Analysis
- max time kernel
106s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/05/2026, 12:23
Behavioral task
behavioral1
Sample
2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.5MB
- Sample260525-pkgvfafw8r
- SHA256 14115b4da45b82f4bccef541fef0d7593da18f788bc372454b4b5ca043aab52d
- MD5 29b66b0ec5ffd2514366b48d738067a1
- SHA1 1b93ca7fb37fe4142a19a345af423b35373545ef
- SHA512 32f23b35478e911a506157fc49ad8acec0f76fcd6c51a359f177ec9e9f87de315f7cca1d7c2fe0207ecc479a1802248059bb77afc4b71036a1d05a86cc712442
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbC:A3k03kc/vBFfkZcC
- TLSH T1B8C51816F6688332D0BAC075CBD6AA55FA7338410B708ACB1385E73C2F376D19676726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 14 IoCs
resource yara_rule behavioral1/memory/2416-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233ae-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4524-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2416-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4524-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000001f2c0-126.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fa-535.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021a64-979.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021f3d-977.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000020310-1378.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000231af-1647.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e50f-2062.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0009000000024633-2091.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00020000000233ae-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x000700000001f2c0-126.dat aspack_v212_v242 behavioral1/files/0x00020000000212fa-535.dat aspack_v212_v242 behavioral1/files/0x0003000000021a64-979.dat aspack_v212_v242 behavioral1/files/0x0002000000021f3d-977.dat aspack_v212_v242 behavioral1/files/0x0008000000020310-1378.dat aspack_v212_v242 behavioral1/files/0x00040000000231af-1647.dat aspack_v212_v242 behavioral1/files/0x000200000001e50f-2062.dat aspack_v212_v242 behavioral1/files/0x0009000000024633-2091.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4524 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2416 2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4524 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_29b66b0ec5ffd2514366b48d738067a1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2416
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4524
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.5MB
- SHA256 14115b4da45b82f4bccef541fef0d7593da18f788bc372454b4b5ca043aab52d
- MD5 29b66b0ec5ffd2514366b48d738067a1
- SHA1 1b93ca7fb37fe4142a19a345af423b35373545ef
- SHA512 32f23b35478e911a506157fc49ad8acec0f76fcd6c51a359f177ec9e9f87de315f7cca1d7c2fe0207ecc479a1802248059bb77afc4b71036a1d05a86cc712442
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbC:A3k03kc/vBFfkZcC
- TLSH T1B8C51816F6688332D0BAC075CBD6AA55FA7338410B708ACB1385E73C2F376D19676726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.8MB
- SHA256 8be66aa0a473d3fefb633d101e42903017d36c154028aad45816a117b36d5a11
- MD5 bd5575dd4270e99b7b633687da1f46a6
- SHA1 9f3e698cc8f4fccb33540a8ae1bc554f8af0e741
- SHA512 56b9712ee3be36f495f22cbc1808fd2535d958a3e2b08a092dbcb329f14950d3510172455a14ebdc953c532a3549db193d7db2bbbbaeec5591b674446616f3d0
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbqUN+Eir:A3k03kc/vBFfkZcuE
- TLSH T1E7D53916F6788762D07BC079CAD6A759FA7338410B708ACB1285E33C2F376D59936722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 3.1MB
- SHA256 4830839a8c54ab411ddf600f0eef5bca2b850f29ad00889aa64548d3df0ac1c1
- MD5 71a33c135f70cb465284eac8ab9ee0a1
- SHA1 cb64b39b148d721d25cdaad4f7ff0d2a9124900e
- SHA512 0de97e44815bfcebb4acd625486ee7a26bafe0abac6376412bc2f6b131f50557d50d4755fa3b052e45e2c3abee0e522ce7cfae40bb746f1be65a8b1d09fbe1f4
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbuUidGl:A3k03kc/vBFfkZcadGl
- TLSH T109E53A16F6A88372D07AC075CBD6A655FA7338410B708ACB0385E33C2F376D59A76726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.1MB
- SHA256 da1784f4f7ee5c5f0beb6ad327272f1b6b109d5818d2d06006d734f4a30d79b4
- MD5 8a36f43f4fe50e1a4c559b034f08cc54
- SHA1 fdd76e5b0db9ef30931b95c7ee2b1baac60c3495
- SHA512 beffc0be16e78bb8b7f8c04316a35b592378d7d6af05b300332b3e70ae7cd4d24e660dd561d898c1604308a5eb131008eef63512182f0e8a63ca3cdd5323d6ff
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbCPji0Aj:A3k03kc/vBFfkZcIjo
- TLSH T133E52A16F6788332D077C079CAD6A699FA7238414B708ACB0385E73C2F376D59636726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
- Size 2.7MB
- SHA256 6cd2c2e408710148b39f405d2a5da0fecc82bad4b9f993778e926cb4889e6e23
- MD5 9950a860aa0021399636f17c48aa83a4
- SHA1 5aa2b6d98576aa5039bd6067dbed0f240e934a7b
- SHA512 27ddddc97ee9c4eb1980cbc66a648373393d4af979c244aeac6d4c838160d25bc367a76ec0a0318b2004bc2534bf82002dc39ea9e559b99a724063d186a8630f
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9Mb/:A3k03kc/vBFfkZc/
- TLSH T141D51816F6688362D07E8075CBD6AA55FA73384107B08ACB02C5E73C2F376D196B6727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 2.6MB
- SHA256 9733224fbd2a868eb5bcee3b8c167e78238c5c79b30c54425ddc41e269392df5
- MD5 bf5835209e3a0589fb011dd8e5d23747
- SHA1 14d21679b1cfef6d3b362f3f9ead20b82cfe6b23
- SHA512 7b8e96fafdee89d877da04716691abc6c713d6c508cd7df41a33873da15cf4491567bea4b87a8037621837da7f999b6925f66762110e211951e87d44d43ea118
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9Mbo:A3k03kc/vBFfkZco
- TLSH T19EC52816F6688332D0BAC075CBD6AA55FA7338410B708ACB1385E73C2F376D19676726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 2.6MB
- SHA256 13a33a371da3897266711646da2508d2ed758e39a76d185078b37641b5d7caa5
- MD5 f3fe15d915b9f444fccff0c36427afb0
- SHA1 fc94faf20d72e3d15d95c7e62e1d4bba0995ddaa
- SHA512 39de358f90f135c24e7183a3e6dc11b2c59964f2ba1e4428dcb5d1d476f1f97730a79c1a0b466420f4924dd901086fc65c215c8bda52774e254ddb320d386f1e
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9Mbv1:A3k03kc/vBFfkZc9
- TLSH T183C52816F6788322D0BAC075CBD6AA55FA7338410B708ACB1385E73C2F376D19676726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$
- Size 2.7MB
- SHA256 4f07c38c26f9159621ad0fc3905af8a84b737973bdf656e877679953b42fd0b9
- MD5 628b4560226a192e2c4678470676dd72
- SHA1 0366b534be1f7de83e46210ccee48699371acaef
- SHA512 528cc626b87ee283ca8e89dc64985386c76b6cfdd1e966da123e83c416c4f20316011b2191408908a7b5749c95d4a944510ecf08582c1f0def76b6532f736798
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbgdSZ:A3k03kc/vBFfkZc
- TLSH T1C0D52916F6688372D07AC075CBD6AA55FA7338410B708ACB1385E33C2F376D19A76726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.8MB
- SHA256 7557127933e7e06028adb304478d84e2b7f59be7ff80cae8d495c6acb92121d4
- MD5 c4421f29207bb8f9b3450f456873167f
- SHA1 4a9a648d3aaec497f8a01e4521baa347adb9e32d
- SHA512 9dfc10eef3c87fe68c65c6a9389ca35efeaae7e866e9d3387a33a0d2bc6aa0129e87f388fe6c5396233458d362fa7af9243f9f4b6a5299927e675ff9ce77b088
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9MbQi2WH3:A3k03kc/vBFfkZcQuX
- TLSH T195D52926F6A88332D077C075CBD6AA59FA7238410B7086CB1385E73C2F376D19676726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$
- Size 2.7MB
- SHA256 a4b99b2e42d5b99a686fea9cdaf45191a5d826f9b301ee6ca5e97d3069a33685
- MD5 6681d5efe7750afcc32ebf52bc45756a
- SHA1 e0ca3b82656a154ca38673b167871ff92e173a44
- SHA512 b28c68fde710f234d1bc4345c2c652c0cdb9b6a1078dd71df3501a50fcb27debe5bc35cf57b56725ac613f7a4286c7bf1815c49b03d333036b1927c8874c7d3d
- SSDEEP 49152:A3k03kD4U2v+oqJtb2IEeW4SkZP4sz9Mb2IiGQ:A3k03kc/vBFfkZcy
- TLSH T176D52A16F6B88322D0BBC075CBD6A655FA7338410B708ACB1285E73C2F376D19676726
- MD5 SHA1 SHA512 SSDEEP TLSH