241e9c9a87df88c1dd8055ae820e9a633672eae764bc541d2abbea6e0eeb8f4f

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/04/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 1.8MB
Sample260424-blpd1sa15n
SHA256 241e9c9a87df88c1dd8055ae820e9a633672eae764bc541d2abbea6e0eeb8f4f
MD5 7a8858a8fd6c5dab9a6333d61ee887f1
SHA1 a08b73e7bb4a5bb52c536cadfba0f302d2d3e431
SHA512 86f12d754ea7010fbe65167a4be147dff686a200ce27a0597d6b6f351a1f0b3fb5278aa8405c9d2774afda8170e2f45beb3803095d06d89d5b569e33c98399b6
SSDEEP 49152:wabH/NYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:2z2yTpR/nbXaP3
TLSH
T100958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4716	UpdatAuto.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\ResizePublish.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\kinit.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4744	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
4716	UpdatAuto.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4744 wrote to memory of 4516	4744	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	86
PID 4744 wrote to memory of 4716	4744	2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	88
PID 4716 wrote to memory of 5588	4716	UpdatAuto.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_7a8858a8fd6c5dab9a6333d61ee887f1_cloudeye_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4516
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 2.7MB
SHA256 b519edcfa9fdfb2ff8122c72670ebffd8a856c7fa09ffbcd54fe67dd708dd351
MD5 a4911248f8d759d120025ff50abd16fd
SHA1 c45097b5ae467de840156d60c51c7dc0c0d348f5
SHA512 97e2faf01751a570474d116b435a54af497eeb56aaa293deabd9e5129b9406a3fb102a8cc9d7fe82e1e20f708982b59ebd329d945494b9df2fa7201c25dc9755
SSDEEP 49152:wabH/5YabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5R/ezSC6vUzPvMHjy:qz2yTpR/nbXaPxezSC6v2XMH
TLSH
T1E0D56E16F6748266D072C0B5D9A6966AFD323C620B3099DB1381B71C3D337E2A63572F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 2.5MB
SHA256 9b9043ebaaa745b6c009707dc045376f8494df10e2c7f9c6f2a0c184d1700e1b
MD5 c9e4dba94c6cb4362c1dc136d131c45d
SHA1 0b32fdcfbccb75e4a88ca2e9f5fb45a9e7203810
SHA512 9318a975382ba93dad0c4861d286c91246001365af67a82dcc55e5627b7e09f1db3e8402368e72b8f37cf18a62dbb7eb3a4fdd5504cde5bf898fe3a631ee1b71
SSDEEP 49152:wabH/cYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5eVO88hXl+:5z2yTpR/nbXaP5/h1+
TLSH
T10EC57E26F6548165E073C071D9A5966AFD323C620B7099CB6381B71C2E337E2BB7532B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.8MB
SHA256 260453083146c1701ddfa1f0786a1d39fccfd4e6385ab29114251f38781c6c7c
MD5 33469062e7430f171328b8a8eeb0666a
SHA1 9cc20caeb16e5daaf7c11c7662c663fd36c31299
SHA512 5d841b755323d7e3751cea949201a4126259cc850fd8ca84a5b7d4a209de4b767d8b568d4b911af3365ebab0e87ebb0ca3bb5b56b4e8d4d9102a46d842a7279d
SSDEEP 49152:wabH/CYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5:bz2yTpR/nbXaP
TLSH
T121957D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 7.8MB
SHA256 79a6c98c019215d167849229a241573fd9618c9566ec0be75e9a310df2a45d85
MD5 f6c6ee89662f81e7e6ae0e11f133dd20
SHA1 964980a941859ef7b66efd072a052b1ebd32af6f
SHA512 4e8f98e6fd6ac4ebe34da212d08f5d07b2e5296b5dee66306b1d217ee696be85b4b46c8ab2515f9641229111265809075a5136689623d2f007980146aba6331d
SSDEEP 98304:vz2yTpR/nbXaP8QRQyi36YOcP+Lvw2gAf+PN34:fTpRDXYQyiKaUX+PNo
TLSH
T15D868E13F3A501E8E05ED974DF3952329A357C5A4BB092DF26C436E51E72AD07B38B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 3.5MB
SHA256 cc6dbc7840f81193eb231e2f0e71af7ddf82fa80bceaa1e4e65b33ddb062b2f4
MD5 92991efffa390ce6520109a11c221f57
SHA1 a04259a57837e8caca2b582b782aac4e63560115
SHA512 7c746496f5adf819c3b6459909d37f7f7eb8a84f1b66247fc9c589b2bcaac54216e723f237d80a69f5aca7128ad827bb3ba57d8ed9e571fa6b237a87e58064ec
SSDEEP 49152:wabH/OYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5Z68Qg55nhoeWu7PNU3/Q:vz2yTpR/nbXaPnthHRc/Q
TLSH
T1CB065B23B2E200A9D05EC1719F168732A5E17C724FA0A7DB968173191F72AE17B3971F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 5.3MB
SHA256 64ebe841b35ae3b706afcf8a17e5a5a3fa268b0173509d1fe6f7a3525a5e068f
MD5 c89e073f2c98bb58a23b07caec841e76
SHA1 14ff3cec38858c414bac61cc826f582324062e76
SHA512 b6658c9e7ff989488a70916e930a9b22c27887964c593acd97d417cb96b2337c7296fe46f3fd80058e71030bc2f297e0cc830bea4f6f8d7365c41b1f8eb3cfc8
SSDEEP 98304:vz2yTpR/nbXaPSy5112gYy5azzVvf69nLKnhZO:fTpRDXyLIHuWhs
TLSH
T1A9468D13F69800E9E05AC1749B5A9232F972BC630B20B6DF0B8077552E77EE16B3D716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 4.1MB
SHA256 a35d4fa65be44021b7d9efd0d6b5bac874436be6cb4cc3ba19370cbfbc4ecd71
MD5 375c6e1bb487b3553c8f9d33bbc8a7f4
SHA1 9c5fbb370d4a66bbbe75357e6b9c48cd914d7d14
SHA512 7d8d617c7afb38a28c6dd0330a04a96bd5da7441b025de099338b8e82513dbda90ba1cffca629be665e6e7bdbd5aecc9f951286cb93b956817623c0dc115076b
SSDEEP 49152:wabH/OYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5aB+taZ3usBWOBr4tEGWG:vz2yTpR/nbXaPIu6Jm0xd2d3
TLSH
T188169E13F68540E9E06AC4749B599233F972BC650B30BADF1780B3192E73AE17B39716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 3.4MB
SHA256 bd6960ea5c66263d79834ea3106d175426bd3ce4dac08a890ccaccec4a10f5e9
MD5 1463ed4993ca44e063f7ffd22d7a4e99
SHA1 bf6c611265210a7f3b760924034c54bdc7177146
SHA512 75dc6289b35ebdf6d89bbfa8d3521059f55b37e1676538dd662b91b3aea311a4a708d0d45641c4e73c218a9dbedb61db879a0ef08643d637eab579f9cb2862e3
SSDEEP 49152:wabH/OYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5U1hpsNoJpF1A6GU44Cw9:vz2yTpR/nbXaPUmifP5R7
TLSH
T14AF5AE13F78440E9E06AC5709A258236F9317C620B60BADF1780B7592E77BE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 4.9MB
SHA256 200e406c0cd91b2b1c7369f15f62f0a64396898bc6ecb6e2af1dc51c04b0f3fe
MD5 77012b1dfd7befa12db1f26a216ade19
SHA1 8bdc906c0c276e511e5b14e3f962638164ebfc88
SHA512 e1069540a93b53d8382f91770e5e260786c1d11bef99ffa4f72af7e0d91811e759a6f9d30c7ee5614ecfa1b1ad9e701cc0323fb1c2f9318fcb674e1806892f00
SSDEEP 49152:wabH/OYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5OyLSrJhMeJNvjLAE3dG5:vz2yTpR/nbXaPdm7vj1BDlZG
TLSH
T190369E13F29440D9E05AC0749B569232EA32BC650B206ADF17C0BB592F77BE17B3D71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 3.2MB
SHA256 9f24e04b667c1ce4bdc8082cc1256427c58d06caa7052f40f32ae23738024f35
MD5 7ab1a50162470565426228007e10bb5e
SHA1 acb59789665c4d8eeee171b4f4133838134322d8
SHA512 92490b4f0c31a56ffaf84827bc4f5879823a7e4fe3953e71cb912173cf2ee827be4d4c225c41a504bad9f47111a2db5f94949b5bc9816f710b970ba116919c9a
SSDEEP 49152:wabH/OYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5nhtSn8EApI0fig1giDnT:vz2yTpR/nbXaP2X2iwphX
TLSH
T1EAF59E13F78440E9E06AC470DA658636E9727C720B60A9DF1780B7192E37BE17B7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.8MB
SHA256 049b104ada79ea474a10b922b65b428c22bf9817195765c81bb26cdddffe7a5e
MD5 41e5a1cb77366b57a1d3b93f469a1c98
SHA1 4405bb64557d6b6879bb9edb83c11385df11bc46
SHA512 5c1d8eac89d1de64c656bf069dcab3753946b8e8c96976b2f16fb4f832f1f77cf13d8941252c597406aa685e07fee3c4f9711d84fe5d18edd3154c8863b73f3e
SSDEEP 49152:wabH/KYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5/:Dz2yTpR/nbXaP/
TLSH
T13A958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.8MB
SHA256 716c93cdae84a3914eeceb1fd17b0b85ec4274f5641d701f28066a96288ee05c
MD5 c742fa7d9a0796bde899049b857c02e8
SHA1 0fd21947acbc6be9561ef8bd3dc79aa82b933dc0
SHA512 e040ea454804550fb9038963de95e78759fc1b3cb434e8a9ec4dfd634019b300b84de57a918cdb67255d3c45b266f45fc7f695b28276d21a845a169642ec57d7
SSDEEP 49152:wabH/KYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5v:Dz2yTpR/nbXaPv
TLSH
T19E958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.8MB
SHA256 594f50042f3cdc3fbdf7db9e6a9beb5ec5485977bd3b877c644786c344074458
MD5 d990564a5e6561242244a9521bfc35aa
SHA1 64053c0499d6c92f46c209f15032c479025271bd
SHA512 db7663a780612de60b26d8b69f5c948a6d1b0df6a31227b99cde98e28ddc8be98fd07649a1f9fe016f5546aadb0ed85b7eed29c14c9ffc4e570cf9d474c3e303
SSDEEP 49152:wabH/KYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5A:Dz2yTpR/nbXaPA
TLSH
T1C0958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.8MB
SHA256 464cd0f8b96f508ba053c229d1c38ceb6e06852bcda383244b3e606e626cffc7
MD5 17e80e7dd279f219e28e552b394e9367
SHA1 f91e62f1346ea4da75d1cf90849872a8059a5f8b
SHA512 65e1d0241410e50389827413e57bffb46402d45f0848538a3eded1ea6c9110d1ebaf2bd2fdb39f03638ba6136610ca6ac1ecf0a9f9d96d036e45a74b1c2fae8b
SSDEEP 49152:wabH/aYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5Z:Tz2yTpR/nbXaPZ
TLSH
T1C9958E22BB4044A9E466C570AD359236B9317C720BA0A9DF67C0B71D2D336E2BB7531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.8MB
SHA256 c4960292f18057a40c3fbf0924e4e21668420505f6448cc4e76dd36de4adc9e2
MD5 4fed469e49c64e48dfd745efba77e0ae
SHA1 26b1df27783209b5ed26dc5b856050ebe7dc8227
SHA512 61348744ad347f610c10cdeadf3ebfcf952bb51e18e11f1b930ea82c6bc574376d19bb0b04ddf262ff5fc669a6cf778c21c710a1c589c9e8b0f8c387717a30cb
SSDEEP 49152:wabH/KYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5k:Dz2yTpR/nbXaPk
TLSH
T1D7958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.8MB
SHA256 e8578989c92ed0c2786fb66d162166025cf785bef16591ac29e0ef06573b8494
MD5 0e0d0850df6d3ff99159e5491921225e
SHA1 d720d35d7a76277a9878aa1484134b2af9f76f48
SHA512 6a6a6c830f7074c10788c010c82920197dc748a2bf07b07c249b413a970e6dc12cb75c1c63860d00f1e1e45cea52743228663a3a3857ce590ce3a354593106a7
SSDEEP 49152:wabH/KYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5b:Dz2yTpR/nbXaPb
TLSH
T1A0958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.9MB
SHA256 dc17308ae233ae12fd4b9944ff44e697df1ff7398f0e527a86d9a47c3ee30840
MD5 b49396821ce0318a5de4de08abe89846
SHA1 80654952a62999c8163f6c1a8c446f97fefc8760
SHA512 83228811f5f2afaca610ffc1595d8194d7298839b76217e82f21e1cbfe57c537f5c45a36bdcc385cee33b757728be25ab71756f070945683cd69ead1fc4a4782
SSDEEP 49152:wabH/mYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5j:Hz2yTpR/nbXaPj
TLSH
T137954B12E6404099E46EC570EB655226B9237C720BD0A9DB67C0F73D2F326E27AF531B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 1.8MB
SHA256 2a3e04ccde835b8148405d947d23485c16dc9b977275d78fff3604b2cb52c41c
MD5 a35642721c05b96599fd60a60f3c6c6a
SHA1 ccc707b4957be044b4bacb6c79dc9ef7a4dc890c
SHA512 1c585edbd2a76374deccaa26207583412003180041edda7d0a668ec0bfdfa2cccd6493113c093780f4a88511221436575c9ad41357acd2d61328e7352e820b28
SSDEEP 49152:wabH/KYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5P:Dz2yTpR/nbXaPP
TLSH
T1DE958D22BB4040A9E466C570AD759236B9317C720B90A9DF67C0B71D2E336E2BB7531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 1.9MB
SHA256 d88e8e20d97737704983f2423d563f48d944867306475223c75c7305d057ae24
MD5 e0642da2591200789e51597d4b57b2f1
SHA1 280ebb017dd24a7061714d9a2d0e0dfc299566c7
SHA512 533c1d4407ab4037b95d5599dc036bc7bfedbd61e601162bea4eac27eef88e550d8b5580993a7dc8c02edbfe5d3b21dc0c35e156b6520b087997c88f81bc3137
SSDEEP 49152:wabH/KYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5lj:Dz2yTpR/nbXaPlj
TLSH
T18B958D22BB4040A9E466C570AD759236B9317C720B90A9DF67C0B71D2E336E2BB7531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 1.9MB
SHA256 d5cf34ed8f511fcf2e0219d0b9629e918179ea08f8755addc13e7b239de3e9b6
MD5 b4a68f10fe16fb9217857770d5485f68
SHA1 bdae14ed8893eb579602d3437579ab7d6a422c0d
SHA512 20a66a96016f279efc60f1b1a393ce8b9e340f9aac7d3f83b9f504a3796b5a7878c67f5a8d0892b7a03f0586e033731877f18e53de086f3c117ef61d61dd3127
SSDEEP 49152:wabH/OYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy5vD:vz2yTpR/nbXaPvD
TLSH
T175958E22BB4044A9E466C570AD359236B9317C720BA0A9DF67C0B71D2D336E2BB7531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 1.8MB
SHA256 241e9c9a87df88c1dd8055ae820e9a633672eae764bc541d2abbea6e0eeb8f4f
MD5 7a8858a8fd6c5dab9a6333d61ee887f1
SHA1 a08b73e7bb4a5bb52c536cadfba0f302d2d3e431
SHA512 86f12d754ea7010fbe65167a4be147dff686a200ce27a0597d6b6f351a1f0b3fb5278aa8405c9d2774afda8170e2f45beb3803095d06d89d5b569e33c98399b6
SSDEEP 49152:wabH/NYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:2z2yTpR/nbXaP3
TLSH
T100958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 803be86762c57872cf55b00c7df3cd44f14440b9bdd743bffb09d02a376ed50f
MD5 30d1d32743f8b06b1545f94962c06ad2
SHA1 ff93ad86657fed6c2d5d6aa7b67ea901d3793f0b
SHA512 6d9dd4fc4991e23ac9df3181699ccf42a6a1f8ebc675839dee465716fe7990931fd43ba43fd2601ca7fcc97d97645175d79e9d2056c278c5c4ccb5721085753a
SSDEEP 49152:wabH/aYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:Tz2yTpR/nbXaP3
TLSH
T1C4958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 f40b5e802d7a639f11ddf1095eec43c34cb1a6aa77dae6917d0a29f1722d833d
MD5 b327aade8ef0a794775937b207684a10
SHA1 0db8ffce407584847c1f40d862922d9e016aa08a
SHA512 64cd2b109090f7654b7a385be4196cddbcf6b5479eec97f28a63e9a5eb708c34e802cf109a80a4f29e25d1cfefbaabe9dc249eedb9e031669aff389a8fe287bb
SSDEEP 49152:wabH/5YabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:qz2yTpR/nbXaP3
TLSH
T13D958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 25cba16333c365daf0b6c969faa266c0a8ebe18ac1d8e873bb4feb2f2049ff91
MD5 f3866c2e66ccf0b03a988b932d2fe603
SHA1 ecf4e3589259dcd413390a443fa8d2ef13eeab0b
SHA512 a3346b0fbde09e72304b50eb6750b320d7332dc2788e0ddb472c45e780c6b83ed8372fc8a6b62558c4bf2e8c833c3e4851919b03a272a8744005db2b7bd7b83a
SSDEEP 49152:wabH/cYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:5z2yTpR/nbXaP3
TLSH
T1AD958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 6db69650d27902e4528a8b86acb75409b35e41d47843bf71d3c142bd115170b4
MD5 49d6c85a9ed314a439ecb64e46186a02
SHA1 2462bedd0c3e57c227721b1c468d31c2d310529a
SHA512 04a697dc69502d095eef865ed65d2c3193d9600eab7e25f952cc389d3bf6279801c68c616e85d0048541fdb28cd6468d3da7db0cfd6d09bcf09d8b1bcdd28517
SSDEEP 49152:wabH/CYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:bz2yTpR/nbXaP3
TLSH
T12F958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 7797430d215d736f3b78585bb043204c8d6fe89c1ce8943c93e349567f67fa25
MD5 3f090b2e71f581baa53af69f54f80c0e
SHA1 bd267e28d15924d4c2ea9eae379be91a0568e617
SHA512 80e71b0f98b6f15fb0b95c8b5674ae52457d355e7a1543e6256734d885fa0787d5aa7a0711e7aab427c47ee859424eb10a3fe554f53e22dd9f6fd12a6e37babb
SSDEEP 49152:wabH/mYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:Hz2yTpR/nbXaP3
TLSH
T155958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 365c7d6219736c0803ad0c45a9cf67b656e8840719ee8624a177eba68c1a5767
MD5 48504c18cb0a73ecf390061210385bbb
SHA1 4af6399cab37ec48f8f386332e859b419cd14ff0
SHA512 796a0b42f3e23123b814a511104b682fe140c4bd06178c2562ea05b6b31c9e66763543520461169b45a97686ed21a25641a195b41faadaa8de3ac3c5c44ea165
SSDEEP 49152:wabH/KYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:Dz2yTpR/nbXaP3
TLSH
T1BF958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 fff6406bbd5d226c699b8d867848432bf9f295070331f4b78a026a9f1b9d2f44
MD5 f6da5c5bd0ecaa316b14f31c1428d0fe
SHA1 245d04aa9f4c1e90941a72f6ca9d9ee105ecf762
SHA512 3d71ce96bfde5cae5aef518e5576a9d9a37a14338ef9bc2c0d90a24873c8d8ab6785b643c753e48bf9094e760d0b9141894bd47d33caf6ddd4de429725ba9dbd
SSDEEP 49152:wabH/OYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:vz2yTpR/nbXaP3
TLSH
T176958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 1.8MB
SHA256 7c9eb5eeae38601b28c5978af34a3a38a1d0f251cb51dd8fb368cbdf8594eb2d
MD5 e3931ace16339e3b26cbc681adb8b6a2
SHA1 57dade58d1d0790d8f143d6a337965647dbbb1f4
SHA512 ba109671afd31cd5c25dd861cf16713e7766bb5361b56387f482960348cdc57ebe3690d9089314254c42c0611b764a73bbb44055babf197c6ab3747e8aa11869
SSDEEP 49152:wabH/OYabH/IjYabH/habH/Ij2wTTpRtTToonbXaIHy53:vz2yTpR/nbXaP3
TLSH
T1D3958D22BB4044A9E466C570AD359236B9317C720B90A9DF67C0B71D2D336E2BBB531F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4716-69-0x00000000008B0000-0x0000000000B31000-memory.dmp

Download

memory/4744-61-0x00000000009B0000-0x0000000000C31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads