fbdcda2119c38c4c1e2d389c58fa927bc71b7b1308b1d7f8cbe132f1d844c258

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe
Size 1.8MB
Sample260809-td291s1dpf
SHA256 fbdcda2119c38c4c1e2d389c58fa927bc71b7b1308b1d7f8cbe132f1d844c258
MD5 ce002603d2a3e57a8c66e991850a7862
SHA1 587552e7ead9ba6267cfd7667add5835e5e5b7af
SHA512 bc3f2c0c9ac812b16da303561617f621b6986a625ea015c62c017bf4dfddae2f20475bd38360b3a7b280a8e1af43455346c4d0f6abe9f94ccc6188b4a3f28095
SSDEEP 49152:+5+hFqj8F9jWOHVuLS3j3DxYmSAOUrw7pbOo3K3cyYF8gB:+5aFqOjWOHT3XxsiqtSMpB
TLSH
T1D88523D1F6E667FEE6872130C929E7A6A6F2F3610B2C9BD7139447022D611D1AB3C305
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery execution spyware

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	2032	mshta.exe

Executes dropped EXE 1 IoCs

pid	Process
6012	DriverPack.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4392	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mshta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DriverPack.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Styles\MaxScriptStatements = "4294967295"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Styles	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\mshta.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SSLUX\mshta.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Styles\MaxScriptStatements = "4294967295"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SSLUX	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Styles	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Styles\MaxScriptStatements = "4294967295"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\mshta.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SSLUX	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING\mshta.exe = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SSLUX\mshta.exe = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Styles	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Internet Explorer\Styles	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE\mshta.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Styles\MaxScriptStatements = "4294967295"	reg.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\Content Type = "text/html"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.css	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.html	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.css	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.css\Content Type = "text/css"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\Content Type = "text/html"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.css\Content Type = "text/css"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\Content Type = "text/html"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.html	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.html\Content Type = "text/html"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\Content Type = "application/javascript"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.js	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.js\Content Type = "application/javascript"	reg.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4000	2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3032	4000	2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe	88
PID 3032 wrote to memory of 6012	3032	wscript.exe	89
PID 6012 wrote to memory of 4392	6012	DriverPack.exe	90
PID 4392 wrote to memory of 1052	4392	cmd.exe	92
PID 4392 wrote to memory of 2724	4392	cmd.exe	93
PID 6012 wrote to memory of 2032	6012	DriverPack.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\start.js" ""C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe" --sfx "2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe""
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe
    "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe" --sfx 2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6012
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Tools\init.cmd "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\Tools\run.hta" "--sfx" "2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe"
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4392
    - - C:\Windows\SysWOW64\reg.exe
        
        reg import C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\\patch.reg
        5⤵
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:1052
    - - C:\Windows\system32\reg.exe
        
        C:\Windows\sysnative\reg.exe import C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\\patch.reg
        5⤵
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:2724
  - - C:\Windows\SysWOW64\mshta.exe
      "C:\Windows\System32\mshta.exe" "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\Tools\run.hta" "--sfx" "2026-08-09_ce002603d2a3e57a8c66e991850a7862_coinminer_driverpack_elex_wannacry.exe"
      4⤵
      Badlisted process makes network request
      System Location Discovery: System Language Discovery
      PID:2032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverPack.exe

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\DriverPack.exe
Size 85KB
SHA256 78fae8f4014baf3b063d44a46dca6109e7483b3e5ca27187394a68bd959599e7
MD5 bea0e0db0118ad8ad5ebd72b79c5ce4a
SHA1 5ebd53b83ce9372c8111127109f1270efe6fb524
SHA512 dda0fb66c39ca1f9b0837cedfdcb562c68d1d3b8ec81868e5c0d4f98b4a3a0072b7f479bcb2ca598bc01503db1eb9fc0da723dfb4081d7f3bebd5f8d858d8186
SSDEEP 1536:FTgSFOJu2aF0gqqcZudzc+d4DBTicF2Lyji6RKi6RM:OZu2Vgc0B4DBTicTPRIRM
TLSH
T176832BCAF6C67B9CF7133434C5F6C37285F3F701412EE6ABBB849A196892641266C705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DriverPack.html

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\DriverPack.html
Size 4KB
SHA256 3d2315de58a5d3c3a4412cec1e426751fb0f7657f27c22254006e23cea3bbad9
MD5 42e912c38ef16cdbc7cb6b1f0de61fde
SHA1 d98922fb3f2684b0a418acfc30e128a996311bce
SHA512 676f72f1ba240a32975ebaecf026fc77623032fd8c68d261333e7b028826f77f037a5f2bec767639a898e20acfaf31d5b103428ee249023ad75ec43c0e6f9b35
SSDEEP 48:kDUpeuQGfAiuCMwUnnnF/x3LvW4/QtoqlNtjttpQynwYfHXCH1Zmb42ejJ36thUU:k+opCDupxaD3txr9nwYKHzvjYgu
TLSH
T1AE8165157CF6943E946B05E233E3DF0B2AA1D003C2168454B1EE0BD92FDAF8ACD17669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Icon.ico

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\Tools\Icon.ico
Size 24KB
SHA256 a0a78539cf3889eaaf2aba62fdc85addf4c31420eebbfb51fc70ff41efadc69a
MD5 73c365efc22f21785caf62a83c563da0
SHA1 21880c3e6370cb9c50fbc37e656bf1f755750801
SHA512 3f025bc4db604d631763b73c1b7bb967b3e70696c5b15679d8570f950a474c67bd0686ffec416831c23e877c1ef273644a040e86f2d893b49fb88b5ab44c0cf4
SSDEEP 384:1MrYEWMoMS8rmGu3kcFl9lBm9KwZLuPtB/Q:1MrYTMI8cFLiLRIi
TLSH
T1B3B287CEF1C5BF0DFA033078D876C3A142FBE744421EA7AB6BD45A5618426914AFDB81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

init.cmd

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\Tools\init.cmd
Size 852B
SHA256 20692738398af39ee4c65eda97b70f65466baaccd1c12eefc26e632f505b68a5
MD5 2d07f324a539ade610cd86f3788db114
SHA1 c898927fe8eddab9997daefe21241ed211221676
SHA512 12a2e9cb3de9ce4113b85c54bc6a0845f604608a9383ffebba7a3fe00c34b18061865f600f134d35d0ab59cf4fd9f755c8d73c738c255106d53d573d7ea0218a
TLSH
T1D701EF8C0C6FAD5660B8FA73A636A0A3D70BD14F053E03C0BE85B38D3F52246411E24C
MD5 SHA1 SHA512 TLSH

Submit Download

run.hta

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\Tools\run.hta
Size 1KB
SHA256 f8233bfffe778f8aa2b90856298b84f296b3bf8dc0547b11afa538a3c3081fb3
MD5 0067963efff86f2d5fb4f792cf68021a
SHA1 eeb5eb6d94c962bc5cd94bfce7306e8fafb160f4
SHA512 d7417e2d35c0894b8fc154b216466522b1b0ae9ea274a63431afbc90e43f026cf647455e885cc767f2d8253693f01c8bdd618e018ddd26bac9b465b1af8b89b7
TLSH
T1253145840DBF45C5A06BB4321BF739015E26115B8588ECD87CDD558CDFC4B1889DBBB9
MD5 SHA1 SHA512 TLSH

Submit Download

bluebird.js

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\bluebird.js
Size 147KB
SHA256 0d6e11be55def7b6f817cff2738e21de9301ad0836e89d124a46f72a64b18eed
MD5 afbb5c813add5d4df9b32419e6a89834
SHA1 8b1d61ac66c59e7eb581453b2c5a9d20452e7f27
SHA512 b0979605cc7898c6fd3435a27b5d2003e5d75c9aa02aac24cc59f755dcbdead55a5a74a1cfe0199479c11e2cf355035bbf7051f1841775e53d955af0877812ca
SSDEEP 3072:zXv4SbCEbPk0iGdIDuc7VKKAJKu8A1jXl6mdOWPX:zPdGKKAJKWj16kOWPX
TLSH
T101E3844BAEF72057921770386E6F980BB2BC4813141DCE84BD5C92D45FE202896E9FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globe.png

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\globe.png
Size 641B
SHA256 9a6abb737e513937865aba2d2db103c9baeac030934b522093b7905d4815c332
MD5 74e9ebec2b365366755028ac89031400
SHA1 51e302935661398c53cb3e8fa11d4b874c6df78a
SHA512 837ab265038703b7b0d5333e9e74977d54c58a050a8128a9127a2a4e482ea6623e4e866aa53638c72ec3111dbd1924958c1bad536003715a883e6dab87e5bb57
TLSH
T169F068673700713B45C90C694D3F3C73E98F789431E9BD405FD585F855039205AC4388
MD5 SHA1 SHA512 TLSH

Submit Download

language.js

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\language.js
Size 15KB
SHA256 cdd2679eaffd10b67894aeec93de1f34dc56038b63feb59c1fcf54d42c590903
MD5 2866dec4af17828efaca8596942635ca
SHA1 2e9faa8a9b5b05d3807daf543e29cf0403e8b969
SHA512 419d8bfb46b6749eb9739e1121ea62764cc1d24ba187e217b8e18b09ed89a5ef7ebe2b114959caad11f21a999151461ffff0a1c3d507a190bf123c49b792e46d
SSDEEP 192:zEvEB++JkBLRsL0JceCv05pFAwfxjufHkZ65qNCuveUuKO3KFKWzRMpCeo8KKynz:zyNTgbkk5qNzeTV3YEVyH9Pwym7y
TLSH
T1A972330D6DF3ACA7222B71A8931B94D166B2C8472144FC957E8CB3D45F4991883FDAE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loading.gif

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\loading.gif
Size 18KB
SHA256 24ed9db3eb0d97ecf1f0832cbd30bd37744e0d2b520ccdad5af60f7a08a45b90
MD5 a90e737d05ebfa82bf96168def807c36
SHA1 ddc76a0c64ebefe5b9a12546c59a37c03d5d1f5b
SHA512 bf1944b5daf9747d98f489eb3edbae84e7bc29ff50436d6b068b85091c95d17fe15b721df0bff08df03232b90b1776a82539d7917599b0a3b2f2f299e7525a51
SSDEEP 384:hfnVYmHzbomdWi6KS1LaRZUvgzjcoZkrzxV3HW5qQUNTVa8KQBJOb:hv+mHzzUi6KGgUSjTZkrlV3HW51UNTVC
TLSH
T1D282D1AD1938745FB9A004BB519C5DAE30AC787D27A1EC132C2C7A736211DD62DA34FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

main.js

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\main.js
Size 127KB
SHA256 f6a61e9413bcfc77cd8a23efc84a96eaa60b769e9cae365dd420e767c629120c
MD5 28396d494d3c7eafb997e1a46c911381
SHA1 6365d24ee9f35fe447f794e55f902e47a8cd141b
SHA512 42e4b6d13a3a3f4f7f2c9e9b07180d9e4c69b3d533998893f89c48d7a1da5fe68fd272eb5316c3789c5a011dc71cf0c08177f040f38caa4a72af560739387ff2
SSDEEP 3072:NAo/ouCbW+JBIzWPiqKO8Qtx5VMvAwq6a:H/3CbW+JBIzW6qoQtxkpa
TLSH
T183D3C58EBAF7B42196A771B8CB5BA105B27688477108DC64BC8C57D41F5442883FAFF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

med_logo_dark_new.png

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\med_logo_dark_new.png
Size 3KB
SHA256 71557ad30e5e02aa551ff8edc29deb83aaae949f31da9151d3e476d67d2a1a4b
MD5 43be5aa6135f7656e2b9ee162479fde2
SHA1 384d58c9712a1d8248c442d596aa604f04c6e028
SHA512 c51e80ee9d5ef1de0eb8244670437320e66036fe277afb669721982d23c2578ff4ce28b6f3cabf8256b39ce391df1c7e335008b0abca795d9c0884082ad21f4a
TLSH
T117811AF14561A88BC4DA91FA575CB65481ECDF1604804FBD03A76499D81B8C7F44FC69
MD5 SHA1 SHA512 TLSH

Submit Download

polyfills.js

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\polyfills.js
Size 270KB
SHA256 62c56826e747553724ce3881eb3f9a367664a8d8172593286e9511496c6640d1
MD5 32dd27de70fca65ac73a1f9835d8f0c3
SHA1 989935a10a8b1d7c3f1334ef2db8b57c7fe9bf7b
SHA512 974461c8ada004d18c12ecc67cb7e075488043cfdd1e7ee5589cb7c1c9d6e85bab31ef5d09a9c3f1aa56e7eb6b8e97774ab9165d097f2ca0c1cba7c7c855cc2c
SSDEEP 6144:hBeBnrisTqYq1il94XxgEFtjzDbuwGzYand57UkoB9MPTs3uI0gpj6QgzbI/mB:eB69zcb
TLSH
T1AE4485897AE3B5415AA771E8831FB912A12EC017A41CFC80B99C57D45FD1C2483BDBFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

styles.css

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\styles.css
Size 2KB
SHA256 81224a285ee25bddb07018336a2434d947c572e92a26aee567be0401b7726892
MD5 f1f2c06d2d6bba1b321ce0386799b154
SHA1 a4b480a399005eaefee6876cf2e6711466db6921
SHA512 245f70f9786303cf5ea214ef0e3627dacbf3bcf1eb742c0e9d44210f2bc9f3f7ab4b827600ebafdba6877d712db5489481a142f971cb3f6b0183b1a55b8b4640
TLSH
T1B8510FE6DB71A648F81AE4B971137B21236C4012A40FC97C97F1396CDF861C996723CE
MD5 SHA1 SHA512 TLSH

Submit Download

patch.reg

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\patch.reg
Size 1KB
SHA256 7bb97b440e949b13feaf9e104be287c950cf87a14ea3ba5af4199fd15e2da581
MD5 5e520ad7be996e01e1f57a5dcffb0148
SHA1 faa0f75bcf42d21250e3aefc5884216d03637dab
SHA512 5ad1657c4de30aa5f97becb0db63ad7e5f5b92ee9ba694cc528203abca974736c6ed3c7d051b6adb9db003caf8b0b8001d8e2dc0b2ebff0f98713f88552f02ae
TLSH
T152415C705C26C11AC0B2E8111395B587F7A5B1A6AAC3DF94B4CD89503BCBECB813D1AE
MD5 SHA1 SHA512 TLSH

Submit Download

start.js

Path C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\bin\tools\start.js
Size 137B
SHA256 abb7b821325c0cd80b188f29b4f00e6a669673e5e036379088ef85d164e4c81e
MD5 efa95ffb77bc168aeac2a61273fe81b3
SHA1 f10a049e592245e0441d87ef87a72b13f836ee61
SHA512 31ff4c980f6ebfe030c56448da4d14634a13c995dd3e54b173aa712ed9ce831a2fd8911358fcc75dce3ef3150a252f9eee34cffd5becae4e254346fd38914bea
TLSH
T11BC02B0D986D9180006AD7470132E41E15868020720BD9E90000C9C0A541E100D12005
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6012-70-0x0000000000400000-0x0000000000418000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads