Analysis
- max time kernel
88s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 17:40
Behavioral task
behavioral1
Sample
2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260528-v855tsht6n
- SHA256 783b223ace19cf0eb57ddc8f85024289892123f807540a1a77bc92dc01a9c8ba
- MD5 e13cd6bf32c012de04005ddec11bff8d
- SHA1 204bfdce0c9ccb76230b07e6069047c07592033e
- SHA512 ea91b6b18033e061b0a8148800531e748846a975064095a6634b8bcfe20e808fc1836fa2605763bcaf850f4755d76bacd3c59fdab38d6b959fe43c613ecc46aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5Tvinrmb:A3k03kHRJB56r
- TLSH T173457B03E6980FA4D11F81749A964662EA777C125F6093CF1358AE153F72BC0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral2/memory/4820-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001b00000002b490-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1596-13-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4820-76-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1596-77-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028e1f-1264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000027a15-1432.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a9ed-1429.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000027a0f-1495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0010000000027a34-1540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0019000000000478-1958.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000025df9-2101.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002a000000000478-2093.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001b00000002b490-7.dat aspack_v212_v242 behavioral2/files/0x0002000000028e1f-1264.dat aspack_v212_v242 behavioral2/files/0x0007000000027a15-1432.dat aspack_v212_v242 behavioral2/files/0x000200000002a9ed-1429.dat aspack_v212_v242 behavioral2/files/0x000e000000027a0f-1495.dat aspack_v212_v242 behavioral2/files/0x0010000000027a34-1540.dat aspack_v212_v242 behavioral2/files/0x0019000000000478-1958.dat aspack_v212_v242 behavioral2/files/0x0005000000025df9-2101.dat aspack_v212_v242 behavioral2/files/0x002a000000000478-2093.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1596 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4820 2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1596 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_e13cd6bf32c012de04005ddec11bff8d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4820
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1596
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 1.1MB
- SHA256 783b223ace19cf0eb57ddc8f85024289892123f807540a1a77bc92dc01a9c8ba
- MD5 e13cd6bf32c012de04005ddec11bff8d
- SHA1 204bfdce0c9ccb76230b07e6069047c07592033e
- SHA512 ea91b6b18033e061b0a8148800531e748846a975064095a6634b8bcfe20e808fc1836fa2605763bcaf850f4755d76bacd3c59fdab38d6b959fe43c613ecc46aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5Tvinrmb:A3k03kHRJB56r
- TLSH T173457B03E6980FA4D11F81749A964662EA777C125F6093CF1358AE153F72BC0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 1.2MB
- SHA256 0c6b10a90b9eebcb57c767ed110561b9b5607a81e2114b7904a3f2a02619b8e9
- MD5 f4ea1496a1e359c17e169815e9770496
- SHA1 852a3c10f3b80b7ac4b05d584edddde66b2bf9f4
- SHA512 d5a55a8eb099a77567ed91b1515250fb131d2a8deee17e89e9b179cb2bb194c7410f67a98c1213fef41fad5fb78f82e8f198cc55a2ca370597991f4ca6bbce97
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5TvinrmbxP:A3k03kHRJB56rw
- TLSH T14A457C03E6980FA5D11F81749AA64662EA777C125F2093CF1354AE153F72BC0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$
- Size 1.4MB
- SHA256 3bb6503bd1ce01adfbac51b914e377fccc78e19ceb04c7141b400afa2d09ff01
- MD5 df8510ab26bcc2bb4e6b46e96d4dbb4e
- SHA1 ce7153f5e700cc0cd4e6b019bd24c10e1baae7f8
- SHA512 f1e817cbb382943d16dca8d030d529f3c7fed262f74b67f511b5fb90ddd6c098daf1dccbf6022a8e5980673a06d5614e27fed68b2e94d05d3ecd34e7f5f1b837
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5TvinrmbE9exZCB86:A3k03kHRJB56r/eS3
- TLSH T145657D03AA940FA5E15FC17499A65626E6777C121F2093CB2364AE193F327C0AF3E357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.3MB
- SHA256 0b85d585a1f42763d348c9f154756a56857d535d9d916dedc17c801c947b4978
- MD5 c93e7511776d06af95dc1801480ced80
- SHA1 ae3c3adad686d8fe58699f1187b2e87495f0fa30
- SHA512 e4097263344014560db51568583320df886351405a5547b386091113f69f0f09628f0ede80660d61dc3c237657cc4ed0e088624bfe3c29ecf71c659fc145b5c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5Tvinrmb/hk:A3k03kHRJB56rIW
- TLSH T1A4557C03A6940EE8D11F81749A954622EB737C161F6097CF1364AE153F72BC0AF3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.6MB
- SHA256 3809c18f195f9795ec861af6e80b78ec2a7a465f9cf17a4a7d6363b3b9a2a237
- MD5 ff028903b5501a6d9a9f87d2c856d1d0
- SHA1 3594a2b2cd84b058b194e5bbb23ad3b3d7b47920
- SHA512 f11afbfc89143bee4efd5f6ede6c872fa0ba4d3526c961f0e333b2207b8a54b5403516b50d1ae9adf12bcb57ab525a539d8a009b8124b836d7528593bb6a6848
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5TvinrmbT3Td9CHKy7GZO:A3k03kHRJB56ryTd9CHKyao
- TLSH T1C0758C02E7D40AE4E16FC23499A64522EA777C561F2097CF1364AE153F327C0AE39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe$
- Size 1.3MB
- SHA256 0095a5505a88d140ddc0a48f2c3cbdbff15a24be39d8ac1db99ca9f68b55d0dc
- MD5 7ba6784b516cf6ea029493d15664d7f9
- SHA1 9dcac47966eda3c29ca46b532f221ea19ae3274d
- SHA512 57ad084d17927ac5aff74e7a41b38a4469aaaef87ec85d32c0abd030cef9e398d1869d8ac57ba11d40565475e6453fe1318562045de6d95b5a526935e5bf3c8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5TvinrmbqGen:A3k03kHRJB56rWI
- TLSH T1AF557C03A6940EE8D11F81749A954A62EB777C125F2097CF1364AE153F72BC0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.2MB
- SHA256 7d5c5e41772dfd9ef513ac835ef002f69a75359e9c33c35edb41e6ee6689028a
- MD5 73feb2e6270e5bb044619456ec72007c
- SHA1 7e2cbb8a3a8e9330ae1f0086e9d34325fecc42ff
- SHA512 f1e5164ed1eb39382ea56455c1534433b66c89865d001532d24d08e37ee401a091fb070d3fce67af017dcf46efff9b787797e916cd868eb7961c8f5a33688f88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5TvinrmbLF:A3k03kHRJB56rc
- TLSH T18C556B03E6940FA5D64F813099964A22EA777D521F2097EF1368BF253F327C0AA39357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.4MB
- SHA256 e670746dc4e452fdb0eed8a172411140bbf8fa77f31dba52a949988772f0724c
- MD5 73066542c9543a29f4bdc0e3ec1b5154
- SHA1 2cbdb6dd9f474e185f49f8f65b3eaa6ca94c2e22
- SHA512 7c6c72fe5155e234afe28c3b23d8b4d41403b2f431dcacaaf0fe8f9de166e6dd853af9951a36f6e0d8c5dfae347f4eb03f9edcf5ab533dbcd20811f5a567df54
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5TvinrmbMV+PAk2hMH3:A3k03kHRJB56rNi2WH3
- TLSH T183659D23A6980EB5D11F813499E54626EB377C125F2183CF1354AE193F72BD0AE3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 1.4MB
- SHA256 e90bc958d2c705e2b10f0adb2d8787d80882014ecf559efd70892de1f43811c4
- MD5 512738b0c47d9f94985bb270cadcc747
- SHA1 3e3c43254c4d30a377642a9f90f4d18345d75509
- SHA512 0501d0182fd6fbfc741bf7062ffbc1044b619fd5d82e78219d2682303c1091ecfb21265ddc68d34920f130e1f201015bf2c220b995f1f59d35666d2bc109783f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiTPelc5D5TvinrmbLV+PAk2hMH3:A3k03kHRJB56rOi2WH3
- TLSH T1E5659D23A6980EB5D11F813499E54626EB377C125F2183CF1354AE193F72BD0AE3A397
- MD5 SHA1 SHA512 SSDEEP TLSH