Analysis
- max time kernel
78s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 14:41
Behavioral task
behavioral1
Sample
2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.7MB
- Sample260708-r2g8msgv71
- SHA256 28478b2651585a558ce069b3481df774bd4b39df88d680193b72b332f40ca0bc
- MD5 f6f7d1a650c9fd85f14f39c481d69cea
- SHA1 e5c1d370a1a322d967a4a2e12beac56466eb47a1
- SHA512 78dbd5ec0c58ef2727db22ebbfc9881403a57b548eeb29e48b16cf4067f4a05ecaef5bd7d9895a951cd6d57115ad97c2648b7a640b36e0ee9d7f1acd82bc8ffa
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbkqJtb2IRpYq:A3k03kHR/fkZck06
- TLSH T1F2D52A16F6788362D073C0B9C5D2AA9AFE32344657308ACB1349D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/380-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/788-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002455a-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/380-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/788-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002455d-125.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d00000001f2b8-199.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021719-760.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022563-1244.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000073d-2085.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002455a-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b67-12.dat aspack_v212_v242 behavioral1/files/0x000700000002455d-125.dat aspack_v212_v242 behavioral1/files/0x000d00000001f2b8-199.dat aspack_v212_v242 behavioral1/files/0x0004000000021719-760.dat aspack_v212_v242 behavioral1/files/0x0003000000022563-1244.dat aspack_v212_v242 behavioral1/files/0x000300000000073d-2085.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 788 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$$ 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 380 2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 788 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_f6f7d1a650c9fd85f14f39c481d69cea_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:380
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:788
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 28478b2651585a558ce069b3481df774bd4b39df88d680193b72b332f40ca0bc
- MD5 f6f7d1a650c9fd85f14f39c481d69cea
- SHA1 e5c1d370a1a322d967a4a2e12beac56466eb47a1
- SHA512 78dbd5ec0c58ef2727db22ebbfc9881403a57b548eeb29e48b16cf4067f4a05ecaef5bd7d9895a951cd6d57115ad97c2648b7a640b36e0ee9d7f1acd82bc8ffa
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbkqJtb2IRpYq:A3k03kHR/fkZck06
- TLSH T1F2D52A16F6788362D073C0B9C5D2AA9AFE32344657308ACB1349D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.3MB
- SHA256 78811babf5033512c4234e7bc9ff0b9f73d2d09751391422ae2d54c309daefd1
- MD5 09cef2d904763ae82c639cf654ff3665
- SHA1 b02b1c8c572b69d28de6625b3e0e255933fab175
- SHA512 931493e12fe60fe6b2d985d1c437a7a14b2057e319b8a2566c7a0fa5de45f0ecba5e9cd570634ede8d242ca6434a0cb0178d9e9fe544b27ec0c37985f832ee0c
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbkqJtb2IRpYqjPji0Aj:A3k03kHR/fkZck06Gjo
- TLSH T188F51916F6788372D073C0B9C5D2AA9AFA32344657308ACB1345D76C2F277D6963A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 2.9MB
- SHA256 fb2a9ddce35d95e08819dc9d7dae10779d5f1a343966ec93752c72edc39968e1
- MD5 78fd1296df16cc371c6267cfe6cb45ea
- SHA1 e1b021a2004f62c5bc5daa90c6d8a3e1224571aa
- SHA512 e1b9c5422cc4e2be7afca5957886a8775492d0f7432bd871adfa9f58dda80a79cacda26c8ac9df907663ae2dd9f584185de71eb138bf7717ee010f4614b30e84
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbkqJtb2IRpYqk:A3k03kHR/fkZck06F
- TLSH T187D51916F6788362D077C0B9C6D2AA5AFA32344557708ACB0385D33C2F277D58A7A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$
- Size 2.8MB
- SHA256 dbca00d2efd21c024693a0ff14d35d83d3993f9420b31288857e944b3046a138
- MD5 332b8cd874fe7c09b382dc10fa18fe1d
- SHA1 34e9cd2a9329be48665d7a8643763b7e12bc7ab5
- SHA512 7b37d5c7be3411e58aa1b8ca96e7b9eea627304b57e944c3f0cf2602679b6f58199c8206529a95f8b58a93be1e2c7664ea15e21c361434d974719ca1c7a3815f
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbkqJtb2IRpYqa:A3k03kHR/fkZck06D
- TLSH T199D52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1345D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 3.2MB
- SHA256 11dd53516bdd343f1cc297b029b1ed914b23ee8292e9282cc61edc6f49e110f9
- MD5 a64434289105099ac37d881864a3fff7
- SHA1 e108ba381ba2bf85cd01b531dfb785695ad28f1e
- SHA512 8663bc168398f107bc66b0aeb6d44cf0e1c3407cda64f0d17199d022f19c2274a9f69b475bdd025c0c1f7f63d490ee782662727fbb8c647686631701e3b42724
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbkqJtb2IRpYqTUOlk09:A3k03kHR/fkZck06G9
- TLSH T1FDF54B16F6788772D073C0B9C5D2AA5AFA3234465B308ACB5349D32C2F277D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe
- Size 2.8MB
- SHA256 f672ccc0e19510e9c1164aa21937c2e14ef2a2b4335c53496ac96450a52f8aba
- MD5 31f51a89d0397f6f8038626ced1cb92c
- SHA1 9ec622f2b4b70659d4bf87e05d62c62e40594452
- SHA512 dc73e77c24e7a41cf92f7dba37bd58014c044bd9d3e97f6d92b3245d1cce1402ce85accd2e5c45629d6958574622ecf9f445da3e62cf536d5cbc57b2de705935
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbkqJtb2IRpYqt:A3k03kHR/fkZck06Y
- TLSH T155D52A16F6788362D0B3C0B9C9D6AA9AFE3138455B308ACB0345E7282E377D5D636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe
- Size 3.0MB
- SHA256 ecc46789487085b4ef063a05f10f1b3d370cd8b981553b90c4e44663f3f3024b
- MD5 1445db2f1b02ba72b542a05ec75f69b9
- SHA1 e66e1f2a5a5aa431896ba9bcc33e85adf8413ac8
- SHA512 70ad2fa952a2c71e97f3c14c82abece155d2e05f3065a0817eb211868601d8d4254fbb5dae7f4f36fd05383c9d30f0d7880e0c63c041b3f9e738611db53450ed
- SSDEEP 49152:A3k03kHRJJeW4SkZP4sz9MbkqJtb2IRpYq/i2WH3:A3k03kHR/fkZck06CuX
- TLSH T186E53A26F6788372D073C0B9C5D6AA9AFA3134465B308ACB1345D72C2F277D58A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH