Analysis
- max time kernel
105s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 09:40
Behavioral task
behavioral1
Sample
2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe
- Size 2.7MB
- Sample260804-lncs4sha22
- SHA256 984a256cde224613df60e09d30514502aa554e203b2e294ef583dd48298f3955
- MD5 cc9404b70f6fde9486e2961c6ab27c20
- SHA1 51600dab7aebfd99087a68a823e2c28beffa10e8
- SHA512 870240d1f044e893acc161dc9c52255351a45944fa4e989c3c9e97bb27ea6828fc6dbe4177779f189bb2e276af28625a094b42d7df2ec7648cefac589560106e
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0Aj:WYrRokKrOO53up6r2wjo
- TLSH T134D55A1DFFA48E31E077817189A6A35E99767C611F3082CB22847A1DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 15 IoCs
resource yara_rule behavioral1/memory/4220-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243c8-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4332-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4220-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4332-41-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023530-117.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021787-747.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000243d3-1015.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001e000000021673-1252.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001e809-1393.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002800000001e809-1540.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002316a-1764.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243fd-1762.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000000071d-1989.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243c8-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-13.dat aspack_v212_v242 behavioral1/files/0x0002000000023530-117.dat aspack_v212_v242 behavioral1/files/0x0002000000021787-747.dat aspack_v212_v242 behavioral1/files/0x00080000000243d3-1015.dat aspack_v212_v242 behavioral1/files/0x001e000000021673-1252.dat aspack_v212_v242 behavioral1/files/0x001400000001e809-1393.dat aspack_v212_v242 behavioral1/files/0x002800000001e809-1540.dat aspack_v212_v242 behavioral1/files/0x000200000002316a-1764.dat aspack_v212_v242 behavioral1/files/0x00070000000243fd-1762.dat aspack_v212_v242 behavioral1/files/0x000400000000071d-1989.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4332 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4220 2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe 4332 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_cc9404b70f6fde9486e2961c6ab27c20_amadey_cobalt-strike_darkgate_elex_hijackloader_stop_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4220
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 984a256cde224613df60e09d30514502aa554e203b2e294ef583dd48298f3955
- MD5 cc9404b70f6fde9486e2961c6ab27c20
- SHA1 51600dab7aebfd99087a68a823e2c28beffa10e8
- SHA512 870240d1f044e893acc161dc9c52255351a45944fa4e989c3c9e97bb27ea6828fc6dbe4177779f189bb2e276af28625a094b42d7df2ec7648cefac589560106e
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0Aj:WYrRokKrOO53up6r2wjo
- TLSH T134D55A1DFFA48E31E077817189A6A35E99767C611F3082CB22847A1DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 3.0MB
- SHA256 48ecad718cbb09a2a929f46d429f2b806ee4a1a91eab41c832efcc2248271f73
- MD5 96a65ba5b32f16151f1b975de69e1bdd
- SHA1 cf003a2b4ab8ef064cb9fcb8da90cbb2e8b1e819
- SHA512 ed36b2b66e3247dc0a7f4424ffd82b4e1ac9773ffea22f2b2e03b722946d5bafa7687e7ed19a8007aea1a3e630e01bba0308b10550453a41ac9e270f10c8fd8d
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0Aj4UN+Eir:WYrRokKrOO53up6r2wjoIE
- TLSH T1EFE5481DFFA48E71E067817588A2935DA676BC610F2083CB22947B1DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.1MB
- SHA256 5979243e6c6bfb9050f8a54ea96ae9dba7023ac858d794c6da81baea27e08652
- MD5 a01be92f2642f9150f73e186aa5795c9
- SHA1 c0f3be002ad48b8eb3ba7b0f65576632325e31b9
- SHA512 2286d842b70278fc63a32a3205ac57cb30061e685ac2318667497bf2102e15211bac7422da83b8c523120108cc2c29b7a25782734c749dd6c29f19264459d0ea
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjGTd9CHKyao:WYrRokKrOO53up6r2wjosCqo
- TLSH T19FE5591DFFE44E71E077817189A2A35E99767C610F2086CB12847A1DEE32FD19A35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
- Size 2.8MB
- SHA256 97305c8208dad5023ed501f0945d44629409257791e1167f3efbf90727d38ad9
- MD5 881a268a4d465909614516847cc07e5a
- SHA1 e92b35b4a03c48831884aac8042ea1cb7e7d8f73
- SHA512 a8b9b25f1e1df214e8e1041d8a7074bef58495d20ac5aa6a697f307851ee8270e8b33391cdf7413abe8c0ea253da82a5c3c5a452bcec9141ba455fe63e13cc08
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjOw:WYrRokKrOO53up6r2wjo/
- TLSH T192D55A1DFFA48E71E077817189A1A35DAA767C610F3086CB22847A1DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$
- Size 3.5MB
- SHA256 e15e479aed36e1cb2e4fa8686ce8668c058da4a9b6765dd623fe4f5ba199a251
- MD5 f9f353208c92fd09f7b50f3f83473911
- SHA1 661c0982d778183f2f3639eaf1a59ad847f51e03
- SHA512 bc6d63bef4049afc8934c1bc56c3a910eb3fb9d3a13e5b47ba654275c7b2724ea452f7f479529e1ee4ca63bdd736875b4c019cd0bf58a73da76456ced35a2113
- SSDEEP 98304:WYrRokKrOO53up6r2wjoKtMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMQ:mpD53upW2CoKl
- TLSH T1D6F56B0AFFE48E31E0B7417189A2975D9676BC610F2082CB22947B1DEE32FD19935727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.2MB
- SHA256 ac2e8b2dcb82544404c0c6a563c41028114dd26c1da90571088ce5e21f3550ca
- MD5 a034e28b8941606f72bb6ce301c50227
- SHA1 d9940e1ebb70eaa347d1ee39f0c88e7d5ab4448b
- SHA512 40214509313062ad1336a1ca19e77f9cfedd1c4f4f9112dda62a633b37eb138b51e57552e0a2e7f611dc63f8df83814644eaa269977adbd0917da1415b45f387
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0Aj4Pji0Aj:WYrRokKrOO53up6r2wjoijo
- TLSH T1D3F55B1DFEA48E31E077817589A2A75DE9727C510F3086CB1284BA2DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 2.8MB
- SHA256 77dde332124cf0b262a9113658066136393ba3b69a0b777a36396508ed832eb6
- MD5 ed3a89ae5136cb35fac5fb50dbb562aa
- SHA1 bece43a04ddc6f6aa7931ab9a98b4b08654e9914
- SHA512 e5e37290a3ebaadd6f534c3f23deaa2a77dda50481d4ea0818d5e37b484c65122048874169cefcf7d44b81938c5210beeb20dfb5272e0e1ec486bd0c3ad40c3a
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0Ajl:WYrRokKrOO53up6r2wjop
- TLSH T1E7D5271DFEA44E31E06B4171CAA1A35DA5777C610F6082CB2284BA2DEF32FD19975723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 3.2MB
- SHA256 b267faf12cb04927a3f570f75cc14a5765f1e15d126d844561ac6ca7c1aae7f2
- MD5 acd4de8d9b41f30bc17cf0aa795913d6
- SHA1 8d7ec09a4d091dae62dc1c99ee33c2abb49b853e
- SHA512 b2e1a3b62b9c5f429be01cc11c076c5d7e1f92343bb20c09e830cfa4f13805f088edd3968448b377895a34b98c9629dab9a870d751ae8e2c47e9921b6b9be40a
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0Aj0UOlk09:WYrRokKrOO53up6r2wjoS9
- TLSH T10CE55A1DFEA48E71D077817489A2935DD5767C610F2083CB6294BA2DEE32FD09A35B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 2.7MB
- SHA256 afe52296fd88ac472b708f0d0acad254f57235941395c6ae41728047f8fdd6b8
- MD5 d8a2c36abc74f2ee2e17b7b30b5f8ef0
- SHA1 1833aa0d0d260d7c009ab28a0280065cd97e15c4
- SHA512 d64782a1b4d5c90d770a6a306c61c36c2268b8d3961927f79131a9c8c644b67293a50387535f018e341205f5835b9f208399223c13f3bca4587d0373722f0eb6
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjN:WYrRokKrOO53up6r2wjoB
- TLSH T15CD55A1DFFA48E31E077817189A5A35EA9767C611F3082CB22847A1DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe
- Size 2.8MB
- SHA256 b51dd53e364dfc4c769c017d03689807135403011ddb148a565c576d85c27779
- MD5 1870b8cfcc6f5b25eba5707895233d18
- SHA1 7920a99b867a3fcbfacee2d277de37fbeea18b3b
- SHA512 4e6c776cf704804bf813fc7518da89b0c09db71058478bb717cc7cc9b44d1938241b357f1602f39b7c554012968a94799413dbf9b6adad7f499a052cd64af525
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0Aj4:WYrRokKrOO53up6r2wjos
- TLSH T179D5490DFEE48E31E0B7417189A6A35DA9767D610F2086CB22847B1DEE32FD19935723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.1MB
- SHA256 314fcbeb9d2bf0e3a39288f0011a3c8328fec6388feac46329bd6cb7a0d764b2
- MD5 5cab9d311a1d4db02d2d320347c77df6
- SHA1 ae4240df9355b144a7bada489484f04b845d07ed
- SHA512 3ebf726475f36364c9a452bac49a765eb8873b73c3d936117025df6b9da54d1d40a168c273c5f32f5bda685da2ae7a297de3e5b185ea34c02672bd59140d3a78
- SSDEEP 49152:FJlJXDtoZerRokp8rOO53RTqtiZEp6056r22hPji0AjrXpiMh:WYrRokKrOO53up6r2wjo3pig
- TLSH T181E53809FFE48E31E0B7427189A5A35D99767C611F3082CB22847A1DEE72FD19A35723
- MD5 SHA1 SHA512 SSDEEP TLSH