Analysis
- max time kernel
84s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/05/2026, 15:57
Behavioral task
behavioral1
Sample
2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260524-teaamaat3q
- SHA256 94be5421f86a65cb9448216e8ffc8d063d545901bd8a608f092e740a36ef7b97
- MD5 4f6e0c0e2b2d919cd8563cfb96358994
- SHA1 4857731fbca9f316053df8fe57d84871c68b21e6
- SHA512 1ae6f1ea21f67affb439470352545c898d3ed395c654b2da4dc92efbf8fb22348602ce56e438d312495b5efcb3656fe9368c42e7aaa76906467be883250ca360
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0ya:A3k03kHRFfkZcBrO1lkNa
- TLSH T1E9B53A12F6B84B66E0B7C174C9E6A656FA323C465F3086CF13449B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4576-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024437-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3872-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4576-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3872-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216a8-1259.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x003300000001e0ae-1522.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000719-1963.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e50e-2058.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d00000001e50c-2129.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024437-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x00030000000216a8-1259.dat aspack_v212_v242 behavioral1/files/0x003300000001e0ae-1522.dat aspack_v212_v242 behavioral1/files/0x0004000000000719-1963.dat aspack_v212_v242 behavioral1/files/0x000200000001e50e-2058.dat aspack_v212_v242 behavioral1/files/0x000d00000001e50c-2129.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3872 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4576 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 3872 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4576
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3872
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 94be5421f86a65cb9448216e8ffc8d063d545901bd8a608f092e740a36ef7b97
- MD5 4f6e0c0e2b2d919cd8563cfb96358994
- SHA1 4857731fbca9f316053df8fe57d84871c68b21e6
- SHA512 1ae6f1ea21f67affb439470352545c898d3ed395c654b2da4dc92efbf8fb22348602ce56e438d312495b5efcb3656fe9368c42e7aaa76906467be883250ca360
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0ya:A3k03kHRFfkZcBrO1lkNa
- TLSH T1E9B53A12F6B84B66E0B7C174C9E6A656FA323C465F3086CF13449B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.7MB
- SHA256 5628c88c3735f0dcafac3398b14f0dfabd1b35d7b6330c374af8d34b2e59814a
- MD5 6150743c79cbe82a718e4757d333d9cb
- SHA1 b158ede016282b3c5940e1763f5b6bcbda0669d3
- SHA512 a1445b6e0a35fb998c1ed168b87bf54b8b960750cf61b5cb5799867efbe7586ec87aa260c43b7240cf7cb9e73f0aafbdce547322b347279b3f53e93b9a841975
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yITd9CHKyao:A3k03kHRFfkZcBrO1lkNuCqo
- TLSH T175D54A12F2F84766E0B7C174C9A6A656FA723C461F3086CF03549A1D2E33BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 8c8c6939ce603e43f81fef6cfaaa7f55233f9bb3a14a36926bb288788decbacd
- MD5 7f0c690aa058087ddd22d870624cca8e
- SHA1 ddbc6244956818da5285e6ef4d7c95c3de32bec8
- SHA512 8f17d51febd35b9fb0534d000f11b407d52022f923b0af146012c4a1d6805557ebe1fb4a0fb3d16350882d799fbb5c30ab8a3d78e5b8cfa751f72b18cb9a2876
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yqPji0Aj:A3k03kHRFfkZcBrO1lkNgjo
- TLSH T11CD53B16F6B84722E0B7C175C9E6A65AF9323C425F3086CF03459B2C2E27BD19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
- Size 2.4MB
- SHA256 6a4f7d72bb5e97956bc7cf6d27d5541cdb0505eb490980c6a0fe31d52ca975bb
- MD5 987cc419a6201c1ae398b743d55ee957
- SHA1 ca061130eead6dc187b1dac158901cdf5cd79400
- SHA512 e1cae997c2325eba8f37654eab7cac8563f909eec2931fee50142a4a7e417675440deeaecc853d22b0f1b69f630ba1bfaeb0152a053371d3cad42f0bf8a040d2
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yK:A3k03kHRFfkZcBrO1lkNK
- TLSH T144B52A12F6B84762E0B7C174C9A6A656F9323C521F3086DF1344AB2D2E33BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.7MB
- SHA256 7642deffea4ce12c4a0108ffad293a6426c07ded41ef64e52710e4840de4cb4b
- MD5 43bc8a87cbb029e062efe22fc97ab1b7
- SHA1 b84ce49ab6ca0ddcbde8eef1fc79e0324aa2cb31
- SHA512 9b01970ba1f2a4448ba7ddcc3529f2e306a1d058adb888bba81d1059fb807be2dfe4b4324a8b09a0278cfaa1b82effa223233312e9a60fe2ff66aff3bba70527
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yxXpiMh:A3k03kHRFfkZcBrO1lkNppig
- TLSH T106D53912B7F84726F0B78274C9B6A656EA727C525F3086CF13449A1C2E32AD0DA35737
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.5MB
- SHA256 9909e6acea444fb2420f7c168c924817455746c9f394f0bc5d3e1f8ef289aefa
- MD5 9848a742d9edc384461b90f598e707ed
- SHA1 adbf764f92dd47b92137636acd207a1f62906ed6
- SHA512 2b72f7069b972add9c95a5e8c132b4003d529e71dcc93cc9e6f7ee84a3f5919600d927d906223c15f9caeba24635e0a4da16225f73321a62cc7942f84d05e7b2
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0y4i2WH3:A3k03kHRFfkZcBrO1lkN4uX
- TLSH T1BEC54B12B6B84736E0B7C175C9E6A65AFA323C425F3086CF13449B1D2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$
- Size 2.4MB
- SHA256 1a97629e7b22f59f7000de4c1043bc76ec6f240716c62bcd3f53d5cc8378228d
- MD5 0c92000362d0f94a8ad25aaf39fc6565
- SHA1 de4103ad6e6c928c0c9ee8978f170e8fd6509755
- SHA512 2d712284cea32346cc8bfd1a5edab2b4dc57e228a7fe491281b795eb0ccad0d9c1f370c6dd2710ba1baf27581982e6d50bfd8611d38c86c640245edce083e30f
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yTccow:A3k03kHRFfkZcBrO1lkNTc
- TLSH T18AC53A12B6B84B66E0B7C174C9E6A656FA327C461F3087CF13449B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH