3a4f9dba0368bf83fc51f3526599d6ea7b041cb67b7a4ebf477a8d50fbad3059

Analysis

max time kernel
108s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/05/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.5MB
Sample260525-ndhbyset9p
SHA256 3a4f9dba0368bf83fc51f3526599d6ea7b041cb67b7a4ebf477a8d50fbad3059
MD5 fa6546dd3a877888c4b6a012e3bd10d7
SHA1 1ab60628198a384ba8e67b505926c7db092feece
SHA512 726798a5ae346a60365ba31ef82be13790e2d1e7374fd478de67c376b8a193edd7a66e88479e796134ff84d8cf17c3ccf37d78127a85d2cb72d1e8e82576ee61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixbvQ0vYTqMi8CtBd2QHCHmTBW5M:A3k03kHRJWqJtb2I
TLSH
T118657C26F6A442B5D067C179C5D29A6AFE3238425B30C6CF1349D3282F63BD1DA3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral1/memory/4836-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0007000000024699-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/6020-7-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000022b3d-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4836-70-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/6020-107-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000a000000020242-1373.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00070000000246be-1595.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000600000001ebef-1943.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000f000000000723-2062.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000024699-5.dat	aspack_v212_v242
behavioral1/files/0x0003000000022b3d-12.dat	aspack_v212_v242
behavioral1/files/0x000a000000020242-1373.dat	aspack_v212_v242
behavioral1/files/0x00070000000246be-1595.dat	aspack_v212_v242
behavioral1/files/0x000600000001ebef-1943.dat	aspack_v212_v242
behavioral1/files/0x000f000000000723-2062.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
6020	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe$	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\pingsender.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$	patcher.exe
File created	C:\Program Files\Java\jre-1.8\bin\ktab.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoev.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ielowutil.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jar.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\java.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Media Player\wmprph.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe$	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4836	2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
6020	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-25_fa6546dd3a877888c4b6a012e3bd10d7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4836

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.5MB
SHA256 3a4f9dba0368bf83fc51f3526599d6ea7b041cb67b7a4ebf477a8d50fbad3059
MD5 fa6546dd3a877888c4b6a012e3bd10d7
SHA1 1ab60628198a384ba8e67b505926c7db092feece
SHA512 726798a5ae346a60365ba31ef82be13790e2d1e7374fd478de67c376b8a193edd7a66e88479e796134ff84d8cf17c3ccf37d78127a85d2cb72d1e8e82576ee61
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixbvQ0vYTqMi8CtBd2QHCHmTBW5M:A3k03kHRJWqJtb2I
TLSH
T118657C26F6A442B5D067C179C5D29A6AFE3238425B30C6CF1349D3282F63BD1DA3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RdrServicesUpdater.exe$

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
Size 1.8MB
SHA256 337a4bac8ce985d17caeaaafaa6d1c3c60549ae75e0ede9ae6bfb2c542391ad2
MD5 183885cbdebf17dcb7d5765a5d9f01df
SHA1 ed6d291d94765f0030f91734f1d4def30fe53274
SHA512 16a8221c9ec080578c63c236146aa0631abe77440f2f1c1d6bb6e1dbcdbcd49ae8bc6e3e1afc9b10884df316fcbb16c82a83ac670e874a24904627425e743de9
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixbvQ0vYTqMi8CtBd2QHCHmTBW5MF3UNw:A3k03kHRJWqJtb2ITUN+Eir
TLSH
T159855A26FAA846A1D027C079C9D29756FA7278521B30CBCB2354832D2F377D59E3A371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe
Size 1.6MB
SHA256 7586ad65e4881b5327debab9aa53d39d5deb0fde3bded8d031835c5282efe3f5
MD5 736ba3cb5873a186404c9717bc8b8663
SHA1 e0374a1b51bb57dda6722566239fad29a55cbeca
SHA512 6333865794522ceee78fc54623241f75fb4b774dcb99bcf90f20bf596654ec8c3c7c25163610696b50d34b5b45f65c74c04197fc09a3bba68bd265e043925c36
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixbvQ0vYTqMi8CtBd2QHCHmTBW5MqGen:A3k03kHRJWqJtb2I/I
TLSH
T19C757C17F6A842B5E067C179C5D29A56FB3238425B308ACF1349C3292F63BD19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_click_helper.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
Size 1.6MB
SHA256 8d08e87df722515ac49539a443c45f4106ae110d92a6d6322aa21446d0bba421
MD5 7f450838704424f2320e91fdb07fb0b8
SHA1 b9a6d7b5589f50ee65a8f9e042ac0e32ba003f52
SHA512 e0f3932163e268e896eff4c578d3c8d0aebba2f69ef953ec9f9fcc0a3e9aecd89d912f83bf9cd4ded794131e0344df798e7065e4b93f8824138129b61286fcc8
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixbvQ0vYTqMi8CtBd2QHCHmTBW5MhTjE:A3k03kHRJWqJtb2Izw
TLSH
T153756C17F6A842B5E067C178C5D29A56FB3238425B309ACF1349C3292F63BD19E3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.0MB
SHA256 f7053f344d539cc3081a1c311a7fc26725cfdcfff5ed973017736d83018398c1
MD5 9f79fe4cc3907f5c663b06356c92b46f
SHA1 620f870bf0da48ed47de66c3bb9784d0882a2ea8
SHA512 90786a14f1e8d4f8728b74dee4439696b8b7df7dd515f2de0628776bf77a496acb93488b5daee622c41b764af44f1005962351228ec70c359666d1a057ccc346
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixbvQ0vYTqMi8CtBd2QHCHmTBW5MP0Lel:A3k03kHRJWqJtb2IRPji0Aj
TLSH
T167A55B26F6A44375D073C0B9C5D2A69AFE3234425B308ACB1349C7282F67BD5DA3A771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdge.exe$

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
Size 1.7MB
SHA256 78154d0f8cdb03cd939408fc91b49507110b5e686b6bac5ec94eee4ed4dec162
MD5 4afc5b4b1cc49b74d7bdaceaf13e1bcc
SHA1 550d8f8afbb1620fee0c2db040eea29e495a32e9
SHA512 d29f1df160c6b43c65c5140b9241bec22a6fc37026939c39ba38c1e95d69a356d6765f74471bf56e26268f757e5c76d3f6936ddc29f431acdbb926de2333836e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqixbvQ0vYTqMi8CtBd2QHCHmTBW5MLV+Pz:A3k03kHRJWqJtb2Ihi2WH3
TLSH
T111858D22F6A84275D077C175C9E6966AFA3138425B30C6CF1349D32D2F63BD19A3A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4836-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4836-70-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6020-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/6020-107-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads