Analysis
- max time kernel
96s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 17:56
Behavioral task
behavioral1
Sample
2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260805-wh5baada62
- SHA256 c20c452608a94ef28163664ee08e1bf1b37abbb075d1cc00089ced25c0b7babd
- MD5 96f9f030c13f118a183a3c76866e92ee
- SHA1 33ceef878d1439c6b5afd821104c5507209b2044
- SHA512 b9b5d085feeb757e0b2e0f219c8d5fafbde95dbfc9812ca04f492e38cd421704cfe26794c4b6e1b896057b3f39167cbb822d6476b83d47efeef973c001b4f848
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJliI:A3k03kHRJU3k03kHRJp
- TLSH T1E195AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/240-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5af-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/240-165-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4172-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b8a-702.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019caa-1283.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001e000000016f53-1533.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5bb-1611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5bd-1609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066bd-1830.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5af-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-293.dat aspack_v212_v242 behavioral2/files/0x0003000000019b8a-702.dat aspack_v212_v242 behavioral2/files/0x0004000000019caa-1283.dat aspack_v212_v242 behavioral2/files/0x001e000000016f53-1533.dat aspack_v212_v242 behavioral2/files/0x000d00000001c5bb-1611.dat aspack_v212_v242 behavioral2/files/0x000c00000001c5bd-1609.dat aspack_v212_v242 behavioral2/files/0x00020000000066bd-1830.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4172 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 240 2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4172 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_96f9f030c13f118a183a3c76866e92ee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:240
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4172
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 c20c452608a94ef28163664ee08e1bf1b37abbb075d1cc00089ced25c0b7babd
- MD5 96f9f030c13f118a183a3c76866e92ee
- SHA1 33ceef878d1439c6b5afd821104c5507209b2044
- SHA512 b9b5d085feeb757e0b2e0f219c8d5fafbde95dbfc9812ca04f492e38cd421704cfe26794c4b6e1b896057b3f39167cbb822d6476b83d47efeef973c001b4f848
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJliI:A3k03kHRJU3k03kHRJp
- TLSH T1E195AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.1MB
- SHA256 71cd9702d9822bf7c15a83c31c9a61bd4b0440ceb4dd99fc53bdb6d90258b8d0
- MD5 ab0680ab1b206cc1bea125af49da716b
- SHA1 fbc82071679695c51077a9b41bc079c9168dcb4c
- SHA512 616bde7d8d0c31db67b7a850b777337890327e942704ba56b8aac07aa08fa9dbb7528a6e39f76aa6a3839c9db4f6ec70c834b14591faffb987fa37a953d22f83
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJlis:A3k03kHRJU3k03kHRJ2T1Llje
- TLSH T173A5AE03E79400F8D50AC1749A968A22EB75BC561760D3DF2368D6152F73BD0AF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe
- Size 2.1MB
- SHA256 e19771128480448f5341ecf2256fe9705be19c313b96c94f7ab9e71f9fc58f36
- MD5 06dfd08d8f955692347db7b11f5e3a53
- SHA1 4b945ff1421725487758333353f8ccf75757252e
- SHA512 caab461ca3c5cf3f2abc6481ddb262045062a7e919b31dbe355ef5e74cd457e2120733f924b973334dcf021212edb91648ca331ae3e2b2afd14037e7ccac4517
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJliF:A3k03kHRJU3k03kHRJUewAav4GY6G+
- TLSH T1A0A5AE13EAE400F5D11AC1749AE59A23FA75BC52176097DF2358C6052F32BC0AF3E7A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
- Size 2.0MB
- SHA256 70357443388e69d0dd3c702b5f46ffd97cb2efdf3c8d921ba951798668d5f349
- MD5 ccdd81f33eec6f991f8f2c017d45772d
- SHA1 d2cee6e61131afeb10fef9da3719423666bc72ce
- SHA512 648215179707bfc384d2427b17d702e19d84c3f4aa7812a536c8fb1d87579a84c970e9a652aab15567dca77df0d1a692791c95287bff1de58835f998a205e30d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJlij:A3k03kHRJU3k03kHRJfw
- TLSH T15795AE03E79500E9E10AC1749AD69A23FB75BC52176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$
- Size 2.6MB
- SHA256 a93d248dc218d7897b3acec653b7a3ac7da1068f37b56191399075c75e024602
- MD5 d50616cca866c4069db4395bdf16c3aa
- SHA1 90a14a1744ecb199b38ab177d494a7976f78ad89
- SHA512 4b0cdedbcd0d1a692e87a43e45a5c651fca91a8359db1fce0ea326d0079aa22b9dd09f8c2904357c206178c0de9d80b16ad9a4057afba21b38c10ca9a068e39c
- SSDEEP 49152:A3k03kHRJU3k03kHRJFPMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMa:A3k03kHRS3k03kHRfMMHMMMvMMZMMMlA
- TLSH T1BBD5AF03F7D404E5E05A81709AA68A22EB75BC525B2093DF3358B71D2F727C0AF3A759
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 7eac5051a487e534c98d5e94ac663b4dbc41c4ce46a3c684b59f52c8d4f48700
- MD5 6c154b8ab2d0820951a48c144d64fe54
- SHA1 13388ea357c8dec1fa9737a632601e7b26d9d42a
- SHA512 59802a60597902ecc2181180de27034ef7091694649554a2f5016be3aa738172b378d77b885e01f3866612a34bb52247c5f14447e1a808531405b470a6d4355c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJlis:A3k03kHRJU3k03kHRJVPji0Aj
- TLSH T18CC58C17F7A401F5D026C1B8CAE69A66FA717842173096CF1358C7292F63BD0AB3E365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.9MB
- SHA256 88405ad1be8b953c7c678a59638a5f0df339abc10e25a222f54e5834c2c1dd62
- MD5 5e398fc348812a393b416990837ab008
- SHA1 5be280e8beb0ecf672453c811acb883091b8a34e
- SHA512 f3f20d1a1ae8571539cf61e76ee9086eb165d43b8bf9bb29066b1c50a2ccde4a2c66e7d387b0ac0b753bc8c8abb7de16c8730c2eceda4dd0838716e7283b79bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJli3:A3k03kHRJU3k03kHRJw
- TLSH T18E95AE13E79500E9D10AC1749AD69A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 1.9MB
- SHA256 c3516a7910a46fe5777961bba3a4c03ff5386f1b3d7d327fff333058f260b2f6
- MD5 567195340123cf5ab550830559019444
- SHA1 fdc9b3ada055421a5b1f1e16f3ccb61a899a113c
- SHA512 4e4a21749495b391975cf510ee27953656017f871d8cd1a9ca3d3fd4b968c3b75e23c098b467bb71015dfc0fb7f9c592555fb6f1060835c500abd634697bc06b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJli0:A3k03kHRJU3k03kHRJ7
- TLSH T1C995AE13E79500E9D10AC1749AD69A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.9MB
- SHA256 8fb9c1c07b41d6e7a198c6f5bf89c7f8a5f9598df754f095723afbed53e9c0c7
- MD5 0e935e21a9f96c6607ffcb7f7b755ee4
- SHA1 d5d358702d277d1a47400dc7c26e93fd0d600f41
- SHA512 b6308d60400fbe259f87b2172f148dd1133ac2d37bb2ad6aa609b1316cff497b7eb064bf2445e21983056ef69269e6a4405f407666eba19b866f5664f842010b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacJyku3mnXoZ643mnXoZ6i6cMJlig:A3k03kHRJU3k03kHRJv
- TLSH T1B895AE03E79500E5D14A81709ADA8A22FA75BD52176097DF2368F7152F72BC0BF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH