Analysis
- max time kernel
98s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 17:37
Behavioral task
behavioral1
Sample
2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260709-v7kshafw2x
- SHA256 542f6166a5292d9907c22cfe162cf353958b655a0c8d588b65ab61b5b71eea9e
- MD5 439e36e89da4cd9bb437f5ccc4c89d32
- SHA1 43270e43a356078be4b680c2fe229b1b932edc66
- SHA512 d909bf9aaa23b96a63b695ddb9b98c3b542ad148fa5045c40f87fefe409f0b29433c92d4dd329ff56df4e4cbd91bed943fe4ed4ee1d6ca0f3e0f3aa28ec2399e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5:A3k03kB56rJqJtb2I
- TLSH T19A654A16F6A44B65D06BC074C5D29666EA333C425F3087CB1349AE283F37BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/832-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ac-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/832-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/640-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021f29-819.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022104-1019.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002160a-1286.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002300000002021f-1534.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245d9-1674.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c0000000006cf-1986.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245ac-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-11.dat aspack_v212_v242 behavioral1/files/0x0003000000021f29-819.dat aspack_v212_v242 behavioral1/files/0x0003000000022104-1019.dat aspack_v212_v242 behavioral1/files/0x000400000002160a-1286.dat aspack_v212_v242 behavioral1/files/0x002300000002021f-1534.dat aspack_v212_v242 behavioral1/files/0x00070000000245d9-1674.dat aspack_v212_v242 behavioral1/files/0x000c0000000006cf-1986.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 640 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 832 2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 640 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_439e36e89da4cd9bb437f5ccc4c89d32_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:832
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 542f6166a5292d9907c22cfe162cf353958b655a0c8d588b65ab61b5b71eea9e
- MD5 439e36e89da4cd9bb437f5ccc4c89d32
- SHA1 43270e43a356078be4b680c2fe229b1b932edc66
- SHA512 d909bf9aaa23b96a63b695ddb9b98c3b542ad148fa5045c40f87fefe409f0b29433c92d4dd329ff56df4e4cbd91bed943fe4ed4ee1d6ca0f3e0f3aa28ec2399e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5:A3k03kB56rJqJtb2I
- TLSH T19A654A16F6A44B65D06BC074C5D29666EA333C425F3087CB1349AE283F37BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 1.9MB
- SHA256 cc097bf0d2fb073526d24372de23b2abb41978145103fd22459585b9caaa0b70
- MD5 c44c398e3906f2d322b1d2fee16012bf
- SHA1 52fd42b6502cee31a5312a0d223f85c7c7a50f9d
- SHA512 4727f2d99abb99277675fc6d39e6394996ba89a6db688d28b302155a2c490feea0009ef6bf298d974c1702677d74551764405cbf7db6682d9cf50349e5b0e255
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5rk:A3k03kB56rJqJtb2IuTd9CHKyao
- TLSH T10F955C12F6A44BA5E07BC174C9E25656EA733C455F308BCF1344AA293F337D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe
- Size 1.6MB
- SHA256 6725cf9c5e25e8aad220bc6be842fc9f5ea041c0e5514f817f994951f19853dd
- MD5 4d78fd7b33d990a5c48a5ff124e8bc43
- SHA1 a35c360505a33973a05405abaeb627b52a20a75e
- SHA512 0f3e25ff17fcd041357a8a3979f3053b8f70a8e5aae0df7838f90fdd620e426921b9a57ab9d61fe4d96c3db4923bd7b41b546b18dcf85e43615e2dfa95fd62d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5Sf:A3k03kB56rJqJtb2IyI
- TLSH T137755B16F6A44BA5D06BC174C5D29666EA333C425F308BCB1345AE283F337D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 1b0781c98e568713c67f1a57c18e37106ec34705ebcd0e63eda5f90967aa8f09
- MD5 9b55637a016504a2087f34596f8e1766
- SHA1 d56d74c78802ab6a7aa6bb1091962d61f0025819
- SHA512 6a685e2a5d3ea8bfc17db7ee6660ca0f464c93a7628017dc6dccc546d974307130b81f2676466aee8629926879773ccfa1e89f25e06ae33fccc51fa05028c6eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5XD:A3k03kB56rJqJtb2IQPji0Aj
- TLSH T1B0A54A16F6A44B65D07BC079C5D2969AEA323C425F308BCB1345DB283F27BD1963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 2.0MB
- SHA256 44917fd2b39e9cdcf8fe91e3a7a123bb3da3e7136cb6185a7820d8fe2dcc2b59
- MD5 6691037b202c4343d6a445cba1953486
- SHA1 0350b80e52fa7204359474f66f14a89a95ba40c5
- SHA512 ecfc8b4b473689ba2370222fe43bab36ea55c0302d748a88ee21e3be4258719b307a43852ac04668ee4d2e5c795d5b7e8bcde12d7592d645063a4984dd81c41d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5Vm:A3k03kB56rJqJtb2IQ8tDZqrKV
- TLSH T188A55A16E6A44BA1D06BC174C5A296B6FA737C411F3097CB0345EB2D3F336D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\misc.exe$
- Size 1.9MB
- SHA256 717d1736e4f23c8a7b13e52d5ddbcfcaca6f90561832cf8b8fe78a2b801dcfe4
- MD5 08de4dcf2b373e7322666fef11a601db
- SHA1 f8c61902c42fe54e9d48cd0243816595df4aa79d
- SHA512 227da9da709940e5b504b091c2225c5dbc9ae6e61d9cee8b0d585ab8bb7365e9e0cc0a95a823fe7d27c9b230770d5182b23ba925f20a9bb679931d17b807fe6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5zh:A3k03kB56rJqJtb2ImZkk
- TLSH T1DD955B16E6A44BA5D06BC178C5E29676FA733C461F3097CB1345DA293F337D09A3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.5MB
- SHA256 992858feb81ad17781d1c6d01055caca64afbf98f18740a85e4a8703ff09fc01
- MD5 e0056279ecce78a0e34753d742a60ee6
- SHA1 2fdc9e20746359d4aab270a791f2103ac4c1d736
- SHA512 72d7d154fbef4e75509958d8ec58c447cf76e8443956e37ef9dd12e74082108e788918b741b80a5ac211efb3c8ea1c3a25526a58f052c5e8cfbd30c8cd8bd11f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5DF:A3k03kB56rJqJtb2Ig
- TLSH T114754B16E6A44B65D06BC074C9D69666EA333C425F308BDB1345BF283F337D1A63A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.9MB
- SHA256 ffe0b18281d00e2c81e109cd1ef447771e94a99a9a39b8a55e9cb720cc118164
- MD5 71fcc07ed4d21e8e62148f4ec476ea3e
- SHA1 f7d7975112fc88e254ca621bba5e7b23ef59dc58
- SHA512 043ec39b6ece5abddb69ab019d78e5658356a2d293db258fa97f1864b15f8b7540772512cafecf2da66155efc1839f56dd716671b9089ee41fadcb004994d2ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVgFYTqMi8CtBd2QHCHmTBW5yJ:A3k03kB56rJqJtb2IjXpiMh
- TLSH T11B953B12F6E44B75E07B8174CAA29656EA737C525F3087CF13849A1C3E726D0DA3A723
- MD5 SHA1 SHA512 SSDEEP TLSH