Analysis
- max time kernel
92s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 22:10
Behavioral task
behavioral1
Sample
2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260804-13jbrser2s
- SHA256 39518ceb813705c4d87fe03bbe233771a9607e2d2128f7d8e527e3a015a5c645
- MD5 dcb9d1e9dd7349ace4f19d50c25e57b8
- SHA1 1944be94d8b53f7142c0f5f16454ec098da78845
- SHA512 a20160d7c1a030c1aab5b5ba40058488ec8d3c1382683c5659780223e3db0fa7bfca47b7d29b904a9e416e103c5ea696e6bc228272c85fbc4a3ab246f2e34bf9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasy3tPSYTqMi8CtBd2QHCHmTBW5kD5TJ:A3k03kHRJSqJtb2Ij56r
- TLSH T179854A16E6A44BA5D06BC074C9D29656EA333C425F3087DF1345BB293F337D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/408-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243f5-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2328-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/408-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2328-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002352f-141.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023531-805.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021651-1288.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000227f3-1532.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a0000000006d1-2060.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243f5-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-13.dat aspack_v212_v242 behavioral1/files/0x000300000002352f-141.dat aspack_v212_v242 behavioral1/files/0x0002000000023531-805.dat aspack_v212_v242 behavioral1/files/0x0003000000021651-1288.dat aspack_v212_v242 behavioral1/files/0x00020000000227f3-1532.dat aspack_v212_v242 behavioral1/files/0x000a0000000006d1-2060.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2328 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 408 2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2328 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_dcb9d1e9dd7349ace4f19d50c25e57b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:408
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2328
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 39518ceb813705c4d87fe03bbe233771a9607e2d2128f7d8e527e3a015a5c645
- MD5 dcb9d1e9dd7349ace4f19d50c25e57b8
- SHA1 1944be94d8b53f7142c0f5f16454ec098da78845
- SHA512 a20160d7c1a030c1aab5b5ba40058488ec8d3c1382683c5659780223e3db0fa7bfca47b7d29b904a9e416e103c5ea696e6bc228272c85fbc4a3ab246f2e34bf9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasy3tPSYTqMi8CtBd2QHCHmTBW5kD5TJ:A3k03kHRJSqJtb2Ij56r
- TLSH T179854A16E6A44BA5D06BC074C9D29656EA333C425F3087DF1345BB293F337D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 2.2MB
- SHA256 4c585a66746c7fa02afead48bfd5001f38455e08989db04169cba8f89671bd24
- MD5 0b3546457cc26023f879df2c2a49a187
- SHA1 93452222b542898e7918c712d393083dbd29815d
- SHA512 9488472be148e24135460ac6f4105e731c07845b586b39ff90ba47eb6bae04b1d5df58f99a6af1f2594a819f10dc8412f31b131869d261f8b18782f1bad7f421
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasy3tPSYTqMi8CtBd2QHCHmTBW5kD5Ty:A3k03kHRJSqJtb2Ij56rwTd9CHKyao
- TLSH T1A1B54A12E6A44BA5E07BC174C9929656EA733C421F308BDF1354BB293F337D19A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 c1113673c92b14770cdc14d8827b011200f44d34eb1b1661fb620b4e0b4e306a
- MD5 2e78dc6377e9ecf882b2ff95ef42c474
- SHA1 12fdf3ebae896520dcb36054d186c2622187d7d5
- SHA512 a09198fc8ebf5bca886b105c19fa645743a9a31c56a18e425f35eeef8ebb7b0142d7b6d3ed4e0ad741caa7c65daa705c984443134a4bc08be80030d1772461fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasy3tPSYTqMi8CtBd2QHCHmTBW5kD5T9:A3k03kHRJSqJtb2Ij56riPji0Aj
- TLSH T14AB54B16F6A44B65D06BC075C9D2965AEA323C425F308BCB1345FB283F377D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 1.9MB
- SHA256 01fe3fbb8045f7dedac6053f9ea89ce6bfeaee1c4718e9accdc1e846995ec971
- MD5 1bfc127b8558e7913ce66c6be740baf9
- SHA1 1ed4b611385b535fdbe522147698bb361b41305a
- SHA512 c6a047d3076a4fab352caff3ad27e085ceaf809dd58ce9713d228fe802e1d1bd48daba5012a3e1f9bac377f0762630ca86ce8f3897d254bfebec6ba71f02dc1e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasy3tPSYTqMi8CtBd2QHCHmTBW5kD5Tq:A3k03kHRJSqJtb2Ij56rf
- TLSH T13E951916E6A447A5D06F8074CB925656FA333C415FA087DB13C4FA3D2F326D09ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe
- Size 2.0MB
- SHA256 39f9a8c0fd587d6ee9cd3b77920593b991c5882897382feea38d86d4e4572540
- MD5 b8e92c4e6fb56352a376c7735cd8f085
- SHA1 aee48ca3c0d57f3ee3cc12b41ee6261e97d71b61
- SHA512 986f8d770b1a28ccac92a08df6ad7b1ce0d7fc2ecf4a25122c488c45c8a54d256a30479df0fa1322010033ff7c855036198006449a319cd0a3940b93137c496b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasy3tPSYTqMi8CtBd2QHCHmTBW5kD5Ts:A3k03kHRJSqJtb2Ij56rgTeX
- TLSH T1C0A54A16E6A44BA5D06BC074C9929666FA337C411F2087DF1355FB293F337D0AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 1.8MB
- SHA256 38462009177fdb87e972bc8128684f91847f1c33b17b257ac936f53264002fde
- MD5 18561dfbe42b16313610beaa0eec9aef
- SHA1 a3d2fb47c20ad08b601b72e3a5be4321bef8cee9
- SHA512 820c1fb9e6c386a3691a061f4061589241631497d581735f68c3696d29b3bbacc29b3589bbf46f7c47d41679f9c7adaf74d13b130ff24f530d0b6acbf8e53950
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasy3tPSYTqMi8CtBd2QHCHmTBW5kD5Tj:A3k03kHRJSqJtb2Ij56ry
- TLSH T101953B12E6A44B65D16BC074C9D69656FA333C815F208BDF1354BB293F337D0AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.0MB
- SHA256 b27c687ea85b4e6f4b5a9f00acf777d8ae9b07308e8321ee2516751370e12fae
- MD5 64d1da535dbe494dbba1ef8fdfee842c
- SHA1 8160d6ff8802e87d90bd2c5f9ae3439bb367deb4
- SHA512 d0f783151c872833b136036f080c166404d0ef12cfec6c61f09b5a196439337d5e72df917da35416f82a5f53676fdef530900885dc29a5e93cfcc6d30ea97b74
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasy3tPSYTqMi8CtBd2QHCHmTBW5kD5TC:A3k03kHRJSqJtb2Ij56rwi2WH3
- TLSH T12FA55B22F6A44B75D06BC074C9D69666EA323C425F3087DB1344BB293F737D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH