72fac74e90d586a6c89405f9da00e54c51fdee1a03d0583e0819da732ff2fb51

Analysis

max time kernel
150s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
15/04/2026, 22:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Size 8.8MB
Sample260415-18mldaa12p
SHA256 72fac74e90d586a6c89405f9da00e54c51fdee1a03d0583e0819da732ff2fb51
MD5 caf23b67ef8462eb3bb3ffd15f407998
SHA1 f9c8bee393c4cc058057571e0cdb9121ef984784
SHA512 5e5bd31b100818dc1580e8e0da0f4b47485102ef656472ff7b4e89b23ee63b86db5e115b33b3b6a6e10aba86c062c03d2dc3ac0e792fb2fc19ccfe0374f4292f
SSDEEP 98304:qZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:qZ8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T1AB96E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
328	UpdatAuto.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File created	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4692	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
328	UpdatAuto.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1888	4692	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	79
PID 4692 wrote to memory of 328	4692	2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe	81
PID 328 wrote to memory of 4960	328	UpdatAuto.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_caf23b67ef8462eb3bb3ffd15f407998_akira_cobalt-strike_elex_hijackloader_icedid_njrat_remcos_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1888
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:328
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 9.3MB
SHA256 da170ced76dcb33363ce0b9c7f992a512ad03658d1a6058c03173e94a8ee2d4f
MD5 bac82d8aa51d4604951a001e6155eb67
SHA1 e01cfd59eb97b2a26c8dbea7e4e42d6bf0bf6464
SHA512 76e059ee543ae6748687026db868d1935951fabe6efec0f03f81ac435df866953acaec9038f78ec89454cbb45cc900a46f40ee404120f385bd6ef987459f20f2
SSDEEP 98304:qZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSVjo:qZ8Kmd0ngTH2qBpu1QfLIqsufho
TLSH
T1AEA6F61261998FDCC05FD074CE46A5A1AA237C454FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 9.7MB
SHA256 439d3726ab1f030148a0449ca9205fa5338cfe4f4f463b90f82b341198aa6712
MD5 c2f049688b498ecedd286c312f8235f4
SHA1 6961ef224c0aa33583ba02d8996244ca003c81f4
SHA512 b97aba8d777666ee966fee94482b7dc8f93d8a46fb08d49aa75047750cd64888e9642aba370cb4a5834ea127f57051156d2b345e0c1618b30fbaf9863223f125
SSDEEP 98304:qZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSGezSC6v2XMH:qZ8Kmd0ngTH2qBpu1QfLIqsufl
TLSH
T13AA6F71261998FD8C05FD074CE4665A1AA237C454FA16FEF19807EA93E366E07F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 9.5MB
SHA256 e868b0ff50a49d1cab619b2f59ab73b361841ffced3f3702c89dba1be91bed31
MD5 a4d5c268ea17e6493f3adc769984dcb8
SHA1 c366d33e18efa0232fe8200deb46dd48fd43c159
SHA512 cfda09fd1fcc842a86a159490caff92c8ee05887833c0ea1789fc3a048024497eadc335f1151ca84320ee051c22368edd460641eb56857407b2ce4fabc4b063f
SSDEEP 98304:ZZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSq/h1+:ZZ8Kmd0ngTH2qBpu1QfLIqsufq/h1+
TLSH
T143A6F71261998FD8C05FD074CE46A5A1AA237C454FA16FEF19807EA53E766E07F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 8.8MB
SHA256 ffa438dc36e58361063a196953fd5547845c4f314cf20f7fd3685a3c4faad45b
MD5 c19774025f41925b3185833cb411e174
SHA1 ced85b5b3932f0946379de2b1aa02237c18f752d
SHA512 a7c9424d790edc2d44204ab545cf49aaa0171f220a735e9d3aa5c480b0b29bf31bdf1aec4c5e1d75e1e2598732ad3f4c9736f1a547a0b760c8d711f5ee3b8052
SSDEEP 98304:uZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKS:uZ8Kmd0ngTH2qBpu1QfLIqsuf
TLSH
T11996E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 14.9MB
SHA256 c11cbe2caf6b3bf8332b330757a0e41febd0097b2f49ead40b6dd55c5c508511
MD5 11ed36be172725dc9e8f10a6334f5536
SHA1 ad70208b0597bac0734d646ca8b499197571051d
SHA512 99cdc19c68d60b11ae1234a89b8437d067332e18ca00b30329ab10cdbbc6d7df1c12991bc529aa58adc2418f99bac6c8f429ac8e8a0b9e3f42af4052469517dd
SSDEEP 196608:CZ8Kmd0ngTH2qBpu1QfLIqsufaQyiKaUX+PNo:wq5THNBpu1Qfc0aQsas+PS
TLSH
T1CFF64B12A2D54ADCD05FD474CE1A55619A237C4A8FB0ABEF15807EA53E326E07F3831B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 10.5MB
SHA256 3d4e65fbd9bd260721c9d8acf961daf9a9665d3687df7e76ef24811f3e3066a7
MD5 6e06b367049b2cc77c998ca36fd72c8c
SHA1 d69f018d3162ead9c6a43f6129136c96836f31c8
SHA512 01cf3a2b0e92a5b4a7b89060f3a7956995289fefe3ba5a9a5c61721f1dc8ba4ab82ccd77dfc9fcdbd20bc87c10e0e1745f44cae0e14b01cad5c008685d17b0cf
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSathHRc/Q:CZ8Kmd0ngTH2qBpu1QfLIqsufathHf
TLSH
T1C2B6F61261D68EDCC05FD074CF06A5A1A6637C558FA1ABEB19807E653E726E07F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 12.3MB
SHA256 3922d71157b8f5853d9bd529083368081b8fa08ff8cba9c727fbd8a8125c4cbf
MD5 9304f8cb8c5ffae87470d7fd73837aa1
SHA1 b649dd62604525fe956fbb895241594879bb4fc7
SHA512 298d8431cf7ef4faa01c38affedeb1391691cc0094499f26178c89d2fe93db2f9c54991a0be188c7da89c4a121f78634e0fe8e7d55d08006ec6446cf3ffdfaa6
SSDEEP 196608:CZ8Kmd0ngTH2qBpu1QfLIqsuf4LIHuWhs:wq5THNBpu1Qfc04+6
TLSH
T183D62912A1999EDCC05FD074CE06A571AA237C464FA16BDF1A807E653E766E07F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 11.1MB
SHA256 0262ce003ab18803333bd7465b1df05e05c56682274c7d2e7a979b2faa13665a
MD5 e374c8ced91f56474acc17e346e4408d
SHA1 5995cc5fffdfd1977e5eb14fa376fde5161c2f73
SHA512 204ba738c04029c835d51db53a575a4b606d97528318c875d88cb92b9452c68a2f706932003f47ec288a647ca93fb7c31911905cdd7f5972c699ac0467741da3
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSLu6Jm0xd2d3:CZ8Kmd0ngTH2qBpu1QfLIqsufy6Jm0G
TLSH
T1DDC6081261998FDCC05FD474CE06A5A1AA237C454FA16BEF19807EA53E766E07F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 10.4MB
SHA256 d70c64b2eb87cf1e0e52d38698032350a6a10403d216dcc4a9d8b18b1ffe81e7
MD5 a97845e8b048461859a02e72d8da11b7
SHA1 8a3b317ebf7e423406864dc2cf966972eecc9647
SHA512 3ee5d21aa539c7a27b2e415c6e0a0745666076949a1494690b1a5ab45d2f77acfeec7e6eafc4594a967a4eca4dec49bb13a26408497d4af7fb0228c766a74b19
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKS9mifP5R7:CZ8Kmd0ngTH2qBpu1QfLIqsuf9fPf
TLSH
T198B6071261998FDCC05FD474CE06A5A1AA237C454FA16BEF19807EA53E766E07F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 10.7MB
SHA256 d29b94768e90b78ce6f74887c8639f2fe219018361026a3faae992d946f37fb8
MD5 30a5dbe9bec1b93c0510b8553b19dc9b
SHA1 c38a80e634b7b9f69b9a45138738af8b6c93ccdd
SHA512 bb639e2a3012562856eb7d8522facd4a1616883d8d019edc9c2561d1bd989f670d88f4b737e3f942f1aeaec346df741206c695df96f08a62cc4842d44ba3aad5
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSG5dKCi616:CZ8Kmd0ngTH2qBpu1QfLIqsufUdKC16
TLSH
T194B6071261D98EDCC05FD474CE06A5A1AA237C454FA16BEF19807EA53E766E07F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 11.9MB
SHA256 305d0ad62e80a5636d00903863a6416165c56acf802dc8a7b0675658245aff98
MD5 315fab9c865641c80e60446170013ec7
SHA1 f5fac9cfde7af7ef8422a46ec87f8e1582083566
SHA512 1a5cf23ce78e7ab1aca02350d9477ebcb1a2db746ccaf3ee7ccea28d74aec5c938d3880e95c4775f2c818d2de4d07b0286e0cfae89a561afc083e8c8a79e4fad
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKS0m7vj1BDlZG:CZ8Kmd0ngTH2qBpu1QfLIqsufBjnDO
TLSH
T1A2C6191261999EDCC05FD074CE06A571AA237C454FA16BEF1980BEA53E766E07F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 10.2MB
SHA256 d5244d15fc2e1282a78b5bcfca650f104330ff937dea13125e1fdcfbf23ba710
MD5 c68df1d4f110e2bdb17b4ff31a0ba2a7
SHA1 b8c91fdd313f5f5f9ff711d73a547abf6d59bf17
SHA512 0c7c2b93de142af99f229eb6fbfb831c739afe9393cb70107b4dfd261638da5b0cc1d4f883a1e95500bc4a55b7aaad5e7fbeef8d561180b557a076893256439e
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSXX2iwphX:CZ8Kmd0ngTH2qBpu1QfLIqsufn2iw3
TLSH
T14CB6071261999FDCC05FD074CE06A5A1AA237C454FA16BEF19807EA53E766E07F3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 8.8MB
SHA256 df158e05b67a3612cab187c77f97442f0fd858e5d18b8fdfbca68a9d926d1b7a
MD5 bcb5a00de112dc90fd7fda5836be6ddb
SHA1 a7ad99e4d0fc6dbde554b790b1b226cde6526c0f
SHA512 3c9e6507b257b0ab3fbd1f5b4bd809f0a539b6bec1ecb5b1e1f6ee5cbd7a81303db1be6dbcb782212dc0d8aa5fa408ae9c681f64bd7489a3c34213e59b2f4fdc
SSDEEP 98304:mZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSq:mZ8Kmd0ngTH2qBpu1QfLIqsufq
TLSH
T12496E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 8.8MB
SHA256 f3077d823c426f50591cc3d1111a0e6abbad423ed8df6437452237070c1c25f2
MD5 6a93f41352772252829e118a9005de4b
SHA1 dd7d709acbfe1ec9d0412d0854a43aac337ec6db
SHA512 9383e22a3c63c1480fbdbe92d96597bc2e183ac3888480db833ffec57d24d1211afd279e54005e81476e424290127387a25e6b9668b5b07f72f5c390e1decb45
SSDEEP 98304:mZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSm:mZ8Kmd0ngTH2qBpu1QfLIqsufm
TLSH
T10D96E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 8.8MB
SHA256 d264c18a0d7724f3cbd8b9207c5474577eeb8d06e91829f0553f2c7eacc37f6f
MD5 70ed812301e0ad637a94228fa36be13f
SHA1 1443d3920fa053eece7e0bf954de654227602f2c
SHA512 92a2bd803fd5205017528da3a476ed8e29d0e1d243fb4540ea1081b1e51e638a8f33cfda22ac466bbf3fdfd86ce014d3caedbab3ac402577453b9e625e9cd648
SSDEEP 98304:mZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSx:mZ8Kmd0ngTH2qBpu1QfLIqsufx
TLSH
T1A296E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 8.8MB
SHA256 c531927abb9b42d3b8fcd2787d83a5363c62dde7972a1f21a595086027ac03bc
MD5 e002bf2c618e5b9261c05d1743dffe01
SHA1 25d59bb87847a6654b8cc92f23a3efa7d4810adf
SHA512 8bb4744b9a963439d83dcdcd316f4b3f16956cc9e0d2425821b1f3111d3ea3434ab53b68d86021937354cbf972378e7d8206f6590cc1ae8214923441b05e1479
SSDEEP 98304:2ZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:2Z8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T11796E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 8.8MB
SHA256 3c103f2e0c3be449dc852c821174191e84581b8e487b67dacf3ae25cdc5e6cf1
MD5 a13291022fc062de2d48eaec40e5cae6
SHA1 faba649bbc75ed78015f6d2f259bf6781fbde53b
SHA512 b40fbbc53b43edac878cc586198ae4e5f3f290f31677213d4a516688b882d42791918e9ac90f6976970b19cb48f24bc575fab9f6627871bb46c4984b6151d44a
SSDEEP 98304:mZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSR:mZ8Kmd0ngTH2qBpu1QfLIqsufR
TLSH
T15F96E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 8.8MB
SHA256 0783578cee74068e4861d06c2ff4441d4540156f6b2f55300950b2ce13313050
MD5 287f688b99a410739b434a4e9bc33e92
SHA1 06f0b525bfeaf98ff192751169090ada0fccfa7a
SHA512 2cd937c3908205d05f49014573c388cdd34b98c85a1259a9a3b40688dc2d2cbd061770df5c707d3ae4605c5770a1ba97bbc5f9ec9b2e2e40ca3b44ff8968a735
SSDEEP 98304:mZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSm:mZ8Kmd0ngTH2qBpu1QfLIqsufm
TLSH
T18596E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 8.9MB
SHA256 72260baf4ab006e95565bf33f2dc81e26a267db860cd516149da331e5ff336ea
MD5 66a488d2b1b11ad8fef7d13d9ccb0213
SHA1 11669d946487a3ff28acdf95a876ee9d74b44f62
SHA512 1abd32979fceb4fec1f1b70d70befbf340719cbc2c0ef77caa6b2b3c1aa25d3abde1af4567ee7cee46e7dc0345e4a051e847d2fbbbca62657dd1deee6ebdaff0
SSDEEP 98304:ZZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSO:ZZ8Kmd0ngTH2qBpu1QfLIqsufO
TLSH
T19F96E61261959FDCC05FD074CE0665A1A6237C458FA16FEF1980BEA93E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 8.9MB
SHA256 f5dbf6faf3412fcd143f34471d3ca1a221163a6429fd08bcf8b6f798c3149297
MD5 c41377ad3f4c705667c8249c5b7b3c71
SHA1 3962c9a7e66b60a0625ac48a9183c394169c8c54
SHA512 501436af240b2a32b247f2fb80faba7427c51fb345d60205f15c9cc3e00fd5ebd1dd6a100954179a263925810bd23348e13a4455e3606bce18c7050968127f49
SSDEEP 98304:mZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKS+:mZ8Kmd0ngTH2qBpu1QfLIqsuf+
TLSH
T12B96E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 8.9MB
SHA256 392231383333b79233ebe7fb20629884873791cee6ea473461ed21007740db33
MD5 5be847f3a8f9095de11954edd2c1021c
SHA1 e9e20f1166d30ff29bb01cbca6eefe45e5ebae73
SHA512 0fb19263f641c4d10c7e5218c5c391930056657a44ab44adc2136a65d800c66bf6f18bf78b2390bc6712eb561bb10f67eaee0a419dc8290735cfbc2414b0b8e3
SSDEEP 98304:mZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKS2j:mZ8Kmd0ngTH2qBpu1QfLIqsuf2j
TLSH
T14E96E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 8.9MB
SHA256 d531e45a9a09613070042a711a0369f264a36f0cfda6418b7f5e87634aa11b11
MD5 390137772638d4621418eebff18e9088
SHA1 99836c0ada963cfbac044e2a939e16bec817109f
SHA512 d4433987913f8bc6f7276e0b76b0c984f0f1a90e68f43abec7a8ae6a090275762e69c5c93507bc7a89ab623874a87a82ad2b1f04ec2cd6cf7c91fa6aadc0c870
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKS0D:CZ8Kmd0ngTH2qBpu1QfLIqsuf0D
TLSH
T11196E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 8.8MB
SHA256 72fac74e90d586a6c89405f9da00e54c51fdee1a03d0583e0819da732ff2fb51
MD5 caf23b67ef8462eb3bb3ffd15f407998
SHA1 f9c8bee393c4cc058057571e0cdb9121ef984784
SHA512 5e5bd31b100818dc1580e8e0da0f4b47485102ef656472ff7b4e89b23ee63b86db5e115b33b3b6a6e10aba86c062c03d2dc3ac0e792fb2fc19ccfe0374f4292f
SSDEEP 98304:qZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:qZ8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T1AB96E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.8MB
SHA256 fe8622b2f54ef37fbe155cb2250ef07c487a86655a6466c513f2c4179b3afb8a
MD5 647c1a81d2530d25c59ae671acc851e1
SHA1 5ecb2ed5d5fd87739cbcb69784cff397cb23325b
SHA512 5116932bb05e53fe7873d034d51039677b39af4a5e7c611d9a1ed2d343458488c024df8ed4eec4344048ca5e0680836352d22a0b8ab45b577ab1d20e57017934
SSDEEP 98304:2ZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:2Z8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T16F96E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.8MB
SHA256 16c253722067ddae51d196d43430c7e50bf6be4db604ef8c65ad348aa39251a2
MD5 a9df944bba9e18daa5596e6fce29c12e
SHA1 1d76b4eb148620f747be34756648464b138a7060
SHA512 342deeb522b14002a56797c27ea6e7e5dbc8926903b5a1ad888bbb487215cefa2e9c71c41bcbb690db88323f49d087d152504f5c3084c3d0cc9383e5d91b5b0a
SSDEEP 98304:ZZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:ZZ8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T11496E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.8MB
SHA256 2a4085fce8d8a6ce45fa015939d772c52cb63ca9d91eedf79b81e9bcb428a0fc
MD5 3ac4d75d5487fc3123f40af53288392e
SHA1 7ecc75d8fc05b811ff5081ad860b72ed425a0d0b
SHA512 26cc36b637dd5d1b271c52d2d179e10048eccb402c37a3081da59cc2fd71d8eb8de5f7a01740008ca83d76596100c071444883ac4117815ca0d1318032838cad
SSDEEP 98304:qZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:qZ8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T12996E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.8MB
SHA256 ac9db92bd807e7e2e32c1a80d461322470cbe386b9cb9959a07df7e149192eb1
MD5 66b8c28e56434e133933bab56fc2321d
SHA1 d350977acfc8a14b03be90a6f97359cfb11b418f
SHA512 1f76d417566be8b50736fdeb41cdfea66819f4e64b78f82b2ad2781e34b416dd42633efc24484b9d24dda7a8aa7a4f5a65f4b391159691511cbd29d12a1f1129
SSDEEP 98304:mZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:mZ8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T18E96E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.8MB
SHA256 f0aaa81cea2544e1882de0be865e88a4d5d6c8908eb74015aad6c640ece96288
MD5 9f31dfb63a0f482f3aba5cd3c91b3073
SHA1 b4852ac98cc1d84cb94c9a1d6845e35ac31c7405
SHA512 26dacb7ce2430f6baa6242079b278ba19de483fdca042ba9ab84a3c9aea90567f76f97c607b93a8366178ab6b6cb140ea2a15d12d7f0f3a822310b63d113e394
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:CZ8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T1C596E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 8.8MB
SHA256 b008d40a097c774cc296f4aeb3fb391a14b45d1a563de6e8d925a8e5677f604a
MD5 47075aa5a147ded786966bf327a993fd
SHA1 2907691305b6a372d28191c592848cd01e07736a
SHA512 3078fefbd23a01a8004104f08e9b873da174352d077dcbae588462eb5936028c3fb7f865cdb2a4cd17d940b9e0b86b3a51e7d6439f4c362b481f473167d987cc
SSDEEP 98304:CZRV0oAaldmdmnp7KUgTH2M2m9UMpu1QfLczqssnKSk:CZ8Kmd0ngTH2qBpu1QfLIqsufk
TLSH
T12596E61261999FDCC05FD074CE06A5A1A6237C458FA16FEF19807EA53E766E07E3820F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/328-80-0x0000000000840000-0x00000000008BB000-memory.dmp

Download

memory/4692-65-0x00000000009A0000-0x0000000000A1B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads