Analysis
- max time kernel
111s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/05/2026, 15:47
Behavioral task
behavioral1
Sample
2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260519-s8a9caaz4q
- SHA256 1a2388f0d02605634bc0fae931db648753fbb8b145f4249f142a54a85e52071c
- MD5 8e5f2fccd4b4cf764e7e8191037d32b4
- SHA1 5f865135046b24681d3df0b3483edee4b2c4f515
- SHA512 f9c7a8b7ce5b6c5902bee1a82b4892cf3abcf4d17af6acca91ebd91b1a716d001fbd7437e4860ba93dcefa43526b40b96662cd4878f1e32ccb3276e336077453
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbu3mnXoZ643mnXoZ6i6cMJlCUQ0l9m:A3k03kHRJP3k03kHRJe
- TLSH T152759D13E79500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2756-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4ca-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4900-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2756-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4900-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002abb5-452.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028ddf-1288.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001a60a-1532.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000265d8-1894.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4ca-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x000400000002abb5-452.dat aspack_v212_v242 behavioral2/files/0x0003000000028ddf-1288.dat aspack_v212_v242 behavioral2/files/0x001f00000001a60a-1532.dat aspack_v212_v242 behavioral2/files/0x00040000000265d8-1894.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4900 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2756 2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4900 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_8e5f2fccd4b4cf764e7e8191037d32b4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2756
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4900
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 1a2388f0d02605634bc0fae931db648753fbb8b145f4249f142a54a85e52071c
- MD5 8e5f2fccd4b4cf764e7e8191037d32b4
- SHA1 5f865135046b24681d3df0b3483edee4b2c4f515
- SHA512 f9c7a8b7ce5b6c5902bee1a82b4892cf3abcf4d17af6acca91ebd91b1a716d001fbd7437e4860ba93dcefa43526b40b96662cd4878f1e32ccb3276e336077453
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbu3mnXoZ643mnXoZ6i6cMJlCUQ0l9m:A3k03kHRJP3k03kHRJe
- TLSH T152759D13E79500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.1MB
- SHA256 1b16b37aa98310767a760aafbc2e389212c1a9cb68a479ace218a46d6ad5f835
- MD5 a38f3e609ec3857389ab1b6bb2c2a42b
- SHA1 43b8a797be2b4b8e090534627ae264c73406e175
- SHA512 8c0f934a921b7c78246096bc973a2643c4444ed4153035cf43d8b382a5c25501f45b3b87faed7413dd24b0f836cddbdcbc5f710b17e6af5eb0129974fa480740
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbu3mnXoZ643mnXoZ6i6cMJlCUQ0l9/:A3k03kHRJP3k03kHRJ8Td9CHKyao
- TLSH T150A59D13E7D400E8E16BC1349AA68A22EA757C561730D7CF136896152F33BD0AF3EB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 2.1MB
- SHA256 1981106730864fa4154a21a5fb76ec3197f8ab5f7ca7e4ef3eabae4fa1fd32b9
- MD5 faf0147df4c9fa78db4247a5c983cd4f
- SHA1 d021f9ed540491448bbb453e467656bc549f493b
- SHA512 eb32f958f9449c81b60dfaf720f430f7a15ba702314697f212ec8ce2971969fe3b167aaaeb0f39d35890304427f66f688a385dd18cdc45c007aabdb5133b6f25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbu3mnXoZ643mnXoZ6i6cMJlCUQ0l9D:A3k03kHRJP3k03kHRJaUidGl
- TLSH T145A5AE03E79400E9D11AC1749A968A23EB75BC561B70A7DF1368C2252F73BD0AF3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 3d72675d790bb26011c7c1223546dfbb5be814f20d998a462c0037316e282900
- MD5 e97dff29cbc3c2eacaaaac1e6532169b
- SHA1 7c441705511a992719f042c37e66bc50794e359c
- SHA512 ccee6c211bd8e937f3a1b5fd4a88b548fbc6895d847d6dbaeb92c4889d7b9c04e88c1b94771d967f3a8c675fdaccadba2331a1c8062635becd0775ce015de1be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbu3mnXoZ643mnXoZ6i6cMJlCUQ0l9K:A3k03kHRJP3k03kHRJOPji0Aj
- TLSH T1A5A58C17F6A402B5D026C1B8CAD69A66FA717842173097CF1358C7293F63BD0AB3E764
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 1.6MB
- SHA256 5baaa48254fe1dee61243c64c9ffdde3aa02c7fc5b03a1400b914e4321f096ef
- MD5 e9784498997a2e2eb9a75e61230011dd
- SHA1 58fc9ec1811ed4022f3e761ec451a0b7d473cdf1
- SHA512 e9cbcbde33db402ff610ca2c453f110423fed28b5f6cd5bf7cda5c190a001a5e04636935a6c1a7e407a07c5dc70a2a76ab2665a03dc211d1398bf1521fffb6a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbu3mnXoZ643mnXoZ6i6cMJlCUQ0l9T:A3k03kHRJP3k03kHRJ7
- TLSH T145859E13E79500E8D10AC1749AD69A33FB75BC561760A3DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.7MB
- SHA256 538a3798b9aef1b9d90d6637c3db5d883fc2616d1708b804ec1649b973f464d7
- MD5 1389d5a7b75b682d8eaf23893867b519
- SHA1 dcfa4b3bfc9547caca3567a007a1583ba22ac83a
- SHA512 e069b7c9a1e88367af185a71fa4dcb838f2eea2a95d72f8b25f560131929012196ffd180297746ee462da596e6855e6f46a4c8eff8c02f961fc1265d11199d8d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbu3mnXoZ643mnXoZ6i6cMJlCUQ0l9e:A3k03kHRJP3k03kHRJ2
- TLSH T172859D03E69500E4D14AC1749E9A8A22FA75BD92172097EF2358F7152F72BD0BF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH