Analysis
- max time kernel
118s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 04:47
Behavioral task
behavioral1
Sample
2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260522-fenw5aev9j
- SHA256 4566dfdedb155e43dd64fa0d886e020c950b5408c9f34314191d483f7a48b6c4
- MD5 0ceabe6ef61aab78735b2da7c3aef30a
- SHA1 677c0735a88b6b20958a8bc73e13460deec8bff1
- SHA512 55695e19042469fb35ea75c9f13c20056796938cc6cf3394dfa6edd33f847a9b6e0cbe4f754865568f460866f8402c3f724fb4168cf183278e835733fba733d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB2bAZe0p4Ek4niOkl/A04szE87JKTvmlDz:A3k03kHRJARJ4eW4SkZP4sz9MbE56r
- TLSH T1EF953916F6784766D0BBC0B9C5D6AA56FA333C454F308BCB03459B283E277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral2/memory/2096-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001700000002b7a9-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2816-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a322-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2096-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2816-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x008c0000000272d8-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00af0000000272d8-1274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00b90000000272d8-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a5a-1488.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001700000002b7c1-1696.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000000476-1890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000261ed-2080.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001700000002b7a9-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a322-12.dat aspack_v212_v242 behavioral2/files/0x008c0000000272d8-1022.dat aspack_v212_v242 behavioral2/files/0x00af0000000272d8-1274.dat aspack_v212_v242 behavioral2/files/0x00b90000000272d8-1377.dat aspack_v212_v242 behavioral2/files/0x0008000000027a5a-1488.dat aspack_v212_v242 behavioral2/files/0x001700000002b7c1-1696.dat aspack_v212_v242 behavioral2/files/0x0014000000000476-1890.dat aspack_v212_v242 behavioral2/files/0x00020000000261ed-2080.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2816 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2096 2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2816 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_0ceabe6ef61aab78735b2da7c3aef30a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2096
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 4566dfdedb155e43dd64fa0d886e020c950b5408c9f34314191d483f7a48b6c4
- MD5 0ceabe6ef61aab78735b2da7c3aef30a
- SHA1 677c0735a88b6b20958a8bc73e13460deec8bff1
- SHA512 55695e19042469fb35ea75c9f13c20056796938cc6cf3394dfa6edd33f847a9b6e0cbe4f754865568f460866f8402c3f724fb4168cf183278e835733fba733d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB2bAZe0p4Ek4niOkl/A04szE87JKTvmlDz:A3k03kHRJARJ4eW4SkZP4sz9MbE56r
- TLSH T1EF953916F6784766D0BBC0B9C5D6AA56FA333C454F308BCB03459B283E277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.6MB
- SHA256 c2b74f7bd6d59d37186872e355816a2c71b1bed024c152bddb24ad187be8479d
- MD5 3fe5ceea74372dd8b4a91acb82e1ebe4
- SHA1 d776418cb887054f8b036118f56c7d11928551be
- SHA512 63b182d96de7cd32840cebcbbcd34a0cab5663b0e4749b2c61f505bdcb7de536795c3ff492423a13dee127a72b83c7694a1778e9f7570261e59b2e4387c2c119
- SSDEEP 49152:A3k03kHRJARJ4eW4SkZP4sz9MbE56rtVk0QGTvntQb:A3k03kHR+RqfkZcBrIHaib
- TLSH T1A1C56C16F2B847A6D0BBC179C5979A56FA323C050F3087CB0355DB293F276D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.0MB
- SHA256 0051a9cba6b7ccf15f787dbdd4baaacc21af02b795e9946f82f1e1707809f656
- MD5 8e17c131da908f3a4c02c60ea9ccab3d
- SHA1 82f302c2df9e4488f4c77bef63d464b0325741de
- SHA512 3d3020c150b1c594df3b558d9f64030e5ebb4750f9b88d7cf9c03afc6e084d73e3f7930c247ec33a6f3027d0eabbfee70e505f2d347fc47aeefe61e02c9c83dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB2bAZe0p4Ek4niOkl/A04szE87JKTvmlDS:A3k03kHRJARJ4eW4SkZP4sz9MbE56rIW
- TLSH T1D1A53916F6B84766D0BBC079C5D6AA56FA333C450F308BCB03459B283F276D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$
- Size 2.0MB
- SHA256 5738ee27f9271e3411e2a3584845603e224b07828686fb6519d86e6b505aa417
- MD5 5c7e4099d7742fe45e8dc331ff88a664
- SHA1 6b01e1c1d283f1c330782639ae50b7d5d907a534
- SHA512 2ba3a21561c91c3a2a57ee4e38c60fb044efa5992243dd3f5da9890890f876e93fa4b7f8b15e9d88d968c236f4a663e39d80d3beffd9c31f426e7a701560cbb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB2bAZe0p4Ek4niOkl/A04szE87JKTvmlDu:A3k03kHRJARJ4eW4SkZP4sz9MbE56rWI
- TLSH T1DEA53916F6B84766D0BBC079C5D6AA56FA333C450F308BCB03459B283F276D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DEDD914E-84D0-49B4-9D48-44B1238479F9}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 2.0MB
- SHA256 c7c28cc4b38135cd701c1f78a6bc5b1c4ab3fce03fc95e499ceddb2751eb7856
- MD5 767451a6b808e3de52b1517fdce577ba
- SHA1 760829dfada1b47dc77a1611725966df709ab5cb
- SHA512 82b788e037bc2b30727bdaf20d4723af3457f61b92b3068b223a6896b4e7878552aa75c492cc1c09514dbe48eec181d88b201a900c7607b3d052f91cf3ab27ed
- SSDEEP 49152:A3k03kHRJARJ4eW4SkZP4sz9MbE56rABPVAU:A3k03kHR+RqfkZcBrABPVl
- TLSH T13CA53916F6B84766D0BBC079C5D6AA56FA333C450F308BCB03459B283F276D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 5e402aaa90fb487779405c081064053f3f7cbdbd6dd5e560a1a1eebad221e526
- MD5 3e6e0153597c17d190cc66f1e1276138
- SHA1 57fc6a71d6e5c5bb060e70d5001008aec36743b1
- SHA512 1baeed02a18671c9f09767969b6cf6e7594ecb11bb3af395bfe1426f6bd156e9ebab2dbf756ce0d6ec5aab076d94515f016a8de71ccd11b6c1564d567cfc2063
- SSDEEP 49152:A3k03kHRJARJ4eW4SkZP4sz9MbE56r0Pji0Aj:A3k03kHR+RqfkZcBrSjo
- TLSH T144C53A16F6784762D077C0B9C5D2AA5AFA3238451F308BCB0345DB283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.9MB
- SHA256 703008e715c077021402a9ee663e02f579726ee9543017e024b43ee5d50dedd8
- MD5 62a05c3945668a1ea61f59f48bedaf7e
- SHA1 be482f08489920191aefea1432d01f4836d31b1c
- SHA512 ca8447f1af9c727ca7bb9031396df4ccc016764a5b1965da76ab1c8de46940786f0807849161e32439f620984af69eb5127485e860b90d8476213bcbae9f2d02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB2bAZe0p4Ek4niOkl/A04szE87JKTvmlD9:A3k03kHRJARJ4eW4SkZP4sz9MbE56rc
- TLSH T12F952A16F6B84762D0BBC079C9D6AA55FA323C450F304BDB0345BB283E376D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.9MB
- SHA256 60957ba3cb28a808ab5d42f7c4168ebfde2b09ffb2ef42d6ca5e7fb4be5e793d
- MD5 cdbe7cec3fa03f4ffd16728186bff284
- SHA1 1e4b002859d2266fd93fbafbfcd6166051eba4f9
- SHA512 570b48aae70b9d52995cd89bd4d6e69e2eab3e075cc030565f28bd72ed428e5815c933afeadd4f8234c2ff3ae1977571c91f7453526d3dc1a38551c5855fbc75
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB2bAZe0p4Ek4niOkl/A04szE87JKTvmlD0:A3k03kHRJARJ4eW4SkZP4sz9MbE56rx
- TLSH T1EE953916F6784766D0BBC0B9C5D6AA56FA333C451F308BCB03459B283E277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 2.1MB
- SHA256 19c6166a7b8cdb440449663dfe352377377a8227ab738b6fa53bf88fee124c99
- MD5 0d78607b106666d6cabb7ec17de99919
- SHA1 b438a9a3a35c1127298e64b03031aa8cf767f825
- SHA512 89211c31cb133cb92f6f8e4ac8bf0e8cb7f5f6f290561f2f379aa3e9d80b18a56c510f343b90ab730de7412feee4994d6ad76998508815ac0c8e3eef26321dc9
- SSDEEP 49152:A3k03kHRJARJ4eW4SkZP4sz9MbE56rNi2WH3:A3k03kHR+RqfkZcBrNuX
- TLSH T1FAA54A16B6B84776D07BC079C5D6AA6AFA323C454F3087CB03449B2D3E277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH