Analysis
- max time kernel
98s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 07:34
Behavioral task
behavioral1
Sample
2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260804-jegdtsfc96
- SHA256 1264fbed5f7fe4ebd97a46e9f1dd6aee20df3a8cec4131314b2a03084cc56eb9
- MD5 40c3f5baf35a3756ff057dc028f030f4
- SHA1 4692a14ad645be5761ddc6e4b10f8783512d88f1
- SHA512 4e984bce2ed39c42752d5aecd0bad1a47ba59ba2fa3656b21a5b9e4d69d1b68104e0c47757191305aa1970993ef4ac5aef8ebdad3cd4d336f8db4bc17d7e0137
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji0v:A3k03kHRJfqJtb2IQPji0Aj
- TLSH T19B955B26F6A44375D073C0B9C5D2A69AFE3134425B308ACB1389D72C2F67BD59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/2616-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244c3-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4156-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2616-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4156-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244c8-143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021ec9-986.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021650-1290.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001e809-1385.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002700000001e809-1534.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001eac1-1929.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000731-2076.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244c3-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x00070000000244c8-143.dat aspack_v212_v242 behavioral1/files/0x0002000000021ec9-986.dat aspack_v212_v242 behavioral1/files/0x0003000000021650-1290.dat aspack_v212_v242 behavioral1/files/0x001400000001e809-1385.dat aspack_v212_v242 behavioral1/files/0x002700000001e809-1534.dat aspack_v212_v242 behavioral1/files/0x000400000001eac1-1929.dat aspack_v212_v242 behavioral1/files/0x0004000000000731-2076.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4156 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe$ 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2616 2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4156 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_40c3f5baf35a3756ff057dc028f030f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2616
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4156
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 1264fbed5f7fe4ebd97a46e9f1dd6aee20df3a8cec4131314b2a03084cc56eb9
- MD5 40c3f5baf35a3756ff057dc028f030f4
- SHA1 4692a14ad645be5761ddc6e4b10f8783512d88f1
- SHA512 4e984bce2ed39c42752d5aecd0bad1a47ba59ba2fa3656b21a5b9e4d69d1b68104e0c47757191305aa1970993ef4ac5aef8ebdad3cd4d336f8db4bc17d7e0137
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji0v:A3k03kHRJfqJtb2IQPji0Aj
- TLSH T19B955B26F6A44375D073C0B9C5D2A69AFE3134425B308ACB1389D72C2F67BD59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.2MB
- SHA256 109ab9185b7ad50a3be6d788fdb16e55fdb40222ddb86ea6c1bbe62cf83dec33
- MD5 8cdc31e7e3ac731baecff00f6e64f9c2
- SHA1 c3622ee57e9e909731f9d21382c89edef163f327
- SHA512 fccb110e4cc584e1e0e06d6ce080cd61210ff2703f37886e82eb093bb8bdf349a41d22a18b8552ac11f9f7fb749edc53cabdbf0d3607c78814f22f075ca3c4bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji0B:A3k03kHRJfqJtb2IQPji0AjyUN+Eir
- TLSH T19AB54A26F66886B1D077C079C9D2979AFA7234421B308ACB1345C32D2F277E59E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.4MB
- SHA256 193df0a5c00b15420ace502b6e210797c6a4b237336e9f5688e296eca5938ec9
- MD5 1146da9eda88f03fa72698bcf2fe753e
- SHA1 91a1148dfa96ac9c2d557bd40b427cbc55327e43
- SHA512 59b0c86a4867e0e2d35866b33e74adb881ad350ec6face18a85146e51889371662754aa9d8ae65792d8744daa85ad8f7f8bf72bd92b6bb92f7cb5b7114492a4d
- SSDEEP 49152:A3k03kHRJfqJtb2IQPji0AjoTd9CHKyao:A3k03kHRNZjoKCqo
- TLSH T1BDB56C16F6A442B5E073C179C9E2965AEE7238461B30CACF1385D7292F337D19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe
- Size 2.0MB
- SHA256 947135c359f9c02a310e4aff48010fb37fd6470a62845c6d523d1a1bc132334d
- MD5 38721ba1c7633508fb66289b5eea79cc
- SHA1 de49bad1f983dc116e7b02e5dd6b0222e5d9f22f
- SHA512 28011ee3b8d3e52f1b1cbd70b8bff03a13f25f8d0ff7bfc81a47fe8c99f0b4f64ba1d7c73d01ef65f851e2149825bdd3827f1e92baaa0324ebc48752c8baa5d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji02:A3k03kHRJfqJtb2IQPji0AjMI
- TLSH T1CDA55B16F6A44375D073C0B9C5D2A69AFE7234425B308ACB1389C72C2F67BD59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 66b17a9b061f7796aa519dc5e19bc03aad4c82f793c006e22808340ea353fcd2
- MD5 ed2df67a9f0a6ff84791543ff51d9172
- SHA1 29a40366b04ce0fb3f292100b2ceb6d0a9419974
- SHA512 50e762f3e57b6b8748b901dfc86786986deb15cd144626c7dee29d615eae3792f2d3ef54e3740072cd16dafaad1726d24dbe6c14f982c3fc9a62671ed54a41a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji0n:A3k03kHRJfqJtb2IQPji0AjKPji0Aj
- TLSH T1E6C55B16F6744375D073C0B9C5D2A69AEE7134821B308ACB1385C76C2F67BE69A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.1MB
- SHA256 71cc5482a751d27e7d5691ae25d613175239819394419f2ce458b1edddc493c3
- MD5 cdb9c13e3ad5390ab5f3835bf13de33f
- SHA1 321f736e131b9063b48b5c5bfd8dc56ccc3ac31e
- SHA512 c93b03d2f60538f470d8a6707f93843cdc5cea39c48c0dd64f9092511755418cb4a8462b72dfefb61716f7b6c98f81883dfc059bc1cdf15effc39d7dec901ed7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji0M:A3k03kHRJfqJtb2IQPji0AjX
- TLSH T145A54916F6A44365D06BC0B9C7D2965AFA33384217B086CB13C5D63C2F277D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE
- Size 1.9MB
- SHA256 36ed2271db99aec20d95d953d6b9dfc211682ea198d9743c56ac8fe87af469e5
- MD5 eb0d6b04306dce7654dca872b9d6ee02
- SHA1 a3b92ee46e04e93621d3e390bae22e70ca6b84d7
- SHA512 8420a4efd6dae7124784014fe0d3b620b855b8b48c25a4f7abeb643c83dbaa58d7cca956f34d2219bbbf37d92916fd5598c55e1d5a2121ec9f38faa97ce44bea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji0m:A3k03kHRJfqJtb2IQPji0AjH1
- TLSH T19C955B26F6A44375D073C0B9C5D2A69AFE3134825B308ACB1349D72C2F67BD59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.0MB
- SHA256 e587ea6040570bd7b23b7c4b36490d3b59e46d398fde73894338aed40e054187
- MD5 8cf6c5fd8a8e8a672632b13874529994
- SHA1 9a275131d812b73d782996196928af19cb0cf3af
- SHA512 55172c7554952859ed8e85a62ad729330418bff744a058f25ad3cc6d83e6a21db770829c9657ae334fef839d0d74f4e9a22b2eb0f80f812ac842a026ba44bc6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji01:A3k03kHRJfqJtb2IQPji0Ajq
- TLSH T13BA54A16F6A44375D073C079C9D2A69AEA313C821B308ADB1349F7282F777D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.2MB
- SHA256 330a1564453ff86d89c55fb8f392a58734fb889a055c816048575cf8f6af4c8f
- MD5 fced84f408f0dc4fef1c70fbb2ebdceb
- SHA1 c23d27ee587d329c972a8e454f27378edaa4028d
- SHA512 72be33cc62495b56a6cbfcdf80ef2d8bab93ab867654580c835550ffcdfdc56b1a7586dd3ed513527735a78ee33e1c9715d4bdebac68eb4e3dc5001e9dbdd759
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8A2yFYTqMi8CtBd2QHCHmTBW5X0Le5ji0w:A3k03kHRJfqJtb2IQPji0AjYi2WH3
- TLSH T16FA56C26F6A44375D073C0B9C9D2A6AAFE3134425B3086CB1345D72D2F67BE19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH