2345412ea9bf471ea7a82c1f18d8832b73ec2b73ffc37ca5eb64450bfcb48bea

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 05:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
Size 2.9MB
Sample260509-fxe2yaaz3x
SHA256 2345412ea9bf471ea7a82c1f18d8832b73ec2b73ffc37ca5eb64450bfcb48bea
MD5 9120f2273caf38a91919fe31256f21d2
SHA1 d9d7844d0d5fd77346b6566c8092ef1a4b77549b
SHA512 4bf46ecf5e2e8751deee37c19122cf628539c41bf21c8c2c4417a3484769bf806446d95cbba4c5026daeb3097391d8bdac9b19aa06585fcfafc4de48cfaba773
SSDEEP 49152:PabH/GIyNa1ZPItx2apeapelHturNp52YXZ/p:tIyLtUvlN6d2g
TLSH
T136D54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4812	UpdatAuto.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File created	C:\Windows\SysWOW64\UpdatAuto.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javadoc.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4536	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
4812	UpdatAuto.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 5956	4536	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe	78
PID 4536 wrote to memory of 4812	4536	2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe	80
PID 4812 wrote to memory of 1068	4812	UpdatAuto.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_9120f2273caf38a91919fe31256f21d2_amadey_elex_hijackloader_redline-stealer_rhadamanthys_smoke-loader_tofsee_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5956
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 3.4MB
SHA256 9cf47b293f7f84109ebb7ca2fb5a63f2ce03ac8fa0dc26e9c66ad1d53194d1f3
MD5 30b40b188c444a73849fb43bc697b9a1
SHA1 25f3cb3cc436e33b854092dc1975fae93346a1a1
SHA512 7688e0135c771000698f62b5785ca06b5072ce55b172558e858640394b128bb7975cb803f4ab7459561272edb111fec2779897212672430d90ac97f7e575170d
SSDEEP 49152:PabH/lIyNa1ZPItx2apeapelHturNp52YXZ/pbPji0Aj:OIyLtUvlN6d2gDjo
TLSH
T186F53912B6104275F022C976C1A2B75AE9703C458B228ECF8249BFAD7FB66F15E35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 3.8MB
SHA256 98bcfc39ca7460ae8d832c53201504d89347f622f2d7a0cb0f3b47b7f8799797
MD5 ebb818e30176a3c98ecc0639dfff2f84
SHA1 872182dc4ce69dd5c6a40a65a631760b0b0693b5
SHA512 d68c4e7eca5e100740bc9b61512f117d6d011ba4e05f9ad9fe1f77411730f51b43148a8d73dc10648665b8552e6236be4430fd118b82dfb99c63631c4ccaa377
SSDEEP 49152:PabH/lIyNa1ZPItx2apeapelHturNp52YXZ/p4/ezSC6vUzPvMHjy:OIyLtUvlN6d2gsezSC6v2XMH
TLSH
T1B4063912B5208276F062D876C1A2B75AF9313C458B328DCF8249BB6D3FB66E14E35735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 3.6MB
SHA256 aeaad85daf5af428a34dbdf87300126a6884245f879d782df3363970fff5d5ac
MD5 59d10fbf6fd4591876fb154a9255d01b
SHA1 9da2ebceb5de73ac31250949b5234605107e9ce2
SHA512 526cac7086893f330b02fb366088e21427a77f1b86445b809a1d96c9e9b2d9dd884f248844108991f24557ca1d48911ab8a739eb038b3cd6b5d33abc3888a1bd
SSDEEP 49152:PabH/qIyNa1ZPItx2apeapelHturNp52YXZ/p7VO88hXl+:hIyLtUvlN6d2g4/h1+
TLSH
T1B1063912B6104275F022C976C1A2B75AE9313C458B228ECF9249BB6D7FB66F19F35331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 2.9MB
SHA256 4403c20e5e062f0ec7c9234256b51dcc782ac58a92c6602ae7d3bc58725ed933
MD5 316e67f2c871eda388fccd60abd7eeff
SHA1 3758e61a40e4ca09e9d7c3288668daa1826f2b74
SHA512 d54460f5a0f982da94a746aa6bedf8050e7f904f1e710e87f6d08d82a37f3d15c1235d58d547edc71f257a5a0e2099a8c431c0b26867a285a7df80b59c19bc33
SSDEEP 49152:PabH/nIyNa1ZPItx2apeapelHturNp52YXZ/p:gIyLtUvlN6d2g
TLSH
T176E54812B60042B9F021D97682A3B71AA9703C448B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 8.9MB
SHA256 c2080277b8fb9668b2c051d72e3dc015e999c08b7379e6f606688dd6f413b478
MD5 65e1f828beb96dd9a404a284f6015fb0
SHA1 38d90b97c4574b46bf36280c8d91b7c5dcd54dfc
SHA512 06e96bb949d3b419d475106abc4fce5a6fa118e6bbd4649e4c60b7a05ab574af7988275e236bf934530b088e2afcd21bcb68bc86b8e7efa0f21c2b593878986f
SSDEEP 98304:UIyLtUvlN6d2gVQRQyi36YOcP+Lvw2gAf+PN34:8LtUvl1QyiKaUX+PNo
TLSH
T174967E13F3A541B8F05AD974CB3963229A317C4A8BB196DF11983BE92E719D07F38721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 4.6MB
SHA256 93620971732a0a4cd107e3252567916ab301ee5b6576b7c1d5da129cdd7d4f8c
MD5 a6a449320c138ea92242da9a4fcf3a03
SHA1 e61541ea02032118294ffcdc26380d0f755afc02
SHA512 ce956f187d6bd8b411f5f55961226f8665c979d49c8efee47946159a991fac859b3edb3d12be3f21088deea6d81320ddd261e1de1d03a954c0ead4ccfb57ff69
SSDEEP 49152:PabH/NIyNa1ZPItx2apeapelHturNp52YXZ/pu68Qg55nhoeWu7PNU3/Q:mIyLtUvlN6d2gcthHRc/Q
TLSH
T1C4266C23B1A101B5F019D872C7576729A5E03C518FA29BCF82497B5D3FB26E06F39326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 6.3MB
SHA256 11636a55bbeb4e7119d63260d196a8735e4385cb872c6ffeb3cdd76ce87ff187
MD5 2f2976cdc2d1b574dc2f02d4e1e92d22
SHA1 bdf3bd3eb416da28a7ab92cb9392a00231340ce5
SHA512 c9c43876e8dfdfb9280066f7fbd024a65dc6d7dc61746c376416d921bc5bebb2e89ca0c31fc91a999ad377f8bac69ce3ba5bd477a281c36260c05eb4477ac2cb
SSDEEP 98304:UIyLtUvlN6d2gjy5112gYy5azzVvf69nLKnhZO:8LtUvlBLIHuWhs
TLSH
T1D9667B13F29401F9F019D9758767A326E9717C468B32AACF06447B693FB6AE05F39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 5.1MB
SHA256 9726cd2a7640583c550881ed13ab352ed2c487749cb144ff4d8854e1b499680e
MD5 ca8c25119972da30be9cc404721e93f9
SHA1 7b12e7b7ad4bf73c01782f567a5ea724514a516f
SHA512 a1bdd7936de21b0039dc8795a9839bae765feacc7ccd6ecc0ae8dcd9c9727ea9512985475ecf49a388973e1647cabfd22696eb0108e73f1b597c1ae943ac01c9
SSDEEP 49152:PabH/rIyNa1ZPItx2apeapelHturNp52YXZ/pLB+taZ3usBWOBr4tEGW0bqx0z+e:UIyLtUvlN6d2g9u6Jm0xd2d3
TLSH
T177466B13F69042F9F015D9758266A32AE9717C454B22AECF42487B6D3FB6AF05F39320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 4.5MB
SHA256 f68ef69e3e48b16fcd6ad3429a6a8815c4c7e71260aaab29b488737723a97f30
MD5 df95d81f3e9ff8fb8da3199a6c0cb2cb
SHA1 ac5aad4d07095368e2644485d48bded5928bb1ef
SHA512 267613118115043f221e18af6b196186a1da1213282d4b5a0ef798177a08d0eb1a301b49da15427f51345d3ef255e3192717dbafd7342f861ece8a36da3176e6
SSDEEP 49152:PabH/rIyNa1ZPItx2apeapelHturNp52YXZ/pD1hpsNoJpF1A6GU44CwH7R4xu:UIyLtUvlN6d2gjmifP5R7
TLSH
T147266C13B65042B5F015C9758666B72AE9703C458B22AECF42487BAD3FB6AF05F39370
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 4.7MB
SHA256 5f02030b48f349eb13033e1c51f762a119db83465f0bcbd251dfb09316ecb021
MD5 69f3a449a9e26ee17e62fd4f92f56020
SHA1 f45f62a5adb20d88f394ea27a4d82570efb4d5e6
SHA512 e313460f340d497ee56a4ddbc8bf7f81acad3b5d01e49eeb6df6a0ee133cb843cad93ac7e568aeb304337638c04648f43959fe7af01f4a273027123c2ad0c617
SSDEEP 49152:PabH/rIyNa1ZPItx2apeapelHturNp52YXZ/pOSuZQIY0Be2K8RVtOnks6NMHq6:UIyLtUvlN6d2gg5dKCi616
TLSH
T122367C12B29041B9F066D975C662632AE9713C458B329ECF42487B6D3FB6AF05F39331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 5.9MB
SHA256 f7cd09192d6b81845320d48525c33fcbddb7e139cd4e121591086bb156391cec
MD5 e162fc9046e274edeb5d17239df6b137
SHA1 33bab6bdd191a3ea6e13ad1ce5558ed7d9305a85
SHA512 21a66d3935b4840ac9ce0104587445910799f0d9f0a5277bda3bae80b71adf7ca6523c2d290064964348083d740421628a6ddf42998a73445d3959d12b6b6beb
SSDEEP 49152:PabH/NIyNa1ZPItx2apeapelHturNp52YXZ/p7yLSrJhMeJNvjLAE3dGGj8b2EGa:mIyLtUvlN6d2gCm7vj1BDlZG
TLSH
T124567C13F29441F9F015C4758266A326E9717C458B22AECF4288BF6D3FB6AE05F39721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 4.3MB
SHA256 8afff0e2794e16e959a2e681454e4d31ea0172de8f240171aa2a7db1493eacd3
MD5 5a5079933df6ae26526254fd6b9d77ba
SHA1 185c9cd7ab601d4a0c3004a8973856bfc5bbeeea
SHA512 326a904e64557f1b7c1b69fac19643d38d5409406de4f7c4251013717f9acedcd5016e0e4614a9a68263e525db0e1c0eff82fd06c0e92a7839e616cd98193bab
SSDEEP 49152:PabH/rIyNa1ZPItx2apeapelHturNp52YXZ/pchtSn8EApI0fig1giDn0AP5w2:UIyLtUvlN6d2g9X2iwphX
TLSH
T100266B12B64042B9F015D975C267B72AA9713C458B229ECF82487B6D3FB6AF05F39331
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 2.9MB
SHA256 055712e8a9a5f7cf38f73a0c4558a6faa17e67915e3b1953d41ad725cc1326ae
MD5 bdf551fd3e2146186ab59796e8a6c3a4
SHA1 fc120a2bacf5661743920909c4c1118327ffe8c1
SHA512 ad4bcda420e014d7516315fcde17744f641b4345e4c561489aeb859c41af1a9a3cfaec42026d9217edf407606145390225b577ed6c951be3aead21f2fe1bee67
SSDEEP 49152:PabH//IyNa1ZPItx2apeapelHturNp52YXZ/pQ:oIyLtUvlN6d2gw
TLSH
T1FBE54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 2.9MB
SHA256 9c3740b7d5705feaa8350c23e154e1725d295c64d339d900f6b5f68c5664f4dc
MD5 fefd060065afe0ad7e712b1246f13240
SHA1 2df6102c6d242e55caa717d4130ec571567a9cff
SHA512 8d91294f1582539036c439dfcd1e5420be2500b18bca506101d36ae35ff62ceca17f26473a29ebe3a782d117dc7a49970216f11af3dc2235e763a4958319cde4
SSDEEP 49152:PabH//IyNa1ZPItx2apeapelHturNp52YXZ/pY:oIyLtUvlN6d2g4
TLSH
T158E54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 2.9MB
SHA256 636fd0a88ab25d76be66c8a8f89bd97a5e24e04410a421f96b1a427d9f691d42
MD5 9bc338e8f81a3cf4d589cfa471fb5e33
SHA1 c5637a0de77a5a3647d2181dd06a425d0e80dcd9
SHA512 34a56045022ea6a594c83f88a4e6ca92be0d6eec1a9e1300ced1635e5937826f7f60e6044fd8df5e6ba2eab0b2261b75faa6133d91c4a8ae684e0873ab369472
SSDEEP 49152:PabH//IyNa1ZPItx2apeapelHturNp52YXZ/pz:oIyLtUvlN6d2gT
TLSH
T11FE54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 2.9MB
SHA256 deca7327eff83c2a1d8ca0655f7146ae2bb2329f423cfa5862c8e9d2c006644d
MD5 199069802bce65b4256d51c6a8d295cd
SHA1 163c950ce4828633ffd267669a4bf39caca28bb2
SHA512 1cbeb8bc7344fc8e485005de992a40f02a502ec75fd01bd7161b9c57e7072a4bacd4722095b33cbaf9b820bb21aa72605371b30b1473cdb817d9614a9754a3ed
SSDEEP 49152:PabH/PIyNa1ZPItx2apeapelHturNp52YXZ/p6:YIyLtUvlN6d2ga
TLSH
T1DDE54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 2.9MB
SHA256 d75040eb45198ae90129e82494c3c7610531df9f4ee4c44c0d9e1ec4a1c17c09
MD5 5d896606e0ddce26a1dc3d3411b3f2e7
SHA1 9bafdb211a5bf3575a311e3afc7280b0ab6fb3d6
SHA512 8c7ca9e7b880286fb89b064886407b3f12221f08f39e69bb40bc7eba7284948fc3e1bdded20abea3f702b53475b4d0595ff80379ee00ec81268e2afd42c5f1a2
SSDEEP 49152:PabH//IyNa1ZPItx2apeapelHturNp52YXZ/p3:oIyLtUvlN6d2gX
TLSH
T1B8E54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 2.9MB
SHA256 b46a97177c272c91daf76d25ccbdb1701fb851e19c8bdbe424a2fe2c7cf99828
MD5 95af331e930317cc4c8ce58fe47efd22
SHA1 338d270f7888abe31e46e7521af2551e4e798182
SHA512 cba5be282859d47e301612d45ea01c60567e6eabde92724347172c54650a0541406c0759d1d318a39ed0a192e3bab6cdc04b168a32cab943f0a54b070b05a73c
SSDEEP 49152:PabH//IyNa1ZPItx2apeapelHturNp52YXZ/pI:oIyLtUvlN6d2go
TLSH
T1D5E54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 2.9MB
SHA256 1778cefee148f0bf1bbf60e6097983c69c6ffd29c09b77400a4ee86bfcd6ca82
MD5 c430f61e8d8e5ae38efa9d2d0db148c9
SHA1 8041d6e96b43a48ee738cb86a7df0ad53831404f
SHA512 06555fff64a8c0860c5639029eb5349d901f64d8202716ef4658a1d1e81358710e4f8dbb4fab270daffc72aff944defa56e15487156ee488ef4dbe1a02e64726
SSDEEP 49152:PabH//IyNa1ZPItx2apeapelHturNp52YXZ/pL:oIyLtUvlN6d2gr
TLSH
T1AEE54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 3.0MB
SHA256 b8d3623804bdec988b1a6d7d87fd6e90818aa5110d6ed9165b068dd6ae2d4537
MD5 b2c3127c71126ac2ba5dd6f7f5a23dc2
SHA1 a8dcab74b9701af6b5d1b81ee78de9b00206d7ef
SHA512 35a935afc4e2b998cc4096d8348f9bd9029937946707e0c8e4669bc9946a96bcd921e5ce6251054e1212a472a747d9efe4a6b3500cd115fc03d96d0c622b7c05
SSDEEP 49152:PabH/lIyNa1ZPItx2apeapelHturNp52YXZ/pM:OIyLtUvlN6d2gs
TLSH
T19EE52812E60042B5F019C975C262771AB9323C448BA29DCF8288BF7D7FB56E15EB5372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 2.9MB
SHA256 3eef0e8a98f5a14cb653335016debd6ea34e4a5a0f5ce0108844102aaec7e4ac
MD5 660d4770020f906a510ca2c307fb4789
SHA1 06549635c42c63c01a6ac26247d484371c0ca317
SHA512 3c858154bbd3d5dde8229cb6b41407c5812be28e93b49e15bcd94cbde6d720f4d105ab0e8857d701b0c1d0ec1d28a9c765b3f9a73234771211eaed4aef94b415
SSDEEP 49152:PabH//IyNa1ZPItx2apeapelHturNp52YXZ/pM:oIyLtUvlN6d2gs
TLSH
T152E54912B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 2.9MB
SHA256 2d4686cdcfadaece3da87201d0c480c297070aa369e8e71cb8c849f6fe774d67
MD5 82d1470e2b551a15c91a8a84413163fd
SHA1 3fcd380f20baf4c29241a9171d8f6b2d88ce9518
SHA512 9c6c3c35f842f638b9d31f73e1bdb6293972a65ab2748fe88a7dd8a3de2e22ddb175b2ec165275789c4cb500a2b5543ec67c5f5d55f8317af092fbfa850a39c5
SSDEEP 49152:PabH/BIyNa1ZPItx2apeapelHturNp52YXZ/pYj:KIyLtUvlN6d2g4j
TLSH
T1E2E54912B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 2.9MB
SHA256 68b146533355d49ffad9525e473ae8a44993e77d7176f3b1076d36a0d4dba73c
MD5 77dc1d909bb9407906c5027b583f54b8
SHA1 9c4e82ad6bb1c328e4b0d8fda0c3108be7b64854
SHA512 0991f224818205de1685ff8cff3ce353d8b2cd7c4680011e6d2e389c6805b2d895ba02e96cd9d36ddda2eba7de6eb878c6926060759fd4c1147a9cd1294c1995
SSDEEP 49152:PabH/rIyNa1ZPItx2apeapelHturNp52YXZ/p6D:UIyLtUvlN6d2gaD
TLSH
T150E54912B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 2.9MB
SHA256 2345412ea9bf471ea7a82c1f18d8832b73ec2b73ffc37ca5eb64450bfcb48bea
MD5 9120f2273caf38a91919fe31256f21d2
SHA1 d9d7844d0d5fd77346b6566c8092ef1a4b77549b
SHA512 4bf46ecf5e2e8751deee37c19122cf628539c41bf21c8c2c4417a3484769bf806446d95cbba4c5026daeb3097391d8bdac9b19aa06585fcfafc4de48cfaba773
SSDEEP 49152:PabH/GIyNa1ZPItx2apeapelHturNp52YXZ/p:tIyLtUvlN6d2g
TLSH
T136D54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.9MB
SHA256 649516dc69594f9fc236f2f60730f9ba8c1c7396a8da9b5b68ec22baccf64783
MD5 348b41991219cae564e3bcbccd48a2d8
SHA1 c9426709f126f32c44fb9424295bc50950a836c4
SHA512 2c31951cdf14fa4bfd8f813daeba011c5ba0dd52886afe8629b6e566249be4a2442c831e42d2482fb47b82521cb938bffbe7e9c4120146979ec248a22014a452
SSDEEP 49152:PabH/PIyNa1ZPItx2apeapelHturNp52YXZ/p:YIyLtUvlN6d2g
TLSH
T107D54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.9MB
SHA256 0c2e47519745e385b3d7c3c6f5ffb5f477ef301d0f197b512bcab94557479d08
MD5 dbc4bc3fbbc7a70d0d13201cfab1a272
SHA1 49b0779333ac90ed7b981f54b46fd2b58f749514
SHA512 b7a37fc8713f7f65bc6b22a79c232ce5514b426cb909e5ad18694e913201fc27a2401fcb39a3e24c4bfab9759008fe6c1d173deeed073f60ee6a8e220fad8dd3
SSDEEP 49152:PabH/qIyNa1ZPItx2apeapelHturNp52YXZ/p:hIyLtUvlN6d2g
TLSH
T15BD54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.9MB
SHA256 ce8eda0f8f36b50aac7df1b709167ae9be7475b6ce9415cd4dadb3bdf69cb0fd
MD5 ed9ed9c91ba8130a0dd2e7291237e488
SHA1 a307629d34538a0ee6112b6bef2aa54032be576e
SHA512 402c54871967ab983ce62e3cef3fbcc7790339ec6caee708910332be8b097988da34e49beabef4c94ec77dd329bb767b6c01d5aa73e67296a6a04e021a921043
SSDEEP 49152:PabH/lIyNa1ZPItx2apeapelHturNp52YXZ/p:OIyLtUvlN6d2g
TLSH
T109D54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.9MB
SHA256 3b8f7468cf6eef9836bad71f8900e25d4a99262cea68d82edb90d9819ef2b9ed
MD5 964e045035a3fae52aebe18d0852ab6d
SHA1 6c9ad89b3f5d5487d738734d74212c75652239ee
SHA512 e05519d868f8c58dd720fd82b0b880e7a677fb0422b0e11e35387f8cb72ccbf96888e99de57627c06962765e8c5cc09754ecaa21ec0a991db876150f1d7c6114
SSDEEP 49152:PabH/nIyNa1ZPItx2apeapelHturNp52YXZ/p:gIyLtUvlN6d2g
TLSH
T16DD54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.9MB
SHA256 a965334e78138dd24b512af39ff96843de6117127150b93c847c82ecefac991d
MD5 d0ab8bcc77ea1d142c9841a74a43a799
SHA1 9ffdfb3ef288bd80cc8cc55132d8f64f33c61fa9
SHA512 2173893d79e0e21fc3aff914865243b2c299d8768dc5b5c16952a2ca8d30bfa6654a6033d27f8c5f28d08078f2a6fd56c8f166e0aeca93a13c3c9999532272d3
SSDEEP 49152:PabH/lIyNa1ZPItx2apeapelHturNp52YXZ/p:OIyLtUvlN6d2g
TLSH
T1ECD54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.9MB
SHA256 e43611a331412d583c034dbc1c0212a0db836b2c9f04fc56c7354589e18d527d
MD5 d982d3ac20dc62ca2dffee6c12abdcbc
SHA1 d9d9e83264254c751797b352a84be9f1cb8478bf
SHA512 710d5091c643cf6b5649339b2a08032b88210995f83a63c132eba49beec162476eb4f85ea130f3dd85da092391d325a930992854b242eed3759f4ef02f4233fb
SSDEEP 49152:PabH//IyNa1ZPItx2apeapelHturNp52YXZ/p:oIyLtUvlN6d2g
TLSH
T1AFD54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.9MB
SHA256 0fb9af5b2f1b77cd26a001dcffebf9917c88c0b63226b89a7e5a550c6b6b89c3
MD5 3c95f297e396da049eb4c9dbcfb778b7
SHA1 c688e71ad5c1c036c2ace1dc2bbda52035e8b9b0
SHA512 782ca95313f5e57e0986452db0da115b43f62c3d7afe71e255cefba320b549acc3566da1af2d75ba5842340e7f754493fa79e61e55fbc317d3f912d7612263ca
SSDEEP 49152:PabH/rIyNa1ZPItx2apeapelHturNp52YXZ/p:UIyLtUvlN6d2g
TLSH
T196D54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 2.9MB
SHA256 20f49c81814b8a1f88dca790f45809c78acdd14593567cf63b5e32ea6c6b392f
MD5 a3f64a67dfd1775a76a82ad84c238693
SHA1 62524fb9bb323cb97d7207213edbb63e44dc9693
SHA512 2905e042575d56cac19f2624181466360ce3bc77af682655150f66d089225f74ea302b0713a20a8a36a60fa4bec23accc7c511f65910e31749f1b2aacee7b4df
SSDEEP 49152:PabH/NIyNa1ZPItx2apeapelHturNp52YXZ/p:mIyLtUvlN6d2g
TLSH
T1EDD54812B60042B9F021C97682A3B71AA9703C458B229ECF92497FAD7FB56F15F35371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4536-67-0x0000000000970000-0x00000000009EA000-memory.dmp

Download

memory/4812-82-0x00000000008C0000-0x000000000093A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads