Analysis
- max time kernel
109s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/07/2026, 17:22
Behavioral task
behavioral1
Sample
2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260701-vxkprabs2l
- SHA256 a2ee705e126fc00ade8ad2d61865ee63b5a4779f84e8cca1fa33578af9031c46
- MD5 212d61d72bfb069af7556a9d0f2f121d
- SHA1 0408fc1bc52bbe01fa52a7369f6c493428dd98d6
- SHA512 3fc8277f4f25311f83ed30f875be491c2167f7b420334813001e9a144396455ba874d95e89d4e49658d8d151ba7d6da268d616593bf2eb5a12a104708b3a52eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5TvinrmC:A3k03kHRJKUOlk0I56rX
- TLSH T1D1757C17EA584EE5C16F817896928612E6737C110F2097CF6368EA293F337D06E39B53
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/5000-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002454c-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5000-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2252-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024551-142.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002266e-1295.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e758-1381.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000739-1762.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e48f-2066.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c01-2119.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000022ccd-2188.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002454c-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-11.dat aspack_v212_v242 behavioral1/files/0x0007000000024551-142.dat aspack_v212_v242 behavioral1/files/0x000200000002266e-1295.dat aspack_v212_v242 behavioral1/files/0x000200000001e758-1381.dat aspack_v212_v242 behavioral1/files/0x0003000000000739-1762.dat aspack_v212_v242 behavioral1/files/0x000200000001e48f-2066.dat aspack_v212_v242 behavioral1/files/0x0003000000022c01-2119.dat aspack_v212_v242 behavioral1/files/0x0004000000022ccd-2188.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2252 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_85093\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$$ 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$ 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5000 2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 2252 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_212d61d72bfb069af7556a9d0f2f121d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5000
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2252
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 a2ee705e126fc00ade8ad2d61865ee63b5a4779f84e8cca1fa33578af9031c46
- MD5 212d61d72bfb069af7556a9d0f2f121d
- SHA1 0408fc1bc52bbe01fa52a7369f6c493428dd98d6
- SHA512 3fc8277f4f25311f83ed30f875be491c2167f7b420334813001e9a144396455ba874d95e89d4e49658d8d151ba7d6da268d616593bf2eb5a12a104708b3a52eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5TvinrmC:A3k03kHRJKUOlk0I56rX
- TLSH T1D1757C17EA584EE5C16F817896928612E6737C110F2097CF6368EA293F337D06E39B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 1.9MB
- SHA256 b09f1c12ccc0e7b3aec6d541dfe5be86a7719ac0c729cc95d98f655c4bc1d926
- MD5 15cb1006e66c2895c5c9bb4654c61a94
- SHA1 9143f978048ade8c8ecc43e4f6ab338c4caf2cdb
- SHA512 97c89adf025269e9376c4d0c81fb7c1ffa9f37ed0e11dd16dd8c59bf7e7c89e6a3654d8d52ba011e2e0d4d55f217ef98b2f284f76ddc59e713e7ec7f34aa7f1d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5Tvinrmc3UNUX:A3k03kHRJKUOlk0I56rtUN+Eir
- TLSH T165956B16EB584DE5C12F817889928651E7737C110F2197CB63649B2E3F337D0AE3AB62
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.7MB
- SHA256 e94871e11e55ca8d34c5753523cb3771fc1e71661b2fd9c7b845cc2003169465
- MD5 be5919327cc378f6d2028cbeb385024a
- SHA1 fe70928e9a51f1b62eaeae3e36be782c12f14c5b
- SHA512 fcdbec6c45723d5561ab49c1ef45e968812aeb155f753cffbdde111ee0cc81ecf96acc7a1618ba52e16816b476912f94c03ca2f71b324995d1c2d282472d9da2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5Tvinrm+TjE:A3k03kHRJKUOlk0I56rNw
- TLSH T190857C17EA584EE5D16F817886928612E7737C110F2097CF6368DA293F337D0AE39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 a41145ec3fb031f9e5d579d1f9f9cf5cd7fca7751b5d26b6441db991fdb289c2
- MD5 f36978d86ecbc3002a5c45a08b17c018
- SHA1 155600c1104b6c6d27ad0d0e74e3a0e0ab7affae
- SHA512 cb32f0a80f863bc36936bad8c46a76d276bb3af0612d851136e9d196392c0487f98474f5729f4cdf25d414c33521038e5ab89ce9338d0aaa96ade9e2e2f142a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5TvinrmC0Le5b:A3k03kHRJKUOlk0I56rTPji0Aj
- TLSH T1F0A56C16F6644BE5D06BC178C6D29656EA733C420F3097CB5358DA293F237D09E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 1.8MB
- SHA256 5db207573870e97df1a8cec30af08bb768b3c44db0d990c3384b8bf0b374753b
- MD5 9dce812d810d8104157853f8230e1d37
- SHA1 1904f373db9c78732d3e9f732604ed827ee45a4b
- SHA512 249aad9a2bb333e45859a2212b24af7850d32cd1fae09e72df6f343a999d99d339fd677912e2ce4e116e6b92a0d6db1ce72412d3fe29ac4094e24f3ac0de1d3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5TvinrmrD:A3k03kHRJKUOlk0I56rU
- TLSH T19D853816E6544AE4C16F8174C7928612F6737C110FE097CB63E8EA3D2F326D06EB9A53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 1.7MB
- SHA256 1612455d2810d46179ee6244bf87eee2c947641fdc1a7f5cf4e8f42f7a5bca63
- MD5 7f5d416f512efd63004d8e9ff17470fc
- SHA1 a2a40174965a913c01ec1965a88011b59ef65411
- SHA512 b626219d11a3ad0f54322d673f44beeaa83d9ab33ab39761322febfe214a2640d679af00d2e5871af4ea7535afec4bb2c0ae1ee203d84c008b74505d73166d5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5TvinrmgF:A3k03kHRJKUOlk0I56r9
- TLSH T103857C12EA944EE5C26F81748A968611E6737C510F2097DF6368FB293F337D06E39B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.9MB
- SHA256 c3241e92032ae25dabc809b13ee810dcb5384170fc8e8a67eaf95ff2c154b352
- MD5 afa75af91a7f1135bda6694e9a687ec1
- SHA1 e1ad703543ba57d48bd4772acbf7c0020c7513bc
- SHA512 fee6a4a5acc992ffd32bfce46683b828cf034ca3b1d69e3fec64e8f2f19531249ba10d343c3c9f99c82d78deb9a4de28020bb8837d2f0a5f1e3a574a6afd7879
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5TvinrmQV+PAm:A3k03kHRJKUOlk0I56rPi2WH3
- TLSH T169957C22EA984DF5C12F81748A958616E6737C110F2197CF6368EA293F337D05E39B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$
- Size 1.8MB
- SHA256 4397c48c539adcf29eb00b57edf9fc5c00829111eaf3aed995a24cf8b550fa6f
- MD5 d714a4c29d8f4eb6ad57c44c913030bb
- SHA1 116281305904c06d2d5bb888ee1ba772024a11bd
- SHA512 085fbccea83738b9fc7df9b7736575075a939056633b533c698920717d8c83e9f7c1f281201109fbee0e6af2e7ac303fd7795d621cab9eefb5c007ab19062f62
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5Tvinrm2IiG1W:A3k03kHRJKUOlk0I56rLIiGQ
- TLSH T1C8857D16E7A84EE4D16F817496A64612E6737C120F21D7CF63689A293F337C05E39B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 1.6MB
- SHA256 8b0f5537e0b67916ec4ce2bc53f7638ad60c38bbd984f48e817cb41e0c2c317e
- MD5 977eab3e08c9dd8bbad218f225512b8a
- SHA1 008fb9685800c7077f8f56ca000f7155c31d5ecd
- SHA512 0a6559a904f3abe26e3356be8701392fe738425527ecd8ba68f49e374c21594d46516c1e22f7a82b0eedfdbf040a34c7eb37775388232641625f4174b336df61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOai45EWmGrUOlZ7q/cOD5TvinrmhBl:A3k03kHRJKUOlk0I56r
- TLSH T15E757C17EA584EE5C16F817896928612E6737C110F2097CF6368EA293F337D06E39B53
- MD5 SHA1 SHA512 SSDEEP TLSH