shodi | d211b9a4191acdabcd02c2685cad9e1d01a898257935a89b65db9841babafc24

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Size 6.1MB
Sample260916-fsva3awajd
SHA256 d211b9a4191acdabcd02c2685cad9e1d01a898257935a89b65db9841babafc24
MD5 acc93f72f2803b65410536d419afb512
SHA1 72c58f69c31003ff09abf4de49d3bbb6136953ee
SHA512 7945a22f493115c20a35658e68daaaf98a596b6b7000a204289e55cdb3d3deb04c531334766d5eed536f0480da6fe658112e39da2f448b097134d1dac5237cb5
SSDEEP 49152:PxgGhqFTTI/KCGZd0qgNEf16lhulJLr/KCGZd0qgNEf16lhulJLirHJIZ/K0tDA/:OP3WQUWQtZ/K0tGOFWVRuLftCTh
TLSH
T118566B13F2E900E9E05AD178CB269231AB327C5A4BF1B5DF225076D52E77AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery shodi spyware stealer worm

Malware Config

Signatures

Family: Shodi
Shodi is a Windows worm written in C++.
worm shodi

Detects Shodi worm 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c600-26.dat	family_shodi
behavioral2/files/0x000200000001ae40-589.dat	family_shodi

Executes dropped EXE 16 IoCs

pid	Process
5668	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
4492	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
1488	chrome.exe
4896	chrome.exe
3144	chrome.exe
2968	chrome.usa
3276	chrome.usa
1396	chrome.usa
5388	chrome.usa
5552	chrome.usa
3544	chrome.usa
3624	chrome.exe
1636	chrome.exe
3636	chrome.exe
4524	chrome.usa
4284	chrome.usa

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\UsaShohdi.asu	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UsaShohdi.asu	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\7-Zip\7zFM.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.usa	chrome.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Mozilla Firefox\uninstall\helper.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Java\jre-1.8\bin\ssvagent.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoia.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\msotd.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Mozilla Firefox\crashreporter.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Client\AppVLP.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.usa	chrome.exe
File created	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\GRAPH.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File created	\??\c:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.usa	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4576	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340089259870295"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe
Token: SeShutdownPrivilege	4640	chrome.exe
Token: SeCreatePagefilePrivilege	4640	chrome.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe
4640	chrome.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 5668	3948	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe	86
PID 5668 wrote to memory of 4492	5668	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa	87
PID 5668 wrote to memory of 4640	5668	2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa	88
PID 4640 wrote to memory of 2592	4640	chrome.exe	89
PID 4640 wrote to memory of 4576	4640	chrome.exe	90
PID 4640 wrote to memory of 4264	4640	chrome.exe	91
PID 4640 wrote to memory of 4264	4640	chrome.exe	91
PID 4640 wrote to memory of 1132	4640	chrome.exe	92
PID 4640 wrote to memory of 1132	4640	chrome.exe	92
PID 4640 wrote to memory of 932	4640	chrome.exe	94
PID 4640 wrote to memory of 932	4640	chrome.exe	94
PID 4640 wrote to memory of 4092	4640	chrome.exe	95
PID 4640 wrote to memory of 4092	4640	chrome.exe	95
PID 4640 wrote to memory of 2416	4640	chrome.exe	96
PID 4640 wrote to memory of 2416	4640	chrome.exe	96
PID 4640 wrote to memory of 3060	4640	chrome.exe	97
PID 4640 wrote to memory of 3060	4640	chrome.exe	97
PID 4640 wrote to memory of 2208	4640	chrome.exe	99
PID 4640 wrote to memory of 3776	4640	chrome.exe	100
PID 4640 wrote to memory of 3776	4640	chrome.exe	100
PID 4640 wrote to memory of 3972	4640	chrome.exe	101
PID 4640 wrote to memory of 3972	4640	chrome.exe	101
PID 4640 wrote to memory of 2768	4640	chrome.exe	103
PID 2768 wrote to memory of 2776	2768	chrmstp.exe	105
PID 2768 wrote to memory of 4056	2768	chrmstp.exe	106
PID 4056 wrote to memory of 4148	4056	chrmstp.exe	107
PID 4640 wrote to memory of 4948	4640	chrome.exe	109
PID 4640 wrote to memory of 4948	4640	chrome.exe	109
PID 4640 wrote to memory of 3968	4640	chrome.exe	110
PID 4640 wrote to memory of 3968	4640	chrome.exe	110
PID 4640 wrote to memory of 560	4640	chrome.exe	112
PID 4640 wrote to memory of 2820	4640	chrome.exe	111
PID 4640 wrote to memory of 560	4640	chrome.exe	112
PID 4640 wrote to memory of 2820	4640	chrome.exe	111
PID 4640 wrote to memory of 1980	4640	chrome.exe	113
PID 4640 wrote to memory of 1404	4640	chrome.exe	114
PID 4640 wrote to memory of 1980	4640	chrome.exe	113
PID 4640 wrote to memory of 1404	4640	chrome.exe	114
PID 4640 wrote to memory of 1488	4640	chrome.exe	116
PID 4640 wrote to memory of 4896	4640	chrome.exe	117
PID 4640 wrote to memory of 3144	4640	chrome.exe	118
PID 1488 wrote to memory of 2968	1488	chrome.exe	119
PID 4896 wrote to memory of 3276	4896	chrome.exe	120
PID 3144 wrote to memory of 1396	3144	chrome.exe	121
PID 3276 wrote to memory of 5388	3276	chrome.usa	122
PID 2968 wrote to memory of 5552	2968	chrome.usa	123
PID 1396 wrote to memory of 3544	1396	chrome.usa	124
PID 4640 wrote to memory of 3624	4640	chrome.exe	125
PID 4640 wrote to memory of 1636	4640	chrome.exe	126
PID 4640 wrote to memory of 3636	4640	chrome.exe	127
PID 3636 wrote to memory of 4524	3636	chrome.exe	128
PID 4524 wrote to memory of 4284	4524	chrome.usa	129

C:\Users\Admin\AppData\Local\Temp\2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
  C:\Users\Admin\AppData\Local\Temp\2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Users\Admin\AppData\Local\Temp\2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
    C:\Users\Admin\AppData\Local\Temp\2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=103.0.5060.114 --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff760f2b618,0x7ff760f2b628,0x7ff760f2b638
    3⤵
    - Executes dropped EXE
    PID:4492
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --force-first-run
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff98907c728,0x7ff98907c734,0x7ff98907c740
      4⤵
      PID:2592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1876,i,18087664258127107207,14227431428537581153,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
      4⤵
      System Time Discovery
      PID:4576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,15615694960545020179,8541324899380644476,262144 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:2
      4⤵
      PID:4264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,10461257705457717231,5804438471839287275,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:13
      4⤵
      PID:1132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,12758164151371534046,8064647716739193772,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:1
      4⤵
      PID:932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3248,i,13502150038220665895,15544839139383986478,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:4092
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,6018177742713202255,4757364012370213086,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=4692 /prefetch:1
      4⤵
      PID:2416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4856,i,16201642541148274150,17219375234551038750,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
      4⤵
      PID:3060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,17738543610543664161,17002696406445721778,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
      4⤵
      PID:2208
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5416,i,4260044078324057665,1034663896639476795,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
      4⤵
      PID:3776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5480,i,9085669884976836766,17994203582543040959,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
      4⤵
      PID:3972
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      Suspicious use of WriteProcessMemory
      PID:2768
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x290,0x294,0x298,0x26c,0x29c,0x7ff6b81255a0,0x7ff6b81255ac,0x7ff6b81255b8
        5⤵
        Drops file in Windows directory
        
        PID:2776
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        Suspicious use of WriteProcessMemory
        
        PID:4056
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x29c,0x2a0,0x2a4,0x278,0x2a8,0x7ff6b81255a0,0x7ff6b81255ac,0x7ff6b81255b8
        6⤵
        Drops file in Windows directory
        
        PID:4148
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5476,i,1953179968989715465,1866512174975904134,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
      4⤵
      PID:4948
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5772,i,17520950491507797236,14600738007560923516,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5372,i,5988436056074773292,9130992056517243749,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:1
      4⤵
      PID:2820
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5912,i,12243984779729607696,261535594322687178,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
      4⤵
      PID:560
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5672,i,1559350286694412085,18345433170545675427,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:1980
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6108,i,10078983033658999942,5004522885980054647,2097152 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
      4⤵
      PID:1404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5980,i,8238711475209896618,10567409490223608974,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:14
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1488
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:2968
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff98907c728,0x7ff98907c734,0x7ff98907c740
        6⤵
        Executes dropped EXE
        
        PID:5552
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4800,i,9039895931673721824,9686858905615929452,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4896
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:3276
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff98907c728,0x7ff98907c734,0x7ff98907c740
        6⤵
        Executes dropped EXE
        
        PID:5388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5964,i,13153979335496928618,14650432908831429047,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3144
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1396
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff98907c728,0x7ff98907c734,0x7ff98907c740
        6⤵
        Executes dropped EXE
        
        PID:3544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,14223068969344421995,15199249554387240319,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:3624
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5512,i,3151423674858713023,2641610256392780166,524288 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:1636
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6096,i,6563666977751277367,456453534135043295,262144 --field-trial-handle=2004,i,3810957736243785815,5598371377796405972,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:10
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3636
    - - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:4524
      - C:\Program Files\Google\Chrome\Application\chrome.usa
        
        "C:\Program Files\Google\Chrome\Application\chrome.usa" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff98907c728,0x7ff98907c734,0x7ff98907c740
        6⤵
        Executes dropped EXE
        
        PID:4284

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2768_13434008926223685.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\2768_13434008926223685.pma
Size 344B
SHA256 fd668d6edcf6b6cc176edd9bf7b0d7f1881fe2f0d94ebae656127c27a359550e
MD5 1b7cdddfb06152ae01f12d9f253237d6
SHA1 1ef358781a086a0727f4fa95cd53510eb328bc52
SHA512 4705c93b233be92dd2d04649d404b538bc76607bbe655d5e35a739653ac1af776ecdd12ec1cbf81476070ec5bae633f891817155014730a06939efb21bd132ea
TLSH
T159E0A79677648B7BD446CD31457B03523F6AF8501F81176F4740758F1E522D88E06420
MD5 SHA1 SHA512 TLSH

Submit Download

4056_13434008926187528.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\4056_13434008926187528.pma
Size 696B
SHA256 da9a8ae0c04da6ceae900796a026f4777895bf149eed2c495fbdae098362f596
MD5 3f5af086a83b749aa34a3aac1b986a0a
SHA1 0e67e17122beec914722d98cef0e669541560ff3
SHA512 0a12749b3971d0023cc1dd4f87113c94cc2c961ef824009c89a32ba24fe51de83357bb0757af7612ffb3a638302f5a298a2fc823dec8d117cf27255d2996191b
TLSH
T153010E49A3144F77CC828D3584FE27412BB0FA501B821BBF7B10724F2E021C9AED9168
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 4.8MB
SHA256 e1caaa08d7932f970070d2e895cec5d61e1ad66f4f23cf1b73d5760fcbc727d5
MD5 80b4843aa34cceff26876d5e0f90942c
SHA1 39af21d4821a27cc8edc9dbc777d198998e47fbb
SHA512 2888e9eafceb9803e51686c251b8f02a153f7de68c428f0ea606f5dbea535dd5bb1ec34ddd957d9fbe59e7fc0ce3660f7ee8e242ebc08f8efff986e75a616506
SSDEEP 49152:xxgGhqFTTI/KCGZd0qgNEf16lhulJLLyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkU:EP3WQem7vj1BDlZv
TLSH
T1EB368B13F29940E9D059D079835A9232EA72BC490B31B6DF0790BB662F77BE06B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.usa

Path C:\Program Files\Google\Chrome\Application\chrome.usa
Size 3.1MB
SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
MD5 fa63967c128ae8a0849c916979790211
SHA1 7064ec510e9828d290aacdee2af26855ca816c84
SHA512 db167c33774c8032501e36488c9f6724a7394f9e7134a1c9235df8bc7f71658132bc39a84967cf98ef8a61e68ce2d4c813f156ae445a8f6273c811e746fe181f
SSDEEP 49152:VyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Um7vj1BDlZG
TLSH
T19DE58C13F2D940D8D059D079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

785dc157-fa5b-4df1-bc70-0e9d3ac8fb02.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\785dc157-fa5b-4df1-bc70-0e9d3ac8fb02.tmp
Size 134KB
SHA256 6b052d0b803ae22361d1671a95c2bc8f5874b1137c979259b4d04a04e36501da
MD5 251d3aeb56d0b588c85438edc9a3deb0
SHA1 cc3d0be5394fc5c2c17e517f52c248cbb1713aed
SHA512 c4b568112002f06e9e1225e18884fb7f419306347207526e6f20e9aacd898a15b16d7afd20b58cef1465d1692cb6bf2d32e6c52351bdb2d789332d8ed6b345bf
SSDEEP 3072:QOSQ9TzpN9/GmBSHAwz8XKWSSeuZRpOVPlK2Sz/vf5/MphT9:/5p/OmBsA/K0emXSPk2CMx
TLSH
T1F4D3122EA4620C75A21D63583D3F33278FE148521B5BAEE4E0E7260D26F66F9433AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 55d4100633aa6320f5ea53eadcf8acbc5919f2cf4c0617687f15fc627ae7e4d9
MD5 fb38cf4cb204ee72ff5a7007a66ac321
SHA1 5f2fb51d343bf6a525b3880f0a46982813efebaa
SHA512 552661264ba5401fa865c959f7752d9991603990938a7324c9656b6fa4d7915edb167410d7f894c9e3a92a11e2c95d2b513e1b22afe0dc09cf4134e4debee4ec
MD5 SHA1 SHA512

Submit Download

220ab41a-ad3f-43bc-a0a3-8ff7cae8d55e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\220ab41a-ad3f-43bc-a0a3-8ff7cae8d55e.tmp
Size 11KB
SHA256 a8d05ce4258ab69f052919f11b91415edd181d302260d8a8fc99e05bae9a7b6c
MD5 83c8f05d54aeb219a726e1f5f46aaa06
SHA1 2fec40bf9b80b7be99550b6b0df5894cf6926f1e
SHA512 e6823013afe0c7bdd16396b10c2ce20b92404ccca4c1bbea09fc552180b9787216ecb61fe741df025eeb9ed5172c7f411c0028f299a76de5a329d4abc27c8f4d
SSDEEP 192:egn4K6m87KxkXqK4I40pUZNCgVLHrKHfFKslEiYeXzKD/Zk+ErUkKN99WvSNmMsJ:FnjB87KxkXqKf/pUZNCgVLH2HfgslYe/
TLSH
T1B332D927D48DAA3F4FD8D91CCC166F8F6DB5025672680D2496FB9C1403A978A224A1BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Google Profile.ico

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Google Profile.ico
Size 192KB
SHA256 87e933966804aefee5b77abdae95b1a7f72c298b148190d7d20fe6a77c239f3b
MD5 010ec79a1098823a764aca5c4adfcbef
SHA1 ee77b3b4682e7b05075d7713f354162fe02555bb
SHA512 3ca45c2be2a916e19c5d9c467e1cdfac64b9243c29c9ac79dcde1342cc0cb9203d3f6ffe1b9ca1257799f6c70237e12019908e2c5091dd77d40134a0ae25d6f8
SSDEEP 3072:2Xm/EXUfaL6MV8nbsFXdFVgQAU6v4v62PV2Ey28nr6dOQriQWe4gMg3cdrqZByGk:2XUMCm4U6q62MEBi99g9sdIJZpVhA
TLSH
T1BA143B265EEEE940EEB11A753E7E4381D6B5B80689FD21E45AE23C112B7FCF505B9003
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 41636299c6186acbdd50214c09ca965a07094fd9158f3a5ebf1de56d7440d3ea
MD5 db1fc6fa1c60e63b9fc389ea5a2874ff
SHA1 d41e32140ddf39095ec91cd491db00624d042f51
SHA512 a50870ef619e489e0e3f606a0f49841d5263dff8fdd33d1b9d9153dadcff8a1fcd2b8cebf6b61590c8b7a2c3a8d1b58bf034dc36b6b5a8313fbe954a0834269f
TLSH
T11D61BBF7C6D8862DC81116F4DB21BA1FDD2D0A28521C3D2688E8EE4B93E2472D35139E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 6bad56125d520fdb47264cb388a3f5a6071b49819093b894e279d81c2f46331a
MD5 ab8eba5264a3ab1c9b297b7d8e37a7d3
SHA1 5c1c6837d11f1a1babd1254804766b4ec9ae48f4
SHA512 18ea9b6ad276c8afd50ad9b59fa39c1861c5d6272974338b7ade56fa359827471158c969c65064edb3c9b4ed5ca565bae254229914dd755094fc9e1f2020e09c
SSDEEP 192:yRHD5iv7copAPRp2bXsb+WNnVF2YOe+iyIsnAUge:yRHD5uVUXIXwX22e
TLSH
T1FA22942EB920753B5CCBD219FAA57E53D7F6102124902E80EAFC863C15D76CD232741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 a240c6e45356865f3ca739f266c2f6a1c6cc24144fe1e82dde057ba24c526548
MD5 bd7ce3aa67aed5ad108d4a644ab22156
SHA1 629b28b57e9007cc0b7c56679c061411def5d516
SHA512 8f52752ec066bc2ae78321d4912b057df0a419541cce2f71bb7c44d211873fc3e33ff7b2fff1e6ad7a504960f81e95b749f27440bf5058e43fe5d46338bb69ba
SSDEEP 192:4RzD5iv7copmPRpgbXsb+WNnB5YZOeWiyIsnAUgE:4RzD5uVuXWXwDY5E
TLSH
T1B232632EB910763B5DDBE219FAA57F53D7F6102124902E84EAFC862C15D76CD232701B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 25113c919afbcb68f4236832aa78148e6f451e58ebc7d985afc2fae6e4b07277
MD5 fcf5ad2fed2fa4f78816c69c947e88f3
SHA1 b4ba13db3802d1beb0f151132a344f26c1d647f4
SHA512 36b81208ed12c6dd373b3beb760e1d15e141cf7f80b8ba09f5e0312e15e9b67cc74dacc6209fde03cb3ebb55e925e68e522b8fa27e2e7e1162f93b2ccb597ed1
SSDEEP 192:4RzD5iv7copAPRp2bXsb+WNnB5Y2OeaiyIsnAUgE:4RzD5uVUXIXwDYcE
TLSH
T19B22842EB920763B5DCBE219FAA57E53D7F6102124902E80EAFC863C15D76CD232741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 10KB
SHA256 4f181a873f4f83a926ee53fced560be8a99e992f0f4c754b4d99ab334e4428d7
MD5 a8a27193dd95c586399d2c0764077733
SHA1 51efb4902fde48aebcf693ff5e2033db12757b94
SHA512 6232eb984b4ad4beaf0012847e157e1207660eecee421a33d554b49612861030f9297f5bbd6821c45b36a25a261a9f4fc167e5631d96e10b8280e0fef36404e7
SSDEEP 192:5R/D5iv7copmPRpgbXsb+WNngOrqOOeWiyIsnAUgE:5R/D5uVuXWXwtrq+E
TLSH
T16732622EB920763B9DCBD219FA657F53D7F6102124A02E84E6FC862C15D76CD2327017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a4e8f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences~RFe5a4e8f.TMP
Size 3KB
SHA256 ec9aecdeb4f112a18ff57dc194fe167a4f8ee3dbb19a35b7e56e9ba730ba0c59
MD5 ca845476c77fef659a83b2f24481d454
SHA1 f3f68809fd56e51faa88254981410ccb3ba06b8b
SHA512 3eb7e7bcf00bb3f460b5f48daeae0be13e47c560ac4d7485c858a9dd22adab17416a6f495cca65a4abab2611c25c4c2331c59f3cc7d494166b076bd35064ad84
TLSH
T1E4618268C4A80CA72EB67B74B82D0782FA51477F0240080A7DBD658C4FB2A778080F6B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 a5cdedfa659e7a37ab14ce7f9bcfc3c810af58c5f33f77187a216f53d5ef0304
MD5 228416aa0a9deca5e61a3e4d0a3d4e27
SHA1 4973b1dd9855f09657932dbba535b10a8c708ec9
SHA512 a8f3453a8033f5f1629c832eb2ce9e88183cf76995093aec17e0ea7eaeae4071c792279f37bf11c9038c250182392b6b51ceea935a85076c851b2e91dc060b57
SSDEEP 3072:POSQ9TzpN9/GmBSHAwz8XKWSSeuZRpOVPlK2Sz/vf5/MphT9:W5p/OmBsA/K0emXSPk2CMx
TLSH
T1F9D3123EA4610C66A20D63683D3F33278FE148521B5BDFE4E1D7260D66F66B9433AE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 2ef99ad612c160f01ec7b81fc88d0c1cd983c3798f66fbca869fb3c0fa957db1
MD5 e41b5141a9b8ab5e681ad5056695e76b
SHA1 4a4be379bc61beac9b1170b777860b3494b4e76b
SHA512 365afbacda381ceb19d536d8c02f89cb3b71248b1a599bdb81e71a6b8c3bbbbdda8088cc59967d68733efa7ae9f6e9cd0dfdbb2d34b8d173405cbb43673e38e8
SSDEEP 96:qC6cd+qJw6eq8Em6eifKcIz9NURDotok5Q8DqB6vGyvQH4jYQ70bblDv4a:qCHxJPz8/CkqDUDL6fr4jYQ70bb1
TLSH
T110A11731B8A95DB784B6E584B2822E03CF64B197A621EFC4B9ED5F1C14F70EC1752A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 f754731fb4ba7765099322ba518659c9da1af216a91edc32858a614ba370feb8
MD5 eb995ceda09ebc7e48c3d549fae3edd7
SHA1 06660fd2d598ca206b6be56e1d05cee5417019d3
SHA512 14954771a5355cb218d0363ae3e53060208a4ef3c743bdc2c14da45e5a4f192bf6a6be5bcf90266e586a783bee890871101066ead1b05645c6fe81ad2600d929
SSDEEP 3072:6OSQ9TzpN9/GmBSHAwz8XKWSSeuZRpOVPlK2Sz/vf5/MphT9:Z5p/OmBsA/K0emXSPk2CMx
TLSH
T1E9D3123EA4610C66A20D63683D3F33278FE149521B5BDFE4E0D7260D66F66B9433AE11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 134KB
SHA256 88ba4c45ee779d4c0fe53fb9c5f999e5974f37286b768ddf4caeb4a5adfba896
MD5 5684a40ceec6b0b11ff4bb3517ddea3f
SHA1 f24ad7a0d9b5fd55b6693cc32dd6c3cd6bed91bf
SHA512 593ba843389924ee7b0d75615df779bb84fe72e40948111f38efe3106cbd817bada762f9a29011347dd5ea8a54d38ff085ad9c4f35ce780484fa81813f647edf
SSDEEP 3072:QOSQ9TzpN9/GmBSHAwz8XKWSSeuZRpOVPlK2Sz/vf5/MphT9:/5p/OmBsA/K0emXSPk2CMx
TLSH
T112D3122EA4620C75A21D63583D3F33278FE148521B5BAEE4E0E7260D26F66F9433AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa

Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_acc93f72f2803b65410536d419afb512_akira_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_rhadamanthys_vidar.usa
Size 4.3MB
SHA256 a8c4ca099a07dbd87d9045f22be0e4acb34857323b8633d7fac46c97dc41d6ef
MD5 c451c81ed46b64c08d9db05237dcee8d
SHA1 ac63c873facf263439de14edde1b03f51514e0fe
SHA512 55649b927b706ba5fdda88539236e8344df8ed7ae6cb2976b8bff1b71bb1ba2dd88d3aea488ad178f6b184941ea38cdf49a19fbedc98bd8bff2fa6039c6fe763
SSDEEP 49152:B/KCGZd0qgNEf16lhulJLirHJIZ/K0tDAy49uO7G6XSq4vFWVRxYOKKJY+lpSt3B:6WQtZ/K0tGOFWVRuLftCT
TLSH
T1D2264A03F2E941E9E0AAE178DF3596319B727C5A8BF1A5DF214032D41E76AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsaShohdi.asu

Path C:\Windows\SysWOW64\UsaShohdi.asu
Size 6.1MB
SHA256 b85870b9f79c87e86154b85d3e5281c0fd0ec5234e0ee7a0a5dfd319dc296dd7
MD5 698e7223007f5cd962560747a0d0bdba
SHA1 f8954de209112721582c068dbb210a16e8fd8028
SHA512 0535baac7f8e7628a4453386f3dcde86d77dea7f814682c535fb96ca63b1922e7d1cc8087b3cda445729503ce583a17f60a96a24a8ada97ad52ca903da30502e
SSDEEP 49152:xxgGhqFTTI/KCGZd0qgNEf16lhulJLr/KCGZd0qgNEf16lhulJLirHJIZ/K0tDA/:EP3WQUWQtZ/K0tGOFWVRuLftCTh
TLSH
T1EE566B13F2E900E9E05AD178CB269231AB327C5A4BF1B5DF225076D52E77AD07B38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Windows\SystemTemp\Crashpad\settings.dat
Size 40B
SHA256 9861796d261df8333355675f9995b47a31e48936d51b81a8ee3ecfe8501f1d40
MD5 2e26aa9eb22fc4015b56e031a3b66a17
SHA1 bdb56b79e26a9d609ff45eb13078702595bffb4b
SHA512 97e3419a63994da8034d1d30fc96bb8d9e9ba7037047a175417affbd21a1af79b4f7b1ce786cd36e4808f75fe454d2526e57aabec3313dda7d1b76d8d63f4722
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Windows\SystemTemp\chrome_installer.log
Size 6KB
SHA256 1b89031987759458137a4e966206a3de975bb00b807330a7c05a10e81254ac94
MD5 0ce75870863f9306da5c5ceff3218114
SHA1 b65fd0185cfa1f252f99eb01ff0a8f49ba87ee9b
SHA512 afedc45f9bbefcc568d7d6dc383663c9d158df49036e5343e630209470b1d396a82ba2d2ac27973f9a3235c9510997b92f4a21f51f482f47a73c93ad636cb5a5
SSDEEP 96:e1aP/tlLDVcV93EtzYYBQhK22K2HBmghfYhPSZyGchK3UzK3uMO0:VXzDVcXE1YYgwVMPZbzXM3
TLSH
T16FD1CED6AE0249BF3B829B2B335321917F9F200AD7D4A4723BDF6545F0CA969011F1A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2776-353-0x00007FF6B7BB0000-0x00007FF6B81DC000-memory.dmp

Download

memory/4148-354-0x00007FF6B7BB0000-0x00007FF6B81DC000-memory.dmp

Download