1bc4fd91f87005e7dca606a09115849b337192980174bac7c643d17c9f6153c6

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 17:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Size 2.1MB
Sample261102-wheevsdz9j
SHA256 1bc4fd91f87005e7dca606a09115849b337192980174bac7c643d17c9f6153c6
MD5 f75e4b9a1549d9c8e7fa8571a47c59a9
SHA1 0df63fb4d6dee09a94f2cca74123dc12c363b915
SHA512 e8245660874eea9246f72c87d52feb9bf5de2c9477f1bb7a577f6ca3f7077ad24c369e9f8ab9349be3c17a6cfdcf5f5832cadcb2fda36028db44bf4367860165
SSDEEP 49152:NYgah0BGucNSQMIZI7VbDMS4BsNgMLIu:voK
TLSH
T14FA58D17A3B800FDD1B7C1B9C9165903EB71B8490731AADF03909AA61F23AE55F7B724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 2 IoCs

resource	yara_rule
behavioral2/files/0x00040000000187c7-4.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/files/0x0007000000016b3a-10.dat	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 2 IoCs

resource	yara_rule
behavioral2/files/0x00040000000187c7-4.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/files/0x0007000000016b3a-10.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 2 IoCs

resource	yara_rule
behavioral2/files/0x00040000000187c7-4.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/files/0x0007000000016b3a-10.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 2 IoCs

resource	yara_rule
behavioral2/files/0x00040000000187c7-4.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store
behavioral2/files/0x0007000000016b3a-10.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5592	netsh.exe

Executes dropped EXE 1 IoCs

pid	Process
5660	VnsService.exe

Loads dropped DLL 3 IoCs

pid	Process
4696	chrome.exe
6056	chrome.exe
3396	chrome.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\VnsService = "\"C:\\Users\\Admin\\AppData\\Local\\vns\\VnsService.exe\""	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe
1240	cmd.exe
5760	cmd.exe
5256	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5256	cmd.exe
3776	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3396	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\FLAGS\ = "0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib\Version = "1.0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib\Version = "1.0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\HELPDIR	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\TypeLib	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\TypeLib	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ = "IElevatorChromeCanary"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\FLAGS	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\0\win64\ = "C:\\Program Files\\Google\\Chrome\\Application\\140.0.7339.81\\elevation_service.exe"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\ = "IElevatorChrome"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\TypeLib\Version = "1.0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\HELPDIR\ = "C:\\Program Files\\Google\\Chrome\\Application\\140.0.7339.81"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\ProxyStubClsid32	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\ = "IElevatorChromeCanary"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\TypeLib\Version = "1.0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ = "IElevatorChromium"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}\ = "IElevatorChromeDev"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4F7CE041-28E9-484F-9DD0-61A8CACEFEE4}\TypeLib\Version = "1.0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\ = "Elevator 1.0 Type Library"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ProxyStubClsid32	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib\Version = "1.0"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{463ABECF-410D-407F-8AF5-0DF35A005CC8}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BB2AA26B-343A-4072-8B6F-80557B8CE571}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}\1.0\0\win64	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ = "IElevator"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\TypeLib	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\ProxyStubClsid32	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\TypeLib	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A2721D66-376E-4D2F-9F0F-9070E9A42B5F}\TypeLib\ = "{0014D784-7012-4A79-8AB6-ADDB8193A06E}"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0014D784-7012-4A79-8AB6-ADDB8193A06E}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\TypeLib\Version = "1.0"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A949CB4E-C4F9-44C4-B213-6BF8AA9AC69C}\ProxyStubClsid32	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ = "IElevatorChromium"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B88C45B9-8825-4629-B83E-77CC67D9CEED}\ProxyStubClsid32	chrome.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
4696	chrome.exe
4696	chrome.exe
1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
4696	chrome.exe
4696	chrome.exe
2744	chrome.exe
2744	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe
Token: SeShutdownPrivilege	4696	chrome.exe
Token: SeCreatePagefilePrivilege	4696	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe
4696	chrome.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4588	1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	91
PID 4588 wrote to memory of 1296	4588	cmd.exe	93
PID 1808 wrote to memory of 1240	1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	94
PID 1240 wrote to memory of 5592	1240	cmd.exe	96
PID 1808 wrote to memory of 5760	1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	97
PID 5760 wrote to memory of 2776	5760	cmd.exe	99
PID 1808 wrote to memory of 5256	1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	100
PID 5256 wrote to memory of 3776	5256	cmd.exe	102
PID 1808 wrote to memory of 4696	1808	2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe	103
PID 4696 wrote to memory of 6056	4696	chrome.exe	104
PID 4696 wrote to memory of 4580	4696	chrome.exe	105
PID 4696 wrote to memory of 3396	4696	chrome.exe	106
PID 4696 wrote to memory of 4580	4696	chrome.exe	105
PID 4696 wrote to memory of 3856	4696	chrome.exe	107
PID 4696 wrote to memory of 3856	4696	chrome.exe	107
PID 4696 wrote to memory of 4052	4696	chrome.exe	109
PID 4696 wrote to memory of 4052	4696	chrome.exe	109
PID 4696 wrote to memory of 484	4696	chrome.exe	110
PID 4696 wrote to memory of 484	4696	chrome.exe	110
PID 4696 wrote to memory of 5080	4696	chrome.exe	111
PID 4696 wrote to memory of 5080	4696	chrome.exe	111
PID 4696 wrote to memory of 3628	4696	chrome.exe	112
PID 4696 wrote to memory of 3628	4696	chrome.exe	112
PID 4696 wrote to memory of 1232	4696	chrome.exe	113
PID 4696 wrote to memory of 5020	4696	chrome.exe	114
PID 4696 wrote to memory of 5020	4696	chrome.exe	114
PID 4696 wrote to memory of 5240	4696	chrome.exe	115
PID 4696 wrote to memory of 5240	4696	chrome.exe	115
PID 4696 wrote to memory of 4328	4696	chrome.exe	119
PID 4696 wrote to memory of 5040	4696	chrome.exe	120
PID 4696 wrote to memory of 4328	4696	chrome.exe	119
PID 4696 wrote to memory of 2416	4696	chrome.exe	121
PID 4696 wrote to memory of 5040	4696	chrome.exe	120
PID 4696 wrote to memory of 2416	4696	chrome.exe	121
PID 4696 wrote to memory of 2704	4696	chrome.exe	122
PID 4696 wrote to memory of 4352	4696	chrome.exe	123
PID 4696 wrote to memory of 2704	4696	chrome.exe	122
PID 4696 wrote to memory of 4536	4696	chrome.exe	124
PID 4696 wrote to memory of 4352	4696	chrome.exe	123
PID 4696 wrote to memory of 4536	4696	chrome.exe	124
PID 4696 wrote to memory of 4940	4696	chrome.exe	126
PID 4696 wrote to memory of 2820	4696	chrome.exe	125
PID 4696 wrote to memory of 2820	4696	chrome.exe	125
PID 4696 wrote to memory of 2856	4696	chrome.exe	127
PID 4696 wrote to memory of 4940	4696	chrome.exe	126
PID 4696 wrote to memory of 2856	4696	chrome.exe	127
PID 4696 wrote to memory of 4628	4696	chrome.exe	128
PID 4696 wrote to memory of 4372	4696	chrome.exe	129
PID 4696 wrote to memory of 4628	4696	chrome.exe	128
PID 4696 wrote to memory of 4372	4696	chrome.exe	129
PID 4696 wrote to memory of 4120	4696	chrome.exe	135
PID 4696 wrote to memory of 832	4696	chrome.exe	136
PID 4696 wrote to memory of 3484	4696	chrome.exe	137
PID 4696 wrote to memory of 2744	4696	chrome.exe	138

C:\Users\Admin\AppData\Local\Temp\2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f75e4b9a1549d9c8e7fa8571a47c59a9_cobalt-strike_icedid_njrat_satacom_stealc.exe"
1⤵
- Adds Run key to start application
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
    3⤵
    PID:1296
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c netsh advfirewall firewall set rule group="remote desktop" new enable=Yes >nul 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Windows\system32\netsh.exe
    netsh advfirewall firewall set rule group="remote desktop" new enable=Yes
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5592
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c netsh wlan export profile folder="C:\Users\Admin\AppData\Local\Temp\vns_wifi" key=clear
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5760
- - C:\Windows\system32\netsh.exe
    netsh wlan export profile folder="C:\Users\Admin\AppData\Local\Temp\vns_wifi" key=clear
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2776
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c netsh wlan show profiles
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  - Suspicious use of WriteProcessMemory
  PID:5256
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  --no-first-run --no-default-browser-check
  2⤵
  - Loads dropped DLL
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7fff1283c728,0x7fff1283c734,0x7fff1283c740
    3⤵
    - Loads dropped DLL
    PID:6056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,4054072166663593598,3811701577465388171,262144 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=1920 /prefetch:2
    3⤵
    PID:4580
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2080,i,5042750352293051355,3493615105846849480,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:11
    3⤵
    - Loads dropped DLL
    - System Time Discovery
    PID:3396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,2859362537211570734,9353913441452509709,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
    3⤵
    PID:3856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,4891947430724630219,5871576713324753757,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3188,i,15181277543670800183,8226835721123441211,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
    3⤵
    PID:484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4680,i,4236386200891008512,7537881139594500566,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:5080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4700,i,11572506130199891271,10781536641885029602,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:3628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,1505367594592833474,16743331028666410684,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
    3⤵
    PID:1232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5400,i,3438872058737165924,11171803942451550064,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5440,i,17475373503547572021,6683851722379528842,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:5240
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5504,i,16710172215263559010,6435039802496515314,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
    3⤵
    PID:4328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5712,i,4885720711060412109,9092935142311415063,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5984,i,6725919729529063945,15525230219474618742,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:2416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5376,i,8690294567327266551,1557606022061181765,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5332,i,14064801095350974019,10797897242761671242,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:1
    3⤵
    PID:4352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5768,i,14522310882414959615,2051694596942265891,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6012,i,5876634551008497415,16709867302407520345,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    PID:2820
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6080,i,11152895239113573393,583103340063683743,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
    3⤵
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5452,i,13840344001145067736,16491814285136514326,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5536,i,7685843987383249227,6955636326782553248,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:1
    3⤵
    PID:4628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6288,i,1687328081973063051,10084186557498688689,2097152 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:9
    3⤵
    PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6292,i,14419287547491178469,6284710370177073568,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
    3⤵
    PID:4120
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4672,i,8988682735047631448,8414753249689092763,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
    3⤵
    PID:832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6336,i,13254933584703532471,11997327274642956371,524288 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
    3⤵
    PID:3484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5896,i,13107697873846551840,12293389595591794056,262144 --field-trial-handle=1928,i,13379682887398272589,1123572509544251079,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2744

C:\Users\Admin\AppData\Local\vns\VnsService.exe
"C:\Users\Admin\AppData\Local\vns\VnsService.exe"
1⤵
- Executes dropped EXE
PID:5660

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1636

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5184

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5052

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4bcf945f-d8b3-42e7-b8b8-6f2e4c5411ed.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\4bcf945f-d8b3-42e7-b8b8-6f2e4c5411ed.tmp
Size 144KB
SHA256 c598b10b8ae616a920ad02f31bd6c6367456d3d64a6517966ec44cfa42c7de99
MD5 3ed4731a664f2b3964fb03da1033cad4
SHA1 e5cfc47dfeda8a8cd8c6f92d9086a2f89e764271
SHA512 e69444d6f571c15c87789a2c9f9d4ae2ebced863ed1a6e2b87d2ba76bdaef1163aec2d9c7935b5e60de4e5fdd2dda4f13c485312da6dd2f1e2f47afcc39f22b1
SSDEEP 3072:aiYZ2i8vZS7i2efDTVIshUtHAbUx9/9bVUXE89ar2+8l1itl7fQT:vFT2efDTKshU+0XV/89SbtlET
TLSH
T1E9E312F25CB069756A21CADCF3528D051CA8E0A74C04B5CCCAFE5E65973E1A816D3E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95f0049e-d2b9-4ac5-bbec-578ea12cd9af.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\95f0049e-d2b9-4ac5-bbec-578ea12cd9af.tmp
Size 4KB
SHA256 080a0c7ec5aaf91b03ecc4335f52286c5106bc99a872ad6c3f0d012a274ed66c
MD5 4faab227b39c3cfbe4f59e00a4e1c89c
SHA1 1d7c10cdad44c13bf0c7cf5dc66db29a870620f3
SHA512 66b4b1fb253ecb10d53a87a14dd90a5fa6b9b94c76c451bac85b57d9d8f8b0f5de8bf5917d5e0ebe73d717122e1eccb73a47fe1ee840d2168edfaad0f881c187
SSDEEP 96:qC0d+qJw6eq8Em6eifKcIz9NURDotok598DNB6vGyvQH4jYJ0bblDv4a:qC0xJPz8/CkqDUDATfr4jYJ0bb1
TLSH
T168A11931B8694DB798B6D585B2832E03DF64B197E621AFC0B9DD1E1C14F70E81352A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99904939-ae6e-4347-b4cc-e0478f65946f.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\99904939-ae6e-4347-b4cc-e0478f65946f.tmp
Size 143KB
SHA256 6faa58ade9538be09410f45f8d53d163fb4a66a20fa6c67dccd823e021c2c482
MD5 2d7b2452f476481885302d910d2ce345
SHA1 f424cd187aae321ce8c48ce96eef0bc215e137bd
SHA512 346c287dd491f3e817fdcd1fd057f60fe08d541ede2aa13c2e600260fbec95d40446c51b7074aa5712f6d23abd315f37275b0267fc9ee1c61ebf5a431ba32cd3
SSDEEP 3072:JiYZ2i8vZS7i2efDTVIshUtHAbUx9/9bVUXE89ar2+8l1itl7fQT:IFT2efDTKshU+0XV/89SbtlET
TLSH
T15BE323F19CF09935AA11CAECF3528C062D74E0A14819A1C8C7FE4E75977E1A816D3E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

06bdde95-4015-4ea1-af14-8b1f32328845.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\06bdde95-4015-4ea1-af14-8b1f32328845.tmp
Size 13KB
SHA256 0db972e8abe344ee512d8f3ba106796367267ee93a79aa4eea9b777b683f2665
MD5 66167be63d736a6e2add093e774cfd2e
SHA1 400115639c8c5ac9c660437921cf405acc50f5c9
SHA512 74399bf7cc1df408d8f849a5d9b674f0a4cdf31aee2bc8a91a41b11a618196ec6af347e6d1912e1b53282465c42b9c427c7f63723ffab1be5fafa26cec27b2a1
SSDEEP 384:FnjB87KxkXqKf/pUZNCgVLH2HfgslYeXODBk+ErU3DGHGJ7sXSsbdpiFaq:FjB87KxkXqKf/pUZNCgVLH2HfgsOEOtP
TLSH
T118520B67A84D993F0FD8DA8CCC276F8FADF502566268092492FB9C1903D57CB114A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dedbdc8-aaa6-4021-a4c0-d01696286026.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4dedbdc8-aaa6-4021-a4c0-d01696286026.tmp
Size 11KB
SHA256 1e9b1731fe5c9bf71c11824aea05d8e1195379913a441ab6be4aac5683c210d0
MD5 92537280e913bc260b7a0b2e327825d5
SHA1 ca9ce3f55b58331c378f934c8a18dc6b839ba7e7
SHA512 b8b7ce72304dbad7b6df241c65d060ccef8a5f4da7400ed834cd90fc51700d6c8c5bb7e0adfef588cba7cd977fedbd1103b4b368a03eec74d573585a66042048
SSDEEP 192:bR4ZASav7sAPRp2P9bHsb+WNnJqVSdqU/0arouClVyIsnAUge:bR4ZF2JX4BwJkSdqzaXCTe
TLSH
T10E32B62DEE10753FACDAC32AFA627B97D6F5102160942E84EAFC893C15E76CC6217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7ac8a095-b5e0-4fcf-b05c-f66af31a62d1.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\7ac8a095-b5e0-4fcf-b05c-f66af31a62d1.tmp
Size 12KB
SHA256 22a1ab5c49a04a9f428aaeeac3bb8fb955743d63a6fe6b613ea574001659ac41
MD5 0fbc5b93586e8705e3355c41a9796ba7
SHA1 dae47e7e22cd3f1f893361fe4b015162be92df85
SHA512 e405913fd774ea660b3db06938778b70a9e8add88d5ec6533646ebc369bf849636ac461e652b9cfe2a38ad63a3d468d5620fd160386de23abbf0fc5ac9784a2c
SSDEEP 192:bR4ZASav7sbPRpfP9bHsb+WNnJqVSdqJ/0arozClVyIsnAUgE:bR4ZF24XnBwJkSdqmaYCTE
TLSH
T1F242C72DE910753FACDAD329FA627B97E6F5102221942E84EBFC893C15E76CC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9884c226-c794-4c85-a5f5-6c4b428aca84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9884c226-c794-4c85-a5f5-6c4b428aca84.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

16cefe82-78e1-4831-9c87-906dd705ee84.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\16cefe82-78e1-4831-9c87-906dd705ee84.tmp
Size 2KB
SHA256 41bb35e82bac44f8ea2208d8f0f66453b67c4ffeecc8b0a84c3a2356be47fa1d
MD5 a920db31557517fdea99a1398e729d30
SHA1 970d1a9dab0f2ff5edd433f1591363f281d35270
SHA512 f0c93528d4d38b438d142f4a83d0231947c3d8a200741ad6bd5d08361a9c8557ec962fd0d2578ff227dd303a1e2db8e447f7732fc29fa6afeb3cec45d84bb843
TLSH
T16D5189F3D3D4866D841556F4AB25AE1FCD7D1A18421C3C6288D8AE4B43F2972D21538F
MD5 SHA1 SHA512 TLSH

Submit Download

8846d971-701e-4ace-b09b-42dd6a5a5a44.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8846d971-701e-4ace-b09b-42dd6a5a5a44.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 2839185f1b9535d55ea4c59b47b5cf04eede226b142860ac40b77828f10d2d85
MD5 ee96bf61b0aa002c62f50713868a9cb0
SHA1 b533a5d85139c10989743cd8369277ac80d67fef
SHA512 9ae4fc5d5766cd5427b14cb14c3b01e51ae619c85c6cc590f65b23669a9de071f86116e3a9f0cbb6db83df4152a681f6474403616e6aa21758a11dd2b126bd25
TLSH
T184A0025049C03911CE105671E0A219432651CC281D63430798A71CFC897F1C44A07149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ea02dd4a95f3fce09f7930eb52769f454be6f653ac75bde721cd4f3cba014b05
MD5 bc92c7f9eb1cbdc99ccd6cd2d56b02b8
SHA1 7709b1ed68ed9cb5ac350305bb2658a5edade294
SHA512 cd7568f8579ec206caaf9d9d895e1ef083e3400fbfab9c0382dbd8019d6844fdb37c613527d88a0a03ea44cefee73b53c63db92aaf4a3f86972cf3f7f0baa8f1
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

b5bb61de-6a8c-407f-9b64-5c1a6b01278e.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\b5bb61de-6a8c-407f-9b64-5c1a6b01278e.tmp
Size 143KB
SHA256 ea1fd211ac93c03d669253e8012d02b614e025ea3070f7f74ba84cde1a4e9bd5
MD5 9b2e975533b0d0b91a4cc84ceb034adb
SHA1 65ebad0da68618a02f9773ed932edba118988cd1
SHA512 097302651d6811aa9847c467bb8822ad28a463ee404179303053665f60261f2ae9bee08ffa7ddeda56524893a811350d4ebabadc1a2308c7ad9781c7756fdf56
SSDEEP 3072:2iYZ2i8vZS7i2efDTVIshUtHAbUx9/9bVUXE89ar2+8l1itl7fQT:LFT2efDTKshU+0XV/89SbtlET
TLSH
T1E0E323F19CF09935AA11CAECF3528D062D74E0A14815A1C8C7FE4E75977E1A816D3E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5ce4e94-b5aa-4909-8109-2c59440d57c1.tmp

Path C:\Users\Admin\AppData\Local\Temp\c5ce4e94-b5aa-4909-8109-2c59440d57c1.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcboost_abe_chrome.bin

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.bin
Size 32B
SHA256 40f15c23b655d146a4241b5d0d0e6ebac54e52c97e98d749ebf5ea1cc1868b42
MD5 be22603fb9fe2a6f0edd1b34a305a6bd
SHA1 10c7dd03c83ef69f09b59eb77f6f28d3817761e5
SHA512 1905d8bd9702a83ba8244aeef273342cd4150a7ddce491e3b190553c2929fa4a11113776688bbf6588aee9cc1b313dba88c02afcf8a1afbd7a4df614e6345ab1
MD5 SHA1 SHA512

Submit Download

pcboost_abe_chrome.cfg

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.cfg
Size 106B
SHA256 9e65979328b61e50207454aae039c2384d233f323d25949b6190decfda13303a
MD5 ab63b3fa1a8b1b7ecdf848b1f4ed9193
SHA1 5c5075e4fd34c174e049ec67251022d8d8559fdd
SHA512 e9d6c3e793f900ffd178f3a9af98dcc37bbf7d0840155dfd8894e4661a0c00017a4be28ff10e254be52dbf35e516dbb12cf4c05fdde76cabb2a0cc086d8ae119
TLSH
T14CB01240F646B75A011088FE9CF40A494E50558D3CBC12850378555FC68652D75E5E86
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 138B
SHA256 cd5a1fda2e559c36d278230a626e2b2f334c530e4edd0c7fa29fe752071e4c8a
MD5 716fb2c9bf2e0a3d186fdcdd5cfea1b0
SHA1 d221e7d66e434b9c4270b2e561c6eb8a2fb41272
SHA512 1378db225b2174ab468e7c16924ad7e7669b0f8a59433d5984d0dbf72efbea9f7501e41959a6e496ec6490cf06914586a644abb0de7af39ca487e622daabba3b
TLSH
T1D0C04C4573D71491CC4483051D1276A10B69B1102CC935D0B08731003B439704B83D02
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 165B
SHA256 b838ea314303324cf0701a87a550f15e355700d381a3eae7d417bbcad9f830be
MD5 4527debcf23bc76deec6868db7700889
SHA1 9b0376a3ae5cf646c5eedeec50018c56b124d9da
SHA512 3938e6da8718ed36c1ac6247accf2dbb766715060fed9dabf478621abc2da626b4d190d0344d0a008231f15480088ef3ade75807dd8b6f6a3030413af34db2b4
TLSH
T131C04C45B3E714D1CC4883451D127AA10BAAF5103CC939D0B08732003F439709B93D02
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 182B
SHA256 c87b60c299e7d3c95c844892a80e3aae9995efc4a3c4cd654fe0cc86a9030edf
MD5 0c9d0b1f15aef51634af9323e2fadbf5
SHA1 4f42d5ae2c7d9c0db35ec68ac6e37667e498ef01
SHA512 3e4d88b046535e537bb146b6a86a8485722a8e37dfaa5ea39aabec24100540a8ab2b71fce849cf5aad55442276792d13b2bfca95b437bdb5ebe57b415ceb41e5
TLSH
T1A9C00246B3EB14D1D98883491D167AA14AAAB5103CD939D4B09772403B43970DB93D02
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 199B
SHA256 b4f0f586bc74c883898d13a7886cf686ad469b10a9f17b1f90138071ac2bbf2c
MD5 09e9ee2e61a3fe98407ae3ab25fa2edb
SHA1 39779fa4a5acd0cd35478faf16490e86818bd3ce
SHA512 e65b3febc370b52ba3b2239a56d7d8fc08e4267c21e8ad9d28de3eedc99ed84465e84d4c2d409209172f127bf2e16ab32b3161d991f83a3dfce1df2a817db36c
TLSH
T19CD00296B3FB14D1D98883491E1A7AA14AAAB5113CD939D8B0A773803F53A70DB93D06
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 216B
SHA256 85bf9063e9dde307fa7522dcdae8fe66eaf4ac62300a10ab74b5142fc62389cf
MD5 fd64a982fd86c03bf7ae25bbef17588a
SHA1 d0727c1a70bcee91bb30e677e16b71615d235d0c
SHA512 2dfab56a86634901eb7934627cfa6f1e53b7f63ebf61a15ea2c0b2938eb83b61645a8348b7620690590fd29fb120156ec68b5bf795eb7aa7b129420d2235d591
TLSH
T1C0D00296B3FB14D1D944834D1E1D76A14AAAB5113CD935D8F0A773803F53A70DB53D06
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 497B
SHA256 03b25a5c1db8859dfb34be1d45f825eeb08084b9421d70ee9b1ea4177bc93f2e
MD5 b24e0053c18128052bbc81d3b76792f5
SHA1 2dc9d89d52fe7560643d6db8e85ac2e6d5893047
SHA512 52e5255f824a2bf7214fb4c1ce5f38e4c54dc3a09ce3d67a382bd715b867aff4cb7e735743c21b02dd39848e1aa7b6febd51a330a3a1442711acedfece5771fa
TLSH
T177F01C96F3BF08D0C44982095EAD39E64A9E712174D832E9A142B7853F27F74DBCAC15
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 450B
SHA256 8729930992e1abba1ba8bfbb2072bdaa744879766be9cdc58f73d7a5fbf7b7ea
MD5 2587e4a84d0f3ffb662eac662e58b2c5
SHA1 c6b36e8fc141f0aea4cebcbde47d4db22ec5a2b0
SHA512 47bd270fcaafc702e67811360b1f326b9cdf926b853c70feb392b809a976d7bb4e4206b4d1b993bdefabd86cd3fd81d9a33062766f199b976dd29f1842d72231
TLSH
T16AF0395BB3FF08D0C449820A5A9D38E64A9D702034C832E5A182B7443B27FB4DB8AC15
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 469B
SHA256 b5086db79e8163f318f195c322f4880f68b9cc0076bbb7452e585adfd972c2d7
MD5 b77153efc5c9a7e0c118e8c80393f68f
SHA1 b08b57fa042498987f6ed0c48392a1041a2c637f
SHA512 c107807004d02218f2d5adbd490d43e0c51f27321113b2049f1403b6980ea88569a0603b484d2a632f002f1c08575e2a3fed07f4799cf5a6bcb88eebd0dc102b
TLSH
T1E8F03057F3FF08D0C44982095E9D39E64A9D712134C831E5A142B7843B27F74DB8AC15
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 478B
SHA256 b8a1d32b290d9dd6be7a8b49ad74246c721593ca73c7341897afdece38adec62
MD5 a61e39c27070f8bb52a974aadeec4a74
SHA1 26804930c50ba3686da912cf39e6d7574bfbe42f
SHA512 349c10d43469742b5077586da3d433ae316d5eaa0b8367fa6118fbcdc4181e301576f180af26f09330ce465c47029fcaceef23c7b646f79693369c9acb51a4ce
TLSH
T11DF03057F3FF08D0C44982095E9D39E64A9E712134C831E5A142B7853F27F74DB8AC15
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.trace

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.trace
Size 507B
SHA256 83a45a034bf3cb12101b722388db7a3b2d8337c5094b92c13ede1fd65914b4d8
MD5 a824cf847fe493c48d2f05c430231653
SHA1 6ffd72eee51aad78557741aa655991da127130f0
SHA512 4551c113b4774c6c43355ce3c004389f85f7ada87d2b31f1ba15bf1235680e1af5f6f21cb4823c1dcf02f4cb0fe37fe1d6b1bf9971a5e80b93b522925b4fe093
TLSH
T143F01296F3BF08D0C449C1095EAD35E64A9E712174D832E9614277853F27F74DBCAC15
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_abe_chrome.txt

Path C:\Users\Admin\AppData\Local\Temp\pcboost_abe_chrome.txt
Size 150B
SHA256 893eb60cc8665985202ab445f809dce9b5361a023fa0bf51a77189f9e5090186
MD5 b1e655c71667ac66b8b1f8c3f0306dca
SHA1 09c4803f3aa5ecc8ee40c899ef0158242e1c3ba0
SHA512 ae1c5ef624ca057095a744b1b4aadec185ae9d0851d75a6b70f9bb84a9bd1a3d4458dddf5eb2eacba93b79091f043e878e73c808a87f54a883414ea11e46416d
TLSH
T195C09B49C34E7007D79E450249BEB504C582371740E185554019E3C59E036D58E0C79C
MD5 SHA1 SHA512 TLSH

Submit Download

pcboost_bridge_1808_1.dll

Path C:\Users\Admin\AppData\Local\Temp\pcboost_bridge_1808_1.dll
Size 167KB
SHA256 1961a16fa49742ce898c0e0d11ca809af783026a22d7f59d178ca36a2619e145
MD5 631654645939a6097d2921ee78bc1658
SHA1 5185085e5dc01e956cf83489a49cbd12c4fef6ee
SHA512 1f7e3eebefdc75fd91e9d53b3547bbbfbb3fdd0c41599bdbaadd1ec7fb495dc76d8376c2c003dd63b8178ea4c38b84bababef0c763c7f1c866bab90922cf4967
SSDEEP 3072:CxpDkKf96NZFmV4UH3JFlkifS0QXP82jdi+EOCcsNKqioSkp:CvPH3JFrUf3lCA
TLSH
T11CF37E16BBA9407FE5379578C9430A01EF72BC564761AACF03900EB65F2B7E48A3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4696_746338809\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

vns_progress.txt

Path C:\Users\Admin\AppData\Local\Temp\vns_progress.txt
Size 288B
SHA256 cf826fe7e84bc3519864089d5448d594241583e1b425547f313af1967f61a684
MD5 deb6761795706f46dc6db0da2136f382
SHA1 c98c899060e987973dd1fa6741fe0625a7d41fc7
SHA512 473c591b48d1cd8290d71135ac348a7172bc9d15e0eaf3d6459eaa5c063791137aa7fb990516787ee5752e42891596a8465106ec1e783f6ddee290d3fb088867
TLSH
T1BBD02B3CFE88937E0A615EDA5C21453D5E04404F3DEA0641A33100C59C9CD5FA9DE7A5
MD5 SHA1 SHA512 TLSH

Submit Download

vns_progress.txt

Path C:\Users\Admin\AppData\Local\Temp\vns_progress.txt
Size 550B
SHA256 c0e846f33fdc0789dd5f097005c959dbd76b0bc7b1b6b3112a44f6f893a5be93
MD5 e35cc67a2986bc9ca5a427c384c2a71f
SHA1 3ccba89eb60f110f9e6b52a23e134b0d9410843c
SHA512 8cd5b4b438a9df45e850dc5f63c510512fe2985f95e781baa412990d742d67f5924884f01f58889652c2c98e60f178e06c74dd31c9e327a5019af033bc6389f3
TLSH
T17FF0C938AF49922BCA215EC38C61B0188D82322F2CDB8980D27292C54C85E1EDC4C3AA
MD5 SHA1 SHA512 TLSH

Submit Download

VnsService.exe

Path C:\Users\Admin\AppData\Local\vns\VnsService.exe
Size 2.1MB
SHA256 1bc4fd91f87005e7dca606a09115849b337192980174bac7c643d17c9f6153c6
MD5 f75e4b9a1549d9c8e7fa8571a47c59a9
SHA1 0df63fb4d6dee09a94f2cca74123dc12c363b915
SHA512 e8245660874eea9246f72c87d52feb9bf5de2c9477f1bb7a577f6ca3f7077ad24c369e9f8ab9349be3c17a6cfdcf5f5832cadcb2fda36028db44bf4367860165
SSDEEP 49152:NYgah0BGucNSQMIZI7VbDMS4BsNgMLIu:voK
TLSH
T14FA58D17A3B800FDD1B7C1B9C9165903EB71B8490731AADF03909AA61F23AE55F7B724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VnsService.exe.new

Path C:\Users\Admin\AppData\Local\vns\VnsService.exe.new
Size 2.1MB
SHA256 90cfdacbca987efd9b4ba4d77eacb9291ddbcd6396fce633ddf0d11e8dd06fe6
MD5 0e3fdcad9454a39af1095c248a60aa06
SHA1 e550c1a650cd383e9a3042b65240105b28bb1b67
SHA512 7167ac218f92c9cfdf942ad0a7c6f971196bb716f49d0b922de63710e4838590f93def20f9423eb5072f48482da6bb774cf0a7fdf85fc0eaef2a89e95f646365
SSDEEP 24576:dC2vNG/TMA5XggAT+vsqDhgWXRHmlQ60Mq1Q6D3wEQFNgMIqoXPW:c2vGTpwgAT+vsqDhDZf1QSQFNgMIf
TLSH
T192A57E27A2B400FDD1B7C1B9C9165907EB71B8490730AADF13D09AA61F33AE15F7A724
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download