Analysis
- max time kernel
104s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 10:08
Behavioral task
behavioral1
Sample
2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260723-l6c7labf54
- SHA256 6fcf13ac9f1c1e51ae2909cc7404581c546f57d6a95bcae4ab1502e9268134f4
- MD5 4c01987a8849dada2e843112470ffcce
- SHA1 636248f31719157e41e9d6403959b7773743379c
- SHA512 1c2d69e8a1cf6fc39d422c97fa837a72afc3f259337e1fb9be0c6e124cf6f5d6626d35ec30242b2b3e5048f796c3346c480e7286fd3073435280a90af53e05ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbajYTqMi8CtBd2QHCHmTBW5M45jcAkE:A3k03kHRJuqJtb2IMpYq
- TLSH T1CA956C16F6648275D073C0B9C5D2AA9AFE3234425B308ACF1389D7282F277D5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/5064-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5ae-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5064-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3208-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0010000000019cca-1019.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9b-1281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c01f-2094.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5ae-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x0010000000019cca-1019.dat aspack_v212_v242 behavioral2/files/0x0004000000019c9b-1281.dat aspack_v212_v242 behavioral2/files/0x000e00000001c01f-2094.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3208 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5064 2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3208 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_4c01987a8849dada2e843112470ffcce_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5064
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3208
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 6fcf13ac9f1c1e51ae2909cc7404581c546f57d6a95bcae4ab1502e9268134f4
- MD5 4c01987a8849dada2e843112470ffcce
- SHA1 636248f31719157e41e9d6403959b7773743379c
- SHA512 1c2d69e8a1cf6fc39d422c97fa837a72afc3f259337e1fb9be0c6e124cf6f5d6626d35ec30242b2b3e5048f796c3346c480e7286fd3073435280a90af53e05ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbajYTqMi8CtBd2QHCHmTBW5M45jcAkE:A3k03kHRJuqJtb2IMpYq
- TLSH T1CA956C16F6648275D073C0B9C5D2AA9AFE3234425B308ACF1389D7282F277D5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 9c8c03727fdf066fbbb7461d9fa7b1e873ad42b89f99de58fcceec2c03d5b1d9
- MD5 cffd02800f5582f5d5886e42a817609b
- SHA1 6c4a60d5d181d8214102eeb8801b1f5321d98e39
- SHA512 c73bb4fba1ca8d483e0635bcdf09495aea2ea847e5a5748293b1d91d28861854f99ff78bb14d7b10b9d8fb782631d064e6927cefcbf27ca47e520ee4e0f24ea7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbajYTqMi8CtBd2QHCHmTBW5M45jcAk6:A3k03kHRJuqJtb2IMpYqjPji0Aj
- TLSH T16DB54B16F6748375D073C0B9C5D2A69AEE3234425B308ACB1385D7682F277E6DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.4MB
- SHA256 77336d038b6b7bdcad6143580e3c19bdff520f3e2fdba0671607b207cfe06026
- MD5 14973e782ad55546dfb1f0bfc623e4dd
- SHA1 470d67e146cb9212b6a8a62c2464d0a7efd1320d
- SHA512 60f4f2f995ec830d3565735669d6b9ae5406193a7d384cf724934f77ac69ba8dc68ce814b1e04024fae590e0f393877f3f2337afa1279fd0ef5bd6c67693058e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbajYTqMi8CtBd2QHCHmTBW5M45jcAkv:A3k03kHRJuqJtb2IMpYqx8tDZqrKV
- TLSH T187C55A16F7A482B5D073C179C6E296B6FA7234420B3096CB1385D36D2F277E19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.9MB
- SHA256 b9897b203f26cffd5ed0d2a65e5c7f46e610351b9588ed79d420c3b649abcf2b
- MD5 6f8f477a1272534b34c78ba0ed1d606d
- SHA1 ab8e8b34d1834e029961a93b3b6a6aecb59a7adc
- SHA512 8022fc8b5b83e5e614141f8837477322158f0b28d5d75792cf3c4ed9955687b7be1413bd776a96528810114144247f30d8bb622e5cb594408d4717c5f93d7524
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbajYTqMi8CtBd2QHCHmTBW5M45jcAku:A3k03kHRJuqJtb2IMpYqt
- TLSH T14E953B16F6A44275D073C079C9D2AA5AFA313C821B308ADB1349F7682F377D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
- Size 1.9MB
- SHA256 f3d13f009ba642dde63d679f7c75e5afb850b69288ecdd0371d99a54fed0d189
- MD5 6e6ee1660cf2373babe8ccbb21228195
- SHA1 b99f692551a295206fc7b5063aa4595d3e4d2a0c
- SHA512 bd29a038e5775f5c2dc7c3b81396ea2fd3483692a08e46e8dd14f7cd380eaf6f4725c3812cfd9f105672feef3cb801fe3ff875c32f5d6f708f14ea08f677995b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbajYTqMi8CtBd2QHCHmTBW5M45jcAk0:A3k03kHRJuqJtb2IMpYqnV
- TLSH T1A0956C16F6A44275D073C0B9C5D2AA5AFE3234425B308ACF2389D7282F277D5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH