Analysis
- max time kernel
93s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 20:10
Behavioral task
behavioral1
Sample
2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe
- Size 2.7MB
- Sample260629-yxpkgset8s
- SHA256 0324429704cdad3994b0d7129127f5df7c80492a1943980b81038ccd284c56c0
- MD5 bb49884d23eba6c5de66c3575b740974
- SHA1 41e2dd90275d935ae74ee355bca4f2fa9a195c8d
- SHA512 f2f7535345de9e00c98dba5484a8176274bf102188c765a0907e78be4bc425beb2cfbf137c0943181e3fe186b466aef36f65108f7bf20c0644cc0e48d5419189
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2I:TfkZcBr+
- TLSH T15AD52B15F6B88762D0B7C0B5C9E6AA5AF9323C410F3087CF4245AB2D2E377D59936326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/2488-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002450a-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2140-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2488-16-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2140-23-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000001f271-132.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000225cd-760.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000168e4-1273.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a0000000168e4-1388.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000000073f-1501.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001300000002025c-1728.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e825-1905.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002450a-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x000800000001f271-132.dat aspack_v212_v242 behavioral1/files/0x00020000000225cd-760.dat aspack_v212_v242 behavioral1/files/0x00050000000168e4-1273.dat aspack_v212_v242 behavioral1/files/0x000a0000000168e4-1388.dat aspack_v212_v242 behavioral1/files/0x000a00000000073f-1501.dat aspack_v212_v242 behavioral1/files/0x001300000002025c-1728.dat aspack_v212_v242 behavioral1/files/0x000500000001e825-1905.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2140 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2488 2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe 2140 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_bb49884d23eba6c5de66c3575b740974_amadey_cobalt-strike_elex_hijackloader_rhadamanthys_stop_vidar.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2488
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2140
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 0324429704cdad3994b0d7129127f5df7c80492a1943980b81038ccd284c56c0
- MD5 bb49884d23eba6c5de66c3575b740974
- SHA1 41e2dd90275d935ae74ee355bca4f2fa9a195c8d
- SHA512 f2f7535345de9e00c98dba5484a8176274bf102188c765a0907e78be4bc425beb2cfbf137c0943181e3fe186b466aef36f65108f7bf20c0644cc0e48d5419189
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2I:TfkZcBr+
- TLSH T15AD52B15F6B88762D0B7C0B5C9E6AA5AF9323C410F3087CF4245AB2D2E377D59936326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.0MB
- SHA256 b1012e34abfcbb7b86f69fc23347da8c03f06a2c1161ae2ee9a38850bfca8474
- MD5 cd8b2ea4504e98e2f1133807e3b49b8f
- SHA1 497de5f9dbda680e1cb3a0efdf2fff5c1a6f779d
- SHA512 c9a20a629b64d7bd1dd39ae6e1361ee126d4084508c31cce0a95f6fd50b80e13b263cde90fd2fbdecbe7b7f16e6d91e6d8dd17622e4f127acd0288d6febfe374
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2IwUN+Eir:TfkZcBr+9E
- TLSH T154E53A15F6B88B62D0B7C0B9C8E6974AFA327C410F3087CB5245A72D2E377D59936326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.8MB
- SHA256 496d1adabf6634ff0581cef847b95f87035a4c32ce1f16b673d86f0537ec1c79
- MD5 f6b951f04a1c8b670736819e754c4d16
- SHA1 fe13f9ebf1b3856ddb36e1d1b7489769f79b1a53
- SHA512 78eebc3f0fad02806e17223980dd5692f945e7be0915f8cdb89b4d4bb5726fe9a4c40dc68df3da07547880d89262aa1f04721daa5537240123b6ce1e1c45bff9
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2I0W:TfkZcBr+xW
- TLSH T111D53B15F6B88762D0B7C1B5C9E69A5AFA323C410F3087CF4245AB2D2E377D19936326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 3.2MB
- SHA256 a3fa8654dbe5e6d80ecb3207f84ea64d2c976133971e199bacaa3336148dd278
- MD5 d95f8680a1405a244c01e5b8caffe841
- SHA1 b9b7f0650ba5fd0234106894b5f1561fa750714c
- SHA512 bff81841230822df5aa9803e4f4bdabc719e1935601e4788724470cb31c941a70f67467d78f0911669b169b19a686d48864a2bd74e315b6a38f0654262546308
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2IvT9t2:TfkZcBr+W2
- TLSH T1B6E54C15F6B88762D0B7C1B5C9E6965AFA323C410F3087CF0245AB2D2E377D59A36326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 3.2MB
- SHA256 92671e99b73ba68ebf24fcea4a0ac9ae51cdfa28c2204ff2a258baa7073552a4
- MD5 716848b2e3b14ed17914e656deb14ad6
- SHA1 315981f4f22791f68a676451a8c9a6d7b14e513a
- SHA512 7daa5202de53f1f9885335334e57783cb9905d03c51d2fdafda137d9e296592dba0a6d52681bb5816be62e489628befb4e81630d9f389b9451ac00c2ca58a474
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2IkUidGl:TfkZcBr+ddGl
- TLSH T1DCE54C15F6B88762D0B7C1B5C9E6965AFA323C410F3087CF0245AB2D2E377D59A36326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.2MB
- SHA256 1e16e6a1c1e9454c26502d017133c0989d619a6a3811d4a5c787da95eb177e6d
- MD5 c470517a2e3aa078be6b018d26caf81a
- SHA1 4fa6f210954e9cfa5d54d391d92df59a37db637b
- SHA512 9b55f2043eb3763d7652a676baec6595378d4634eb01592eecce6431fd28e5929f2407348b38d068e36c08d41ded7caba0d00d3b75f1e3f298690ccda5ee68fd
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2IQPji0Aj:TfkZcBr+Zjo
- TLSH T174F53B15F6B88722D0B7C0B5C9E6A65AF9323C410F308BCB4245AB6D2E377D59636336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$
- Size 2.8MB
- SHA256 a45303f9dbac77522502d1bc23226d74ff76d026f8beb601982eadca62ee9f1c
- MD5 ef2edeb99267811666d1a1491ca5c66a
- SHA1 6b04c97fcc787b467e74f77634ff7eaa9d27240a
- SHA512 0383b23e1c9be7032b4c8d67dfdf72e1b0c96713762b1157bdffd1127bef0ebcc194b78474ee4994a4d6b8b93aeee16cd30da378bca53a50ead8b1957288c1f3
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2It:TfkZcBr+y
- TLSH T14ED50915F6B88762D0BB80B5C6A6564AFA333C410F6086CB4285EB3D2F377D19976327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 3.1MB
- SHA256 a12c641dfe97ad9af9f9286bc4b695373657461ab24d54731118e81eb1c9d151
- MD5 d3acc0602fdf726c66cfc2aad6bd6753
- SHA1 44f0f492821d2ffc6ae2924657a1daa20f082fca
- SHA512 83b0d2369c76c7d749dd35ebfd7165d37815ce0ecaf0a7b44f774832db341d1b672314f1bce1d58332797eb705aecc4bb28feb213d1985d27f1ffd2592e15443
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2I8UOlk09:TfkZcBr+P9
- TLSH T193E55C15F6B88762D0B7C1B5C9E69A4AFA323C410F3087CF5245A72D2E337D19A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.7MB
- SHA256 d6d0bfbe49a1fabc87db811b8a65af4def4c53b0fbfb23e26218897a4b5d36fe
- MD5 6bd7d7c7ad77cc2fee510e2cd7d37217
- SHA1 14f3ee2c9c08937100e4a34b71f37c1c60198638
- SHA512 fc2b011f64774fce5fd971238a625e33ab5f905c3284a362e785d0b1624fcbe91df328fa46e60d8609ecf314ae0862742b94c002d6db805f28f47957cd035c56
- SSDEEP 49152:Tx2aq2aqeW4SkZP4sz9MbE56r+qJtb2Ig:TfkZcBr+r
- TLSH T19ED52A15F6B88762D0B7C0B5C9E6AA5AF9323C410F308BDB0245BB2D2E377D59536326
- MD5 SHA1 SHA512 SSDEEP TLSH