4b9686ea149cabe64ababe2389d9cd209f49a84b3fd1b848c1fb5026ca61d6a4

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 04:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 7.9MB
Sample260415-evcclahy4w
SHA256 4b9686ea149cabe64ababe2389d9cd209f49a84b3fd1b848c1fb5026ca61d6a4
MD5 8520511618d7552680496d5f2c6e396a
SHA1 70d7ae25216feb2e070c245b5f80333bf959d582
SHA512 f4873d547e8cd7d96d3e016ab216bef2aa5f38ed7bb396da02802ce395292cc446cab255b750bd5a39e8724986f7967bac9889a9644dbfd2f874a5a2d2c1543e
SSDEEP 98304:f7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:mKmd0BKmd0lcI9
TLSH
T19D864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4048	UpdatAuto.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jinfo.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2032	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4048	UpdatAuto.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 4460	2032	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	84
PID 2032 wrote to memory of 4048	2032	2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 4048 wrote to memory of 3364	4048	UpdatAuto.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_8520511618d7552680496d5f2c6e396a_akira_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4460
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4048
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 8.4MB
SHA256 8f735629f1d4c3561cc73493847f98f194d5dd742cab2fc95cefbc9c689db835
MD5 b77eb10241ab3a00826a71927059af3d
SHA1 7a975a104ec58d5916e62ab9f071a913dc89b2a4
SHA512 f5c2d3bc986effc0c4297eb63bc75c296412eb8c80c0a9d66093abdc05fc436140c750b28dacb6b855277d820d440e29e2fa51542ffb2b2fd7b6ef291e4378cd
SSDEEP 98304:L7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIWjo:SKmd0BKmd0lcIgo
TLSH
T183964913B1A544A9D15AC034CF468235E7A27C6D4BF1A6FB3280B6D93E73AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 8.8MB
SHA256 ba6a21ab22b0c02f38fc688de4c8d9f6adea8d42a9f1262160109de5585cec18
MD5 382fb9d92419b3c198b809da2292cccc
SHA1 ca3fac79946fe11f3cf8397d6efffad8c9e8487a
SHA512 ab57b1918d2c1d8c59545cfcfb7c9ebc8eede56d858ce3f6af741ed8f121fabf87405088b1ca5151d4eabaf095bba25818a6ebd87803db40927f349f3d788926
SSDEEP 98304:L7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapILezSC6v2XMH:SKmd0BKmd0lcII
TLSH
T1F7966A13B1A545AAD19AC074CF468235EBA23C5D4BF196FB3280B6D93E33AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 8.6MB
SHA256 89980efe9c0671b47fcfe0aa1d287a13d002086ad81b0de2287d19c9a7f0b123
MD5 3e321a28cc462f50c80c133a1cc83b73
SHA1 c800a686d259217ab15dde5609e8a566e4e0a255
SHA512 82354813c9ea2468914d11527c132b67172fb4ebea9afad83bc109c2caccf17adc7a9569243010cfacc1a5fa8157b3aec82e198e1ad65c93b3679ade3c35a08c
SSDEEP 98304:47Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapID/h1+:LKmd0BKmd0lcID/h1+
TLSH
T1C9965A13B1A544A9D15AC034CF468235E7A27C5D4BF2A6FB3280B6D93E73AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 7.9MB
SHA256 e0bd123209ae9ba7ac7052c065c1d7717d4e6c271311fafbff69a745ad81b37f
MD5 229546aef7a10efd03f0ccb854723900
SHA1 bcb08ac782e7e7b81ea70259257320b8e011e748
SHA512 1ace53217fe27c7129501612a917c044d4f93bb5dc45e6483dafdb92aa35a7143ad3b2078b3935f7a5ee4ae503428ac3b6eb98f01aa7261b787ed892e696c175
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI:qKmd0BKmd0lcI
TLSH
T17E864913B2950899D19AC035DF468231E7A27C6D4BF2A6FB328076D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 13.9MB
SHA256 9f81f9359a25d99b1187762c2e767a580ac6ccd9727c087910985a8cf2f1dadb
MD5 dc03bd90f5d6437ea4b7122b1cfc1834
SHA1 254a76d3d37f56545df6e7942365735fc054fe82
SHA512 cda996b150bdd9363b51d9f67d44b7a95d38d6c5e1ebc504dbb883910c2e095f0201cb0ec8789aa16864677048edb33accecdd8fe5f84b83c1187b965ec95b6f
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIaQRQyi36YOcP+Lvw2gAf+PN34:qKmd0BKmd0lcIRQyiKaUX+PNo
TLSH
T1EAE66C13F2A500E9D05AD574CF2A823197617C5E8BF1A2EF368476E52E73AD03B39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 9.6MB
SHA256 b5894515ab7741ab617c38076af4915a363ee168a3387e4e74b46a9363352870
MD5 34ca2cd043f80904085f34cd14df1691
SHA1 f78d79fc581d04667fac5bf14522f730364323db
SHA512 3b0ac745a2838b0ea781e17a678799f05a367a33e95f6e0ce4f6351b0245c0773177312117a3927a5057d867f5d5bd2dd858ab9329d41ad70a0a4ff39a4540bb
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIlthHRc/Q:qKmd0BKmd0lcIlthHf
TLSH
T153A64A23B1E60499D149D035DF468231E7A27C6D8BF1A6EB328076D52F73AD03B3971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 11.3MB
SHA256 8c2d7148fa8dcb4a5c537383444f212ee78ea15a0911df1df2c0a3901ee5f497
MD5 b6af9d8b6cdeff72cd1b683ef803ee61
SHA1 44fcfde27044bebaff78ca509b03a26f254f623b
SHA512 c2cb4c0a9a4571cd2ce7859243696c7fa397da2aa13ae3f8bf887a7faf29583d653102177568a2e21c3996913c9d1b5f24b65d969608fbcab22085b369230818
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIEy5112gYy5azzVvf69nLKnhZO:qKmd0BKmd0lcIFLIHuWhs
TLSH
T1A8C66A13B29504E9D059C174CF468232EBA27C5A4BF2A6EF368077D62E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 10.1MB
SHA256 d71bb2fb78b8b0bc532f5b2ded3d12aac8bf86deef60b5306d949b8b262415e2
MD5 c2d5209bbf7a0bd3ed71b8d89dd49602
SHA1 3f849f854b308dc0e9db92d187ba13a55699a9dd
SHA512 0772316745e5fe27d12b0e036799d46d8bb98da367d5de0f128352a71e850ea50427d70467e0627708767b164646137845d3403254bb2f86714d4cd912636115
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIOu6Jm0xd2d3:qKmd0BKmd0lcIt6Jm0G
TLSH
T120B65913B29504E9D15AC034DF468232EBA27C6D4BF1A6FB3680B6D52E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 9.5MB
SHA256 b1417fa0b9bab2e24187d579531e26eb08e403abe80cf9f42230c6f896ab92a0
MD5 47775794013fbb3ce2dad8d305fe194b
SHA1 8cd8d1679f7a662ea8088959c60d27d42811bd3d
SHA512 4e87ab6fa4cc942125028beca4d748926f5754235488051465c155fc1a0a5193add99bed17d92cc667e9cdc64d31a042670014566f34d42ae420d50869d0a2cb
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI2mifP5R7:qKmd0BKmd0lcIefPf
TLSH
T164A64913B29504E9D19AC074CF468231E7A27C6D4BF2A6FB3680B6D52E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 9.7MB
SHA256 3f7bc3b1060addd236266a54531061eacb73c4b72b51af5ef4dc3cd9694de308
MD5 e8bf9edf8dcd209374e194ee48b29252
SHA1 91e879205741dcc8e770a4be244d16e15f086cb6
SHA512 c25198ff73566e5ff8e0a8a1695cba752169ada3f736bd1602204b5b3e6fbbbcfb16e2a377beb55975a5376a49c1039d6f5a38c474943bbff9d57271738b35a0
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIl5dKCi616:qKmd0BKmd0lcIrdKC16
TLSH
T1D4A65913B2A504E9D19AC134CF568231EBA27C6D4BF1A6EF328076D52E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 10.9MB
SHA256 dce576286f687b358daf5e5f99e5779334debfc838c940002536429827ae5f0a
MD5 35c7003f5ff6475296388f4cbcec6879
SHA1 6e18bf0c5f0bb34368f0096eb29f3b83894eeb00
SHA512 57382111922b3031a6bda3525d513b9310b5658e9d74de528228e59e9d51fe188b0ef537cf31c1db1f283fc3c1b815c3925f134ca8dc2d31a88d9a2f36cab405
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI3m7vj1BDlZG:qKmd0BKmd0lcIWjnDO
TLSH
T1EFC65A13B29544D9D15AC034CF468232EBA27C5D4BF1A6EB3680BAD63E73AD03B39715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 9.3MB
SHA256 c964ca274dcea604ee8b514224d311eba0e57c056b4015a1f304f9599c9ce538
MD5 ef37deb523c1464520a0dbe368b686cb
SHA1 e6e162eb795e18eeb967518b8c928fbf7499d6d4
SHA512 12bec680192715fa25e8348c11b419ef1ce9bf0d011713bf1a2a2bad5a3ddb753c06a1c868593d5d65afb319eb56c48ad9e611bf52781be39a6262c841da1077
SSDEEP 98304:77Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIAX2iwphX:iKmd0BKmd0lcIU2iw3
TLSH
T119A65A13B29504E9D15AC074CF468231E7A27C6D4BF2A6FB3680B6D52E73AD03B3A715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 7.9MB
SHA256 1119a10ce3620617db57328d8b2fd9008a4ad6c5b2776df5a29d520dde846ec8
MD5 49dc39d6be312c48c0bb0f15a1b316f3
SHA1 95065f5a390e397f2fddbefb2bfd7b6957aa6e64
SHA512 86860dcd5bc6e4346d9d25dd486878fb1b79ea4f86bc886495dbec3e58f8541b60bf59d996c72f79ffffdfc3d68ca6f163094652ad102966ce80ec5aaab2bd07
SSDEEP 98304:v7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIh:WKmd0BKmd0lcIh
TLSH
T1E2864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 7.9MB
SHA256 4975cc62765322e223cd597f4f52f68f9b1a41fe506f123b2c6fb0b77ff8620d
MD5 e4352e686b67c773d0608a8c0cb212b2
SHA1 09d2fe8646090bcecf3df0d7cab5c09f344a8528
SHA512 5a7f20745ab5f66a4e9e71ac53eca01be5dd12721ff0ed06618c99bc3ccb5d9e16f4d61ff54da0d36ab47763b5ddbcc08891cdee54a5efc37e087fa5565a2e3d
SSDEEP 98304:v7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIl:WKmd0BKmd0lcIl
TLSH
T1E1864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 7.9MB
SHA256 1cb1e5dad6fc2ddb880f4e32b145c738cfa3f0d663c3113b50c4f48517fc34be
MD5 2a39d6691d7ac4200530232fc8620448
SHA1 a9ef578200fd63a9b2cf64219ae5d1e9f73b1b57
SHA512 2562933da39fa36ae56fdc664d4a49658e4c809acdce577dc6ae326a1d366d779e0039b1b7cffdaf6cb5537749be020f247465c906991589b962891adface656
SSDEEP 98304:v7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIW:WKmd0BKmd0lcIW
TLSH
T1A1864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 7.9MB
SHA256 fcbec3763d6463d5ee87a3fc63b7d33044d410b0b9c73064981bf52f31b71b3d
MD5 39d6080908828d14472a47060d935a37
SHA1 c4eed7b44fffa334e5d893720658c1aab714f068
SHA512 e4affa7243ef01376922120f53e76d11614ab6633e1da1db1830b64e9ebfe261a0a126cdfc920222dc284641ab11846612cfba5c9b560be7ac7efb62b45ce7ec
SSDEEP 98304:f7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIT:mKmd0BKmd0lcIT
TLSH
T146864913B2950899D19AC035DF468231E7A27C6D4BF2A6FB328076D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 7.9MB
SHA256 4450c3ecd6be1bd5d4bf8c0699a7d0092a5982432643fa1a3ea424eda9a2f3c8
MD5 204fafde37194e0aaa06c7a5f5c4b737
SHA1 98a3e7a30d32b4857f9a7613286f43fb3888ff34
SHA512 57fb9c5f790a9b09762e32ac8aca22223ad816d054cff943b6d1f6b79cf104b24e3a5042b7ce821c4d4ef6e24f74716199cb3ea4a531802e783417c21075d1fa
SSDEEP 98304:v7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIW:WKmd0BKmd0lcIW
TLSH
T127864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 7.9MB
SHA256 f3ee0f14229b3936c3a2db46a4b90d9993c9d641e43190bae2148464cb87420d
MD5 d32272931555bba299e2847cd3e74040
SHA1 92f16be144065cfbea30c63f2e735967388e11ff
SHA512 33bd528d413b95edb5d00000ebcb4b4322bafc37bd9deb06cc9397c0e385158e6cad964366769a81e57b7e00fe9e8342821b6c99ba7a5c6717e4251f60bc2b8e
SSDEEP 98304:v7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIx:WKmd0BKmd0lcIx
TLSH
T19E864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 8.0MB
SHA256 1bd3a03fd5a5eecc8b6e86683e1bc7fd302d6f138771cd470678fee5f688c8b2
MD5 2ac61c52d58d625a05bd64f1f1835352
SHA1 cfef7dd5439ca3c41e1aac00fc53142b126cfcc3
SHA512 cb53048d6b82bb70924711e7c6ceafcd96899ec0c1b16d7cd24d0ed94372a3b106bb7f82e7130f6a9b0a30b908099c765020998739b308242aea6e401341e73c
SSDEEP 98304:L7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapId:SKmd0BKmd0lcId
TLSH
T11C863913B1950499D15AC034DF468231A7A27C6D4BF2A6FB3280B6E93F73AD03B79716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 7.9MB
SHA256 c58506a23ec418100b48e0d40bc3d12dead11f424e9ee2c4433571b37b0fefad
MD5 72eed267b4f5d01a9e09f49bf68c3195
SHA1 7216bcb38f3ed5c3af5f83fd8441ca6bdd0f2916
SHA512 4ef1be89fa41b81e9b3361e6c317cb8ac3acec50c6a23cf238dd0feb9a03817a7a3ee7ac1b296cf7ba96ecb40a7380501794e803e44a459e4f7f5d666d7f2558
SSDEEP 98304:v7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapIZ:WKmd0BKmd0lcIZ
TLSH
T165864913B1A54499D19AC034DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 7.9MB
SHA256 0bafcefb29b8132d2af19c43d6e4b58935dd401727e44d1863e2fee9d07b4f22
MD5 b220814ab48a528c23f219f0556afe97
SHA1 06b11e0ebcf0618da0abe97fda3f7e8cd081d50d
SHA512 395916c66af3d4036818c219c5478f32fe78c556bb4d6cdb4c00cc5fe360c03c6816ce1bc77451eb04655f370a8eaed592f571de83e8cb7258deb3e26e57ab8c
SSDEEP 98304:77Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI7j:iKmd0BKmd0lcI7j
TLSH
T1E5864913B2A50499D15AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 7.9MB
SHA256 46fd27d2a44494038c65bd010c75ff5d2f7080758112b27936e4b81ac97f9ba2
MD5 d9da7a9b2821889cf9475c68a1d17b0f
SHA1 8f13c70bab6820199a7b582aaa69b53e6c723b4d
SHA512 3c80089a43b259a63b419153189dea5202b1c6ab66638d2024e07090f044f4a079c37b684487bcad1f22f4cf6c36d65116a157e24f94e8cc71e15f838d14eb63
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI5D:qKmd0BKmd0lcI5D
TLSH
T1CE864913B1A50899D19AC035DF468231E7A27C6D4BF2A6FB328076D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 7.9MB
SHA256 4b9686ea149cabe64ababe2389d9cd209f49a84b3fd1b848c1fb5026ca61d6a4
MD5 8520511618d7552680496d5f2c6e396a
SHA1 70d7ae25216feb2e070c245b5f80333bf959d582
SHA512 f4873d547e8cd7d96d3e016ab216bef2aa5f38ed7bb396da02802ce395292cc446cab255b750bd5a39e8724986f7967bac9889a9644dbfd2f874a5a2d2c1543e
SSDEEP 98304:f7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:mKmd0BKmd0lcI9
TLSH
T19D864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 bf2238d3b4069d949a3bbd116f8876b2e2c6496c5df567ad9e9652c2153ee558
MD5 e12d1bb0b98bcc9b727822bb5826ff25
SHA1 56fbfadf9f354b8a29cdefc32483e6b6530d0b5d
SHA512 a93bc1269df9ab86683046a4e4f0423b30c62c655b5b48d51aef22490f591cd52476b59bfca25447f8b2b908d332df24940f631c63c3feb993ebf7977a9c0a5e
SSDEEP 98304:f7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:mKmd0BKmd0lcI9
TLSH
T19E864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 7bec53cf994f912cf2c46455b6d15259a76b38379bd0c0b1e47f5d33050aca7c
MD5 8b1e7c49e2db28571fa748cc35c7b9d1
SHA1 83ca217aa29a5468d68408e27e4aba07365de50c
SHA512 c3b113461da9e337e64d047cd60f8e96818c8b501520129c03deb08c4d9e02a255517206c87a85920e306d358db57d51325564b8529fcbc72ca0a3e132b9da3b
SSDEEP 98304:L7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:SKmd0BKmd0lcI9
TLSH
T16C864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 4f69fd8b0691f7c680c114915368bf89cea730c07143a3f5d1b6b2039821b49f
MD5 87be7d77fb33757223d21b4d2c34ad37
SHA1 bc3e946d21febb1af309a69d2c3b4f3d3c9fccbb
SHA512 7ffbe6552e29c865f38bccbdf5a698a095782b0e0e787c7766da97581bb7a9ab90a29c0902effd9267e70f6a3e07f45248af3e6d4a0cfbf79d825d32678de283
SSDEEP 98304:47Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:LKmd0BKmd0lcI9
TLSH
T113864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 a4fececb49bf8bf761e1220a8ec53a72f063c47b2a79bda77724035963fe9b9b
MD5 0d55254ee82a37f28e013a83fbc98d12
SHA1 700009990fab0307fd0d8c70d931ef01ebadde63
SHA512 3b3ca681ec05d6dd1b06ac92ab62e4dbc2670962c79cd09f50c3a6089256b78dde24908566dace35ce2f908cd4ecfbed549aa8530323cd58e3663b29e4c2f5b9
SSDEEP 98304:L7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:SKmd0BKmd0lcI9
TLSH
T1BF864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 b4ca86fc2ecc35eb7df8653f17810bf1e5fe8be0535a5365e7eb921b81870c62
MD5 fcb3c7f36fa31c92b3244dccfaee6fd7
SHA1 b15ac2f90de9850b7949c7bdaea641709b04150f
SHA512 7f93b289668de8771e7fce9f4b29eb5d35c12cd7eed43d2065f7ac54a7d3861bc778949d51d673544e24a3521e7d385170bf648ba97e64108dca36310afd6d71
SSDEEP 98304:v7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:WKmd0BKmd0lcI9
TLSH
T166864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 377090a6d30f02dc491659bbf645489143cfcd0fc81b4f61cfa6206e2d2c00c3
MD5 3fd5f96e03c750a78879cc01729c6e8d
SHA1 d44b2f7cdcbdd93ffcf48e45476281b7c71aac3c
SHA512 c4af963b739e1195079fc096a31be6c16b34191aed363393e603b9586429e7db34edfadf0c174baddde0013c5e3430bad867ef058d436d2ea657affd4f8926d6
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:qKmd0BKmd0lcI9
TLSH
T12C864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB328076D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 f34939aa5cda52e0121cf1d335fd29bb055d84c17a9c646bbc24af9c40d2551f
MD5 cfdb712c9de4048d3a1e3a6c22713cb6
SHA1 144f63e1e49e57f7f84b913ca031a060ac85c514
SHA512 18b8c1e507c077d0eabaa1bb7ecb6070906f47bd8a90a69b30135ceda503475d66c40c745227c9789207882aab3e7e6850c96669e70d772f7e9137430a7732a7
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:qKmd0BKmd0lcI9
TLSH
T1AF864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 196540f7e728099342f564b9c9fb0cecc507f66a1d46489d724ed2dcf2898dab
MD5 a96ceb993c5f7b748869ad399cf42115
SHA1 53cbb7cab186eb953eb8bccb06fc514025752aad
SHA512 6a600b5674a20421cd23e0e52f70e8e726381d3f6eba9d1b5b767045d126f833f69151f221f3aa558a979f23ed725324543c1962828075e0309564c4fc701e97
SSDEEP 98304:D7Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:qKmd0BKmd0lcI9
TLSH
T1C4864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB3280B6D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 7.9MB
SHA256 3db69105266753b56ceb5ca8e216ad989778420a2d2a79d0ae50bdc4557c3950
MD5 1cc29d7ed8a9b359c6bc33b47bc36e05
SHA1 5debeab14120c54b1cbc6735ef2aea21c4e3fc66
SHA512 6e182b5dd20982783ce97a34cc14f015cb188d7c6055d7164c51ad9f1ba7d953220936271c6304bc9ed035f27534870efe9ed3f952241378f6fd59512ea8aa0a
SSDEEP 98304:77Iwu8j0oAaldmdmnpS0oAaldmdmnp/LapI9:iKmd0BKmd0lcI9
TLSH
T1FC864913B1950899D19AC035DF468231E7A27C6D4BF2A6FB328076D53E73AD03B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2032-69-0x0000000000570000-0x0000000000595000-memory.dmp

Download

memory/4048-77-0x0000000000530000-0x0000000000555000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads