Analysis
- max time kernel
119s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 01:40
Behavioral task
behavioral1
Sample
2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260602-b3vmcscs9m
- SHA256 29bc0977ac6564cabfec43137090cdaf178573f0db7bb2d9ddb9c1d33b12dc19
- MD5 81b607f2a4d5e2fef25c92be0cab71eb
- SHA1 9fe8466493caef63b85600e5f12295273bbe73a6
- SHA512 1d1b2a9c22d1c8f6f5664727ecbae6468a24e34f375732a8d5d1f3274aac8c89471d3ed19c706d0e78e62e50fb8824bc69a77e76ab916cdb5fc53fc875fef072
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyE:A3k03kHRJ7pYqqpYq
- TLSH T147957C16F6644675D073C0B9CAD2AA5AEE71344617308BCF1389C7282F27BE1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/2108-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b401-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4280-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2108-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4280-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029db3-1294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002200000001a60a-1555.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b40f-1598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002a8e3-1659.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1988.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025aba-2101.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b401-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x0002000000029db3-1294.dat aspack_v212_v242 behavioral2/files/0x002200000001a60a-1555.dat aspack_v212_v242 behavioral2/files/0x001a00000002b40f-1598.dat aspack_v212_v242 behavioral2/files/0x000400000002a8e3-1659.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1988.dat aspack_v212_v242 behavioral2/files/0x0003000000025aba-2101.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4280 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\WeatherStub.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2108 2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4280 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_81b607f2a4d5e2fef25c92be0cab71eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2108
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4280
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 29bc0977ac6564cabfec43137090cdaf178573f0db7bb2d9ddb9c1d33b12dc19
- MD5 81b607f2a4d5e2fef25c92be0cab71eb
- SHA1 9fe8466493caef63b85600e5f12295273bbe73a6
- SHA512 1d1b2a9c22d1c8f6f5664727ecbae6468a24e34f375732a8d5d1f3274aac8c89471d3ed19c706d0e78e62e50fb8824bc69a77e76ab916cdb5fc53fc875fef072
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyE:A3k03kHRJ7pYqqpYq
- TLSH T147957C16F6644675D073C0B9CAD2AA5AEE71344617308BCF1389C7282F27BE1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.3MB
- SHA256 74584ed3fbd325f10cc4c19de6784f2af08722c815a5b93b07a3ca50f26db214
- MD5 18b473149578ef814392a5c634602a0b
- SHA1 3d8c731d54f0b1e33b0199852d90e45ae892b8a0
- SHA512 4d0f1b1b581033e267758174b367c81ef9c4e1eef31e635f7c9cd6760c993e7eb2ddb44e1050bad6c9a348d3eee88f78c10b8c59cbfaac384911d598c8f6637d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyEfM:A3k03kHRJ7pYqqpYq/UidGl
- TLSH T125B57C12F6A446B5D073C178CAD29656EE7234460B309BCF1399C3782F27BE59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 2.3MB
- SHA256 2c0ba8ac02296daea9a216aefb9c0aed60ac2ab8b27ec8cfd1305bd134105b5b
- MD5 7c4460c66f94aad2a7b1ed4752316302
- SHA1 e858e7c2f9f3723815908a5900c1ec65eabcee55
- SHA512 4fff941568339c138572ddb3722dd0c596d9adb164029b93a66fd4e1a85026d1df30309fdd1f054a66691ec7b3000ba6e867900fc49320f621268d59633328b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyEeK:A3k03kHRJ7pYqqpYq+T9t2
- TLSH T147B57C16F7A446B5D073C179CAD2965AEE7138860B3096CF1395C3782F23BE19A3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$
- Size 1.9MB
- SHA256 28c7e14d041c676e5890ee23bc611b4c7b189521aed2ef4c872ea676e22c0d78
- MD5 0952d3346cde0fca99e783a885874f6b
- SHA1 eda3e12a79a24ebab3dbe668db8e931d283af336
- SHA512 71dd334f722807f8080af9146a7d406cddb82e3fa1bba6f40bb3926be515b119371e0c6ff0df86bc5c4505fde1a18c4be17bfad19fd85cf944a974ad4e4a0be7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyEdc:A3k03kHRJ7pYqqpYqdw
- TLSH T1F6956B16F66446B5D073C1B9C9D2AA5AEE31344617309BCF1399C3282F23BE19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 f2843a026d0331f9fdde92363d28281ae9ebf24851c2ca94ef88ea95f8f03458
- MD5 74e3fd8c008a6c3f2ccb8d3c87969dc7
- SHA1 823665140a5e4e489560e954d26e4e5ef78ab275
- SHA512 2073db6fe79869ef0422fb7b9447aee4956df2f550dd552026a86d393f864a70507313a1f9ed5fc6bfba76af91500d86874cc571f6397057de95b5c66a824cf1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyEDD:A3k03kHRJ7pYqqpYqjPji0Aj
- TLSH T173B56C16F6744275D073C0B9C5D2A69AEE31348617308ACB1389C7782F27BE6DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 1.9MB
- SHA256 e7d74c9762ac12288bf054002c5551ab81f8e2a8aa4dff48d333a415b6fcc4d5
- MD5 1704b7ed6b888afed638ac0f9c871fbf
- SHA1 7b83c9322f5b2bdba556ff1e637ac06e65f1c91d
- SHA512 5a76c49b5e27aed0fb157b76d6674c8ffdeb41a1d1a0c63ac567610b76afa2114f20ccbf416f7366d182d4d3b7779314952a1acad8c1a9b20111f03d2e1e8530
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyEPF:A3k03kHRJ7pYqqpYqt
- TLSH T1CB955B16F6A44675D073C079C9D2AA56EE313C860B308ADB1399F7282F337D19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.3MB
- SHA256 9461f5b6459c0ee8903390f31743cebea50d0a4d749b258198320f0a92b9993b
- MD5 1d995f229095b6eee00675e9e5d88f3c
- SHA1 d363fa513753cc108454595299d82375035eae1e
- SHA512 efd1e26136211ac0e9df7f2ec6e19559938ffb48a0762f52058f6b552f6e92ad7ef41c40f97ba930a40b792429184a6e2343567763a5510e0f9da725b2604374
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyEuJ:A3k03kHRJ7pYqqpYqOXpiMh
- TLSH T18FB56B12F7A44175E0B3C275CAE29656EA7238425B3086CF1389D62C2F73BD1DA39772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 2.1MB
- SHA256 212783e1217984154516d010ea78653f3a2fb8276c9cc789d1c7f802e7e94364
- MD5 3b76d4201a3ee5051e73423424a384a6
- SHA1 cdef215867354f5a16bb5ebc9a770b44c939afa8
- SHA512 a34705b3a7fd6bff834af07544540b761d4cf939ec6cefe4a7209d2986a4176d7a8986b4ee1b29f89a8719fc9d14e7cd391b26096a51ddfaaf1fa03964145782
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaidkOdC45jcAkSYqyE05jcAkSYqyEfA:A3k03kHRJ7pYqqpYq/i2WH3
- TLSH T15CA57C22F6A44575D073C1B9C9D2A66AEE3134460B3086CF1389D72C2F67BE1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH