Analysis
- max time kernel
96s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 11:08
Behavioral task
behavioral1
Sample
2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 968KB
- Sample260723-m8ptva1thy
- SHA256 5ba93264a0b3526e3b82ef142052d60f10ff0528ca576615033461f22cf6c062
- MD5 3c094ab61250687eeb5eff24b7b55439
- SHA1 d7f7313d03abde7c5892d71a405aac032edf79c8
- SHA512 f5fd15a782a76f57a12aa70d0e28a75baea61dc646ac6a11a6f32b91bde1fcdb2e7252aa05f33b2729e348ff7adb05b6df8a8aeb1432b1c4d0f7b1f89d170953
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNa:A3k03kB56r
- TLSH T1E4257C03E6940FA4D10F81749A964662EA777C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/3920-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000232bb-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2352-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3920-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2352-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002365d-129.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022577-1004.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000218dd-1006.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f0000000246c9-1376.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000246ce-1559.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000231ad-1645.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002e0000000006d3-2059.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00020000000232bb-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x000200000002365d-129.dat aspack_v212_v242 behavioral1/files/0x0002000000022577-1004.dat aspack_v212_v242 behavioral1/files/0x00020000000218dd-1006.dat aspack_v212_v242 behavioral1/files/0x000f0000000246c9-1376.dat aspack_v212_v242 behavioral1/files/0x00070000000246ce-1559.dat aspack_v212_v242 behavioral1/files/0x00040000000231ad-1645.dat aspack_v212_v242 behavioral1/files/0x002e0000000006d3-2059.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2352 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3920 2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2352 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_3c094ab61250687eeb5eff24b7b55439_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3920
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 968KB
- SHA256 5ba93264a0b3526e3b82ef142052d60f10ff0528ca576615033461f22cf6c062
- MD5 3c094ab61250687eeb5eff24b7b55439
- SHA1 d7f7313d03abde7c5892d71a405aac032edf79c8
- SHA512 f5fd15a782a76f57a12aa70d0e28a75baea61dc646ac6a11a6f32b91bde1fcdb2e7252aa05f33b2729e348ff7adb05b6df8a8aeb1432b1c4d0f7b1f89d170953
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNa:A3k03kB56r
- TLSH T1E4257C03E6940FA4D10F81749A964662EA777C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
- Size 1.2MB
- SHA256 8a6ba4f18ec7dee1039231a518e94e43bfab0ed2ee947722d757c56893e659b6
- MD5 930974cf1af3b46258d40c3f09a57402
- SHA1 dc5939c8916d171c7121ac2697d9f66719ec174f
- SHA512 4a040b0dcb194439fba91fc811112ac43ddff3f9ddef25f54d3763cccadbc651d4f90c877e6642bd87a85cb5b918f53131b7f322cc78d2fcc30f5b26f91f5de5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNaF3UNUpEisI:A3k03kB56rgUN+Eir
- TLSH T108554A17AB584EE1D11F817899968255F673BC110F2097CB23549F2E3F336D0AE3A2A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.5MB
- SHA256 a0f22fb7470e70e807adfb1fcb5a3c2b6f7266ef88dc562f573f3855b527196d
- MD5 8a916666537e0dac1ef12bdd88fda491
- SHA1 c736c9441e6ad82b2be11e40be9998f1346e7fd5
- SHA512 b0a71eb42805115b8691863016bf2f4879d9c47f85b7a6f62ecdd349cb9d1f034693939bd0c9611703fcd512233b7295746162add79b6289006a707ec0092baa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNabUr2d29dBrtpDiI:A3k03kB56r0UidGl
- TLSH T1EF657C02E6940FE5D01FC1349A964662EA737C521F60A7DF1394AE293F32BD06B3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 1.1MB
- SHA256 71d9917d3dd0a840b2d6c3bfcf2fc47f0966901f8f21955b1c9ef359507e91c2
- MD5 83407035716c070cecd07c0770e91649
- SHA1 af31f7ec83726910e9fa9c1de168c6c1f5a357be
- SHA512 18541fd10f8de61f9077a0ce2a9582b17c9ead206e25545ecb4e5b7b22f9d068ceb2d3236376944d4a1c4ed36496e53df71968267f6bb0d933cc816ec3787e58
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNahTjE:A3k03kB56r2w
- TLSH T1C4356A03A6940FE4D11F81749A954662EB73BC125F2097DF1368AE153F32BC0AE3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 c91913155207c9690303a8381b39b32000d79a1001fd751079746cd0bda2511d
- MD5 b5d5e7ed019b4b767a8ecb107e589b2b
- SHA1 f0ffd44382d7075ed1446319f725d0d489bfb33c
- SHA512 2496fde31599a3708324cb210a585c218434e0d297db8b6492b26e1cb73edf69074b1eb14d340594fd53814caa8dfbf4c92b4b3d1607e2c3d1df8cf3b9c9504b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNaP0Le5ji0hmxNrM:A3k03kB56rgPji0Aj
- TLSH T116755A16F6A44BA5D02BC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 1.1MB
- SHA256 0af77af0e185062660ca4f50c0585ca7ac3f3e0782b91c9b3d12464072131bb4
- MD5 2b8cbb82aa1fb97a45fac5dfc98561e5
- SHA1 baf8f238bf3c05f62d1a2bdf9b8cc028eabb491a
- SHA512 67aa305c514e5ecd19747a1731dbc9b22d4098ea15ff5492248ae2978e70cc4a91d289b1d93ff0c4f0680de7c97b6bc95a2d6a22011414ee2ddfbdd2213c4005
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNakD:A3k03kB56r9
- TLSH T1A7352706D6940EA4D11F8174DB954662F6737C125FE093CB13D4EE3D3F32A80AAEA297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 1012KB
- SHA256 0094d594560430e34e17f99db63c6fac3cb2c4257a80b860f7cb03d3b0496e7c
- MD5 5b79aacddae096a00c1b0222813e2925
- SHA1 f331c014e2b0e756c60470bb7d55c6f3d6d74358
- SHA512 9e7de3ac9ae763aaa7d738c66e6ac6d5f435f54868b4de6fee146e313d3110f3008fc8fcf7d8ae1c6d3629e3522f9a017934c924e82937a0132837de7729a3ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNaSwE:A3k03kB56rF
- TLSH T16E257B03E6940FA5D10F81749AA58662EA777C421F6093DF1358EE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$
- Size 1.5MB
- SHA256 c47a2e4d4e9bf43a1c34c1419e39a90ae5c101d80cb7e761c6bae946c56775f2
- MD5 303ebaace5b42af707ac39316fa9f4bb
- SHA1 91a5bf05311d22fb7b378a0c71bdd30500273e12
- SHA512 41cdc4ce5c0b99063f7d6629dda83b53e3ac55dfdd62875b71a5ebb9ca93444e0e80fe51e691e4f50fbf62808bc2606b989b4937e8b2409dcb848bc65b3cc338
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNa93N+tCn50ChWdArKV:A3k03kB56rA8tDZqrKV
- TLSH T18F756B06EB944FE5D11F817496A68572F6B3BC411F2093CF5354EE2A3F336906E2A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.2MB
- SHA256 3903465340a573a17e36ef05894434ca1ea31e0bc90d178c8d80d1b818aef51e
- MD5 ab1cd331858ed4ed7189dceeb76d4a3d
- SHA1 b080b9be5ceb1deb5201af5b6683e79ae6003436
- SHA512 f6d9a51fd5ac8a03985e72a34fffe34013bfeb815d86cf3d5434c6ed7901390f004d7fa91a1cc1f071e70e58bc65219cf966aa46a34a25887211d59bb2d116cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKapVGgNaLV+PAk2hMH3:A3k03kB56rKi2WH3
- TLSH T194459D23A6940FB5D11F81309AE98576EA377C025F2193CF1354AE193F71BD0AA3A397
- MD5 SHA1 SHA512 SSDEEP TLSH