Analysis
- max time kernel
115s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:37
Behavioral task
behavioral1
Sample
2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.2MB
- Sample260802-w9ws8aem2z
- SHA256 a20cd3f7a1f90a162b1abf9739fac7c199d61ed45a4b2a5d10d2ac80c58f0680
- MD5 517f57ff7200816b3925fc6a4474fd01
- SHA1 5fe8a65a82ac6f14142af8cd17a8211271c5165b
- SHA512 3015409ab37971f479f96c13d68e0a1a7e7b46e271e5cd9b4f92909e616615513969006e9e6299cd36d190cc4cb0defd1db9060483d11989daa81edc7373d5a8
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0Aj:A3k03kHR+R8fkZcHfkZcQjo
- TLSH T1D3F52A16F6788362D0B3C0B9C5D6AA9AFA32384557308ACB0345E72C2E377D5DA36735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/5112-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b805-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000016cd1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5112-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1860-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000900000001848c-157.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019995-585.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000019974-586.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a79f-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0dd-1030.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9f-1293.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000300000001b805-5.dat aspack_v212_v242 behavioral2/files/0x0006000000016cd1-11.dat aspack_v212_v242 behavioral2/files/0x000900000001848c-157.dat aspack_v212_v242 behavioral2/files/0x0003000000019995-585.dat aspack_v212_v242 behavioral2/files/0x0009000000019974-586.dat aspack_v212_v242 behavioral2/files/0x000300000001a79f-894.dat aspack_v212_v242 behavioral2/files/0x000300000001a0dd-1030.dat aspack_v212_v242 behavioral2/files/0x0004000000019c9f-1293.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1860 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5112 2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1860 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_517f57ff7200816b3925fc6a4474fd01_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5112
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1860
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 a20cd3f7a1f90a162b1abf9739fac7c199d61ed45a4b2a5d10d2ac80c58f0680
- MD5 517f57ff7200816b3925fc6a4474fd01
- SHA1 5fe8a65a82ac6f14142af8cd17a8211271c5165b
- SHA512 3015409ab37971f479f96c13d68e0a1a7e7b46e271e5cd9b4f92909e616615513969006e9e6299cd36d190cc4cb0defd1db9060483d11989daa81edc7373d5a8
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0Aj:A3k03kHR+R8fkZcHfkZcQjo
- TLSH T1D3F52A16F6788362D0B3C0B9C5D6AA9AFA32384557308ACB0345E72C2E377D5DA36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.7MB
- SHA256 fc99d2ef38ebe123512a840f192787b30f7a068eefc701c029be9e99097c0383
- MD5 23928b11aa5ce796fd5e098c39ade29e
- SHA1 7bd7f2ef74985697927c1e3666444797177a9a38
- SHA512 ae154f40aab505717048d921eb059ff35c7a6df0e619f0a9f5766e5a2b02fd6b57b2216b028feb71ed22dfed54b8264d394335b96d73f085364da963432eb171
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0AjKPji0Aj:A3k03kHR+R8fkZcHfkZcQjo0jo
- TLSH T13C061A16F6788332D0B3C0B9C5D6AA9AFA32384557308ACB0345E76C2E377D59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe$
- Size 3.2MB
- SHA256 5b994390bc15c5e1db5d9b3adcaec429885ed15de6e90abd1a1c1d5297a05f9f
- MD5 b42379050a5b13358e922d860dcef5cc
- SHA1 6bb2075def076a2597322ecd46ee5ba69b4a41cd
- SHA512 48e6e0dce7df8a1c166aa321cfc6e610e8a5976a60481698c6868dda48f24bc93e25d37032b62f76f8d53743e45e0140428d5b44b86b46d290bc1a46c33a8476
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0AjDD:A3k03kHR+R8fkZcHfkZcQjo3D
- TLSH T16EF52A16F6788362D0B3C0B9C5D6AA9AFA32384557308ACB0345E72C2E377D5DA36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 3.2MB
- SHA256 ad1bff2277b67065574e4574b1d94c720ae88923e8e5f8588cb2f75331f2350d
- MD5 c172a8844082a41aceae07cef9f4e4ca
- SHA1 c54ceec4ca7f4b3794583d6b4bc4b5dbe2ae1201
- SHA512 00b92fdd11e82f32786e8b5b532dc85583efe9c01eb395e87f141dc95e42e2f9fa4edac12707a6fe61efead1ceb00f6e0db20fdfffd6806973c3bda06288b2d7
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0Aj+:A3k03kHR+R8fkZcHfkZcQjoy
- TLSH T1A4F52A16F6788362D0B3C0B9C5D6AA9AFA32384557308ACB0345E72C2E377D5DA36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$
- Size 3.3MB
- SHA256 8387a1f05edd452348435fffda84d8280fc0558b781eb72f79a4a2e803aa3afc
- MD5 b9852352866a0ecee9ab639b771a4ff4
- SHA1 a7a65ad9e62c536ee1cb0e8805559ee5f7596b0a
- SHA512 bb100f6389c5cdac54553981239fbf93742ab79a936e185d11fe99d2372bd2003b159ddc1748ffd0c885f13a0ffb287141033cddcf3acd83cc377766b4fccada
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0Aj+7:A3k03kHR+R8fkZcHfkZcQjow
- TLSH T1BFF52B16F6B88362D0B3C0B9C5D6AA5AFA32384557308ACB0345E72C2E377D5DA36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$
- Size 3.3MB
- SHA256 7f07b9fd41fdb6008d637f9c488a2d8456aed6d52494af5eae2ade14a9655269
- MD5 d787008cf11c28f30a1962521cc30178
- SHA1 abff5b4ff83db8be79eefc0c6801ac257c9cda5a
- SHA512 6067c257b7af150d0c8496cf4384560162bd2a99e057782ddfae14d35e08de74d2ed9805f434d0b0ad8cdb5abfb573b014a64ff4529da7ef0d1275f628cd8170
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0AjOhNDS5lS/A:A3k03kHR+R8fkZcHfkZcQjoWNDS5lSo
- TLSH T177F52B16F6788362D0B3C0B9C5D6AA9AFA32384557308ACB0345E72C2E377D5DA36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.2MB
- SHA256 95d1bab7aeefaaa000bbd79f564fb2f02c04b5c2059fe3b0261e35e3c25f08a6
- MD5 1805bb8a635ace322ab66a633473623b
- SHA1 ee436c74ce90c46612ff5a42bd59a8a950481250
- SHA512 a8032e056d8017d4cc5ddc32f80b71de2775535aeca348bcd56a9e0a7b6943302617abb3d934e3455a1fbc2053aa457644695377f883d6d79cc1defdf7aaa57e
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0Aj7:A3k03kHR+R8fkZcHfkZcQjoX
- TLSH T155F52A16F6788362D0B3C0B9C5D6AA9AFA32384557308ACB0345E72C2E377D5DA36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.3MB
- SHA256 39605e33c38649af85b38e9d20bd3cb6eaaafdae9ad01573297c8faed51a18fc
- MD5 f38585c0595272f1957ae667e4f4b5fc
- SHA1 72ea2420d3704b66edf40d37fa444e4230cc6bfd
- SHA512 fd5173cf6301e2ecd6d0ad4dafecfa0c398388fc350d3600092d275f8352c4496760ab7b2ae8506f7ca70ec5cd62d2d001d07769a3cedd07a55084e2a4bc9eae
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mb3eW4SkZP4sz9Mb6Pji0Ajq:A3k03kHR+R8fkZcHfkZcQjo2
- TLSH T1F9F50916F6B88362D0B3C0B9C9D6AA5AFA323C4517308ADB0245F72C2E377D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH