Analysis
- max time kernel
119s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 00:48
Behavioral task
behavioral1
Sample
2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260529-a5secafs8t
- SHA256 403e585cb7b81a1d5cbaabec8f8313e292360f6e2ac404056f863b0a6bef80e9
- MD5 07251cc44f2efcdf380e365e667f5098
- SHA1 e424503699f50fccbe87b4d04a93804c97e0deaa
- SHA512 467ec5e3c7addd73450fdb6e242cd9d1dc83b8b5c0b97e21f5025582f4d050fa41aa2b5f70dce3c453c37f990f18b8e5e14557a668714484c1b9d93c861f113c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyE:A3k03kHRJhpYq
- TLSH T116658D17F6A445B5D063C1B9CAD29A66FE7138461B3097CF1358C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/3296-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001d00000002b581-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1228-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a411-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3296-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1228-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000029d41-1263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a85-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a787-1878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a87c-1934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1989.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00170000000004a7-2096.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001d00000002b581-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a411-12.dat aspack_v212_v242 behavioral2/files/0x0003000000029d41-1263.dat aspack_v212_v242 behavioral2/files/0x0008000000027a85-1377.dat aspack_v212_v242 behavioral2/files/0x000300000002a787-1878.dat aspack_v212_v242 behavioral2/files/0x000300000002a87c-1934.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1989.dat aspack_v212_v242 behavioral2/files/0x00170000000004a7-2096.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1228 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3296 2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1228 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_07251cc44f2efcdf380e365e667f5098_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3296
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 403e585cb7b81a1d5cbaabec8f8313e292360f6e2ac404056f863b0a6bef80e9
- MD5 07251cc44f2efcdf380e365e667f5098
- SHA1 e424503699f50fccbe87b4d04a93804c97e0deaa
- SHA512 467ec5e3c7addd73450fdb6e242cd9d1dc83b8b5c0b97e21f5025582f4d050fa41aa2b5f70dce3c453c37f990f18b8e5e14557a668714484c1b9d93c861f113c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyE:A3k03kHRJhpYq
- TLSH T116658D17F6A445B5D063C1B9CAD29A66FE7138461B3097CF1358C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.1MB
- SHA256 97dec2ed538b451d80da93a25727449c99aaa440a2c45d09a2885aa935b7e12b
- MD5 40298c487c2026f2da8bda6ae9660756
- SHA1 a4f02c62e225db6701f5161b0295140ffb7ec8bc
- SHA512 41bf62f10b824537af0154e9e1cef2acf31da1341eaffa0c15dbdea7f04b40019276b487467e2c6fc1855e62209dd1407e0f5c3c3532eb1123bddcdedeb957e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyEqVkGDvQGs94iv:A3k03kHRJhpYqKVk0QGTvntQb
- TLSH T1F9A58D17E6A802E5E07AC179C6979657FA713846173097CF03A5C2292F63BE19F3E360
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1.5MB
- SHA256 b26f2a7536820d6691403a57ea1751a0222873f07af4e3d52bc05bc01ad879a8
- MD5 e1af4daf4ade5b4fae6f4401f2403240
- SHA1 0828082dcb876445c0be23ed4f9f036d9800e047
- SHA512 56d387094ebfc4349140f9b74c0c0501dc45f1513df68ebc3060273cae5555cae6f6776772a3e6ce02f9aa73bfe16ab01cc0a6eba4433a84650f8fbfaae7f3d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyEZbBPzBAU:A3k03kHRJhpYqtBPVAU
- TLSH T19D758D17F6A445B5D063C174CAD29A66EE7138461B3097CF2398C3282F23BD1AB3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe
- Size 1.5MB
- SHA256 3d74d2ebf1c20e52a5594d05986dc0e23b11d18482c280b98ce50b9cbf6b979e
- MD5 d12b6290afe1dacceed787ab8c904c23
- SHA1 31ab996c6df13f544eb897828ba6a04d30e073da
- SHA512 2d263b7ac0a4836c19377e54d8e4083c9fc33306956b0d8690a5cf30a266bbc1ca2befa61c093b79fe5481a50345f78227272c1cb261bcd2c0964ae2c6a3fc08
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyEeGen:A3k03kHRJhpYqZI
- TLSH T112757C17F6A405B5D067C178CAD29A66EB7238461B3097CF1358C3282F63BD1AE3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 fc6d03fd8a34b49eee0c8068ed45b073a54f8d50eacc48120c855927777f6968
- MD5 cd8019cef45b964ddd0094569bd500ec
- SHA1 92b528e6ea120f436ca8c31887a716f7d23f12fd
- SHA512 b6827e8b8278edca78a059085888feb857a8c19ad134577836015c1636149e21fb0a8f2d5925a161e1b1a261718720154d4fe95ee2df09b750c7f5f7989d67db
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyED0Le5ji0hmxNw:A3k03kHRJhpYqjPji0Aj
- TLSH T14B957C16F6744275D073C0B9C5D2A69AFE7134861B308ACB1389C7283F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
- Size 1.5MB
- SHA256 d776e253a8a0a12da87e17c8f1c6c1548e171eccd8c0248ed2b47565a00d6b62
- MD5 9a3f1bedfa187256ac7137c876edb8da
- SHA1 e306881c2ee6495b0cac66af39c2d31c61da23c4
- SHA512 ce943ff607c9c88b0cf9ddf3c697c5e146e83f5c9d602116d41fdbcdf1e5f175ae76292787e3940fcb1cded115ba7bd3244bb8a68a0a20be1e0d2129f17a931e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyEPF:A3k03kHRJhpYqt
- TLSH T11D657C13F6A405B5D063C174CAD69A56FA313C861B309ADF1358F7282F33BD1AA3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.8MB
- SHA256 78e7a4b8cad7cbe7d5f2a02fc5ecf53785e5cad57c92cf22ae874c83b2ce9b72
- MD5 e2761c9553688fdd840dc71d95561ec6
- SHA1 ef61af02580a04b262fd66a1330e68fc23ba016e
- SHA512 5772410cda06da6cc085b3e0cf83318b623f9ca926366477827d0318e98c828685459432426957782562b9d1a38c1271470218f47f9e32af5bf94a7dadf63a02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyEu3npi63iC:A3k03kHRJhpYqOXpiMh
- TLSH T1BB956B12F7E44175E0B38274DAE29656EA767C525B30C6CF2388861C1F72BD0EA39772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.6MB
- SHA256 50b917c3ee093d5a3453b146edf699299fe6a4a8ed3f32bd9f3c6746a6db2e8e
- MD5 5a12650e88dfb9f184b1088bce7a83a1
- SHA1 09d1f0142dc4395f17a39e9cabceb6c4b7fa259f
- SHA512 0a053605a7dd278bb9a40f467a32784ad8e7b9d85db846956935cc790ac8af829b48a2a7dbaf98c9e7fdb5c1a1cb189d2a1c7a7139cc6336ade59d70bdfc4c55
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkiaqv5jcAkSYqyEfV+PAk2hMH3:A3k03kHRJhpYq/i2WH3
- TLSH T17F858D23F7A445B6D063C175CAD6A66AEA3138421B3086CF1358D32D2F63BD19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH