2299a6ee52264a3b23ae117a912d77359af733456f66d3656c4f1497b1678ae8

Analysis

max time kernel
109s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 20:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Size 1.7MB
Sample260810-ywptvsgn8x
SHA256 2299a6ee52264a3b23ae117a912d77359af733456f66d3656c4f1497b1678ae8
MD5 8282edd1d14b6d7a5aa67a499e3e5bb2
SHA1 9cd3ce17d00fe491743b4a8fb101d05622d534dc
SHA512 2c15e13bd1a13322781cda6430a6e1d281a5e738faac3f8fb32ec8e700f691fdb73e8d1d03904230720c3a53097de93b22220d84659981f948b18beabefe664a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5TvinrmC:A3k03kHRJuil56rX
TLSH
T1CB853983AB465EB5F14E843098918239A6337E190FD347DB135E7F1A7F317886AF8216
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

aspackv2 discovery persistence spyware stealer

Malware Config

Signatures

Detects executables packed with ASPack 11 IoCs

resource	yara_rule
behavioral2/memory/1564-0-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c451-5.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000300000001b305-11.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1564-15-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5888-16-0x0000000000400000-0x000000000040F000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000200000001bb4d-157.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c457-461.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0003000000019902-455.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x0004000000019c9e-1288.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x002a0000000187fc-1645.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c47a-1773.dat	INDICATOR_EXE_Packed_ASPack

ASPack v2.12-2.42 8 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000d00000001c451-5.dat	aspack_v212_v242
behavioral2/files/0x000300000001b305-11.dat	aspack_v212_v242
behavioral2/files/0x000200000001bb4d-157.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c457-461.dat	aspack_v212_v242
behavioral2/files/0x0003000000019902-455.dat	aspack_v212_v242
behavioral2/files/0x0004000000019c9e-1288.dat	aspack_v212_v242
behavioral2/files/0x002a0000000187fc-1645.dat	aspack_v212_v242
behavioral2/files/0x000d00000001c47a-1773.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
5888	patcher.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe"	patcher.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Client\AppVLP.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE	patcher.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe	patcher.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	patcher.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstatd.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE	patcher.exe
File opened for modification	C:\Program Files\Windows Photo Viewer\ImagingDevices.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jhat.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jstack.exe	patcher.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE	patcher.exe
File created	C:\Program Files\Mozilla Firefox\firefox.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender\MpCopyAccelerator.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$	patcher.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe	patcher.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe	patcher.exe
File created	C:\Program Files\Google\Chrome\Application\chrome.exe$	patcher.exe
File created	C:\Program Files\Java\jdk-1.8\bin\keytool.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe	patcher.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe	patcher.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmid.exe$	patcher.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$	patcher.exe
File created	C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe	patcher.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	patcher.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Temp\:\autorun.inf	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
File opened for modification	C:\Windows\:\autorun.inf	patcher.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1564	2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
5888	patcher.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8282edd1d14b6d7a5aa67a499e3e5bb2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1564

C:\905c0769f9a06c95a24ddf945\patcher.exe
C:\905c0769f9a06c95a24ddf945\patcher.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

patcher.exe

Path C:\905c0769f9a06c95a24ddf945\patcher.exe
Size 1.7MB
SHA256 2299a6ee52264a3b23ae117a912d77359af733456f66d3656c4f1497b1678ae8
MD5 8282edd1d14b6d7a5aa67a499e3e5bb2
SHA1 9cd3ce17d00fe491743b4a8fb101d05622d534dc
SHA512 2c15e13bd1a13322781cda6430a6e1d281a5e738faac3f8fb32ec8e700f691fdb73e8d1d03904230720c3a53097de93b22220d84659981f948b18beabefe664a
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5TvinrmC:A3k03kHRJuil56rX
TLSH
T1CB853983AB465EB5F14E843098918239A6337E190FD347DB135E7F1A7F317886AF8216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe$

Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$
Size 2.2MB
SHA256 7a84d37203d85c7160c4b6b92d3809340d47ea6672079291b655209d460e0c64
MD5 bf16baa03cdfe8e91e7fbfdb30b759b3
SHA1 ba80d947104c6bc78f53140a609cc77003af1204
SHA512 04a8daeec18641ab248be1667bfe33128269fdd594c3284838bad66e34fd86fac9cde8824b657bd86065ec1a99485e3ad93e4859a01c6a1b45c0bbfe46faf392
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5Tvinrm8k9mR4qYbQ:A3k03kHRJuil56rimWD
TLSH
T127B54A83AB854EB5F14E843089424239A6337D590FE397DB135D7E1A3F366C86AF8316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msedgewebview2.exe

Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
Size 1.8MB
SHA256 11d5ccfac539163b0e87c85f84ed02d2a8a0c09729cf5e82a4a19d7008bbac2f
MD5 5a65983d66fe76bc5e520d60d9fa68de
SHA1 30f1c975eea4bf57e38c4d6da373c15f996b746a
SHA512 104bd1b2b878e8e007de50d5729a541dbeafd48046f32e162460d2cf2caf18a21525cc57cb3631d7522b7ba38c1731f0cace811f82a632c0f84bc3cfb5e3f472
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5Tvinrm+TjE:A3k03kHRJuil56rNw
TLSH
T13D952883AB465EB5F14E843088914239A6337E690FD347DB135E7F1A7F317886AF8216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe$

Path C:\Program Files\7-Zip\7z.exe$
Size 2.2MB
SHA256 ea26f7ec245c1b4a5900074ebc93c8d30df7bacaca897b042391c66d1643c6e3
MD5 c2c9e81f67e5da6ae822d9206e4cf1b3
SHA1 d70907c78e39651e37c6821ebeaed8711aeaa1ae
SHA512 6ef66182208666332c0f1257e34f527c2f1762422a434c9969683292062da8db44dee331c7c68d764634780eb2246d713aa1acecf19807350b7ca4c0e1b96b58
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5TvinrmC0Le5ji0hJ:A3k03kHRJuil56rTPji0Aj
TLSH
T12BB52843A7554EB5F05E8074C8928279E6333D590FE386CB124EBF192F366C85AF9326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.exe$

Path C:\Program Files\Google\Chrome\Application\chrome.exe$
Size 1.8MB
SHA256 3afd60158429622b7962a602cce21bbc49b3e2653d66232f08cfb62317469a8e
MD5 1ceb8c46dec96086101ae9dcdf8208fe
SHA1 0155a68d653b78802870d374d5aecd7d15c0bd1f
SHA512 998bada9445d4db811c054a749e642bf3e01558c8550d215f6b9abc416a9343dd9cda2ec5a248845c4bcf21d47170d246cc4fd13c348e39d24359c5a329aeb6e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5TvinrmrD:A3k03kHRJuil56rU
TLSH
T1F695E583E7464EB5F14E8430CA514239B6337E590FD346DB129DFE2E6B316886AF8217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 1.7MB
SHA256 6c62b83e588d464d80904606ad0a1980be86e026b6f9803bdc925f9f24c05c15
MD5 7c1e0cb216d704e1c41cde7f851ffc11
SHA1 2a127d1d341681864dd5a9cb48910d4edb6736de
SHA512 5c7b4984759665b3aa4483a4ee0da197c14ec255a919dfd164adbeb3a937a6868061d85c1ed4250204e66b6b06fd99decf0760c1254a8661e29d72b68b5d4231
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5Tvinrm7L:A3k03kHRJuil56ro
TLSH
T11A853983AB464EB5F14E843098918239A6337E590FD347DB135E7F1A7F317886AF8216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wsgen.exe

Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
Size 1.9MB
SHA256 2ce8e548ea9ace3a47a643cc9e0501981c695d40195822d3f0921744a8411082
MD5 7a222fb9c22b652ecf56f124e7cf61b0
SHA1 7786108942163fc6b86938b9a6e1fcf89bc7d9cc
SHA512 defb777872b520620f4cbf9fead4295d36b7113790fed4b19cc4825c0804ee8a0a394dee0fdd5df308c18388a4888c9e03d21e057d2e053fbc80ad3c6ed5e318
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5TvinrmGjCXF7IwZ:A3k03kHRJuil56rZC17IwZ
TLSH
T128953983AB465EB5F14E803498914239A6337E190FD347DB125E7F167F327C86AF821A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.exe$

Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
Size 1.8MB
SHA256 37a7dc28ddc7ef2e1b7d2ed6b227908bdc671f2c50912f6cf74b6521b93cd2d3
MD5 00d95e7be2100892c262052e0483ed49
SHA1 c1dc77a5604d8ebc881eae720f23d49ab3c43fac
SHA512 506e642345659e25219529392c853b01c343f2408646ce014849b40be204f5d2effa441de4202d4e98187abc8e6da5f7f88ea277446f5b472e50322d92eb144e
SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasimYaacLaLDilD5TvinrmgF:A3k03kHRJuil56r9
TLSH
T1AD852983AB865EB5F14E8430C8854239A6377E590FD347DB125E7F1A7F313886AF8216
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1564-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1564-15-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/5888-16-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads