Analysis
- max time kernel
89s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 14:36
Behavioral task
behavioral1
Sample
2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.0MB
- Sample260720-ryrb5sft51
- SHA256 dea91ca5fe38d1e3314e7d7da24cc4e5299edca72b73a64c8d45d9df89a333b8
- MD5 4d9d3cb03ed3d99251ff1bb600e0d57c
- SHA1 9fa955ff7c6cf511f6a133c22b63c07b3189d129
- SHA512 ce1c6cca93af2ad13ba3115bbceb84baf00e15f10259602ae867c47654e54d04db8606fbe572fde1849bb25cc33034f2afce0b4a4cf770f84149a9ce0b1373dd
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rX:A3k03kHRafkZckcJrX
- TLSH T162E52A16F6788762D077C0B9C5D2AA9AFA3238425F308ACB0345D72C2E277D5D53A736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 14 IoCs
resource yara_rule behavioral1/memory/2168-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002459e-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2144-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2168-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2144-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023534-125.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002217b-1132.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022160-1140.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022545-1188.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216ee-1196.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a5-1272.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233f8-1547.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000168c3-1665.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002459e-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023534-125.dat aspack_v212_v242 behavioral1/files/0x000200000002217b-1132.dat aspack_v212_v242 behavioral1/files/0x0003000000022160-1140.dat aspack_v212_v242 behavioral1/files/0x0002000000022545-1188.dat aspack_v212_v242 behavioral1/files/0x00030000000216ee-1196.dat aspack_v212_v242 behavioral1/files/0x00020000000216a5-1272.dat aspack_v212_v242 behavioral1/files/0x00020000000233f8-1547.dat aspack_v212_v242 behavioral1/files/0x00060000000168c3-1665.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2144 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe$ 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2168 2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2144 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_4d9d3cb03ed3d99251ff1bb600e0d57c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2168
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 dea91ca5fe38d1e3314e7d7da24cc4e5299edca72b73a64c8d45d9df89a333b8
- MD5 4d9d3cb03ed3d99251ff1bb600e0d57c
- SHA1 9fa955ff7c6cf511f6a133c22b63c07b3189d129
- SHA512 ce1c6cca93af2ad13ba3115bbceb84baf00e15f10259602ae867c47654e54d04db8606fbe572fde1849bb25cc33034f2afce0b4a4cf770f84149a9ce0b1373dd
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rX:A3k03kHRafkZckcJrX
- TLSH T162E52A16F6788762D077C0B9C5D2AA9AFA3238425F308ACB0345D72C2E277D5D53A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 3.5MB
- SHA256 94ec311d6fef79216af1b9ac18541933f26cfc6f708241dec495ae7dec462a11
- MD5 2ff05f80c27acf268ba9bff1514ce140
- SHA1 459ced308e5fb2b232f9e2c3c6e4dbccaf9b80cb
- SHA512 918290abc6e10152251bf75a7f3e06fc06f60a6f43fa21b52d9f4a071c1f4b500ac1bd090dee323f7a389d0c28dc0a2a4f8caac9b4bb00a36ca7047feded14e4
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rXTd9CHKyao:A3k03kHRafkZckcJrTCqo
- TLSH T1DDF53A16F6B88762D077C079C5D2AA5AFA3238465F308ACB0345972C2F277D5D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 3.5MB
- SHA256 e6bac1e1eaeaa748a2ece13c1ea505059a504a8108274c21132ef622ab7c94a0
- MD5 000ad65b5a42df9d309f8cdeb1dfdea4
- SHA1 c5d873cbc0d68d3038206ea865df06892398b1eb
- SHA512 b0758e7da70e5d33c14f89f903b38406e2a5f62a8aee8a437c675e058a2bdb608de3d30ed18bc8eef0214e160b91b6b9afe83f330a2c044d6cb6c1868fa8f011
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rvUidGl:A3k03kHRafkZckcJrvdGl
- TLSH T19C063B16F6788766D077C079C5D2AA5AFA3238425F308ACB0345D72C2F277D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 4b003c9562739f528c7083ba52343cfd6c93f6c154f1b33b7f1580ca55d98e26
- MD5 5c7b3cd77270a8b8d41567773f958434
- SHA1 ec64344961347d8d7263c8ddd539feaa3097d717
- SHA512 a3f982213d691e39db0e0cc1e2cc3bdebe5b3e61fcec68ccaa02980d3fadf58f649ad545945c046ac3470c77671eea5a801b3526428bcc34a19d7af334176146
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rTPji0Aj:A3k03kHRafkZckcJrLjo
- TLSH T1E5061A16F6788762D077C0B9C5D2AA9AFA3238425F308ACB0345D76C2F277D5953A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$
- Size 3.2MB
- SHA256 3306414a4900f33a726bf35ed5a42bf967767134152190bc5332af6cc61e7788
- MD5 6c404b7fd253c18e8b0181261f22a5b0
- SHA1 8da9d0fa5d583f857967cadb74db78b5e816cee1
- SHA512 6a69cfbbe7d63706bff37224c8bd99d7686506fffb9c673089577ea7cdee2f3f9ea13cf5ad87744fc9584e55dc95cb7afa70352ff3e5cc570b7c6527cfea3de2
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rU:A3k03kHRafkZckcJrU
- TLSH T177E52A16F6788762D07BC079C6D2AA5AFA3338415F7086CB0285D73C2F276D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe
- Size 3.1MB
- SHA256 31c8f6db4b393d5cd0ca3f095d27c0a75befc156f0f73e58708997339a7de872
- MD5 14c02e55ed0370f83212a6f31b4410e1
- SHA1 50bfa4464bcc252e7e7096ae4a8c7224fcf16aa1
- SHA512 bf2e2e475a8b43e0917bbbe217b71d9ef5137197ad0e8e20b1e92090f18b363310d27706cf988cabacbf31c69bd1e7932ed585283c2157c68b81cb79c0b092e6
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rJ:A3k03kHRafkZckcJrJ
- TLSH T1F3E52A16F6788762D077C0B9C5D2AA9AFA3238425F308ACB0345D72C2E277D5D53A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe
- Size 3.5MB
- SHA256 8ecb6f59d14347861f06dfabc1b335eedba9768557547688bf425e90a1923560
- MD5 993ba59fbb81de1ef897aa0de7e245ba
- SHA1 07878c2700c7f94a79724e961fea1bd4af2302e5
- SHA512 e928edd7a4efc9650dcc132a8093e560f7993397c9e32bc44b5be26c79b9d7681a604173cf08ac199f451d34f69aa89e20e0a33d8c8aa308fd120204116ef793
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rIbdv230xat:A3k03kHRafkZckcJrCdG
- TLSH T181F53B16F6B88726D077C175C9E2A69AFA323C425F3086CF1245A72C2E377D18636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 3.1MB
- SHA256 a6ffa9c07dd0ec88018a2598f3e3f1cab4a652d4430ec2b085a6e5cd00e594fb
- MD5 6b43b9f1fd874005c09a4e497c32732a
- SHA1 84f60731dfce3e33cf03f23505d8d8eecd0ab1a4
- SHA512 c5988a9c758c97c515a144e78e206fdca0c512c95d7d9583c388ca593834ebd8b42f86dc93df080b3eb7f07a62bd81ce0fc1ec246e162cb64a0d7c0f59f0cf94
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rA+:A3k03kHRafkZckcJrL
- TLSH T181E52A16F6788762D077C0B9C5D2AA9AFA3238425F308ACB0345D72C2E277D5D53A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 3.8MB
- SHA256 692b16d8ddc5cac3d22cea18b7bb9efbd3706225d392bbbec98e75eb3b4937fc
- MD5 53f81a37d6b4e2f221080ab06e7c396e
- SHA1 49fd76e33266802e82b9ec519bd45876c87a4123
- SHA512 c53c328d75552925202a2f1ccf615bddf16b298af9345fc0c59155602b0313ff6c587dcf674212263afe3890dca813a8a3ec9de90cdb4df9b59b3f85eeaf9ee5
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56rG:A3k03kHRafkZckcJrG
- TLSH T1A106F511A1688722DC6FCC75C592AA75F9323C4F7F2CB6CB0E45B6282E376D19536322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.1MB
- SHA256 a416b9845b4f04fcff1bfa2092af6096c8d8179bf8e33a84fe9b67e62dba8d22
- MD5 1d4dbdd78e0d42f99cf6a1f5bfd057fb
- SHA1 543bd4df223aae0e81f67a5c284346d8cec2d877
- SHA512 fbc3581982311f1535ed122d43fdf9ce26d373a059f029b00ff63bcb7953126b06cf9c5631c8893bb40ad35f8a278ffb04e9d911c0842414af06bbb6c57b9c40
- SSDEEP 49152:A3k03kHRJceW4SkZP4sz9MbkqJtb2IdqJtb2Ij56r9:A3k03kHRafkZckcJr9
- TLSH T119E51A16F6B88762D077C079C5D2AA9AFA323C415F308ACB0345A72C2E377D5953A736
- MD5 SHA1 SHA512 SSDEEP TLSH