38697ac214ef78f691dfa3b72fd57c3195201929484ee167cb38c92bb30e6ce1

Analysis

max time kernel
112s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
Size 2.8MB
Sample260416-s9fkfset3k
SHA256 38697ac214ef78f691dfa3b72fd57c3195201929484ee167cb38c92bb30e6ce1
MD5 e59691d704f9042f512b51b5dfe49291
SHA1 87a10b3a4b2cf36a8d691131d131e0b2aaf6d002
SHA512 e427ce8142033b168bb54eadac73bee8258bf258b84fef3110c936121ecb9d36b2ab0318008857d7cc5e7f183c1226de5600de480220e3d8a8edeca8612b52ed
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I067W:9QjAOmiYOXwnS4rVSM+M6RkMkIM7R
TLSH
T181D58B12FB8194B2C5A601704A26962C5336BD61CB134EDB62987FCEFFF12C16D35A36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3004	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javah.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe$	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Media Player\wmlaunch.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jar.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Windows Media Player\wmpconfig.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4340	2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
3004	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_e59691d704f9042f512b51b5dfe49291_elex_glassworm_rhadamanthys_smoke-loader.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4340

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.8MB
SHA256 38697ac214ef78f691dfa3b72fd57c3195201929484ee167cb38c92bb30e6ce1
MD5 e59691d704f9042f512b51b5dfe49291
SHA1 87a10b3a4b2cf36a8d691131d131e0b2aaf6d002
SHA512 e427ce8142033b168bb54eadac73bee8258bf258b84fef3110c936121ecb9d36b2ab0318008857d7cc5e7f183c1226de5600de480220e3d8a8edeca8612b52ed
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I067W:9QjAOmiYOXwnS4rVSM+M6RkMkIM7R
TLSH
T181D58B12FB8194B2C5A601704A26962C5336BD61CB134EDB62987FCEFFF12C16D35A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.exe$

Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
Size 2.9MB
SHA256 9ab4877a3e5e0ff04026b497cf47f3e90b63ebc08a3d56478babbb109f69a04d
MD5 a00258e4bb0e317e7395639fd3b12b7e
SHA1 15fe12247e459fdff87f00f1a7108b619d19a277
SHA512 649d77cb5e333052b516f1999c64f63825723bc802bb975acef6137cf2f1fb9996202913d0c99b741a3c71740df12b3829c42772e0a5465033116be92653417e
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I0676W:9QjAOmiYOXwnS4rVSM+M6RkMkIM7lW
TLSH
T167D58C12FB8194B2C5A601704966962C5336BD60CB134EDB62987FCEFFF22C16D35A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
Size 2.9MB
SHA256 1928ab2e697cfcfb13415a3a0e615f5c603f65ac111d4d739633708fe28b50b6
MD5 7d3741d24947563e23b2412e04d3b2f4
SHA1 91711041c4eb51833d0b9087801c1eab86c33839
SHA512 9a665dd0525b0f89df5ea280073d1c56541375ddefadd56d653e9287431989dae721ef9a29a3ced4f3003e001d60094b15fd5f020401a7d1fbfa498e12b74861
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I067YI:9QjAOmiYOXwnS4rVSM+M6RkMkIM7bI
TLSH
T1BEE58C12FB8194B2C5A601704926962C5336BD61CB134EDB62987FCEFFF22C16D35A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdgeUpdateSetup.exe$

Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe$
Size 2.9MB
SHA256 f05b9e61e0cd8624d1a7c82f221a140896e42cfdba7a9fd98c74fec0031daf07
MD5 7c006ce6f9c7c30b624125f3e8147abc
SHA1 2522a640b3383cfa19b39c57fc6b166675181423
SHA512 d8da02ed8849d5b228e791788e99afab95e720a21a6f5b1afe0c6af3c571e9c99306c2679fa1ab26afc81f205d0e757b8e408bd20b47a2b6bff73f678a170c11
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I067AfFXu:9QjAOmiYOXwnS4rVSM+M6RkMkIM7bfFe
TLSH
T13DD58B12BA81D4B2C5A201704966962C5336FD61CB138EDB62987FCEFFF12C16D35A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_proxy.exe$

Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$
Size 2.9MB
SHA256 e3dcdd2cd012361a4e24b90a0e323d673a13f987d387ff44a49f8793ea4cb492
MD5 c980ec02ed053629f55f4ee065464235
SHA1 8844dbb599d1363bd2000e696ce8c1cc7ec82ec8
SHA512 a7617aa0b3af1ec3b8051deeaed0ca8a047dfe579c2f5936974b0e0b96e5c425b23907e6505408c129c7533c457e70ffe811f16cfc615be97ed621f77f323dfa
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I067Mw:9QjAOmiYOXwnS4rVSM+M6RkMkIM7A
TLSH
T161E58B12FB8194B2C5A601704926962C5336BD61CB134EDB62987FCEFFF22C16D35A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.3MB
SHA256 555cdb84ebf2a6af670c959332d30647b6c0cb9998b78b0b069a229359ff7a82
MD5 4ad57fe8acf4e209727615ab42ed4eb1
SHA1 1db7af9c5d15fdc177e48f985b4f6869c2bc893e
SHA512 1b129747c10cd3560fd2becd357b0d01b7303f71a03a9d259c5c91592c3fdb9ee98706533f19325c68dd5c8ecf759138564737ff76031575f64a0b81e6a9ae71
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I067WPji0Aj:9QjAOmiYOXwnS4rVSM+M6RkMkIM7Njo
TLSH
T135F58D12F790C1B1C062417089A6975DA732BD618B228ECB6294BFDDBFF22C15D36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 2.9MB
SHA256 f5915889ddd334755cb6a8c9dfd3441206aea274c8cfbf4797920c61bfa7e0dd
MD5 d6ac2244b4b64dcd235248c22bd3c425
SHA1 eb6f9f4d2622e38b6cf2ae69daed6bfab3cad66e
SHA512 7db5523c0fda3a94ae81973fe83cbbd8eefcc666cec16664b333529b75aa205d9d906a65eb3dd0b54e80ae80e8a37709f8fad6cdb9accbc7c57b271420ad8abd
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I067u:9QjAOmiYOXwnS4rVSM+M6RkMkIM73
TLSH
T167D58C12FA8194B2C59601704D26962C5336FE608B134EEB62987FDEFFF12C16D35A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python.exe$

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
Size 3.0MB
SHA256 c17a573fc9b4bb61f883d420fd054259fd68ec27c985370dcd033a8eba7f6a91
MD5 cead25cf1cc79e0978806337a5129eba
SHA1 df7a36bc7c6d9fcfe701f75819cadec39017919a
SHA512 a7352f99a3f2e5626952ee91fb895c93979fe2944c24ba50522cc4c71902ba5f09717fa165cfa680fe6891a6916c20636e750efbcc0a185a2e209f84441bfab9
SSDEEP 49152:92V2yLfUMA0vb6Uv32DkYOMwwnMb4PmyV70g7mM+M6RkMkIM7I067Ui2WH3:9QjAOmiYOXwnS4rVSM+M6RkMkIM7duX
TLSH
T1EFE59C12BB8194B2C5A601700966962C5336FD61CB234EDBA2987FCEFFF12C15D35A36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3004-1349-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3004-71-0x0000000000870000-0x000000000094F000-memory.dmp

Download

memory/3004-7-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4340-1347-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/4340-70-0x0000000000970000-0x0000000000A4F000-memory.dmp

Download

memory/4340-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads