Analysis
- max time kernel
92s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/07/2026, 14:53
Behavioral task
behavioral1
Sample
2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.0MB
- Sample260708-r9fpsagy21
- SHA256 fb787356a76add892916d70677f036aaa3c1d2e9fc3a5b4db327b108988b858e
- MD5 9021745ce9166e0f0c2e6589c08cea6a
- SHA1 58f31d72e6c09dd95418cfcb24748c317cc6fede
- SHA512 b66c9468b0366dcd6b347ed7226501807b33a225ce68ac984e618c839db5fc71c4e42b5afb4ed2ac65314990d97ee46fc1f6b11214137aa74d7dd91bfdfeddd2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5Tvinrmb:A3k03kHRJW56r
- TLSH T134356B03A6980FE8D11F81749A964662EA737C125F2097CF1354AE153F72BD0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4464-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024443-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4464-33-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4308-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023528-152.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021725-866.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a1-1265.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000202f1-1464.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024461-1580.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001d00000002025c-1654.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001100000000002e-1976.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024443-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-11.dat aspack_v212_v242 behavioral1/files/0x0002000000023528-152.dat aspack_v212_v242 behavioral1/files/0x0004000000021725-866.dat aspack_v212_v242 behavioral1/files/0x00020000000216a1-1265.dat aspack_v212_v242 behavioral1/files/0x00020000000202f1-1464.dat aspack_v212_v242 behavioral1/files/0x0008000000024461-1580.dat aspack_v212_v242 behavioral1/files/0x001d00000002025c-1654.dat aspack_v212_v242 behavioral1/files/0x001100000000002e-1976.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4308 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4464 2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4308 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9021745ce9166e0f0c2e6589c08cea6a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4464
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4308
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.0MB
- SHA256 fb787356a76add892916d70677f036aaa3c1d2e9fc3a5b4db327b108988b858e
- MD5 9021745ce9166e0f0c2e6589c08cea6a
- SHA1 58f31d72e6c09dd95418cfcb24748c317cc6fede
- SHA512 b66c9468b0366dcd6b347ed7226501807b33a225ce68ac984e618c839db5fc71c4e42b5afb4ed2ac65314990d97ee46fc1f6b11214137aa74d7dd91bfdfeddd2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5Tvinrmb:A3k03kHRJW56r
- TLSH T134356B03A6980FE8D11F81749A964662EA737C125F2097CF1354AE153F72BD0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
- Size 1.3MB
- SHA256 1654514e2c830d4abe709398428904a2e4f20ba1365386db5b489dcb848f40a4
- MD5 95c9ea78bd6fe711955e36b428ae0d29
- SHA1 5cb6baa962162037bd6ce424930f224289edb606
- SHA512 62a68b180c23f45b27259b2c619fbe8bb9f7093fe8c771fb16a76984266d8d06ea2c32ad138ca8003b02d5f13454f567845ebcd2fce841bef089d95e3bbfe99b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5TvinrmbRD+qB2:A3k03kHRJW56rK+t
- TLSH T18A557B13B6890FA9D11F817489A59A76E6777C020F2093CF23589F193F72BC06E3A257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.5MB
- SHA256 0af45dc9209c74096957a036576b11e67ec15dadb7fe0866713dddf849f70611
- MD5 53cbd227d5f220dccf2e2e019e97c56b
- SHA1 49414e3253c722c905336129c93bbcd0008e9668
- SHA512 54986baf7cd87750155454cbf5fda33c93f716c46cef2c95a73b5d825d9a12f480feef7c0b761100aa80bb85fd199f5676519de0970ac8af340393b5472a488c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5TvinrmbbUr2d29dBrtpDiI:A3k03kHRJW56roUidGl
- TLSH T1E7757C02A6980EE9D05FC1748A964662EA737C560F2097DF1394AE253F33BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
- Size 1.2MB
- SHA256 749850012e9e288037e13c12134627da45d91e6a36aa77f65a5a2dcdc8ca1de6
- MD5 13fefd911bfc3bc17c4032de1926a35b
- SHA1 03bce49b68643ea2bddac2d9434690ad0a38531f
- SHA512 fd17b17498b0c52f120a0912267d3fc9212dbfc24c56d62af5a7ed34c33649649b0994872790f4ffc77dae5e3d55dc222253a7f6287f203fb283e052faf80deb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5TvinrmbhTjE:A3k03kHRJW56rSw
- TLSH T192457B03A6980FE8D11F81749A964A62EB737C121F2097DF1354AE153F32BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 7e8bf1fba95c45953c0a3f18990725fe5d76829e7d460ce772f39f912e0d58cb
- MD5 23851809d1674b2866ce38f152b0a5b0
- SHA1 16f5d82235efabea0908b1fd5ad3db41507bc082
- SHA512 b7e84cda8de979c4189380825e29cf3fb6b8629b0a27de8363c6a876492f5ae6978d0fe60958949f12ebeaa91cdca6ecdb1bed37bfb50d44a29285998738e559
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5TvinrmbP0Le5ji0hmxNrM:A3k03kHRJW56r0Pji0Aj
- TLSH T1D3755B16F6A44BA5D02FC178C5D2965AEA733C421F3087CB1354DE283F67BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 1.2MB
- SHA256 66e09f02e6e40433cc3ae61dd4ef2390ad50f681605211b5bd2f94d818d41212
- MD5 1a2eba16567575883402f68df4b9b043
- SHA1 a68a6f6e73748aa8b53f4b0ca73d0addcb830586
- SHA512 b26139572fd91f7465c487130142305d8872dfc2751926e492ed5b17ca5e10a71a2fd12bda39e9063e122bf5b4a792fc1bfa737b7f7747a84437183a587812c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5TvinrmbkD:A3k03kHRJW56r5
- TLSH T1E7452706E6980AA8D11F8174D7954622F6737C125FE093CB13D4EE3D3F32680AAFA257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE
- Size 1.5MB
- SHA256 8a1abf64c01da4ddb93c45a37837c748459eb4a1dea864d5e484f5d63beaaeee
- MD5 53bc6ecab28746e2c6ecdbf66166fb3f
- SHA1 c23193917035072516af9a86209915be45e37ca1
- SHA512 f9b399030971129f11d90b8bed2daac4631456b832feac72391cd40d31acaf1db11dac9ace28190243183864b8b6730a2d2c3527fd70ca707a323bd157de0e93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5Tvinrmbm8JsZw1:A3k03kHRJW56r583
- TLSH T1C375270EEE540FA8D55F813485A6876EE6327C111F21A7CB2354BE15FF32F806A3A257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.1MB
- SHA256 7d18a623b9ffe3c5392d1c3fdd7cdde973fe5701c1e55e241418226ec4b78085
- MD5 3ac3169543595133de478084fce50932
- SHA1 f9f2ff6927b34e3b9357d15dbbca86e82d5a60de
- SHA512 bfd6f08d793909b747e9e7f4b3d88de41cc230ffe2767577cb6a371a91518463181ab14010662e1f519c81dee199c3f908ddce816ba5e95c256c001771fcbd8a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5TvinrmbLF:A3k03kHRJW56rc
- TLSH T179456A03E6990FA4D24F81349A968A62E6377D520F2097EF1354BF253F327D0AA39357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.5MB
- SHA256 48a62b964349a562d478bc4c1493f566b10cd64a1d099a8cd5cf8da736db1c81
- MD5 feaf145db285aa435b1a4c881ee70792
- SHA1 a0064f6849250a0656ed7f4157892fb1d5c613f8
- SHA512 ef31fdbe8d6347f77fdfd5e207d37329673ff76bbb6ae130e1df797950e604fd85d0b95a5630adf4c52b0338147048793544f359edde68c14adaef8ab2d62fae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFHUMD5TvinrmbK3npi63iC:A3k03kHRJW56r3XpiMh
- TLSH T181755B03B7D84AB4E1BB86309AB54562EA777C115F3093CF13946E193F71AC0AA39763
- MD5 SHA1 SHA512 SSDEEP TLSH