Analysis
- max time kernel
94s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 07:51
Behavioral task
behavioral1
Sample
2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 6.3MB
- Sample260804-jp3ptaam31
- SHA256 73b1194da08e259ac6c13768c627f594c27963d39f00d96aebe7582f187e4091
- MD5 2fbfa3f17225e7e7351bb97e6a65dfd2
- SHA1 1c80a49eea2777cc830798ace32c8d80efe43cf2
- SHA512 0074302fc1951d15f509436466dfc7f688202dd2a30b58361fd3983492d4a623cfef695ab9cf94a487d8f7c16389a882a21670a34a0fadd05486db4144c8c189
- SSDEEP 49152:A3k03kHRJV56r+qJtb2IdqJtb2IU56r+qJtb2IdqJtb2IdqJtb2IdqJtb2Ij56rr:A3k03kHRMr+c6r+cccJr0fkZcRjo
- TLSH T19A660925F6788721D077C0B9C5D2A69AFA3238425F308BCB1246DB6C3E276D5D53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2172-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002454d-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1664-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2172-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1664-17-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002351e-135.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021787-750.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000002036c-1527.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000729-1971.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001f183-2145.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002454d-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x000200000002351e-135.dat aspack_v212_v242 behavioral1/files/0x0002000000021787-750.dat aspack_v212_v242 behavioral1/files/0x000500000002036c-1527.dat aspack_v212_v242 behavioral1/files/0x0003000000000729-1971.dat aspack_v212_v242 behavioral1/files/0x000300000001f183-2145.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1664 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2172 2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1664 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2fbfa3f17225e7e7351bb97e6a65dfd2_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2172
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1664
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 6.3MB
- SHA256 73b1194da08e259ac6c13768c627f594c27963d39f00d96aebe7582f187e4091
- MD5 2fbfa3f17225e7e7351bb97e6a65dfd2
- SHA1 1c80a49eea2777cc830798ace32c8d80efe43cf2
- SHA512 0074302fc1951d15f509436466dfc7f688202dd2a30b58361fd3983492d4a623cfef695ab9cf94a487d8f7c16389a882a21670a34a0fadd05486db4144c8c189
- SSDEEP 49152:A3k03kHRJV56r+qJtb2IdqJtb2IU56r+qJtb2IdqJtb2IdqJtb2IdqJtb2Ij56rr:A3k03kHRMr+c6r+cccJr0fkZcRjo
- TLSH T19A660925F6788721D077C0B9C5D2A69AFA3238425F308BCB1246DB6C3E276D5D53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 6.7MB
- SHA256 8576d49da73ea013c9fe93465980b454ddcb15e572e9286a4fc1e4bd573199bc
- MD5 e2c03adf2c2d593c934ea49b699b8357
- SHA1 b5ff5091cbb865045ad8ce0ff909b5744e7e0384
- SHA512 0ee5cc6a65b1daca8429b430b449289b66044ca9b7a39799a660a9a0b8ed0e42237057c7c59c549b24703c418843196808c3700683a1cfae8fb00086d1cfdd1e
- SSDEEP 49152:A3k03kHRJV56r+qJtb2IdqJtb2IU56r+qJtb2IdqJtb2IdqJtb2IdqJtb2Ij56rf:A3k03kHRMr+c6r+cccJr0fkZcRjoKCqo
- TLSH T10F661A25F6B88761D077C079C5D2A69AFA3238425F308BCB02459B6C3E277D5D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 6.8MB
- SHA256 8074c23bdf227b690e68ea2da7022055877826784fbca24a398637e6a8686f9b
- MD5 818a12a56baa015588662e32855fd78f
- SHA1 3c4ff566ed9ba4e431fbb124c0228ccc0b24de3c
- SHA512 5e2c4901b5da3bbf89c84eb4a4ee85115ae687c53e03af831948c4c76d74659aba94a9bee47ea2a772a81401a12dc807576e050b4b3408a2dc2d79af5a6238a1
- SSDEEP 49152:A3k03kHRJV56r+qJtb2IdqJtb2IU56r+qJtb2IdqJtb2IdqJtb2IdqJtb2Ij56rZ:A3k03kHRMr+c6r+cccJr0fkZcRjo0jo
- TLSH T1B0760A15F6788721D077C0B9C5D2A69AFA3238425F308BCB1245DB6C3E276D6D53A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
- Size 6.4MB
- SHA256 6800ab434416e3c33ce6525f4310faf7ac4684e021aad1f39cfb8068d7946569
- MD5 b691fa28ac85d3395a1f01481353b029
- SHA1 5d7325e737c72b7c11e314075c925ca9df0d0e2e
- SHA512 f09b14ac969a2fd6377334dfe827f854f70a278dab0e00dddda807ad70753a674c3713465495e3d6b4f2b5c077595c0e9f797cdebcbe4b19b6abd87b8ba4132c
- SSDEEP 49152:A3k03kHRJV56r+qJtb2IdqJtb2IU56r+qJtb2IdqJtb2IdqJtb2IdqJtb2Ij56r7:A3k03kHRMr+c6r+cccJr0fkZcRjoT
- TLSH T1E366F815F6688761D07BC0B9C5D2A69AFA3338425F308ACB0285DB7C3F276D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 6.7MB
- SHA256 f475dc1937e3e8ab79c41702672958e0f18abbd99fbd64ee3fba798caff941e7
- MD5 eaa39c489ad1081011f614e545af97f0
- SHA1 952de8536fe906f96e784fd510fbf31ebcc78f1a
- SHA512 967c691cbe164798ef1749c23983844893616cc54ec974cb9d3e0107db09cafff23388bad4634d9dc64f384ddb8b2768c481d6333158e2705bf1bf1d8c9e4a93
- SSDEEP 49152:A3k03kHRJV56r+qJtb2IdqJtb2IU56r+qJtb2IdqJtb2IdqJtb2IdqJtb2Ij56rE:A3k03kHRMr+c6r+cccJr0fkZcRjog9
- TLSH T13F662925F6788761D077C0B9C5D2A69AFA3238425F308BCB1245DB6C3E276D5C93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 6.7MB
- SHA256 7b31de7623516997933895beb46ae8aa6248996f919290ee2af3f6f9853974c7
- MD5 2c774d6cd636695ad7ad4c9cdafbb570
- SHA1 019cbffcb21bd8401962d2f1f0aceb6a8aff67b0
- SHA512 c56584c2f567c3a07ef295146842ca2ba24af26bd15bc6d65ddf9b5f4624b660feb612db64972a27883b999c0ab86cb9cdf9f0e0f178184220d67ee6ce5f4469
- SSDEEP 49152:A3k03kHRJV56r+qJtb2IdqJtb2IU56r+qJtb2IdqJtb2IdqJtb2IdqJtb2Ij56rP:A3k03kHRMr+c6r+cccJr0fkZcRjolpig
- TLSH T11B661915F6B88731D077C079C5D2A69AFA3238425F308BCB12859B6C3E276D5D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe
- Size 6.5MB
- SHA256 b44e196df5d0135ba805cba3f486bc986669a2834d5855038070097d8592f078
- MD5 8c9be414983ac4047188d054e0bc5c18
- SHA1 e585a5e5dade68c9ed41f9428dd77d947ca33711
- SHA512 1c803337401b1a1b08fe8dba72fc0222e1adc1d55608751342a5d3804b46a8b212405a520750375f35b14f04474c53ddd1b9e7b308f798ae74cdb96f1aaf6d33
- SSDEEP 49152:A3k03kHRJV56r+qJtb2IdqJtb2IU56r+qJtb2IdqJtb2IdqJtb2IdqJtb2Ij56rT:A3k03kHRMr+c6r+cccJr0fkZcRjoPT
- TLSH T171660925F6788721D077C0B9C5D2A69AFA3238425F308BCB12499B6C3E277D5D936732
- MD5 SHA1 SHA512 SSDEEP TLSH