Analysis
- max time kernel
85s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 18:19
Behavioral task
behavioral1
Sample
2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260805-wx9vbataqh
- SHA256 6be8ab52fbb89066e7da6931341a24d40650370c538376bfce9def8498ede35b
- MD5 6f160dc1fe4f83e2b7dc678df4163e4f
- SHA1 af4462e4244d7a92ee120c35dbc375307f9febac
- SHA512 50e9ba26b652eb8c37f4d70db3ddbb490379d15b70a23344c5c5e5da433aacd85d441db2cf47ba0c9751eb5d27f74c502ad4b581b71af6fdd54055420b3cb788
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTvN5xe5jcAkSYqyE3YTqMi8CtBd2Q8:A3k03kHRJMpYqOqJtb2I
- TLSH T1B1956C16F6A44275D073C0B9C5D2AA9AFE3134425B308ACF1389D7282F27BD5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/524-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024415-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3352-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/524-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3352-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021c91-1013.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022630-1011.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002181d-1131.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001b00000001e08a-1605.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e48d-2072.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024415-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021c91-1013.dat aspack_v212_v242 behavioral1/files/0x0002000000022630-1011.dat aspack_v212_v242 behavioral1/files/0x000200000002181d-1131.dat aspack_v212_v242 behavioral1/files/0x001b00000001e08a-1605.dat aspack_v212_v242 behavioral1/files/0x000200000001e48d-2072.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3352 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 524 2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3352 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_6f160dc1fe4f83e2b7dc678df4163e4f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:524
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3352
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 6be8ab52fbb89066e7da6931341a24d40650370c538376bfce9def8498ede35b
- MD5 6f160dc1fe4f83e2b7dc678df4163e4f
- SHA1 af4462e4244d7a92ee120c35dbc375307f9febac
- SHA512 50e9ba26b652eb8c37f4d70db3ddbb490379d15b70a23344c5c5e5da433aacd85d441db2cf47ba0c9751eb5d27f74c502ad4b581b71af6fdd54055420b3cb788
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTvN5xe5jcAkSYqyE3YTqMi8CtBd2Q8:A3k03kHRJMpYqOqJtb2I
- TLSH T1B1956C16F6A44275D073C0B9C5D2AA9AFE3134425B308ACF1389D7282F27BD5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
- Size 2.0MB
- SHA256 76b2d9bf254dafb602061138655796aaa12fed17e9ce23a4bc95b69aaacfa85b
- MD5 01ea28e888ab6af6647de411788f0319
- SHA1 301d651c5e8e1767e4454eb969532cb7e17b91c0
- SHA512 6e4a7bb8ef3ec0e8e1c31306642f262a6903084af4970d8397714873385440f4bbc205b6bbc81ddb831fb55af0980eec4840ca95058a0b612185a01901dbebf3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTvN5xe5jcAkSYqyE3YTqMi8CtBd2QN:A3k03kHRJMpYqOqJtb2Imw
- TLSH T175A56C16F6A442B5D073C1B9C5D2AA5AFE3234425B308ACF1389D7282F277D1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 f214abc7ef1a22a5ade53c0b3dceb6b6f71d7942d5e71861a04fed547b58a75b
- MD5 08555d9d3d1f6a77ea6141422cb54ef2
- SHA1 fe32b2f37844ba8421ba89dfbf3b3c9e6311ad40
- SHA512 3ea2902e276ca7885185d9992838214a2767aa2a37d26e081b1579e8453086ae3214dbc5d35784f571bdd5f2d187cb5fc384f5f623aebf4c9fdab288ae60482e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTvN5xe5jcAkSYqyE3YTqMi8CtBd2Qm:A3k03kHRJMpYqOqJtb2IQPji0Aj
- TLSH T161C54B16F6748375D073C0B9C5D2A69AEE3134825B308ACB1389D7682F277D6DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 2.0MB
- SHA256 a1fee94bf1f4842b182b7a466072c558674499902badc57a61bb6cfda960faec
- MD5 bde6f0edb8a2bf0f6f714abdee09aedb
- SHA1 ecd35e1a41833332995cc38cf1a71ea49cc900df
- SHA512 751c6087ce8622cb2285fb774da7aab2b92571b37fece6bc82651fb55a9790bfefa6f433837d856ab980da1bb23008f7e1ee124aaa00590b365dd421686a82de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTvN5xe5jcAkSYqyE3YTqMi8CtBd2Qj:A3k03kHRJMpYqOqJtb2IV
- TLSH T118A56C16F6A44275D073C0B9C5D2AA9AFE3134825B308ACF1389D7282F677D1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$
- Size 2.5MB
- SHA256 a839bc972c9f693fcf61ab42c5edf7bf09852f1b2821c2673ad802690eafbf6f
- MD5 f62d1b6c974942d12cc82b008e124142
- SHA1 61c168ff57e8edee1339023c6f070bc8cd21b333
- SHA512 3627a1e14a4767d7099243e95384062628dbf79c4943bd0cf10e29199a9cf4384a7a0afeabb5aa9cb0031a222936c403b41f904ff1aad9e9c7bc383364227814
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTvN5xe5jcAkSYqyE3YTqMi8CtBd2Q7:A3k03kHRJMpYqOqJtb2IQ8tDZqrKV
- TLSH T132C55A16F6A482B5D073C179C5E296BAFA7234421B3096CB1385D32D2F277E19E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$
- Size 2.0MB
- SHA256 417da9fb7b3640ba26806450b5d49ae0f775eadf3f66ad953de470ad5ff6e33a
- MD5 6ae439b4291dfc60380a4b790a13e5c7
- SHA1 95da78c68cb83608432bfb50b2788637b6f33e98
- SHA512 f57ad9fe946563033da88f5be1368277bab130b9570c50be641e5f0bf71c05113d1413fb49261df36047d6f0c2481d3993a1a83fd83f34189ab12969a2c80e45
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTvN5xe5jcAkSYqyE3YTqMi8CtBd2Q6:A3k03kHRJMpYqOqJtb2IY
- TLSH T19FA56C16F6A44275D073C0B9C5D2AA9AFE3234425B308ACF1389D7282F677D1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.2MB
- SHA256 d24bfc278a8ce7423298ebdbac6f49b01de7c3d4cd40efdcb566690c97ab8339
- MD5 3ec45499f41b99704dd21edef6f056db
- SHA1 fc48a1a12004caa338a1aaae6570bb2311912962
- SHA512 3529942bdde177c56f2249d21c43449141cf6e0623f5e005886acc9734662e8f502f8f67609c9df115b3109650f320c11c9dc572946116bb7ca95a928b602c28
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTvN5xe5jcAkSYqyE3YTqMi8CtBd2Qb:A3k03kHRJMpYqOqJtb2Iai2WH3
- TLSH T157B56C22F6A44275D073C079C9D2A6AAFE3134425B3086CB1389D72D2F67BD1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH