Analysis
- max time kernel
149s - max time network
158s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/04/2026, 08:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
Resource
win11-20260130-en
windows11-21h2-x64
6 signatures
150 seconds
General
- Target 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe
- Size 942KB
- Sample260424-kdsadady2n
- SHA256 d7bb9f23e47f7b8583200e935bc0cb16d1248f06c40501671cdf64bb9f2c29fa
- MD5 9aab92b6a090f2b2db10ea140ba37dc6
- SHA1 9e54eea298c609a17f3e9489e22f33d3307c539f
- SHA512 7d657398801938a0475d202ea7d807dfcbb2b6b680b4179314bcce6bc5d7fc3337b485e0eafbb63384994384d799c1df1bd1899530ca3d4978ea17689674fb11
- SSDEEP 24576:w4R5CIH/7pS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/0abH/FPjH+PIj0
- TLSH T1B9250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4664 UpdatAuto.exe - Drops file in System32 directory 5 IoCs
description ioc Process File created C:\Windows\SysWOW64\Option.bat 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File created C:\Windows\SysWOW64\UpdatAuto.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\UpdatAuto.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Windows\SysWOW64\Option.bat UpdatAuto.exe File opened for modification C:\Windows\SysWOW64\UpdatAuto.exe UpdatAuto.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe UpdatAuto.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe UpdatAuto.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\7-Zip\7z.exe UpdatAuto.exe File opened for modification C:\Program Files\edge_BITS_4436_1374417699\BITB91B.tmp 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe UpdatAuto.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe UpdatAuto.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe UpdatAuto.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe UpdatAuto.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe UpdatAuto.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe UpdatAuto.exe - System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language UpdatAuto.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4240 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe 4664 UpdatAuto.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4240 wrote to memory of 4136 4240 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe 84 PID 4240 wrote to memory of 4664 4240 2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe 86 PID 4664 wrote to memory of 4452 4664 UpdatAuto.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_9aab92b6a090f2b2db10ea140ba37dc6_cobalt-strike_elex_icedid_luca-stealer_njrat_vidar.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4240 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat2⤵
- System Location Discovery: System Language Discovery
PID:4136
-
-
C:\Windows\SysWOW64\UpdatAuto.exeC:\Windows\system32\UpdatAuto.exe2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4664 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat3⤵
- System Location Discovery: System Language Discovery
PID:4452
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.5MB
- SHA256 5674538933c76a318bd22f774a1dd34e46ffda4c2af603c7fb1abc4ca8787433
- MD5 852fbf4fac2996013b0412d57d8fe87e
- SHA1 19f94bea5602b8b5bb313a85b21a0ece86e6002f
- SHA512 d75e4f50f47fdb8c7fea8fcbc3d5626d53dae6417f78a7521edc007745789e50b6ec3f4c7ab50678f375208183273cb3fac878bccf17955b3b7edd5ee2192591
- SSDEEP 24576:w4R5CIH/7dS4R5CIH/7iWDPjHg9PnNUcQjriLo0Le5ji0hmxNrM:wabH/IabH/FPjH+PIjVPji0Aj
- TLSH T1D7651811F6644275E072847988A1964EEA313C61CB338D8B2385BEDDBFF36D29935732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.9MB
- SHA256 2dcf77d17c8d90500ddc6f6e50c501d3e3ec6cf2891606e8362a8224b0c23830
- MD5 4fde198996850856133bfb11f5bfafef
- SHA1 d226e4da74691569ddd7f75daaea383d26fa4c30
- SHA512 1b0118dcf64468818a52568de16eafefc8f0759b77612337eb48f6a39b9ce19e8994f952a520668247629e84525db52a05b25df1803b67f381e06ec12ca4b5e1
- SSDEEP 49152:wabH/IabH/FPjH+PIjy/ezSC6vUzPvMHjy:Zbb2ezSC6v2XMH
- TLSH T170950811B6748232E0B2C079C4A6A65DFA323C518B328DCB1245AFDD7FB36D29935736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.6MB
- SHA256 de24a51853d031f3cacbcef3c987647ce1605f1e47e0a6f8ab3401affb61d5fd
- MD5 794ccd40e68378086f877d5fdea515b4
- SHA1 d9e465a06dafe775679cb31f2949e1f0128463c0
- SHA512 87f31aec7ed528b684b1f6201392900d6bc1e2a1329dbab99f872f5e6b5d53c021c17920e1669a4bbf597746b29d897d67ce27941fbcd8f68556b2fab3f8c387
- SSDEEP 24576:w4R5CIH/76S4R5CIH/7iWDPjHg9PnNUcQjriLEVbqPb88hv/l+7:wabH/9abH/FPjH+PIjhVO88hXl+
- TLSH T1F7750721F6A48175E0728475C8A1964DEA323C61CB338D8B22857FDDBFF26D29935732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 956KB
- SHA256 61ff3edcf96ccbc01f5f346fbc94a52c2e284832cd2be998d465aec621e64255
- MD5 b5b3430e23a3a6cdff42a5b3365855f6
- SHA1 fa1f88c3bd69d6ca5e7fc7325eb5e5049587c0b5
- SHA512 798f7204169c9597a6b3b28decd3f941796297612225618e51566d838c98d06fc8f7c43dac2916d07f28414e22789f1cbf60ac606ec07789b77a9cfff8027517
- SSDEEP 24576:w4R5CIH/73S4R5CIH/7iWDPjHg9PnNUcQjriLqa:wabH/+abH/FPjH+PIj
- TLSH T184250611BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 7.0MB
- SHA256 2fd2ec99abeb634c9056dc7816958e064ee7f4bfc0b91edfec5d92578d97705f
- MD5 34ec351f964f23d407088c2244b80854
- SHA1 c0f0777d072ae6b9d9762867edd8e6aac79729b1
- SHA512 4e5eb4b1ff1b5985bbaa4f2196d43d52a0b56470f78e01ea74b895a90c7fc96021d257384c6cd2e6ed9dac8f8c7e73266d281e1b988e5639206419400a350ed5
- SSDEEP 49152:wabH/KabH/FPjH+PIjkj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259D:bbb7QRQyi36YOcP+Lvw2gAf+PN34
- TLSH T167767D03F3A500B8E05ED974CF3952229B357C5A87B196DF25943AE52BB29D07B38B31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.6MB
- SHA256 21260b45ba14618a60b14a1accf00b746ad86a5aad780c816e0a0be50bdaaa5a
- MD5 7316e82ef363d5c2a32f25ed71673748
- SHA1 ea16bc5d159ec3cce86e7b26e1f4a1f70962084c
- SHA512 a848ed16f18cdbf1231d8cc12941b89dab1b3f1234c1009b3cdb8e62fb01b49fd0d65ff47a99cac7b88d2115e00801d09debb4bf39d9287c25be0397d4e30a85
- SSDEEP 49152:wabH/KabH/FPjH+PIjQ68Qg55nhoeWu7PNU3/Q:bbbKthHRc/Q
- TLSH T1B5D52923B2E200B5D059C5359B16862995D17C71CFA2DFCB52403A8E3FF2AD16A3973B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.4MB
- SHA256 32d34c8ad12151c2a13efad7e4884d69474e6273baadc7c94a6d7b7a40e743cb
- MD5 09d487aa9b95e437ee6b43a9f0259fc3
- SHA1 9c248161e536f98b9e97ff05a0ef096ca0b99912
- SHA512 1444473e7b0c5d2af28a610bb65f777b602d6b8578f7c5db505391f385dc2b14f98a83c0ce4515961aba4e683ee0d18a9b74d3cfc9e3ed92de9e34d012f8edf3
- SSDEEP 49152:wabH/KabH/FPjH+PIjI3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6J:bbbly5112gYy5azzVvf69nLKnhZO
- TLSH T18F267C13F29800F8D019C5794756822AE971BC568B22AECF06507B993FB7AE16F3D731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 3.2MB
- SHA256 d160e797b758b613149bdc85a4243e776cddbe9e0b9e93ce6d4e91275c7bdcf1
- MD5 57cc296362d45a8c60c7b5df3b1002d2
- SHA1 72fa6c34febaca4ba9d22c0bd8f030b2b60cb903
- SHA512 77ff54509b0b7f0717d994fe089149dc4e23cbaa96b3b25c84456c5207489a592d04cd51b9dc86240388bdc9d43c01a5e443b0b22c2d8137944d642dd4ee3665
- SSDEEP 49152:wabH/KabH/FPjH+PIjVB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:bbbbu6Jm0xd2d3
- TLSH T13CF57C13F69500F8E06AC4745615912AE921BC558B22AEDF17807BCE3FF3AE16B39731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.6MB
- SHA256 67f424232a1157cece037798ec8ed99aa9cc9064d6d296a5772a05d938818e8d
- MD5 4f8cf33ca0a986389c2de3540f99de71
- SHA1 ad29132990042cf83049ab82705480bff78dc5ae
- SHA512 ed989387ea5641b5818f5b5d2129c1a4862773f9ad16f17088a4933b74c88c60fec0a46414313848b477c9a8eb977f1351ec5dccd7cac765f33666cfdd68d0e6
- SSDEEP 49152:wabH/KabH/FPjH+PIjN1hpsNoJpF1A6GU44CwH7R4xu:bbbNmifP5R7
- TLSH T178C55C13B29400F4E066C5745A25912EEA217C658B23AEDF12807EDE7FF3AD15B39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.8MB
- SHA256 4568e4a74b49071dde4852cdb67ceb77084df65304b1bb356393b93c2bf20087
- MD5 ac1568e7886b341227105c57a69ac1ad
- SHA1 fa1ed9916f733ffd35ee4b39358fe5025f0a5961
- SHA512 97655332bd697f1d400fe85b3b26e7a2335dc8c0b3046918fa7b48c324ffad1bdade4862c9f989670def391cfe74824598f870417df6bac7ae4b16d6183465cb
- SSDEEP 49152:wabH/KabH/FPjH+PIjESuZQIY0Be2K8RVtOnks6NMHq6:bbbW5dKCi616
- TLSH T110D55C12B2D440B4E0BAC5749A65912EEA627C558B329DCF13403ADD7FF3AE05B39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 4.0MB
- SHA256 9fcd65c5b507d236123fa51b82699c6fd381bf122b272f4cdbe52453feaa84d5
- MD5 94e459e9f4989580b207a4f3ca5f8ee5
- SHA1 89bbdb3f923e8762bc8512db014fa6783ea0c986
- SHA512 497956b129c681d2b4db092e6eb501c3f1845b411466ee53b249f82305ca4530718e2c8046f18370c02b3ad563c03f0bdb31ab02abcd80ecd9f95bc386e2d566
- SSDEEP 49152:wabH/KabH/FPjH+PIjFyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAE:bbbEm7vj1BDlZG
- TLSH T1A6167C13F29440F4D069C0748756823AEA227C558B226EDF1790BE9E3FB7AD16B39731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.3MB
- SHA256 265ebe728c1def9b83b845e8370285f31c4008dd4524971fb750d06ae8d3f602
- MD5 5b871e77a7ba4c413a81811fa141dc6c
- SHA1 01d565d083e596009e8526866941ab0e676b5507
- SHA512 a4a9572629ffb6926908a210467d0591d19a4193a23aae633d9610c8f75a254ebed0e8fd787d0f54b07ee5676f10abcd1e433b9248e38ca8d132b56c1330699f
- SSDEEP 49152:wabH/KabH/FPjH+PIjGhtSn8EApI0fig1giDn0AP5w2:bbbHX2iwphX
- TLSH T1AEB55B12B68400F4E066C5759A15852EA9227C25CB239EDF13807EDE7FF3AD16B39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 965KB
- SHA256 13cd3f5412f70e3753968f3c555e1499440901d4f12ad1dfef86c719c7fd36ab
- MD5 4c7f43c7f565abebe846c34371cff58a
- SHA1 aa260ac1505432d79181b52313e1d8c8c4b55500
- SHA512 d4be085203bb6eb49800f57b1e9385d0cb609ac8115ae811bad8eb3698d0c42ff03b7470452c329252b9e6e81b442f7e0ec59e801226d8a10c85e518fefbf3bd
- SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriLd7:wabH/WabH/FPjH+PIj6
- TLSH T1C7250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 965KB
- SHA256 0fca394234bef78dd79e8454bca5310b6a2a877bc87bf9acec0836d3db9ddc03
- MD5 298161165aa5893af910adb426bacdef
- SHA1 9e1eb4b87b3291bdb728bc9256117154fe569021
- SHA512 2f2c5ecdd26eab202d0d9d0d29d6188705a2cb55ca6b17bbf933b12828d66e1443d50951ff83624e93908634f5f702a24282aebb11f3d4f73402e5fa43981edb
- SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriLLx:wabH/WabH/FPjH+PIjW
- TLSH T1D0250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 965KB
- SHA256 e920a68176776e4bfdd4de4359f7d16c1efeeb9af98416c6e2ae5f7433698d95
- MD5 51e9de8271338c7345e992f8d28db932
- SHA1 379d873fc08b42e95e1896218a5135618114febb
- SHA512 c1fabebf9a32a72da7757bcc06b4a9a8ac4b83725b7db562b218b016f55f5e5d234cf472277cd9743ae46d70c982468f276f719141f5ca7269ff4378e5c75bce
- SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriLNs:wabH/WabH/FPjH+PIjB
- TLSH T168250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 986KB
- SHA256 ab1f49bf63cebe953c5aa0ae5985e3ac3e0f543b4672034ae7b5d5d530295e80
- MD5 c5084bfc006f2ed33db6b9d228e616ab
- SHA1 d6c47956e46bb8adc1acbf5ec76638019bee1fce
- SHA512 343ac598241f84590198c301477aa018f7fb6459d740fd20527fd9adb61a0ac892b4a643f6d945aa8f9d51989235c33a802d03b297f5877b3e5e947d5b61dd19
- SSDEEP 24576:w4R5CIH/7PS4R5CIH/7iWDPjHg9PnNUcQjriLz:wabH/GabH/FPjH+PIj0
- TLSH T176250711BA904075F07289756825820DAA267C75CA638D4F73803ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 965KB
- SHA256 697d8dd66c8037eca2c851853baad35a199e693a3c0302613a123d939029a9db
- MD5 24952cff487e715a546e4d622d198051
- SHA1 ed12c421d87b4904383f9b90860c47663e356a54
- SHA512 1df0f93de27ed790a546993653ffb74b323f17bf18856604d93979c73869b15680768e38f51aa00470e9451cc1973167f878f02462553bda90f90a613706ff5b
- SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriL0Z:wabH/WabH/FPjH+PIjB
- TLSH T15A250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 965KB
- SHA256 e3e4dd557d53ec185338b9c58bee7b85f5ae9a628d910b7612cff16b4f29e49c
- MD5 d8189cc3de0fed6aea9ee71b5cf1460e
- SHA1 10c1776fcc36d9b180caad6abc30cda9c4248c62
- SHA512 8f35d418d9d907acaa419f4644f024451878ff930362cdba556218c4aed64c77d761634c55cc545102760e9f37eb3838bff5d1fd92835dbbf897e796b4f5c5f6
- SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriL71:wabH/WabH/FPjH+PIjW
- TLSH T1F3250711BA804075F07289756825820DAA267C75CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 1.1MB
- SHA256 a6976ee1bc60f7fc7488c0710df139dd1e43f4be80328c0aead35923169b4e96
- MD5 6b1d3c943d3bff59669156e440e32d36
- SHA1 a575506e02beace4a2c315014a903a0240fc59de
- SHA512 bcf398716238893903248f1654ed55a2f5f7e2c6a9f1ff910b435d8d96fe22ebd26f5b4eaa84f6bda384974d90ad09e7145233d1b3c8c506ca7d866b50251be4
- SSDEEP 24576:w4R5CIH/7dS4R5CIH/7iWDPjHg9PnNUcQjriLtD:wabH/IabH/FPjH+PIje
- TLSH T1A735B411E6404075E06E4935DB25850DB6273C64CAE38D4B22C0FEFEBBF269269E5B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
- Size 998KB
- SHA256 69f70b0af240f912cb6bf8e883d576a8ef5423b74826fb990741b18988419148
- MD5 552eb3ffe9cf2cc60af333e461539f23
- SHA1 388ac42fd2200b6d4a1fd9279e8854f1e388c757
- SHA512 9bb77b5183fcfccd1351164826d978bc5331e256639f8b68973abc7af2b79fe4226fac58b8061471695640e8ea0eb88a202cdf48f1fcdb7d606e9a8aa75771f3
- SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriL5:wabH/WabH/FPjH+PIju
- TLSH T17C251711BA9040B5F07289755825820DAA267C75CA638D4F33843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
- Size 1006KB
- SHA256 259c94a2c575a25556880f5beda85b9790721a1204991070b7e9aa1ee366b03c
- MD5 5f4fcc99ee07df96fb2f4865a952e65a
- SHA1 a48a7f1ad7ebd4ecab3db3dd418daa2d80f1b5a0
- SHA512 f81ec55a8337c0e89b1b3daeef08beff377b4c6c9c3ff6a6c1bce360fbdacfc4567a2b96b811646357673767156f790adc6ba508cfe762fa681a57b2a9faa336
- SSDEEP 24576:w4R5CIH/7hS4R5CIH/7iWDPjHg9PnNUcQjriLbj:wabH/cabH/FPjH+PIjGj
- TLSH T110250711B68040B5F07289795825860DAA267C75CA638D4F33843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
- Size 1002KB
- SHA256 b214f63928eab670302959e8a94e541ce35c2e75b24c5885c5fd60ff95bb0cca
- MD5 ba65b5c6219656839af1c9ee6bcd2ba5
- SHA1 e0e129f11cb9a803d81b08a95d4784b744f67f63
- SHA512 41113ae7afaf6a21f9890300bc6a6419793dc33955f7085eace63ed56b76cb58601c2153055a7e58bbcc3a3e2d1c1b9b6d69476081ab5e6dd1be01d77b17433d
- SSDEEP 24576:w4R5CIH/7DS4R5CIH/7iWDPjHg9PnNUcQjriLZjv:wabH/KabH/FPjH+PIjED
- TLSH T101250711B68040B5F07289795825860DAA267C75CA638D4F33843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SysWOW64\Option.bat
- Size 53B
- SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
- MD5 1d04abf39e9df55eed1d04430cc21eb8
- SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
- SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
- TLSH T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\UpdatAuto.exe
- Size 942KB
- SHA256 d7bb9f23e47f7b8583200e935bc0cb16d1248f06c40501671cdf64bb9f2c29fa
- MD5 9aab92b6a090f2b2db10ea140ba37dc6
- SHA1 9e54eea298c609a17f3e9489e22f33d3307c539f
- SHA512 7d657398801938a0475d202ea7d807dfcbb2b6b680b4179314bcce6bc5d7fc3337b485e0eafbb63384994384d799c1df1bd1899530ca3d4978ea17689674fb11
- SSDEEP 24576:w4R5CIH/7pS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/0abH/FPjH+PIj0
- TLSH T1B9250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ntldr~6
- Size 942KB
- SHA256 b900ede26f30c055599889d207e6402941533d2036f0a480c3ef979a9024565f
- MD5 311b345bbc753444c0f21988ea8d0477
- SHA1 de649769e07ee4d6331aa2a215871c14dfd206a8
- SHA512 f77d0588247f59b8730a505adea0722da04b9fac459e37f9ccbda9e338c4979feff909b2e5f9fb77a856cda51bccac70debc1ff49168372afa4088cfdcec67bf
- SSDEEP 24576:w4R5CIH/7PS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/GabH/FPjH+PIj0
- TLSH T158250711BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ntldr~6
- Size 942KB
- SHA256 d57e94d0e0c978dfbb96f84f9cc7b736634939fe93d6d4a4ac027faf0c69c417
- MD5 c75f13d81ac6fce1a64255062aa2baef
- SHA1 ac3cd54b115b3b64485281dddebd6814dc578543
- SHA512 f1dae3806dc3c07fbcabce5761f905b2124deeb88bc3e1024f8fdb763452b6273bffc52c325ec0a43d5ab90f0a59ea706e45066dd6b4ee1ef760b0bbf220c756
- SSDEEP 24576:w4R5CIH/7dS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/IabH/FPjH+PIj0
- TLSH T13E250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ntldr~6
- Size 942KB
- SHA256 6ec0ec382c0506a28a0a13eee104414346a996c32ef6f472a71a69cc2572d8fa
- MD5 f5353cd20bdcb3e8f7f160cd9e8877e2
- SHA1 4a79c9ce8b68096e3a7358823a40c2400f96f4f4
- SHA512 4e376229f3a11e9458fbb101eb946eb74ac22dc218c9b39f8bf4c28f5b857a3bbf72ff4f32095dc154b626911d5a8cffd90a6084c7073ac4b645b051ecef0a5d
- SSDEEP 24576:w4R5CIH/76S4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/9abH/FPjH+PIj0
- TLSH T16E250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ntldr~6
- Size 942KB
- SHA256 2748809743731f0ab5fa278573fb4cd777253e1002aec153ea29371728fad2fc
- MD5 1ee8219cc2bdf54cc4925d66e9bbfb89
- SHA1 a502af8601229f3b1ebbcb684a71232e865af443
- SHA512 bdac8b27d02f1c0a77debf067d9bb23db37a7a87a3223b5053db7e8e519b9310aac55ab8915beb253c8c73a987ca8b642b9210f577752ae3e80e2e8978cf194a
- SSDEEP 24576:w4R5CIH/73S4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/+abH/FPjH+PIj0
- TLSH T1E2250711BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ntldr~6
- Size 942KB
- SHA256 bfd49f29655c7c6b4d7114a3821b153798da045b58058fc63cb23a3d2c87f351
- MD5 36d661bfe2a732c8e04988b0532443ab
- SHA1 ac52d99ed43a40c96d36e7037be3b78d72a1cdac
- SHA512 58436c81d363bbc8fa4e6160b59fee7a47c2874609927f597da977c03d6663b6287527001542788e3d3cc779417c0a933e36546cfc27c062658ea6047912f000
- SSDEEP 24576:w4R5CIH/7dS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/IabH/FPjH+PIj0
- TLSH T1A5250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ntldr~6
- Size 942KB
- SHA256 c79fef8dd9180cd170a7f1367a6f3c522de1d62a2cc749aad1e5de1e27ed7c93
- MD5 3e5fc65bbe5cd27d18283d473d33f035
- SHA1 d19ad761503ff5238b61bee5d4519a253083c329
- SHA512 0d45885469bcd43e0a439f27ddb8063a898c1ccb25469a977f073386aaf952c1535b22304787c1d20a43cea463692871949e9094a8451f5073193099e56e05ab
- SSDEEP 24576:w4R5CIH/7/S4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/WabH/FPjH+PIj0
- TLSH T188250711BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ntldr~6
- Size 942KB
- SHA256 38d1adb10acbb343e385566237319bad305be2ef06c0072b83e01a4c7a6dc5a8
- MD5 2336ef4373fdc16bd1450d316c138184
- SHA1 871185a64c89b42301a3d37d5bb5dfe510cb556d
- SHA512 e3aa290351b03361d99b01662fca13d2ad5e724a968d9d2755b500fc9e75796b7b9e02d1e690631b8d006465029d90d559f7568f47c6f6492992bd192362de24
- SSDEEP 24576:w4R5CIH/7hS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/cabH/FPjH+PIj0
- TLSH T19C250711BA804075F07289756825860DAA267C74CA638D4F73843ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\ntldr~6
- Size 942KB
- SHA256 f5c8931c9a327f915658b0a8f15baf63c845696667f3003ced05d5598a84cbde
- MD5 139ced9dcacfb3db5f584c520de91b94
- SHA1 976622ad65e0f2cc65361e6ead49fcd36fc7da21
- SHA512 7e773a6baf28e29d387374d33f4c7447372afc55ba1c21cbed5d66abe0f8eb7a83bd884fc87d1ae6c1bb97a08d78505c6d03233647ce3a497b340a52f85223c5
- SSDEEP 24576:w4R5CIH/7DS4R5CIH/7iWDPjHg9PnNUcQjriLd:wabH/KabH/FPjH+PIj0
- TLSH T14F250711BA804075F07289756825860DAA267C75CA638D4F73803ECEFFF26D2A975B37
- MD5 SHA1 SHA512 SSDEEP TLSH