Analysis
- max time kernel
119s - max time network
156s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 15:33
Behavioral task
behavioral1
Sample
2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260604-sy8f4aav4l
- SHA256 79eea383c7572964f86108dac27303f21eb99e3a9681bce257d46dd160aa2a3c
- MD5 183e43904b1f41a7ba0b125099962a16
- SHA1 c8b4f6aaf8f9874b6493bd4896d2ba3f1b4f5e7b
- SHA512 db7986d691c4c113d7a88f2b3b14b2e35c563f09ea772d987714172c38da0d936be6001401928b8b9a6770848fe47d4179a70cda05137755ea1fbf20ce44e242
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdYlcydWXkdeC45jcAkSYqyEoD5TvinrmC:A3k03kB56rBYXrpYq+56rX
- TLSH T151754A16F6A44FA4D02FC178C9929666EA733C415F209BCF1344AE293F376D19A39723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/5156-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001b00000002b3ff-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4908-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a428-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5156-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4908-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x008c0000000272ec-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001a5f9-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001300000001a5f9-1488.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a817-1818.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000000476-1885.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001b00000002b3ff-6.dat aspack_v212_v242 behavioral2/files/0x000200000002a428-12.dat aspack_v212_v242 behavioral2/files/0x008c0000000272ec-1022.dat aspack_v212_v242 behavioral2/files/0x000800000001a5f9-1381.dat aspack_v212_v242 behavioral2/files/0x001300000001a5f9-1488.dat aspack_v212_v242 behavioral2/files/0x000300000002a817-1818.dat aspack_v212_v242 behavioral2/files/0x0013000000000476-1885.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4908 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5156 2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4908 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_183e43904b1f41a7ba0b125099962a16_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5156
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 79eea383c7572964f86108dac27303f21eb99e3a9681bce257d46dd160aa2a3c
- MD5 183e43904b1f41a7ba0b125099962a16
- SHA1 c8b4f6aaf8f9874b6493bd4896d2ba3f1b4f5e7b
- SHA512 db7986d691c4c113d7a88f2b3b14b2e35c563f09ea772d987714172c38da0d936be6001401928b8b9a6770848fe47d4179a70cda05137755ea1fbf20ce44e242
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdYlcydWXkdeC45jcAkSYqyEoD5TvinrmC:A3k03kB56rBYXrpYq+56rX
- TLSH T151754A16F6A44FA4D02FC178C9929666EA733C415F209BCF1344AE293F376D19A39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.3MB
- SHA256 7b3828b797d5095c186f27556b5bf53e491a696f23b4523c71eac5df1fb419fd
- MD5 2248850f392fd93041df8c97e536a250
- SHA1 d47f0040f4252d72ca6f1fee58db31f4054bf08b
- SHA512 428dad4d9779c159c04eb9454f8c35c28b004ae7f8472da15d2994e73a2f554bdd26d393c532a691fa34fba76645c5aa8e58a5cd0b45c82386a7a1e6ebc95e89
- SSDEEP 49152:A3k03kB56rBYXrpYq+56r6Vk0QGTvntQb:A3k03kCrBgr6sr3Haib
- TLSH T1C2B54B16A2A80BA4D06FC179C6928556FA733C451F3097CB03A4DE293F77AE19A3D713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.7MB
- SHA256 085e6164c066966bf33e3e0ad767ac5124782823816412f366ec2cd792cd3eee
- MD5 12d6c87e7275dc3e29cbdb4853af47d0
- SHA1 eb1d35353c92fb90d6895404c0b672c901900b4d
- SHA512 2464173b7f580f05ef7011a4f780ef9add9fc7fea60e80b5ff7785f74f3ffacd7bda5985af8eae33f6f5f4edfa3625f249e77adab1329448d033e3443fac0f4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdYlcydWXkdeC45jcAkSYqyEoD5TvinrmGhk:A3k03kB56rBYXrpYq+56rDW
- TLSH T137854916E6A44FA4D02FC178C9929666EA733C451F309BCF1354AE293F336D19A39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe
- Size 1.7MB
- SHA256 292f0c2de0b4095fb0e4cb7f20c2acc9e562a7fab883ef70a28bf43ce0707477
- MD5 60a4707a07eef6f1fe1c699d4749a105
- SHA1 91cb4950b93f899bd16f49472e21aaacfa444934
- SHA512 e24f1434378c4dc6cb3e935073539b8650a10b37df7d2df636f48de63d9181d5a621998ef988d9dfafb8e356078c6cd4bb382ecfe9d94cdb389e178f496a117f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdYlcydWXkdeC45jcAkSYqyEoD5Tvinrm3Ufc:A3k03kB56rBYXrpYq+56rRfFXu
- TLSH T154854A16F6944FA5D02FC178C9929666EA733C411F209BCF1384AE293F336D19A39763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{62B9A573-FEDC-4CA0-88A8-BCFC9656AA28}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.7MB
- SHA256 5dd1bd5742fa51fa80e2f492df48cacac83680180f0a7ed405e781c483020fd3
- MD5 de191737a17cd3b725efedf3ade5d6ed
- SHA1 b8ec0281c7daea6c48fcb04f4f6a9d82c2071017
- SHA512 6d427e3151c83738b9e50d5eb338914476f05aea5d65f4f0553f2516fe23b910a80a7c75aa07f4f0a4deb200f5879007d097cb74d99781850876ea44629cd5fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdYlcydWXkdeC45jcAkSYqyEoD5TvinrmcbBD:A3k03kB56rBYXrpYq+56r9BPVAU
- TLSH T19E854A16F6944FA5D02FC178C9929666EA733C411F209BCF1384AE293F336D19A39763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 49c9bd6d6877887baf4045691ea0dfa5dc3817d738defb43cf1f146187d5c010
- MD5 9d776719927e6be04d055e3a49ff739b
- SHA1 d49b84745b90601f9975a12cbb71d14de29cd960
- SHA512 9215b8cc91387eb61ec78faa1049927e3c4b0f9de49dfeb19efa3daa3d65df6d156f3ad58455efe64d12c1684298a392c1d7ddcb61ab359c8969ebadc21438aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdYlcydWXkdeC45jcAkSYqyEoD5TvinrmC0Lu:A3k03kB56rBYXrpYq+56rTPji0Aj
- TLSH T189A52916F6644B65D07BC079C5D2969AEA733C411F308BCB1385AE283F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.1MB
- SHA256 a93bcf69e92fbd699163c5f8be7d855ad1e3a67de521323c39d0142b9b206413
- MD5 afe7b5514dbe4f4c500b646b4f46491f
- SHA1 9b6a298d71829fa89406fe03b6112a2454bfc7f6
- SHA512 9a2bf85c15b4558931e26f008a487549416abc1087c76fca05ac932f2feae5eb2f54599453ae8a2701701e2f81bfe8638fabd1ce9e63abab28bc992a77fd2f66
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdYlcydWXkdeC45jcAkSYqyEoD5Tvinrme3NI:A3k03kB56rBYXrpYq+56rB8tDZqrKV
- TLSH T1A2A52916A6A44FA5D06FC178C5A28676FA737C410F2097CB0354EE293F376E19A39723
- MD5 SHA1 SHA512 SSDEEP TLSH