828e9b63ab79913d54a52c4516fbb46ec1b14353448996ead55b47d6ba98ba52

Analysis

max time kernel
112s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/04/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
Size 2.8MB
Sample260420-mphanafy9m
SHA256 828e9b63ab79913d54a52c4516fbb46ec1b14353448996ead55b47d6ba98ba52
MD5 a69b3f16f4fa3acf0d1f1b86303ab531
SHA1 c9d9616317cc6c51d6fc95cbbcbd1e1a6cde84db
SHA512 54cf18acff876bfe646750fe76d632eb26179747cb3f601b0044f7893f1fb2cedd2ba2f9ac61762b144b2de6fcc8abc5c4f718cd69a99518a8f22448e69f7d5b
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQe5b9guZrpCyfUwZd7wj:BCL2c8MNFLA0vb7w56rgu2M/n7wj
TLSH
T1DBD53886B29449F5D06B41748961866DD673BC11CE138FCB22907EEEBFF26C15E29233
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral2/memory/3816-0-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001a00000002b346-6.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3904-7-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000002a190-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000028dc8-1247.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3816-1332-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3904-1333-0x0000000000400000-0x000000000040D000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001e00000001a5f7-1484.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000002a724-1870.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0002000000025ae1-2040.dat	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 1 IoCs

pid	Process
3904	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe$	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_180578\javaws.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaw.exe$	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	patcher.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3816	2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
3904	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_a69b3f16f4fa3acf0d1f1b86303ab531_cobalt-strike_elex_hijackloader_icedid_rhadamanthys_smoke-loader_vidar.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3816

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 2.8MB
SHA256 828e9b63ab79913d54a52c4516fbb46ec1b14353448996ead55b47d6ba98ba52
MD5 a69b3f16f4fa3acf0d1f1b86303ab531
SHA1 c9d9616317cc6c51d6fc95cbbcbd1e1a6cde84db
SHA512 54cf18acff876bfe646750fe76d632eb26179747cb3f601b0044f7893f1fb2cedd2ba2f9ac61762b144b2de6fcc8abc5c4f718cd69a99518a8f22448e69f7d5b
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQe5b9guZrpCyfUwZd7wj:BCL2c8MNFLA0vb7w56rgu2M/n7wj
TLSH
T1DBD53886B29449F5D06B41748961866DD673BC11CE138FCB22907EEEBFF26C15E29233
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

disabledupdater.exe$

Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
Size 3.2MB
SHA256 66761fbb82e3beca693b2ecb3c13422c78d525b424efec229aee0def71746fde
MD5 2f1b6bdd275b7c68715c4fe01d64e65f
SHA1 3732028f31656564cbe3ff6ce47e5381266f3c50
SHA512 41bd31e4a6b06b7d7be2ef2360f46d17aafa0aff6cc4781b1541c37a13e772a9bc58dea2fffd5b08cd5c0f8b50645c3b755b77a18b0c9dec40e1f605af2af8e9
SSDEEP 49152:BCL2c8MNFLA0vb7w56rgu2M/n7wjTd9CHKyao:YqcxAO1rAfCqo
TLSH
T1C7F54A81B29449F5E06B813489618629D673BC558F128FCF12907EEEBFF26C15E39732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

identity_helper.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
Size 2.9MB
SHA256 9f3150681728fd195d30daf306f1f1c1e862217640ed3ffff0fb700aff56c68e
MD5 f3ec0e7c87698d77599fdee266ab1b8f
SHA1 e673dd2ea3566ea83affd9ad46b597be7dfa13d9
SHA512 ce082e7acf91e871f08b234556018009c20ebd3a141bc9f44c87304212acc5a731fae740220d370fb84102d810cb9d3e91135f2c300bda71367a8211af1b2782
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQe5b9guZrpCyfUwZd7waGen:BCL2c8MNFLA0vb7w56rgu2M/n7w1I
TLSH
T1C0E53886A29449F5D06B81748921866DD773BC11CF139FCB12907EEEBFF26C15E29232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.3MB
SHA256 bef64822c550571ae3b01b3a94201d8deedde442dde520b053976a1d5c3a8f8b
MD5 15b1804a1939f49880bdd0b57017cb50
SHA1 1a26fd7a28f1375715d8fbca81b66e0db020aea9
SHA512 1c7424c0aa0042d44f989c42356fffacf97f4c2d65c77a5461ef64f23f89e1ae2133fdf44059db33f26c2a0ff5a6bf2ddc88ccbee6990930ffd680f6a80bd9e1
SSDEEP 49152:BCL2c8MNFLA0vb7w56rgu2M/n7wfPji0Aj:YqcxAO1rAPjo
TLSH
T193F55B45B2A44AF1D06B81748591965DDA727C418F228FCB1290BEEE7FF36D14E3A332
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 2.8MB
SHA256 26489121021b5c812ddef8f11b8481d19fcf23b4562f80490b2affe16f68cf23
MD5 effb9b0ac968b0dc5d7f19a5f4340d13
SHA1 04aa5330bfc235f900c711c4831a1d20b6cd548e
SHA512 b031fec35fa6c0f1d7ba92c874e6b7ccb9c5347ccc21c60e3486e4a44f21bed65e8a0b8c1b72a502dcf19e75c5896c22f91eff8854ad98104f23b5d0950cc09f
SSDEEP 24576:BCbvtJqc8iHNFpuWvWL0vbxSIWD5TvinrmpErQe5b9guZrpCyfUwZd7w7F:BCL2c8MNFLA0vb7w56rgu2M/n7wh
TLSH
T1E4D54981A2944AF5D56B41348921866DD673BC51CE138FCB22907FEFBFF26C15E29232
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdge.exe$

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
Size 3.0MB
SHA256 4dcb2e7e90acd910ad8dd093c5d12192fd88bca44b32b7d512a87688ca3ba8c3
MD5 1944e1625df9950f1abc43403918077b
SHA1 49d6b77668934077fac617daba7123bd4e0046c2
SHA512 fe82a166d1b50f5fd2ef638705638850ea427ba4ef03d06a4df7ba0f2b01799cfa8229eb619ffbc70abc938d2cce171d4adb934ae8c03b47dacbc9308ebfac29
SSDEEP 49152:BCL2c8MNFLA0vb7w56rgu2M/n7w7i2WH3:YqcxAO1rAjuX
TLSH
T11FE54891B29449F5D06B41348961866D9672BC118F138FCB22907EEEBFF26D15E3A333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3816-0-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3816-1332-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3904-7-0x0000000000400000-0x000000000040D000-memory.dmp

Download

memory/3904-1333-0x0000000000400000-0x000000000040D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads