42dfb26ab0f9f454eace644eff3d0d25e1768bbbe5638f12f495171f190bc01b

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
Size 820KB
Sample260604-e2k83shz2v
SHA256 42dfb26ab0f9f454eace644eff3d0d25e1768bbbe5638f12f495171f190bc01b
MD5 928fd3b71b4b93134152eaa8bc93d107
SHA1 0887f39b8478e0a12315ab0c0f7ab078a0ae372b
SHA512 64bc39acf280b54fca42e5b2beb082426a1031cc007dab7ee20b69ca423eeaef1442ec9c90283393bb44d6ef68b1a8631974d06359e06a469f2ab37be596cec8
SSDEEP 12288:P4Ryed8I7r/7mJACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/7qYf8NO+9iGnB9umM
TLSH
T19405086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
844	UpdatAuto.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe
File created	C:\Windows\SysWOW64\Option.bat	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File created	C:\Windows\SysWOW64\UpdatAuto.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\WaitResume.tmp	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\misc.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	UpdatAuto.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3560	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
844	UpdatAuto.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 5000	3560	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	80
PID 3560 wrote to memory of 844	3560	2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe	82
PID 844 wrote to memory of 1712	844	UpdatAuto.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_928fd3b71b4b93134152eaa8bc93d107_cobalt-strike_elex_hijackloader_icedid_njrat_vidar.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5000
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.7MB
SHA256 6d87e6a19d5837ff8c6c06fba2258016458c3bd845efc6f4069ab4f90eaa17cc
MD5 71cda9cc8f0e858d1aec29c90fb93da2
SHA1 84e4abb93abb14d3b1e939fb675e5b5f9a691308
SHA512 427a4e5a5fa4348f9d617dd43f03b3913d5b4bc83b8974ad83c0672f31e28fff9307e79f7d73886ecc40c0f436d543c532037aa4971c04ed3656585a7dd1b9aa
SSDEEP 24576:P4R5CIH/7uYf8NO+9iGnB9um3a7/ezSC6vUyD/aqgrvWx6q8wyu:PabH/iYfk5fu1/ezSC6vUzPvMHjy
TLSH
T1A1851922B1248327F466D9BBC6D6B359F9313C46073085CFC24AB7282D376F19A36769
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.5MB
SHA256 68f2ebfe47f59028696bb3e62d02ce5c300e8ff0b607139883b7b3200651bb20
MD5 52d90fd4dc1da9bbb524e822407ed55b
SHA1 ba1810e26df123b39466b05678daaf523bbb94cd
SHA512 604651d4d6c47e12bd36b7b8acf4262945839b8fc3c80eec6e8439be6f4af19ae33d12d93ee1fcbdc65929e0c3c472bac044072a1d00a8d27d0bc906dc7dbc67
SSDEEP 24576:P4R5CIH/7XYf8NO+9iGnB9um5VbqPb88hv/l+7:PabH/zYfk5fuaVO88hXl+
TLSH
T197652962B1108625F426DDBBC296B319F9313C860B7189CFD249B72C2E776F19B36361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 835KB
SHA256 dcbe2878381c6b84150396c65480bdf79673d4dd8cffaa3ca1a2638d7109e847
MD5 77769ed0096e49de980388eb45e13f31
SHA1 74580e6a259a5f97d5403375a1b6f64fec04f4af
SHA512 a11b5d2c7907498076f35e334c5002d62aedfb100bb5a14c9c6ef861698eaf09959e8e1f97eace4cb10f65651838112594f36cffdea2f68ccd6869abb645ab82
SSDEEP 12288:P4Ryed8I7r/7mNACFYgGt8NO+1cQiHmNJLB9unmXa:P4R5CIH/7WYf8NO+9iGnB9umXa
TLSH
T18605186261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.9MB
SHA256 fc908a608de51fd4e734cfed77303eaea69f1cfe991043127b74b73f5679fe22
MD5 ef460c5e10a51c53d63c95dd7564b326
SHA1 0346932fe5783bc85c6a34e7478d87a7113e1d8d
SHA512 d11e76c08d1daa6c45e0bbeb3448cfae306804c5f718f05262db582f05588722f410bca8d846d24a8217b5146a173f69e8e27aff91de76717f25fae2c722c45d
SSDEEP 49152:PabH/eYfk5fuhj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpg:kC1QRQyi36YOcP+Lvw2gAf+PN34
TLSH
T167766D53F3A501E8F05EDD74CF3D6222AA317C4A47B092DF259836E51A72AE47B38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.5MB
SHA256 1f93722db4f6f05526832baa21cf071e017bcc4dc31025c9763860d933ee1a66
MD5 695e38ce5282c21f299bdb14e1d2e24d
SHA1 fea4bdc3a2be06a7a85165e7494ed9128b5c6658
SHA512 2b401e8a4f5c6b2548b2ac5bbaf359ba31e6f20069aea281524fd45d4ae51158c687c120cfdd5adf329e3856761c8b918a8a20d0a5d52c6eb62c86b1c708e84d
SSDEEP 24576:P4R5CIH/76Yf8NO+9iGnB9umOwvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PN9:PabH/eYfk5fuF68Qg55nhoeWu7PNU3/Q
TLSH
T1B5C51733B1E201A9F44DD976CB4AA321A5E17C658FE0D7CFC24532191B726F06B3A74A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.3MB
SHA256 6c75e7716352dbb36145f7f0e2a5abd713a741d428cdabb8f681aa74dffa2925
MD5 9718e4d5933a77e3099372b5d310207d
SHA1 83f712f6d3ca05fae71215f23f1221e092188219
SHA512 011ca2cb572d797b5c0e3762b70ff9f65d5bc628154578b87c456226e5eab756128aaa8c6f919012dbf2e13741f479b3abbcbba4755ad6a0e99a2f7c65a28315
SSDEEP 49152:PabH/eYfk5fur3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2F3:kCDy5112gYy5azzVvf69nLKnhZO
TLSH
T18F266B23F29901E9F01DD9BA874AA232F971BC464B31A6CF464477152E7BAF06B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 3.1MB
SHA256 664eba11a316ca2c52bb8273becf3e9c493edeaa7bc5c8d68bbe546c1ee2a382
MD5 438a9eb7bdf0247cabbee7aab9f04c58
SHA1 817a0b076e0e1f7863315cffdeb8e4a429ee2e2f
SHA512 6214b0118cacab268620b0750596b4d55bb098e279eb8b343c171cd624d0565ce3e2e140874659558738584b6accc56c8abff598ddbb9c7e2813a8c3e8c5362f
SSDEEP 49152:PabH/eYfk5fumB+taZ3usBWOBr4tEGW0bqx0z+n217aau1gl3:kCdu6Jm0xd2d3
TLSH
T13CE56A23F18501E9F45ADD7A874AB232F961BC4A0B30A6DF868477152E77AF06B3D740
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.4MB
SHA256 f35784d014eb886db434c02d104495d4cbd8848de9e0e08df78ac3fe05c63db8
MD5 419471214bf123cfce638c23d3d30101
SHA1 c04411817d0a0e9fe540bbc6931eabdc66d659bc
SHA512 cdcdf775ef608123cf338500135f75349f1b9c7b18cae7339f97cf4e51398579a4d44f10caa352a39258f9271e2ae1ab757b08e4051d876fbf26bf5b4d24a3cb
SSDEEP 49152:PabH/eYfk5fuI1hpsNoJpF1A6GU44CwH7R4xu:kCDmifP5R7
TLSH
T178C56B23B24441E9F459DD7AC75AB322F970BC460B61A6CF864877191E7BAF06F3A340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.7MB
SHA256 efab9623947291a2edc9142cff75accc758222bbe6b30c37045701f6d6422b6c
MD5 a7b57d04af634ac2aef5a1e518996629
SHA1 7f407bb05d4807d035b41859f76e7dd1406787ac
SHA512 78d790f9ed457f33eacbee917ae69003ce53475aeebf8fa832538572075910a632f2fac554bfd35d5e078bb7bf70dc7a8eba9bdf6798ff0313b547cff1484e94
SSDEEP 49152:PabH/eYfk5fulSuZQIY0Be2K8RVtOnks6NMHq6:kCA5dKCi616
TLSH
T110D57C13B29541E9F4AADE7AC76AB322F971BC460B70A5CF824432191E77BF05B39311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 3.9MB
SHA256 97ddcb6f984c813d0e6292571c1eb34ef258ca6a019ccfbcc984be1506bdad32
MD5 5dab0683bb1c22235b35be115330689b
SHA1 9de1f8a38606fddf6a0954619d8a866480dfb4dc
SHA512 1423874421cb98438cb606b45f84484c7599cc454f82207d0be8002f4f2cdd8d8d4bfddd6a0aebc973792e7b2c0163a662175533003a17b10508a65c35980b66
SSDEEP 49152:PabH/eYfk5fuayLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6YG:kCim7vj1BDlZG
TLSH
T1A6167B13F29541D9F019D97A834AA332F921BC490B31A6DF4684BB162E77BF06B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.2MB
SHA256 923846b8b4bb8d58bcdd0d82a11612c56f679de0fbd303c33acca479c9511d7d
MD5 aed35a15a0dc96ba97fe0452a818eea7
SHA1 94b6b3e334d964ef2b42d7879a5eede1826e8e1d
SHA512 5ce230d199f3603bd1fdf12919b02cc1797830c4c685f3feaf1d852aa73eeaf58da040d3a6d1e9a3f441dc97becfbf9a210b719bbab30b42961f8e8e59e89600
SSDEEP 49152:PabH/eYfk5fujhtSn8EApI0fig1giDn0AP5w2:kCdX2iwphX
TLSH
T1AEB57B23B24441E9F41ADDBAC75AB332F8617C460B61A5CF864877191E7BBF06B3A341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 844KB
SHA256 97da407f43b9430e270e6b07bcc758659d7aa27129c90c5fab346aa905644d0b
MD5 d299db613ebca0d59fb332d1dfa1b62b
SHA1 3e07d116c551ce32303e571e951e324e415e3f77
SHA512 9bb161d1a91aa2a086f1b030a1dd2152a7af29ca6b12d849059e0052429aee9be6f1fc23c5f664b457179a149726641b7fcbcae77d8577745f9dab35a7e90c95
SSDEEP 12288:P4Ryed8I7r/7mVACFYgGt8NO+1cQiHmNJLB9unmk7:P4R5CIH/7uYf8NO+9iGnB9umk7
TLSH
T18305196261015A6AFC09DE7BC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 844KB
SHA256 032baaf08daced33bfe3c555f47d966dd0f5dcccc91441876c26c09fbb1eebe4
MD5 9e20e12316b44d87763beffa9cb6a985
SHA1 b33bba744e2e40ad6551231a0086bd270b34bcf1
SHA512 c3ca46fb672fa47287608697a91bdee34fd8a6678457fbadb41387f30e2326471cc86e49417c7267c7b4dc969191309c7b1eb3c0d6921e4522c9c636aed108ab
SSDEEP 12288:P4Ryed8I7r/7mVACFYgGt8NO+1cQiHmNJLB9unmax:P4R5CIH/7uYf8NO+9iGnB9umax
TLSH
T1FD05196261015A6AFC09DE7BC35BB325B8207C9A0BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 844KB
SHA256 f404c6b06f77c4d3cf73845ff297ef9829aaa9e7541266629e2021c3e391ee14
MD5 cf5914e716bd10dbb33dcf472a11505a
SHA1 aa9d43084cc8794e856c0890df96368309a6253a
SHA512 568bc1b9928533f7099ccdb5e0d14a877885b51ec7774b2a3e2f77f148d922294f6952071f88cd2bcfb03e42a0af55b444cecd2ca3af05ad157b8ad65b0e5702
SSDEEP 12288:P4Ryed8I7r/7mVACFYgGt8NO+1cQiHmNJLB9unmAs:P4R5CIH/7uYf8NO+9iGnB9umAs
TLSH
T19D05196261015A6AFC09DE7BC35BB325B8207C9A0BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 864KB
SHA256 ebf4970452e4106a07a8c942be34e45a5658c2c68d1d2b6097cf37041f647869
MD5 264b3f6d2641c11499c75dcefc1fb8e4
SHA1 9c33483b6a84428614417e71cca53a6220ac18d8
SHA512 cf4c9d4d1af1bbe7434380c3e5b92297a5d609b951b9b5c985e6aca55925ce9ee74b80e5531e8d2777f1050d42bb4c9a343e07676826ec93290f6254aba70fee
SSDEEP 12288:P4Ryed8I7r/7mFACFYgGt8NO+1cQiHmNJLB9unmFVc:P4R5CIH/7+Yf8NO+9iGnB9umc
TLSH
T18F15186261015A6AF809DEBBC35BB325B8307C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 844KB
SHA256 720887035591789c82e28b06bb6a9ba1cdb1099a7fb6ad010d07fd94dd733bad
MD5 5799f3f672dfd7e882fcb01e9fc74cac
SHA1 fec1f02d5f16db662885393d2581f02bd9ef7a8b
SHA512 3123cd8bf029bde494bcab4f05b5b9aabef868024b48abb07d3976009f53b03eddf9b9e26d1cba626d90d7747b858937a170b2d3633a1625828134377ddc84bc
SSDEEP 12288:P4Ryed8I7r/7mVACFYgGt8NO+1cQiHmNJLB9unm3Z:P4R5CIH/7uYf8NO+9iGnB9um3Z
TLSH
T16705196261015A6AFC09DE7BC35BB325B8207C9A0BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 844KB
SHA256 de892e5e14ef399939652a87b13bb0e9cedc80f1914a7f06dbfc4bf4926f62d5
MD5 ead8e9911e269d62ccc414c6bf8d7521
SHA1 256803ce351ea7ff739f5bc8d5fb10b765afae35
SHA512 7bc6cce19901132fd5ec1647d7b31c56641821b120207010a63b9997909cc30278ff739d9633d2deda36321816a79a51f43a85d7dc6ea6a9caee954956931618
SSDEEP 12288:P4Ryed8I7r/7mVACFYgGt8NO+1cQiHmNJLB9unmk1:P4R5CIH/7uYf8NO+9iGnB9umk1
TLSH
T19205196261015A6AFC09DE7BC35BB325B8207C9A0BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 964KB
SHA256 a9b2a736982b64475e196e1c4fe302e2e18080f0db51b060b29aeef22a20b330
MD5 3400d6f54e22aa1a67cfef950c004a6f
SHA1 f254e0df57b6a43ccbe377456981410f07af28b9
SHA512 e59a464b1599fc83f6f24f612cbf7d1c644ce4ab71619dd887769b81b35bd73127041a8c6839ea2c931193668bb4f01747ad1c2d63df4e1b7e689ffd8974f253
SSDEEP 12288:P4Ryed8I7r/7mxACFYgGt8NO+1cQiHmNJLB9unmnXsf3z:P4R5CIH/7CYf8NO+9iGnB9umOD
TLSH
T11925C362E100566AF80D9E77C35AB325B8237C9906E1948FD2C9F63C1B762F05AF5387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 877KB
SHA256 39e7a9c81b7642fd5cfb2687296cf45d0f69f92923f48a73a6e6342502629d99
MD5 3936fd4f60fc5e2d2026c13509176587
SHA1 8e1419da7a3cf247c11166e9f79f521782796568
SHA512 2a3db501c9af2afff18dcd9ec928147bb40f3e8030f72a7565b425a0ca4125512173fb71777b5b0d3b1dc588a6546e167b1ba18402712bb0a3d53de64369cf02
SSDEEP 12288:P4Ryed8I7r/7mVACFYgGt8NO+1cQiHmNJLB9unm0r:P4R5CIH/7uYf8NO+9iGnB9umG
TLSH
T18B15196261015A6AF809DEBBC35BB325B8307C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 885KB
SHA256 4f623ebd5a886d13e36c37184037100d1a4bb7ba18e6be5bd87567dc02caa24b
MD5 52d197e438658890ee2326daf6eda5e8
SHA1 70443a5d40cfd1b097d3a14f478507f221ff2ab7
SHA512 6d142da2cfff66724fbde80e32a45a13e7225352343cb1d93a324c874cdca0c494da79a127975c535564a1f1ea9eea5696a53714cffc5340c65c16f2b4f41f58
SSDEEP 12288:P4Ryed8I7r/7mVACFYgGt8NO+1cQiHmNJLB9unmeqnkraG:P4R5CIH/7uYf8NO+9iGnB9umej
TLSH
T10F1519626101566AF809DEBBC35BB325B8307C990BA194CFD34D77281D762F06FBA385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 881KB
SHA256 d334e49ffe7df4536599796c04722983e7cfbc3da391854aa15ee70fe42e8cc8
MD5 9785d92dccf277cc0ae907b7bb6e5825
SHA1 40f4d7d761d672eb37a6ab3a30e3c1b09cf350a8
SHA512 fb603779884ade25b5f9fb6e32d770a918b659b8bed33a168f4bdd230938e698f1bca5931c2f64fbb820b6866fa2b024aeef27b5044cd7e3e8f3ccef8166b48e
SSDEEP 12288:P4Ryed8I7r/7m5ACFYgGt8NO+1cQiHmNJLB9unmMpIyvJd:P4R5CIH/76Yf8NO+9iGnB9umMjv
TLSH
T11D15196261015A6AF809DEBBC35BB325B8307C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 820KB
SHA256 42dfb26ab0f9f454eace644eff3d0d25e1768bbbe5638f12f495171f190bc01b
MD5 928fd3b71b4b93134152eaa8bc93d107
SHA1 0887f39b8478e0a12315ab0c0f7ab078a0ae372b
SHA512 64bc39acf280b54fca42e5b2beb082426a1031cc007dab7ee20b69ca423eeaef1442ec9c90283393bb44d6ef68b1a8631974d06359e06a469f2ab37be596cec8
SSDEEP 12288:P4Ryed8I7r/7mJACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/7qYf8NO+9iGnB9umM
TLSH
T19405086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 820KB
SHA256 8549a5bba863be817903e4efeeb88801cc69daff7f5e1c29c0f27c3f78beea79
MD5 fdf01f1513f761a8bec13cb71e0c727c
SHA1 8a962498c85facd54ae69838811d38ca4c8427fb
SHA512 d6c314b26fc98e1563c6e2106710ba1a0089fd007f80e4c7a85850adf29fdea3a9cfedd452a2435972e9942cad58139285a5f117cc53e405ff4c5cafae7d5b32
SSDEEP 12288:P4Ryed8I7r/7mFACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/7+Yf8NO+9iGnB9umM
TLSH
T11005086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 820KB
SHA256 18c10f14351b0cf8fc425767f9d0d9b636593740ab61d4a033beb709d6720b9e
MD5 e663ccdab231258b0ba68fd5aacc1836
SHA1 8ddb90295852c8729a47c20bb5e4f99cecff5679
SHA512 9e79e36e7a02fb3e68229cd34a5942d40adec91b897a78144b897ee750c3d8b2e19bc6c3faa0b839acf6566f959d8528373d4cdbdcb0794cfd7ccc3d6d3a4aa9
SSDEEP 12288:P4Ryed8I7r/7m1ACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/7uYf8NO+9iGnB9umM
TLSH
T18B05086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 820KB
SHA256 36ddc43483c482f9a799dd66d6c757d168e079055d2b539bdafe051647f12d94
MD5 ecc441c94f434b407bd3b2461252d223
SHA1 4a389d4bd9ef4b16e3a20d271aac39700aa194c0
SHA512 11de222ec74bc114c53e5a3316bb1261919f7bd029aa12f98d229d382b4d7638b6ae80da19bb1ecab08734d3d73d6e548e3c24673f2daab69cad43aae451e338
SSDEEP 12288:P4Ryed8I7r/7mQACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/7XYf8NO+9iGnB9umM
TLSH
T1AE05086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 820KB
SHA256 33165f7a12de1c741c080d672962e39ce55be385493385360041f9d04b05e979
MD5 4d13e55d1513901f8262cf478f85a43b
SHA1 aaeea633c6368a4b44567da4a561a0fc1e0dd70b
SHA512 957603766f7d4c80d473277cddc838f083809f40752735c92985db5f31b24e6798aca257502048d87f70369cbd6679b12b3fcee8309015515f2e0b2fdd281bdb
SSDEEP 12288:P4Ryed8I7r/7mNACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/7WYf8NO+9iGnB9umM
TLSH
T11205086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 820KB
SHA256 d939a96a9afafdbd216582c723cf2daf87bd144e35435e5b1dc24eb0bf329189
MD5 dbbb257d1d99a4850720548c1b4be2be
SHA1 a38ed86d77f4a1714795f279f895483f74b58fc1
SHA512 5c93639b76c04c8649a160215225bcd9df27d569bd27f00a63ef74ef1ec1cced929b10839d196d9bfbc61b7862923e362429eb235136c1bc0595168bd847cffe
SSDEEP 12288:P4Ryed8I7r/7mxACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/7CYf8NO+9iGnB9umM
TLSH
T1FC05086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 820KB
SHA256 b9dedf9b2631068826b582ad71e61f091fc1a6d6fcfbf85b168fbb61dfffbeff
MD5 0d81dc8b49e51ce83f731055f9282e48
SHA1 413e1b8e032e2e7117e2a724adc88e32c87809ac
SHA512 010a6b346f0d0e3e81aa83cecd00f4798edae9145fdf12065c58edd887c163fa4f96a6f6d1e24651efa9e9f4a54d4fb6c3ce66a2af58e28e8ffd3aff0594c368
SSDEEP 12288:P4Ryed8I7r/7mVACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/7uYf8NO+9iGnB9umM
TLSH
T1F805086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 820KB
SHA256 64dacf705426885bc657c98bbc3bb7df3ffcd2c3a2353cb092cc459a83a4cab0
MD5 f1cbda47d37fce457535589ad1de0f0b
SHA1 4995c752f177c4472c51b67822d60e60b767e176
SHA512 29cbacedc6b93049446de04b793785dcee8982b8a8445ed803c6124df4bad6c1d53822700781793d15c91a63a9eed888c83b4f24d78154f99462a61b118e65e4
SSDEEP 12288:P4Ryed8I7r/7m5ACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/76Yf8NO+9iGnB9umM
TLSH
T10205086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 820KB
SHA256 63521f6b1327e020c36626df48243db26a18fac01abc6c03a095d90e591f28c8
MD5 450d8aa9368ea754da9e96743bc26a09
SHA1 8741fc22fc63c9a615bb106a2fa3ef5358e07dda
SHA512 c71e29d30b8b6c52bf27a98082becac50f612bd8e43fcd560c8e481689acd7fe30131ace6d10a85322669a5d866302278ca539c7413bcc4ec988b43eb65dc8da
SSDEEP 12288:P4Ryed8I7r/7m5ACFYgGt8NO+1cQiHmNJLB9unmM:P4R5CIH/76Yf8NO+9iGnB9umM
TLSH
T14F05086261015A6AFC09DEBBC35BB325B8207C990BA194CFD34D77281D762F06FB6385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads