Analysis
- max time kernel
97s - max time network
127s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 14:09
Behavioral task
behavioral1
Sample
2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.6MB
- Sample260716-rgacase16m
- SHA256 47875998bbef3408a2247ab0c27507c1cdd098b75b213947a7e21ae8cf0ed32c
- MD5 004a7f311b6d6da9db8e42e107ac3006
- SHA1 0d2841f08cba0109bb3f3f4b143a855bbbe9e149
- SHA512 3390c4baeb1fb2a6858e8fa7e8a63d8bd96a4806b99e9d8a840a95a479da05ddf8ffe20e95d4c1029fc74bfbab39a28a99e1477a013c7facd37f7bfabf146b1d
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9Mbq:A3k03kHR+RcfkZcNfkZcNfkZcq
- TLSH T1BF060916F6788323D0B6C0B9C6D6AA99FA32344557708ACB0385D73C2F277D58A3573A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/2732-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002443e-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/544-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001db14-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2732-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/544-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000215db-1278.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002027f-1479.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023130-1638.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001ebc5-1929.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000072b-1967.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000747-2062.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b0000000167ed-2165.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002443e-5.dat aspack_v212_v242 behavioral1/files/0x000300000001db14-12.dat aspack_v212_v242 behavioral1/files/0x00030000000215db-1278.dat aspack_v212_v242 behavioral1/files/0x000800000002027f-1479.dat aspack_v212_v242 behavioral1/files/0x0004000000023130-1638.dat aspack_v212_v242 behavioral1/files/0x000500000001ebc5-1929.dat aspack_v212_v242 behavioral1/files/0x000400000000072b-1967.dat aspack_v212_v242 behavioral1/files/0x0004000000000747-2062.dat aspack_v212_v242 behavioral1/files/0x000b0000000167ed-2165.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 544 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe$ 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2732 2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 544 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_004a7f311b6d6da9db8e42e107ac3006_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2732
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:544
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.6MB
- SHA256 47875998bbef3408a2247ab0c27507c1cdd098b75b213947a7e21ae8cf0ed32c
- MD5 004a7f311b6d6da9db8e42e107ac3006
- SHA1 0d2841f08cba0109bb3f3f4b143a855bbbe9e149
- SHA512 3390c4baeb1fb2a6858e8fa7e8a63d8bd96a4806b99e9d8a840a95a479da05ddf8ffe20e95d4c1029fc74bfbab39a28a99e1477a013c7facd37f7bfabf146b1d
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9Mbq:A3k03kHR+RcfkZcNfkZcNfkZcq
- TLSH T1BF060916F6788323D0B6C0B9C6D6AA99FA32344557708ACB0385D73C2F277D58A3573A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 3.7MB
- SHA256 6dfc3b9a5d0a136fb4a0ebeb88de7702ed3edd7ad4356362189f75cf157b2759
- MD5 5fb10afd59c55a7f3eeecac1fe65497a
- SHA1 8ad3ad69a01f1826b45c8b0b9aad01845cfa7184
- SHA512 843987229b403676ffcb429bdb503116ac036fcbcaeb82040eba3a71d72f5f1c408f297df0dd70b8a93eb46f770d1a798526027b8b624902e999c6fb584695f6
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9Mb+W:A3k03kHR+RcfkZcNfkZcNfkZc+W
- TLSH T1E3061916F6788363D0B6C0B9C6D6AA59FA32344557708ACB0385D33C2F277D58A3673A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 4.1MB
- SHA256 b7b082823b52a6e0436aadc470a499bf37104c78a1d645410422cf6eb2b497c4
- MD5 2435e35ff6c9c44c0c7adc731a189a7a
- SHA1 8948394488ff20226281a5c9d1637afa48c64010
- SHA512 6bddfe876e0f9c921b3a46217b4ce0b41539b2473d0916b350bef572afe961a596fc3a9f4783543df5550610c52ad256d5707efabe6a8706da335fc287e9e9ab
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9MbmUidGl:A3k03kHR+RcfkZcNfkZcNfkZcidGl
- TLSH T1B6162A16F6788363D0B6C0B9C6D6AA5AFA32344557708ACB0385D33C2F277D58A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe
- Size 3.7MB
- SHA256 20f81c3067ab0d450a2d390ceda72a19337083176e3fd9290e971732f7e27b6b
- MD5 bd3f32ec9be4255eadd100ca197cb8f5
- SHA1 cb8bd1b7976aefdc2c7287482fa003cf9d5a3cb9
- SHA512 84e49b6abab99b966225e7b7a1591f8a9134909ec68be635cf9e32537587dccaaf5c62367f0a2540ba02e7c5ca284999431f1e5b0c32d49b9797de617a947f06
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9Mb8I:A3k03kHR+RcfkZcNfkZcNfkZc8I
- TLSH T117061A16F6788363D0B6C0B9C6D6AA99FA32344557708ACB0385D33C2F277D58A3573A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.1MB
- SHA256 3625008f9fddb3b7fa49a2119f0c17b6609b14de36331be0b26973b2f74d7b8f
- MD5 6431f77454ceeb4cef233b7c0926fe2f
- SHA1 57a8305b254b2269f4d90b52445f33309c727b39
- SHA512 17a1e0fa0b81b67642065d6472cfb9ec07c3d82b11b5c10ec676d6dfbd9b72db6e4a82b3ff7982a08109feb8ec43bc66a7a280d021f83b9969db3c345a585294
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9Mb6Pji0Aj:A3k03kHR+RcfkZcNfkZcNfkZcQjo
- TLSH T19B160A16F5788323D0B7C0B9C6D6AA9AFA32344557708ACB0285D73C2F277D58A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.6MB
- SHA256 d1d6efabc929fb3098648798ac77d0bdf54baee7017300b5c026f5e5b53b14ea
- MD5 af877448666a8ec93372248ec55e9680
- SHA1 e6a980dd962bf180372d8d1285361a8a1338dd50
- SHA512 d9f62c95dc3b82713e0edac0a85c61e16a3ea0f01850ccc5b9248de88232129eecde2aeacf1e89776eafa2e6cef028b42472be6c121c06214c713d5d91496d72
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9Mb6:A3k03kHR+RcfkZcNfkZcNfkZc6
- TLSH T1DE061916F5788323D0B6C0B9C6D6AA59FA32384557308ACB0285E73C2F377D59A3573A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 4.0MB
- SHA256 e27ab4f829a138cb5497bdaaf34742abf0836e895009c0656f3852470c754029
- MD5 3ecf1b566045c53531dff8429f5a2e86
- SHA1 3297ff23ce70b1fcc9687800e4495ef99e60642f
- SHA512 9c8986f119bb3df8243b5fca0fd0fd076b4c9d179aba41b1696467b328430cc296bc1d90332ce29e90f3b2ed2603919164a3226decb775f4b6d6d7b947bef8bd
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9MbhXpiMh:A3k03kHR+RcfkZcNfkZcNfkZcZpig
- TLSH T100161916F6B88323E0B7C179C6E6AA59FA3234455B308ACB0385D32C1F276D5DA35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 3.8MB
- SHA256 9cb884c1b973032a648a2355824f4704eac1705cd98a3d88436b073e14ca337a
- MD5 46c832915ea48157879cb1c8cb268d18
- SHA1 9866a6f6bfc2810c8d797af0b83a2add7fd4be23
- SHA512 920aade42aad629c4cef2b87690d5cfbe07e2ddecc54223153e32b7ed83914959c06df0056c87c7113fdcf6024f7980730c24f13fa9329217da11665be90d1f9
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9Mboi2WH3:A3k03kHR+RcfkZcNfkZcNfkZcouX
- TLSH T11D060916F6788323D0B7C0B9C6D6AA99FA32344557708ACB0285D73C2F277D58A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 3.6MB
- SHA256 ce76a88cf1ed3edb48f21bab605cce93b6d3ba4684efd34014bb94c2c338dd46
- MD5 e8e933a2ca3f6cf805a78885e16a6b4d
- SHA1 bfc12020343723b174d72cfd656a9c036e8daabe
- SHA512 be415fc1b3533a60601b39c574056e1ec2dcbad97426c66aebaf54d839ce6cba21f198419d7bf0b8441089177875bfcc4c4c4dd6a27ae4d381ffc7bfa570bd07
- SSDEEP 49152:A3k03kHRJARJ+eW4SkZP4sz9Mb5eW4SkZP4sz9Mb5eW4SkZP4sz9Mb:A3k03kHR+RcfkZcNfkZcNfkZc
- TLSH T1D3061916F6788323D0B6C0B9C6D6AA99FA32344557708ACB0385D73C2F277D58A3573A
- MD5 SHA1 SHA512 SSDEEP TLSH