Analysis
- max time kernel
95s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 03:03
Behavioral task
behavioral1
Sample
2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.8MB
- Sample260718-dkf3cses5n
- SHA256 fc33cdc9f9fc2ea36ec6f6b6b6e386a2a3ec44ac9ae19c97d89a288bc298d428
- MD5 877f12f370801a514ba1a61e7a61aa64
- SHA1 a25a0ea773d8d02f1c938c52018c09a6b3961ba9
- SHA512 b517c6b91e8f9c992589d76737e4e9721ecec1aadbd02265918666cc4804ffb8dcf0827f59eb5ccfe1595711dd5f9fa6fffdccbe5ec7a4963707d16a609f8574
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0Aj:A3k03kHRKfkZckZjo
- TLSH T1FFD52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/1432-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ec-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3628-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1432-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3628-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235e6-121.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002181d-1124.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002160a-1284.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020285-1420.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002153c-1531.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000071f-1974.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000073f-2076.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245ec-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235e6-121.dat aspack_v212_v242 behavioral1/files/0x000200000002181d-1124.dat aspack_v212_v242 behavioral1/files/0x000300000002160a-1284.dat aspack_v212_v242 behavioral1/files/0x0007000000020285-1420.dat aspack_v212_v242 behavioral1/files/0x000400000002153c-1531.dat aspack_v212_v242 behavioral1/files/0x000400000000071f-1974.dat aspack_v212_v242 behavioral1/files/0x000300000000073f-2076.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3628 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe$ 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1432 2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3628 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_877f12f370801a514ba1a61e7a61aa64_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1432
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.8MB
- SHA256 fc33cdc9f9fc2ea36ec6f6b6b6e386a2a3ec44ac9ae19c97d89a288bc298d428
- MD5 877f12f370801a514ba1a61e7a61aa64
- SHA1 a25a0ea773d8d02f1c938c52018c09a6b3961ba9
- SHA512 b517c6b91e8f9c992589d76737e4e9721ecec1aadbd02265918666cc4804ffb8dcf0827f59eb5ccfe1595711dd5f9fa6fffdccbe5ec7a4963707d16a609f8574
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0Aj:A3k03kHRKfkZckZjo
- TLSH T1FFD52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
- Size 3.1MB
- SHA256 0f09fd619b418d5a0869fe71d08232d75d5c75d514fd55b1b06da767858109b0
- MD5 55593df85329ab72d56a2098a69ee29a
- SHA1 a6327ddeac9e912defca021bcc8bf8ed12ff2f91
- SHA512 716a5081d8229ca6c11385f7bdb56bbfbd0232ea31552523cd8c3fc8262607e45a2b344e0c2b876f06656778be3776e79aabd44e27ccebb07d4c3daa11483e96
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0AjpeS3:A3k03kHRKfkZckZjoQI
- TLSH T14CE53B16F6788772E073C0B9C5D6AA5AFA3234425B308ACB1345D72C2F277D59A3A335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.3MB
- SHA256 3fe54db47e1071d22b1325019872a5793a48ae8e45afd30b2a000c3501f857b3
- MD5 2fd9652701d5cd8ee953cc7e1bc6ec20
- SHA1 944dfb9e7bc3600345fe5be9f9f6f18a3172d75e
- SHA512 129c7833716303fae9ea174c9a36c391b985362d3a6268aa54c26cc98ec5da38b30171d18cb2d05f888e5fac1d5f5256004c775a65ea377b5f4b631db0214fb8
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0AjoTd9CHKyao:A3k03kHRKfkZckZjoKCqo
- TLSH T16BF53B16F6B84372D073C0B9C5D2AA5AFA7234465B308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 1da3ae642e1a673598a2e9c38ebbdb1088bbd8ebf09026e1064b409bcf0e0f55
- MD5 e409870b46cb8e2ca2d9a4fa34697a80
- SHA1 e1d9c72252a3f6c8967eb5fa01610f23d4919033
- SHA512 7641d3e8dfb597f4a39a5192feb8b33f999d633f96126fa4bc2e0ca7b1cb23716cabbf24903b2ed2aabdbfc754901e8dbcec2adcf35e6052337adc11be3343ca
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0AjKPji0Aj:A3k03kHRKfkZckZjo0jo
- TLSH T10EF52916F6788372D073C0B9C5D2AA9AFA3234465B308ACB0345D76C2F277D6963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$
- Size 3.0MB
- SHA256 96e7dfef8b8d832d3d33e2d8db5db6d74a1986f3b5e1a5ee9ad1bf5be17fd64f
- MD5 a816b2caed14957f60d1e6a35a9078ba
- SHA1 974e5d625ee74ff032483e1abb72f36e04b50ee0
- SHA512 f6162292662c4bcff6afc4afa277da6ddb6c8baefa50466ca3dbc00dd8b38425c43a5fa098797f6c9f94b39491ac9f01ac346ee787d6cb298ae5b63ca81669c7
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0AjX:A3k03kHRKfkZckZjoT
- TLSH T10EE52A16F6788362D077C0B9C6D2AA5AFA323442577086CB0385D33C2F277D59A7A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$
- Size 2.9MB
- SHA256 1d126c1919fa42f033e99000376d26dd2a26336bc51d27daa79bd9e7b18b209e
- MD5 837267cd042d9587166eea6f13da7e38
- SHA1 ce408c0430ea107645629dfce7a1679abf6aac8a
- SHA512 1c93056238c1b14344b74a9ab41a11a29b15613d1c2ab53beb73c6eb757705d63f6f758a9b59de632320fccc4d8396fe156963de7b3f70b08fdb77bfd9638ef7
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0AjS:A3k03kHRKfkZckZjo+
- TLSH T157E53A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.9MB
- SHA256 5cd2c42ee4be1ff524c0157d39d324ef9e047f15cc04a259d68b94070dba8c7c
- MD5 b50a4788d5372f9a474edc208764ed22
- SHA1 cb377d37164b93fb8827c49d830b3fb7894e5883
- SHA512 376a5150c2eeca51c52737ed4e14a6b2f76eb31f4e3da37f18053a21f64e848c60fe466890bf69cb47c6aee04fd9046a9e426d2163e616f0a576a03ee38dc1ab
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0Ajq:A3k03kHRKfkZckZjo2
- TLSH T1FCE52A16F6B88362D073C0B9C5D6AA9AF93138465B308ACB0345E72C2F377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.3MB
- SHA256 95581c1332298e82e271beba6185e03bfbca94c34cdc2073995809bd99d73686
- MD5 120575e20a5c49d388cd95f51bdea4ba
- SHA1 5f3c43dc4522270d1aa7e0c0063b6e56aedfc988
- SHA512 02554036f6782ff85138bf5c4e38b2e7096cc517ee0e9021803092125ddf8098c97a8db02a7c362311b38ccdc87ea563685d7b7b1371eedcbee12c01b5ff43f4
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0AjRXpiMh:A3k03kHRKfkZckZjolpig
- TLSH T1ABF52B16F6B88332E0B3C175C5E6A65AFA7238425B3086CB1345972C2F677D1D63A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 3.1MB
- SHA256 029deb3264873602c41acd4ca0731d415c94c6e0b5d54b119cb96aa2e37fc27e
- MD5 4684aeb497f295e946b8690efbcd3a13
- SHA1 6a1b41208beb6b0586b8ba8ba7a44c41ca53c849
- SHA512 dae4b57b0de1fdcb3db87b2e692c72f299b3b4bdb07c93ef2056d82b998efc40762f934c46446b7096cc00f59b9e474405dc8ad157b176eba472e09f1ff4ddbe
- SSDEEP 49152:A3k03kHRJYeW4SkZP4sz9MbkqJtb2IQPji0AjYi2WH3:A3k03kHRKfkZckZjoMuX
- TLSH T1DDE53B26F6B88332D073C0B9C5D6A69AFA3134465B308ACB1345D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH