bfb59d80c2a109ec6c6233733302e3edcd9ef09d0abf5d7b0545a64bd38ab178

Analysis

user interaction
yes
max time kernel
104s
max time network
45s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
elostrap v5.exe
Size 23.5MB
Sample260909-rmy8lsfn31
SHA256 bfb59d80c2a109ec6c6233733302e3edcd9ef09d0abf5d7b0545a64bd38ab178
MD5 5ae3620582c7583f54f433f5b719ded3
SHA1 7151f5628112ab6ab78c6d8edea6af247271e446
SHA512 86c0cfdb1e6f56c99af5de76e251410b8f5bf941280ce185de58deab819f7a04ad3a15e93f0db0248b9cfd491fe8da17291fc2aaa34287c0d281f5ab58b7aee5
SSDEEP 393216:dl6Tw28JnLYJE7ICLf2MNxVHhXWk1hSywTGsK6cZ2yhV+7hnG3SqT:kIJLYD+lWk3ISsK61i4hnG33
TLSH
T1B6473327A5108ADDD0BAD3FC5843D252AA323C08577212CB16E43697DEB7E811E3EE57
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	elostrap v5.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3228	msedgewebview2.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 3228	3872	elostrap v5.exe	89
PID 3228 wrote to memory of 1744	3228	msedgewebview2.exe	90
PID 3228 wrote to memory of 1780	3228	msedgewebview2.exe	91
PID 3228 wrote to memory of 1780	3228	msedgewebview2.exe	91
PID 3228 wrote to memory of 1780	3228	msedgewebview2.exe	91
PID 3228 wrote to memory of 1780	3228	msedgewebview2.exe	91
PID 3228 wrote to memory of 5568	3228	msedgewebview2.exe	92
PID 3228 wrote to memory of 4320	3228	msedgewebview2.exe	93
PID 3228 wrote to memory of 4320	3228	msedgewebview2.exe	93
PID 3228 wrote to memory of 4320	3228	msedgewebview2.exe	93
PID 3228 wrote to memory of 5928	3228	msedgewebview2.exe	94
PID 3228 wrote to memory of 5928	3228	msedgewebview2.exe	94
PID 3228 wrote to memory of 5928	3228	msedgewebview2.exe	94
PID 3228 wrote to memory of 5928	3228	msedgewebview2.exe	94
PID 3228 wrote to memory of 5928	3228	msedgewebview2.exe	94

C:\Users\Admin\AppData\Local\Temp\elostrap v5.exe
"C:\Users\Admin\AppData\Local\Temp\elostrap v5.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="elostrap v5.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3872.5088.12264906067258030252 /pfhostedapp:1c3df17a7f836ba168c6b32a873af18da6d63aae
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView /prefetch:4 /pfhostedapp:1c3df17a7f836ba168c6b32a873af18da6d63aae --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffa95db5fd8,0x7ffa95db5fe4,0x7ffa95db5ff0
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView" --webview-exe-name="elostrap v5.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1728,i,14300715952968654319,3240764398127407792,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:1c3df17a7f836ba168c6b32a873af18da6d63aae
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView" --webview-exe-name="elostrap v5.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2092 --field-trial-handle=1728,i,14300715952968654319,3240764398127407792,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:1c3df17a7f836ba168c6b32a873af18da6d63aae
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView" --webview-exe-name="elostrap v5.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2376 --field-trial-handle=1728,i,14300715952968654319,3240764398127407792,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:1c3df17a7f836ba168c6b32a873af18da6d63aae
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView" --webview-exe-name="elostrap v5.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3460 --field-trial-handle=1728,i,14300715952968654319,3240764398127407792,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:1c3df17a7f836ba168c6b32a873af18da6d63aae /prefetch:1
    3⤵
    PID:5928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7ac58e806db1fd1faca7b87897626e41ec2b8af5e6fc2a6231777f150a091986
MD5 2e72e5be2b6cd30f15858cf01066f907
SHA1 e313a38fdd5ecdc0021c62c7f78e18973c68938f
SHA512 d11fe3262247fc87172b779a422a1100cf1496e3c310ffb2ded8637b0625306ba1cf9e1c148601f62e6d304dbf6e23380c6567de2ee2650e4d738147d6d08757
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 357523c22eaa7262e955a3dabde0d01d56acc8e6c5e9ae56d163dc19cb4c3db0
MD5 fc4f6a1902edc4625a72d6df586c2445
SHA1 1ed705bbe5ec4fa5827b486fbc4b0c24198ac77d
SHA512 73a42428d3891e97338b22edb684d26a0fd2d4b5dfc4cc65baf29ace58f5a8ea9dc86ca24ce5e34c74ed1d5cc357c63a5f5a37c1b450cc0ed41f8f3c6976c9da
TLSH
T161D0122332414174C0202033000261080901C20B454A91049838856D5A440500E078D2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Local State
Size 2KB
SHA256 5edf212124e8ce9d59036ebd6bd03842a42e22764e326131c811baada2c8ea4d
MD5 c0c1c8245ae86e9b04d025a198b117cf
SHA1 1a1d5ee9399558853cbb0890f781db006bd5ea5b
SHA512 a98c552bdf3898cbaf1752edb64d2c0881bf08f613c9da213206b0cfd113b28dc2f8e52d3b12afca134aea1604ec30180ccafda0f5ab81a4b4f6becc3ddda00d
TLSH
T1015165736C28AB37CAA29708BA473F62DA755152AA622F50DBDC0B2E01D714D1307C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Local State
Size 3KB
SHA256 31268a652d7a720607bd8edbae1fe89925645711d473a2db8ee740d7cb36fb10
MD5 376659a5c7bc72265b0aa345ac2e43a9
SHA1 28d1766430d0c06f0232b552963253d72904ffbb
SHA512 9f80aae5d884c6de68bca5557e2a118fa80912c4f44268dbbee3db9026811563fdbd73a1f4f4189c4a4c62aaea08da844400178951dd2c52c1d63f3359651855
TLSH
T17F6167736974EA378EB39B04B9862B16E7A55123E5913F94C6EC0F1D01D728C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Local State
Size 1KB
SHA256 04bb6c8e9f9cf570ec03a5a712d8a9d0d35cffea7650457fdf3c35aca28a0326
MD5 8fe338fff10815021b253bcf9bc16b0a
SHA1 00adb529e9433a78002dd94a68264a6161bebb9f
SHA512 7937c6b7698b1f515643caf73c51d8b318d4dc7876cb46324d2c13c21274cca97b43752fd4abba0e997e717ecf2dc2997988f0dc4d465d6e00b46c9a7685afad
TLSH
T1462165B2947C9B33ED56630976832FA6AE21115796210E00D2DD8F3F02E714D562BC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Elostrap\WebView2\EBWebView\Local State
Size 3KB
SHA256 64a82c5f2af6c3ca60541314ddba22df7f0d909ace7fdc55eae4c7d878fb6920
MD5 4e72887885764dd589b43acf57c9a3b0
SHA1 6fe027a693543f38adc92bd23c851a3408858930
SHA512 5b4b7baa65a95d8184cbaa7d7158f71800c49d6f31ca1cffe8f658edd90d627d115d6e870c783c275f7d4000c1e7ffc1405725cc0ff3ded0c4854c22d26631f5
TLSH
T1CE7174636974EA279EB2DB09B9863F12A7A45123A5913F95DAEC0F2E01D728D0342C17
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1780-108-0x00007FFAB7DF0000-0x00007FFAB7DF1000-memory.dmp

Download

memory/3872-0-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/3872-10-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/3872-2-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/3872-6-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/3872-3-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/3872-5-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/3872-4-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/3872-175-0x0000000140000000-0x00000001401B9000-memory.dmp

Download

memory/3872-180-0x00007FFAB87A0000-0x00007FFAB8A03000-memory.dmp

Download

memory/3872-1-0x00007FFAB88FF000-0x00007FFAB8900000-memory.dmp

Download

memory/5928-109-0x00007FFAB7DF0000-0x00007FFAB7DF1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads