d46f7ae6898c4ed39fa8771b56057e38afcaa6afadbf9151891727d4c6e39afab833a7d9ea0a1c430082f7197a753a6c455327000441403ca50d2a
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.109.1_0\service_worker_bin_prod.js
Size 132KB
SHA256 108c7add8cba49512da24b2a1b95cef35d778691ef5a5d01ba66c2ba7dcee00c
MD5 4208fdfeff374e23801e43b0fb3be7d0
SHA1 7115966dc5b13d52e04ecab1915d83ff4f851c0b
SHA512 93c65fa0c727676bd1741fca7d31166798ffeec416322c30dab27f5ae7cf7d77b3d4cfc72e2d75fde9d9c389dfba9a57c2417321ddf29ff01718beba0717c070
SSDEEP 3072:NMMPOfeioQnKd8lIuG5sVFbcBvahMWlURPLVV+9Wy7:NMMZQy8h0ahMWlURPLVV+o0
TLSH
T165D3D9CCB6B5B4224363A5F5002F010BB23AB8A9E44C85A8F188D9E97DB546D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bd8cf8e701250a0637350b2379b63e98a4dc757560f084f27d5a3dd4fd71e3fe
MD5 4fae091550f1f0162b227e46fb40e8e0
SHA1 d9f534082759eeb3938acf3c891f022a4e5d843b
SHA512 366a9764e0226a98f873c6cd5727b931ecaec5132edb840ad1e224fd4ad1f3043f806485c1ba729df7144a248a33f91cd046a22a7cdde0931d5ef9f430b4e50b
TLSH
T15E518FFBC3D8866EC41196F497216E2FCD2D0A24522C3C56C8E4AF5F53E2972D20174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 e7d0ccd5a18e4e0be566b1796cc2d5436735a2f8becb0863652f6c5414a77e99
MD5 9ae8fdb14c0e1a2c0de73ace4461d223
SHA1 cee5878f7e96a3928ec14c4ee7bb4a88154e9c10
SHA512 ad0922f51d08a5476460bc9c90f22ef140ec48c6b7674ade687a49520f7ece254347069b31a3be9dda1491f7519959449b99b9c703bd729f6705b9c68aaacc00
SSDEEP 192:6R5t+Thqv7cpAPRp2/Xsb+WNnyG2EX7Ag9yiyIsnAUge:6R5t+ThmgUX8Xwr2O7nre
TLSH
T11132942DBE55B93B5CCBC219FD26B743D6F5103660A42E84E6FC842C19EB5DD222B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 98c7aa3194c1c74554c4b89f44ea5434a3f2af93d1f793b9aa85b0529e975554
MD5 6673fa927f6df1e8c6a5cdee0b4dd305
SHA1 49a17f0484bafbd70c326f87b9e35831986deb1b
SHA512 b3f2f2d9104d9d42d995718af24557d1c72e1dc11e36e6cd22889899284767753b9dcd96e7cf7e23319da3cab976ad3941f60a12fdf564b9735e5efcf0449444
SSDEEP 192:hR5Z+vYbhqv7cpAPRp2/Xsb+WNnflYvX7AgNyiyIsnAUgE:hR5Z+OhmgUX8XwtYP7vrE
TLSH
T10A42B52DBD41B93B6CCBD229FD267B43D6F5103660A42E84E6FC852C15EB5DD222B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 9d197446350df6fab8316604dc288b89f19077fc9ffee3b5796d9617ac251a3d
MD5 54262bffb6c11d77d17e669ff141ab54
SHA1 c8ccfb806f519aafebd1c3224a12523a152e589f
SHA512 6b909686e072d5fbf1e15d7b3d1790ed2478410c5d52e92021d64ac38f3caaa7b7b41acde0b6ca06b41dc0042db31365b0131ea49ac6d2396777c2fc6371b11b
SSDEEP 192:6R5t+vYbhqv7cpAPRp2/Xsb+WNnyG2EX7Ag9yiyIsnAUge:6R5t+OhmgUX8Xwr2O7nre
TLSH
T14532B52DBE45B93B5CCBD229FD26B743DAF5103660A42E84D6FC852C14EB5DD222B027
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe591ff2.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe591ff2.TMP
Size 3KB
SHA256 40a47d066ae589ed7705099781c3ca476562b191acf56a39964e10f1dc470c0f
MD5 4ca6c9b1dc1b2942172d6fa0543969cb
SHA1 490d9229c8a0fe2178372b1cc89f5aa00df26a66
SHA512 37632dad50fb6879824c310b12cb40587ea3c059aab052bd6db0afbc7c418e12484174fb9accec87185a1a5e6989367fa724311250628225a1538ce0f17db7b2
TLSH
T15361202DD8644CAB0DB26775B87A07C1F996463F12505D1A3C7E0A8E0F72DAB4181FAE
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 16KB
SHA256 c24a19a8ab85fe4cdfc86a47903fbca297dbf577f9cec24e572fc80dea53ac9c
MD5 6c93ecb98030f04ad7496d573344caf2
SHA1 782a7e29c1126c00ed8599e054e3246b48a2ba67
SHA512 d7763e62a792262578d5056293c2d40a576aeb0fbc085be6f9fe948dc92b92f88ad7b61724e51ef92960a1b8559e6659cfee29fb867377d45e76f24b9f1089b4
SSDEEP 384:Majm97KxkXqKf/pUZNCgVLH2Hfgsl3S7pLuLcI21XODmd+ErU30bHG8tGr8Jg3:MKm97KxkXqKf/pUZNCgVLH2Hfgs9S7pe
TLSH
T1E072E8677C4C9E770F94C9CCDC277A4FACB5024B65ED886542FA582903D5ACF110A2EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 38d73e5278ecef1ac7f65d3207fa4968babea5fd54e45fd8fcf0b8fc9ead396a
MD5 dc5e2feb00b15966310d46a6585f770a
SHA1 8911050aa41fa5868de3d2736bc71555aaf617b2
SHA512 187679ccf9539c7c6b3b003bc80df147e6db3838084bba9b8c52b1d6652ccd4bf999b9cb31e70201da61ce4a4f6fd90c06d8f3b2e068c5a40acd189d2a8617e8
TLSH
T1F4B01248C09A2B20C90042F41119104423509F37D0081B028ED0AA86ACC30F042A3515
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 52b29a66cec3324797b79a3065f55900f651f7650a062df496b48de5b6d2d454
MD5 4e85e127cc131d73fd99a57b958ab483
SHA1 12a9ba03bc0b8fd0cb8743bf561859e1920d9567
SHA512 4a4ad61186a7e4160c922bbcf266ad15b9f739f6343fd4ebea55660fa4bd3d131c8a8abf942b0f9f67d01e38c6c3d7bcb6ca4eec838a3c8243fa1442b7330c37
TLSH
T120A0025046D01431CD0242B1A561094122E24CB9566E730354A21558C97B5C49211211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596b33.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe596b33.TMP
Size 48B
SHA256 ec836982beef26725816f662a02abb1296eed1638ac132164633a9e8bd12977e
MD5 2ef00bcec4fc6119963a84e34fdbf70a
SHA1 119a54351086f28bc419de75ddea9185168ebfef
SHA512 a52b1b7c82deb34b8613a799a2a8a92b349a93609cfcad5a4efb15da7325cf56d0449f872c03334706321169fce569fef582aaf6cbc56eb094f7fe2917676476
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 4dc2f54c645243c77208262418856a4980822ad1bd4c8fcbce845bebce8a8aa1
MD5 d6dd0e9c01b4ab120ecb89f0919bf39f
SHA1 63bd4897a21370aa22bafad3c77ef0474c6c538f
SHA512 7ccecfbe7ee411bfbdd93a7a0926f3c1647cddbc11d9d6e9f09a034c32efb69c8938991410c3c67b9b7958d9bbdf7b7faabb581a3c450eaebf3c31b4660cd933
SSDEEP 96:5KC0d+oJm4V0FH+pqf+HBKyoytsRDotok5IHDWB6eGyvkonyob1v4a:MC0HJm5FHuPgXDUDKGW8nyobZ
TLSH
T1F5A12AB1A4A98CB759B7D345F8823A83DEE4A2276990FF80D9DD1E0C01F31E81341A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 772b15016229495bf52f59304a26a9707b09748c8917cb639b5ae4ede9226673
MD5 f8f3ed65039a0a7e07559c9dff1c82ae
SHA1 8d6c6fbd1e8df445fe3e99de1e707fec3373f28e
SHA512 44a53717730ac80caae7b020cd0f2d044b9c1fffa2b9b411788ead100cab687dd088853920bff30205b379f39dfd0e089c52f3f7d9369818e61415bc5cefc729
SSDEEP 3072:T7YeG4Our47mMDrQkbG9XkkP0AhHZ+cTDzv3AftU:T7hOurjMI+G9bjWcTHv3Afa
TLSH
T135D3125964A56CF21320E6CDF90F94AF8EEC666E8F54F60041A7011D89B91EE6F1072F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 1eb4c0c7f4116d84c054171bcf051c107ac65219a739ca96feb7ab4a0de9a6bd
MD5 280cdc158dde701a423a4b9969123d28
SHA1 967a9393c499331840118b8fc99fdb6ac97daec1
SHA512 0e7ce0165c21131bb087abf480381f500d0e72afc04a10c0404b98661ca6b89e513ab3a5d14723248dbf9ae7cddcf565844bb4b8934e601f1d9a0bcd252ba4b6
SSDEEP 3072:u7YeG4Our47mMDrQkbG9XkkP0AhHZ+cTDzv3AftU:u7hOurjMI+G9bjWcTHv3Afa
TLSH
T1FBD3125964B56CF25320E6CDF90F94AF8EEC666E8F44F60041A7011D89B91AE6F1072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 128KB
SHA256 f33b97a22a8594e7dda3607efe1dc68608297a7f63dacaa9be95aa8f2dd9b9ff
MD5 ba652718936db5cf76aa94d9c07adb69
SHA1 62eb60999fb26a4c87a14bb4d810af7d165d6562
SHA512 3f8b7e6990e79429e7c62071df8debdee7427830af1c5e1f33718fa8b2204c59510f74a509d8deb720da696eb5040b7d1fa20dc204d6b41ed7a71125558ae4a2
SSDEEP 3072:1o7YeG4Our47mMDrQkbG9XkkP0AhHZ+cTDzv3AftU:i7hOurjMI+G9bjWcTHv3Afa
TLSH
T1BFD3125964F5ACF25320EA8EFD0F94AF8EEC656E8F14F60441A7011D48B91EE6F1072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho

Path C:\Users\Admin\AppData\Local\Temp\2026-08-25_a61195f03ee9a62baf8a64e78d15cd59_cobalt-strike_elex_hijackloader_icedid_njrat_nymaim_rhad.sho
Size 4.3MB
SHA256 a8c4ca099a07dbd87d9045f22be0e4acb34857323b8633d7fac46c97dc41d6ef
MD5 c451c81ed46b64c08d9db05237dcee8d
SHA1 ac63c873facf263439de14edde1b03f51514e0fe
SHA512 55649b927b706ba5fdda88539236e8344df8ed7ae6cb2976b8bff1b71bb1ba2dd88d3aea488ad178f6b184941ea38cdf49a19fbedc98bd8bff2fa6039c6fe763
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T1D2264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3404_377228728\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

Shohdi.hdi

Path C:\Windows\SysWOW64\Shohdi.hdi
Size 5.0MB
SHA256 60d8b265c4091366119627913afa77f9999470ded44fed5fc131d9d7ce84e85c
MD5 d281e7d2657e85486351466d3d035b54
SHA1 586d26dba06e3218ba450e74f150c09b1bb2b839
SHA512 d0265fe82bef2cca15065712b773ba6faa34c9512de86fa62a961ad1a24573b43d71e50461eecc108f8aebe3137fc5e5932bb178452f75cf6469d0f86f29531a
SSDEEP 49152:pHRaYSDA+ouZ/K0tDg/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vp:pRUZ/K0tzWQtZ/K0tGOFWVRuLftCTm
TLSH
T124366B13F6E940E8E0AAD178DF3692319B727C5A4BF1A5DF224072D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 8c8f023e8571238b5da916d457275e7bb34ac064caf5cc52ddeee584144a8aa9
MD5 1146a38f2fe543c9723a70dac28cc20c
SHA1 37cdc1b5a046d20e49ca1b48ba183282d29dedbb
SHA512 5f8c02745b6c5e3b8d79449790f0302fde094553cecd1d3b5b904ade886da7113e22439249d4d424e414e288a99290996cf9333e86150ac9415aaa68b15cdb69
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 0d58d4f38e84c8bf7e7bceaec05a3a9b2b61ebfb2949999e1b4359b7a8f9718a
MD5 9c692c88f074de689392f8f926299f7e
SHA1 29b8927c51a2379c791cea61b927d797a4f112d0
SHA512 f9c1ff0a2726390cdabee49f699901bd651ce74d62b25fba9ef04068aa7def65a47d6ba26cea424c4b3d987839efa4b07fb6c43af5d218b8dd9d0589881838ec
SSDEEP 96:UHaunJU4KQMvNCwBhK26K2fFMe5lsyXfwuF73hK3hK3AQ0:U6coj1YJzXxaJF
TLSH
T13DD1AF968F0288BF7BC18B6B334331956E9B640EC7D4647237DBA602F0CA575051F5A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-1062-0x00007FF68E6D0000-0x00007FF68ECFC000-memory.dmp

Download

memory/5712-1061-0x00007FF68E6D0000-0x00007FF68ECFC000-memory.dmp

Download