Analysis
- max time kernel
113s - max time network
115s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 12:50
Behavioral task
behavioral1
Sample
2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 2.6MB
- Sample260602-p3bfdadw7x
- SHA256 5df3be140a825a425eb72bb4c80b3a51574dc3b3624ab0f6ba9acdf7040ed696
- MD5 de1330664af92f581ee44dadb70e051b
- SHA1 56c8da61c3b19d2694d3a6c77c65752a4dc88684
- SHA512 6e14de8af03ed7de14c888d929dc186bd7e3c35a8ded2f1204ed44c71596122fa349da109264af685d03fe9f7db3a17accb3633e00c23b161fb0a12df1eecb93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzymqzRotKYYTqMi8CtBd2QHCHmTBW5V3NL:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2I
- TLSH T1FCC55B26F6A483B5D073C179C5E296BAFA7238421B3086CB5345D32D2F277D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/4732-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000002b282-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1652-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4732-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1652-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00900000000272e6-1026.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028ddf-1290.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001a60a-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a9d0-1404.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000265d8-1905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000025ab8-2103.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001f00000002b282-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x00900000000272e6-1026.dat aspack_v212_v242 behavioral2/files/0x0003000000028ddf-1290.dat aspack_v212_v242 behavioral2/files/0x000800000001a60a-1392.dat aspack_v212_v242 behavioral2/files/0x000200000002a9d0-1404.dat aspack_v212_v242 behavioral2/files/0x00040000000265d8-1905.dat aspack_v212_v242 behavioral2/files/0x0002000000025ab8-2103.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1652 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4732 2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 1652 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_de1330664af92f581ee44dadb70e051b_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4732
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.6MB
- SHA256 5df3be140a825a425eb72bb4c80b3a51574dc3b3624ab0f6ba9acdf7040ed696
- MD5 de1330664af92f581ee44dadb70e051b
- SHA1 56c8da61c3b19d2694d3a6c77c65752a4dc88684
- SHA512 6e14de8af03ed7de14c888d929dc186bd7e3c35a8ded2f1204ed44c71596122fa349da109264af685d03fe9f7db3a17accb3633e00c23b161fb0a12df1eecb93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzymqzRotKYYTqMi8CtBd2QHCHmTBW5V3NL:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2I
- TLSH T1FCC55B26F6A483B5D073C179C5E296BAFA7238421B3086CB5345D32D2F277D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.3MB
- SHA256 8c48084514649e6ba38e79c9f762b1cd91e86dc8dbdb8e412f70c1338ad5a6b4
- MD5 a81902214005ca3f9efe41798c2a6206
- SHA1 204dbba131354c3efef3b509f8d912cd720a886f
- SHA512 2c2e5e4c37701b4d0a091e7bb60f23aaec9c99d12c8f088bf1122049100cf322e0c96e03ecadfee96f3e3f67aa601fbcec21637251befdb30ed3b8b6e641ace5
- SSDEEP 49152:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2IRVk0QGTvntQb:A3k03kHROzrlHaib
- TLSH T103F56C26E6A843E5E077C179C5E39666FA723842173096CB0395C32D2F677E19E3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe
- Size 2.6MB
- SHA256 c3771c917c57c800efee134b234008bf18e34028e467dd45b696f7fe898192a7
- MD5 54a4537019a8915f1ec7e3d9b39d90c5
- SHA1 b6fc1a9d2caa6bc79e2def3e4e09abacf2909d08
- SHA512 d43570501e9d89d910095c7bee6b3a2676a12aa59c70060efc3f3c41c4d43ec9b63cc455ee8768f0a9113acb9bed6ff8093af34bfe1eca499f07e3261eb625aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzymqzRotKYYTqMi8CtBd2QHCHmTBW5V3NL:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2I
- TLSH T147D54B26F6A483A5D077C179C5E296BAFA7238421B3086CB1345D32D2F377D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 3.1MB
- SHA256 8d98ef9210020bb867093f659c459b6ef2a3208ed6e200e1672827f6801daaf6
- MD5 9602bacd3dd1285efcda1460d4220386
- SHA1 7c7a0c4ed965da57e81f0242719d93fb3f1227d4
- SHA512 77ffa1258595bde3735bfe4da2e953b54ecbbcb0ce3324e9fb814e9143ee487f1f0fa541aa695bc424903ab65cff68c6aec689efeee74c5e420cb663dce8ae1e
- SSDEEP 49152:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2IkUidGl:A3k03kHROzrddGl
- TLSH T140E55B16F6A483B5D077C178C5E296A6FA7238421B3096CF1385D32D2F277E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.1MB
- SHA256 0edcda036ce7490751a100529f53a77667c53340a983b93dd36822c9455d16db
- MD5 f66c01d5af652b000ef03f8c7c8039b5
- SHA1 e1b1dc8d0d6ae4cb1e9ce1042fa151ee29b0e3af
- SHA512 0de2ffb0c1e443a10d9df5118c5467229beaac9d793fb9c7d70ee7027054f0e8379559cdbc23582a88d62358ae890e0ec3a91d20aea24007f437ae69460c5404
- SSDEEP 49152:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2IQPji0Aj:A3k03kHROzrZjo
- TLSH T170E55B16F6B483B1D073C079C5E296AAFA7234421B3086CB5385D76D2F277E19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.7MB
- SHA256 3e0c7d7692121e3ae5b4aaecbe058cd553d8b7f93ccb44749c3b486562d72bbf
- MD5 d8f5581137921c716ad636ee479c3bc0
- SHA1 f80670a6cd42a50df4b10c71a02e417cbc4a4cf0
- SHA512 b1d6d27d2e935c2ee2f747d91a4b836b2e7440c3ca90976378729c62b8a1473d9f193f18ee3a2d8e01c1f205912fe9eebaaaefec6b0ab107fc2252917a358b59
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzymqzRotKYYTqMi8CtBd2QHCHmTBW5V3NE:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2IV
- TLSH T109D55B26F6A483B5D073C179C5E29ABAFA7234421B3086CB5345D32D2F277D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.7MB
- SHA256 e12ddcfb00be4d759c56ba25b6291573bd911a49e6c6ff7936219f84aa687b32
- MD5 69966462af9b26132dd745523210dbb5
- SHA1 7d1466160b8aa63dbb3aea8047497ed93282e82e
- SHA512 14a07f95ab7ea4ef3ba14d3c72023d4bce3974c561446d7ce77d4d18da8e6866dee1b419b7351ab3d6f8a40f48170423cde01bea1a12d850067b3d6ecba49ced
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzymqzRotKYYTqMi8CtBd2QHCHmTBW5V3NN:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2Ig
- TLSH T145D54A16F6A483A5D073C075C9E696B6FA723C821B3086CB1345E72D2F377D19A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.9MB
- SHA256 7108eee549a217ca57a744fdfb0e62f1ebe3ac0fa77c1c27a74a2075ebf0a1a8
- MD5 1c6097782400ccaee74bf142cfbe9c76
- SHA1 8df1966dbf35aae1230dc8ca852d76805db5009d
- SHA512 4d3f21fb0cafe9d1eb9eeb2ac6ec85f9e580a9bcba6ba73a14ac3d2b47088252899375918903cdd3054f247b34c96e2ccc7eb7ab7735838d3dbeafc54ef3848e
- SSDEEP 49152:A3k03kHRJIqJtb2IQ8tDZqrK0qJtb2Iai2WH3:A3k03kHROzrJuX
- TLSH T187D55B26F6A483B5D073C179C5E296BAFA7238421B3086CB5345D32D2F277D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH