f887ced09015f09b113b7d3701668e1d802ee716b5612b02b0b2a51534d5c37c

Analysis

max time kernel
130s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/05/2026, 12:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 3.2MB
Sample260530-p2bpracv2w
SHA256 f887ced09015f09b113b7d3701668e1d802ee716b5612b02b0b2a51534d5c37c
MD5 6a15412cdcb84e94b9828768ced56e5a
SHA1 b51265a0d791a724218911773d10d96a807adfa8
SHA512 8c62ff8c7966b7c6f318657d6dcd82828273a4d46da51edaf714747622713630ca0a1f37c3deff8e711f60ba8d6c293379d09e2605539be835991d35b5108db0
SSDEEP 49152:A3k03kHRJARJmqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb:A3k03kHR+RwFfkZcNfkZc
TLSH
T10BF51A16F6788362D0B3C0B9C5D6AA9AFA32384557308ACB0345E72C2E377D5DA36735
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Custom signature

Detects executables packed with ASPack 10 IoCs

resource	yara_rule
behavioral1/memory/2096-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0010000000024419-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4644-7-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000022b67-12.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/2096-40-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/memory/4644-59-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00020000000235d0-132.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x0003000000021606-1285.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x00030000000230a5-1759.dat	INDICATOR_EXE_Packed_ASPack
behavioral1/files/0x000200000001e47f-2071.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0010000000024419-5.dat	aspack_v212_v242
behavioral1/files/0x0003000000022b67-12.dat	aspack_v212_v242
behavioral1/files/0x00020000000235d0-132.dat	aspack_v212_v242
behavioral1/files/0x0003000000021606-1285.dat	aspack_v212_v242
behavioral1/files/0x00030000000230a5-1759.dat	aspack_v212_v242
behavioral1/files/0x000200000001e47f-2071.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
4644	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoev.exe$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaws.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$	patcher.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2096	2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
4644	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-30_6a15412cdcb84e94b9828768ced56e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2096

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 3.2MB
SHA256 f887ced09015f09b113b7d3701668e1d802ee716b5612b02b0b2a51534d5c37c
MD5 6a15412cdcb84e94b9828768ced56e5a
SHA1 b51265a0d791a724218911773d10d96a807adfa8
SHA512 8c62ff8c7966b7c6f318657d6dcd82828273a4d46da51edaf714747622713630ca0a1f37c3deff8e711f60ba8d6c293379d09e2605539be835991d35b5108db0
SSDEEP 49152:A3k03kHRJARJmqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mb:A3k03kHR+RwFfkZcNfkZc
TLSH
T10BF51A16F6788362D0B3C0B9C5D6AA9AFA32384557308ACB0345E72C2E377D5DA36735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedge_pwa_launcher.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
Size 3.3MB
SHA256 ee1a743bdfd3ddf82201faa3fb3bbb66a9b4cc038da2c1c1a073d0392ea370da
MD5 841e5b9348b70ac5711622e83956889c
SHA1 6a950065c305cf841ef131502e0d428987f7b1f8
SHA512 10afafe15477cff3f3c30afc0a905cb7fd817526cb774759de34f849af47f5dcd16860009401cf1fea00671f480f318633041d110b9d00b298c37f4237c5598c
SSDEEP 49152:A3k03kHRJARJmqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mbjw:A3k03kHR+RwFfkZcNfkZcs
TLSH
T1EEF51A16F6B88362D0B3C0B9C5D6AA5AFA32384557308ACB0345E72C2E377D5DA36735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 3.8MB
SHA256 f31c82c4358f36cf95e159a18ac6944da6315b05d7275b324fc10cc18ffc6cf8
MD5 a3c7a825a751dc20d034f54fafa44629
SHA1 123f824d6f0d61dc7dd5f0a931e34d6f6769c6ff
SHA512 0b417efa0a18f2104774cbda1fc1e3fb6a240195adc3c70f04e7d97da90d8a245427e28ea727cb16afec1618779e671a6f0216efc09b13f337cbe630fb5b6c0e
SSDEEP 49152:A3k03kHRJARJmqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbBPji0Aj:A3k03kHR+RwFfkZcNfkZcRjo
TLSH
T1E3061A16F6788322D0B3C0B9C5D6AA9AFA3238455B308ACB0345E76C2E377D5D636735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe$

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
Size 3.4MB
SHA256 9f5f524baf4d16046cd86f55ef39c33bafb0c4ae8d5379db9888fe9db2db2432
MD5 ecae8229020c40731ce4404893f1ad05
SHA1 228fe2ff2a43946ea01bc6b0e2165230bc15933e
SHA512 eaabbcf14a535c66ee9899a7cb7cc542634a83feafe91f3d58dacbe709fe0cec87eafcc75baf9ecb8fea427a717da0256c4bee4b2996a189e5231c8e345abd61
SSDEEP 49152:A3k03kHRJARJmqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mbq:A3k03kHR+RwFfkZcNfkZcq
TLSH
T1F5F52A16F6788322D0B7C079C6D6AA59FA32384557708ACB0285E33C2F377D59A36736
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 3.3MB
SHA256 c8f39e5831c412403cc9b4997fbb64f1bbf1fcb33423bbbedc0bf2f134f6b75f
MD5 38f46956a799cf6337c93b3f5f8ad35d
SHA1 d6d4cbb614be1a857a31651f04d9909487044f3f
SHA512 4fea1f08304d109fd2b29830886e5da694bc32a08fbb5a9e0032fe4b20d1e241517530dca8825cfd2b5b1827fdf5d098cbda4c524c1606005d016dc4e88c5a98
SSDEEP 49152:A3k03kHRJARJmqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mbj:A3k03kHR+RwFfkZcNfkZcj
TLSH
T105F51A16F6B88322D0B3C0B9C9D6AA59FA323C455B308ADB0245F72C2E377D59636735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftEdge.exe$

Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
Size 3.5MB
SHA256 c5f5c96bfd0387fae3675f41a8e021ade7734e73ac604626656924c6dbf0b241
MD5 5699cec3ab97f99522fa9726fa2646b8
SHA1 ed640e62b46ec56d86cbaaca4e849c15df22491c
SHA512 b4c9e9439b2c1abf22b7b7dbbdc5b0a5426c4e146b32cc42cf0b002293ed8fd15f85ddca99b4ebf1bd275fa0e73de85a702cfcd949d7ad08ee324ffd79e5c3b0
SSDEEP 49152:A3k03kHRJARJmqJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9Mbxi2WH3:A3k03kHR+RwFfkZcNfkZcxuX
TLSH
T1DCF51A16F6B88372D0B3C0B9C5D6AA59FA3238455B308ACB0345E72C2E377D59A36735
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2096-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2096-40-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4644-7-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/4644-59-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads