Analysis
- max time kernel
103s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 01:15
Behavioral task
behavioral1
Sample
2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260720-bmntwaa19q
- SHA256 ea15584ba570926f909572e446e15f6623651abfd6a328ef61bfcad5780b4b87
- MD5 7436ba47a094032d06aa410b368c0a59
- SHA1 27074aa61b85976b6a58ad186a4e53317ca97b1b
- SHA512 fcb34c027656e2272377f9f2f58ac433a2c4a691bab6c48da841f42cbfd0a9c5c7ced4c707559a2901cd0cc82c24de44431bb2bf5e99bdb1d7d0c67254972d76
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tvf:A3k03kB56rt3k03kB56ro
- TLSH T1F9957B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/4300-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c591-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4300-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5968-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-306.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb0d-303.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a356-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a39-1460.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a0000000066a9-1872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000006503-1954.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c591-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-306.dat aspack_v212_v242 behavioral2/files/0x000300000001bb0d-303.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-379.dat aspack_v212_v242 behavioral2/files/0x000300000001a356-1022.dat aspack_v212_v242 behavioral2/files/0x0006000000018a39-1460.dat aspack_v212_v242 behavioral2/files/0x000a0000000066a9-1872.dat aspack_v212_v242 behavioral2/files/0x0003000000006503-1954.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5968 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe - Drops file in Windows directory 25 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4300 2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5968 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_7436ba47a094032d06aa410b368c0a59_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4300
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 ea15584ba570926f909572e446e15f6623651abfd6a328ef61bfcad5780b4b87
- MD5 7436ba47a094032d06aa410b368c0a59
- SHA1 27074aa61b85976b6a58ad186a4e53317ca97b1b
- SHA512 fcb34c027656e2272377f9f2f58ac433a2c4a691bab6c48da841f42cbfd0a9c5c7ced4c707559a2901cd0cc82c24de44431bb2bf5e99bdb1d7d0c67254972d76
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tvf:A3k03kB56rt3k03kB56ro
- TLSH T1F9957B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
- Size 2.0MB
- SHA256 a886cc0c5e93a4ac3f63724ce5d454892db05800217664c8ab0cada147e63110
- MD5 dcbc50e83b45eb315b95dc5ef91b30a6
- SHA1 28a95bec55972ad88f4e46734316ea9b5d7ed686
- SHA512 7e3feeb81db10ed26d149ab43bc06b685830bb38cbdf04ccf409f4e4d19085785c505c171d2cc38dba8e1b29a4d987d75e8075706913b5ac361ad613d9866cae
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tvs:A3k03kB56rt3k03kB56rG+t
- TLSH T12AA58D13E6850FA5D10F81709AE58676EA777C021F2093DF2358AE153F72BD06B3A297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 2.0MB
- SHA256 1db964fded337a227dc0a2aa291e4236f71667b35e31bc1513c3e504cfd44d81
- MD5 3873d9521d069f56140d6ee9160d9f4a
- SHA1 f310c25c52d614d35434912f7c76db158562e07b
- SHA512 15c586eebf01bd27fefab4d82a0560ae7ca105d33b18af7e0165b531b1082b7c69b8ef5661b09adff6d80c2bc6f9c28db51e9b92cb4145c35c8233e1c6832564
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tvg:A3k03kB56rt3k03kB56rYEP
- TLSH T15FA58B17A6980FE5D01FC1749A958A22E673BC121F2097DF1354AE153F32BC06B3A76B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe
- Size 3.8MB
- SHA256 9a49787bb6313bd4d2763cf7ec6a5972534201d25ac851bc1937900a6b5dfe59
- MD5 64025e106db1dc911b93035cd11f8a9b
- SHA1 db4c9c2d42bbccff6cd3c481dcda297766902387
- SHA512 ec3eb059a7c67ae3e1fe36bc1edd7026bad308134ddfff5977556fea8b04361f196269d7ded1f47ddc24cf88e67066d468327b26075b35036e71d6212bd8524a
- SSDEEP 98304:A3k03kCrt3k03kCrt3k03kCrt3k03kCrYEP:A3k03ket3k03ket3k03ket3k03ke1P
- TLSH T16D067B13E6940FA5D10FC1749A958A22EA737C125F2097DF1358AE153F32BC06B3A79B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 51d8364fd34e07c5e1e366cae66cef6cdaaff493840450ada9a6402ece480e7a
- MD5 4cf1a69957cac20ede3fa867a03e81fe
- SHA1 8f3362237ee913c5b0fd649f041751488db898d3
- SHA512 5dcdf027976bf6a050398254910736026dc99b1c329c8d1d1147b400ca5b3324af4046f33a20d1f43a9911b2e1cd67e6d0eb6d31abb56651c7dbc31bf7be761d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tv3:A3k03kB56rt3k03kB56rwPji0Aj
- TLSH T182B55B17E6940FA5D02FC174C5969666EA733C421F3097CB1354AE283F72BD0AA3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 1.8MB
- SHA256 9ee41ad0400b5055bdcb0a6a114b68f45ae5a6acf4b72bef276ae649e6952a07
- MD5 792e3e9ef8e5f2436a8036109b3f88c7
- SHA1 74247cf53380dcfe379a675eb42c77d38014b880
- SHA512 99912e42195bdcb5f8c3df651d0f1f586c2167e5bf347dd85a5aa9c5fde48eab296b0ebaa0c215d89ebaf8f7569fd92ea7590435a5dda7aecf33a07ebb433457
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tvr:A3k03kB56rt3k03kB56rO
- TLSH T126957B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe$
- Size 1.8MB
- SHA256 e5f89d8ef2347c242b21586fac18a4fe4e81981bc5a010d13c7ef4ce98923faf
- MD5 46825687762fff4b62b3e64a4213f7bb
- SHA1 7d630902c4d167d39a735d982e7c9fa82741ed68
- SHA512 43d5ba291143cfc855bd145ca80bbc6bd8b1c65992be9076eec03459965ac5a4e487f1f74cf3cbf4b04374361b2d7134ef3f190c870c30954a8b109c4b60f52c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tve:A3k03kB56rt3k03kB56rL
- TLSH T1B4957B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 1.8MB
- SHA256 bee9e9f923e794dd7bd9b7229dc00e480eb8c608e2189438d4941685e77a778c
- MD5 36620df3aab7893236a2a3fc6526677c
- SHA1 ed9685bd43d8872e6c4d4662491a8074c1e856c1
- SHA512 6a8683c4a5ab03328705d62a7b6bda21333b1be4a45435857571ba1129cd44679230c38c5cd6aecec9a0bfbb2f2da68d7524bb82da8946a728fba12664f0c547
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tvi:A3k03kB56rt3k03kB56r7
- TLSH T17D957B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.8MB
- SHA256 6340c3b30ef6e0e66e2b88314b4fe9b461df79ddf3d60c6ca0f6690d8ed77813
- MD5 5a15badc72a39f735f4c19b231258d53
- SHA1 b60b75d368a735c9dfaabc0b4df36dd2cadf3b70
- SHA512 08ff619e36fed5d152fbc992fb30052c87214aea849c9d0c8e4c8633356f9196834c4abc21a0b31f3703a5b780e6cbc046c740681d61fed4baeb6cbf9f83faea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagaN5go3mnXoZ643mnXoZ6iLa5D5Tvc:A3k03kB56rt3k03kB56r1
- TLSH T1BC957B03E6840FA5D10F81749A968672EA777C425F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH