Analysis
- max time kernel
93s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/07/2026, 11:41
Behavioral task
behavioral1
Sample
2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260718-ntfhasdv41
- SHA256 3a4d01b8ade434c07bbd1e85cd2703c0988303d70a11d3a279c2f3a31f532f16
- MD5 29fcb6b1c2525306fae483b921583197
- SHA1 f9aeaa9dd93c96850e0e4cd59087be21d73c9efb
- SHA512 bbdff724303ff7f9f4bcc0e8e4978a76d1e6f0dcbfcffd54cbd0c09a3688a6ebf3ab749b9e759ab1c1829f719f3702ec46e99b6e1d6c932ef3411644345aba8a
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrM:x7iw2T56r0Pji0Aj
- TLSH T1A1753916B6A84B61D07B9174C5E2464AEA737C451F3087CF12689F2C3F23BE1AD39726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4916-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024474-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2976-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4916-40-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2976-65-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001db11-1280.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002027f-1612.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000002027f-1647.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021567-1688.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000072b-1975.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e0b9-2075.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024474-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x001400000001db11-1280.dat aspack_v212_v242 behavioral1/files/0x000800000002027f-1612.dat aspack_v212_v242 behavioral1/files/0x000a00000002027f-1647.dat aspack_v212_v242 behavioral1/files/0x0003000000021567-1688.dat aspack_v212_v242 behavioral1/files/0x000400000000072b-1975.dat aspack_v212_v242 behavioral1/files/0x000300000001e0b9-2075.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2976 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe$ 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4916 2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2976 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-18_29fcb6b1c2525306fae483b921583197_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4916
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2976
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 3a4d01b8ade434c07bbd1e85cd2703c0988303d70a11d3a279c2f3a31f532f16
- MD5 29fcb6b1c2525306fae483b921583197
- SHA1 f9aeaa9dd93c96850e0e4cd59087be21d73c9efb
- SHA512 bbdff724303ff7f9f4bcc0e8e4978a76d1e6f0dcbfcffd54cbd0c09a3688a6ebf3ab749b9e759ab1c1829f719f3702ec46e99b6e1d6c932ef3411644345aba8a
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrM:x7iw2T56r0Pji0Aj
- TLSH T1A1753916B6A84B61D07B9174C5E2464AEA737C451F3087CF12689F2C3F23BE1AD39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.1MB
- SHA256 7833fe2a790375099d6af9b23568fce21b32a43a664b42fadebefb59de742158
- MD5 3cb23fae84b89159fbe1f2507f5b1ac0
- SHA1 8310fea9fc2c54460d0e845cc42a399bf715bdde
- SHA512 000a5c294bdc7f4e7535183f1ed22becca3d58809fac8641d15af7a23ed57f0ca1e3d5cc7eb113c55e0aea126bca2c60f50c07f62c0260cdce2ab7f4ef30c4ec
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrMfUr2d29dBrtpDiI:x7iw2T56r0Pji0Aj2UidGl
- TLSH T17CA53A16B6A84BA5D07B9174C5A24646EA737C450F3087CF02A49B3D3F37BE19E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
- Size 1.7MB
- SHA256 fab62b4124b18f9dd50af67b1e97a9335ef83a86bdabae3768f23ea4b5b1cd4b
- MD5 db7331ba314945ae55978b3e62a8f975
- SHA1 6ad7ad67bc295d5351bfca7c5c4031b298fdbac8
- SHA512 b89060f8df7e99fd8e142073a94a35706101ec67a3eda386fb4d688358d9232a648ca8c5322a2dc0f7d1595da5014e2d626509f753aa981a4004df288a475774
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrMeGen:x7iw2T56r0Pji0AjMI
- TLSH T1E7853A16B6A84BA5D07B9174C5E24646EA73BC551F3087CF02649F2C3F23BE1AD39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$
- Size 1.7MB
- SHA256 8c2c3ed3b00bc7d7a0733d1a4a5021f2f2d08da75d873777dd8d75b38ee227f5
- MD5 bf50fdada9801956ba5b023da2b31e77
- SHA1 01466591aa665a6af0ade074e8d3c8f7a149e892
- SHA512 700f968a50e2747d6329f1ad22fed002d17dbf601851291242e4edee841705c7c8dd5f9b3804f8fa43f00dffe77c298d6f334c52bfb6b652954d9a74ca78df85
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrMdTjE:x7iw2T56r0Pji0Ajow
- TLSH T13C853A16B6A84BA5D07B9174C5E24646EA73BC551F3087CF02649F2C3F23BE1AD39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 97fa6e3dce7a2355f59d82fee151cdf9623098ce7da562faf3860a86a8221fcf
- MD5 180a7232973315574e280ca99a0ca063
- SHA1 90cb343b0e9dd379fab1c38fdde3af85ea140fe4
- SHA512 ba266e535ebc655a59ab1c365e03697fbf75287e4856ad62e45017bc25df7864e08910963b32d59a88fd78aa3a7be1f987fce0688231931dd5b67bb75ca026c7
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrMD0Le5ji0hmxNrM:x7iw2T56r0Pji0AjKPji0Aj
- TLSH T128A52916F6A84B61D077D074C5E2964AEA7278461F3087CF0295DB3C3E27BE1993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.7MB
- SHA256 01532af83561dc085043bff7b39119971e7f29c9e709c2c31f812bd4b180c0e2
- MD5 80edfa837daaa39a739484a880b564fe
- SHA1 cc9cdc40ced36c999aaa6b578b86885f986ff1be
- SHA512 dfc5142bab61e2affd4bd33afa56dab7c0d4e20c549d6432784236d6c4d0b7ea5fe9843efa922206b43d279992992d8030fd928e888215b2c9d38b5c325caab2
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrMPF:x7iw2T56r0Pji0Ajq
- TLSH T154852916B6A84B61D06B9174C9A64646EA737C451F3087CF1264BF3C3E33BE1AD39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.1MB
- SHA256 21c80974a35aa83070c7dcbdc6df2ee0f1631a7f5d59905101cb8cdf80610a47
- MD5 93b68831c67ace933a6e2691bcb6c4aa
- SHA1 9070132c007cb20784c39ba838e5d1324485f73d
- SHA512 aa0cbfe11496a1ac8c0e327613d9e645a96feb13355436e91e51ba4a81d507b2aeeb4ea6fffd4c0f50ee1201918b5bb7ccfdbd8f10bc1d70c4d44f2a78b28194
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrMu3npi63iC:x7iw2T56r0Pji0AjRXpiMh
- TLSH T135A53A12B6E84A60E0B79234C9B54655EA73BC515F30C7CF12949B2C2E73AE1AD39733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.9MB
- SHA256 6060aca9a4c7d62e4e834e4337ac74f9eb68ba6d06160db96937e05e0ae56b4d
- MD5 981a787e5fa6b80d429fbdb3970bcc79
- SHA1 b6cf2554e463fd3b94d680a7864ffedbc519aa34
- SHA512 a018db97970fcb954a446c6944967950bd73466dd11cdee79b31b22c52d6179337c8098c585d1cdfd0f3d421a1b6673ec68c720515977bc766deab2859979a94
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpnD5TvinrmbP0Le5ji0hmxNrMfV+PAk2hMH3:x7iw2T56r0Pji0AjYi2WH3
- TLSH T1F0954A16B6A84B61D07B9134C9E5865AEA737C410F3087CF12649F2D3E63BE1AD39723
- MD5 SHA1 SHA512 SSDEEP TLSH