Analysis
- max time kernel
108s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
27/05/2026, 15:07
Behavioral task
behavioral1
Sample
2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 1.3MB
- Sample260527-shetvabs3s
- SHA256 6fc78c6f8551ffc3e69a170170fe0ae6acb94b29df97d1c80e5aed2d866b8517
- MD5 0711fc9b19bbb59287deb100dca075be
- SHA1 51cd90ebfdeec419f40dc2c1c38789691b716a89
- SHA512 4be5b12e9fbdadada1ea58d8ef8f64512585e922785b581a37e1fc152af447644e3b53477b42b8328b25c79d37280e721c585e74b8f5b64c8b933f70c9b45b5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9RfkX:A3k03kHRJARJRZkk
- TLSH T1A1657C07EB9400F9D15AD1789AA68A32F776BC551B20A7CF1364C61A2F73BD0AE3D350
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral2/memory/5036-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b48d-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/940-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a33d-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5036-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/940-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f000000028e9c-1259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001100000000eeac-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a3e8-1535.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002aac2-1632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0012000000000476-1868.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000026759-1979.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000025ada-2120.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b48d-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a33d-12.dat aspack_v212_v242 behavioral2/files/0x000f000000028e9c-1259.dat aspack_v212_v242 behavioral2/files/0x001100000000eeac-1372.dat aspack_v212_v242 behavioral2/files/0x000300000002a3e8-1535.dat aspack_v212_v242 behavioral2/files/0x000400000002aac2-1632.dat aspack_v212_v242 behavioral2/files/0x0012000000000476-1868.dat aspack_v212_v242 behavioral2/files/0x0003000000026759-1979.dat aspack_v212_v242 behavioral2/files/0x0005000000025ada-2120.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 940 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5036 2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 940 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_0711fc9b19bbb59287deb100dca075be_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5036
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:940
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 6fc78c6f8551ffc3e69a170170fe0ae6acb94b29df97d1c80e5aed2d866b8517
- MD5 0711fc9b19bbb59287deb100dca075be
- SHA1 51cd90ebfdeec419f40dc2c1c38789691b716a89
- SHA512 4be5b12e9fbdadada1ea58d8ef8f64512585e922785b581a37e1fc152af447644e3b53477b42b8328b25c79d37280e721c585e74b8f5b64c8b933f70c9b45b5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9RfkX:A3k03kHRJARJRZkk
- TLSH T1A1657C07EB9400F9D15AD1789AA68A32F776BC551B20A7CF1364C61A2F73BD0AE3D350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.1MB
- SHA256 1eb2725fab8e2fee3e01631d434a9ced383b37107870ce7f52635d5d897eee69
- MD5 3f875c9f59fb6e681b0de183d35529d1
- SHA1 c3a9dfcaa0fd5666af0145e078bcf59530e40c04
- SHA512 d0deae898023f52045afd25c75a583a82c90d4678dd69148fce899e7b4275718d80d854ffeae4ca23baa2c63d18e997c516f204bbc978ba5a17bfb21d34b77ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9Rfk6VkGDvQGs94iGWt:A3k03kHRJARJRZk1Vk0QGTvntQb
- TLSH T1ACA56C17E7A801E9E1AAD27886678523F7717C561731A7CF0364C61A2F63AE0AF3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe
- Size 1.8MB
- SHA256 cf29b4e10b6a1ed2e0c710a9034e6dfaec36b7f0b78e48bb5b66928ffcccd7d2
- MD5 b1a6e2e67d0083669506c2dcc83209cb
- SHA1 03e72c2f57a4074631d1b5d8d63334ca4303b300
- SHA512 9410484b0dca4c21dc73e80f3a887f57de091da028a5b03b53059db1ca0bdbde7a9655c24421c931756b61fe6fa5754616124874e89d7923d42feb889c4e9df6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9RfkH3Td9CHKy7GZO:A3k03kHRJARJRZkqTd9CHKyao
- TLSH T177957C56E7D400F8E167D23489A68632E776BC551B309BCF1364D61A2F33BD0AE39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.4MB
- SHA256 edaebb7ee71f15e11a5f7137364373d6a3d3026ff6a35d9aa2aab155fad29403
- MD5 c5f05762897eba7530c049bd4c3f0082
- SHA1 3de8ae302b0857fd6d0789a3af45dd893dca6c08
- SHA512 de6fe8294bea1410e7d2cafcd391e088eec1d21ee3cc4069e8c62c88ca336c5b886fa7addadad656f4fbfd501362eaecc03596a6e0e4dd1242a7918105fa1a1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9RfkpbBPzBAU:A3k03kHRJARJRZk4BPVAU
- TLSH T1AB657C07E79400F9D15AD1388AA69A32FB76BC550B20A7DF1364C61A2F33BD0AF39751
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.5MB
- SHA256 5aa2f75503443c57615157be0956017e61b99947fdf0814a40313c3958736d96
- MD5 068c0b5167a0b9d689160b038d9f606b
- SHA1 d98660228cb8c35f2e3bf762f25a818755f7e806
- SHA512 fb6c37525b138cc8e024314b029ff90651552799d469aa46c36bfca392d9d97233c99b396ade47a3c2e4952b5b36f581a2c03ca27c3074042a6208f9ab1fcc1b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9RfkNTjE:A3k03kHRJARJRZk6w
- TLSH T13C657C07E79400F9D15AC2788AA68A32F776BC551B20A7DF1364C61A2F73BD0AE3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 5f7790b81e3805cc1fe59e305f8d188ac6dd87374e710df7a183c08470037bba
- MD5 aaea2aa68547567941a7eb7db725831d
- SHA1 66cb768b2600d350e8138318006e168b33b336c4
- SHA512 5edaa1451a55dbebef51c721ca365084a581cde7bf276f52365148ded61d8e2a97859cd7c87b49f241626cb20a73452d2f4d3a7823a75091b30f0970bf042e11
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9RfkT0Le5ji0hmxNrM:A3k03kHRJARJRZkcPji0Aj
- TLSH T128956B17F7A442B5D067C178C5E69666FB7278860B3097CB1394C7292F23BE19E3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.4MB
- SHA256 835c9b6e432147cda3f2db4cb2eacdce0bce2e68a340abcf1a5aa4cd98d3fdf0
- MD5 287de4f46e9d65850a3bb13a95c815cc
- SHA1 ceb747c91a090c04bd61661fe3e895ff68ebf10e
- SHA512 a84ddb3476ed77a8117ccbc1eaf3538c42d0d327c53b9b350351779fe829c96170ceab306a42dca9a8ff7795f37aaf46265e6605b03a9c1e77131bc4dcb7a77a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9Rfk/F:A3k03kHRJARJRZkU
- TLSH T154657C07E79400E5D65A9134C9AA8A32F776BC950B2097EF1364F72A2F337D0AE39750
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 1.8MB
- SHA256 a29d011a44b361e82d1ecbae6ceabd251616eaa3a112e1a064d18a2801aadd54
- MD5 c9dfe8e4599d37b1a9c5460ef3eae7d2
- SHA1 febf7de94800bd61a5c1915f02181354cce6800f
- SHA512 337288a8b2dc1546135c794b5e075f9e011c5ad95daaab13805dda295453ebd1cba7d63845716118bf5bb6b3d1b12e367bd7da1410c8b3a5f6d0e30b2a97ddc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9Rfke3npi63iC:A3k03kHRJARJRZkfXpiMh
- TLSH T135856B03F7E840B5E1B792349AB58632E776BC511B3097CF1394C61E1F72A90AE39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\GroupUse\AssertGroup.exe$
- Size 1.6MB
- SHA256 b18f239456a14d100161ef2683a6b02158133a8700263f7225b7670a0bfef37a
- MD5 1000422c052a3f89c928e7ad5dabedb9
- SHA1 6792cf616e519391c6a1f4b86c694aeca492d929
- SHA512 4f5c1f9f0b94ec622449fc71ff8b05fab506f07e3f7a75776c67f3e49bbe110bc18bfe6692e050b4e6dbdf603dc42068e5fd76903726df6a8e3f410c11755895
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEoZ3LaEoqZuqZM9RfkPV+PAk2hMH3:A3k03kHRJARJRZk2i2WH3
- TLSH T1F0758C13EB9800F9D15B81388AAA9636F776BC550B2097CF1364D61E2F73BD0AE39351
- MD5 SHA1 SHA512 SSDEEP TLSH