Analysis
- max time kernel
95s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 22:08
Behavioral task
behavioral1
Sample
2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260810-12grjsvtb1
- SHA256 411b4e551851f6b5f12432511a69cb9b86a8794bf66e85029e187f2f28aaa7a6
- MD5 8f717c946924bbeeb81621cf72f979d8
- SHA1 d7ea129527c34176e17f89addeb3625bbe379a0a
- SHA512 8ab9d23d520185776b59d7288234ec74b1acd1a64bc188816309a7e4197294a6d56a55a4b19bdb598b769a0211e45bed06783d4554aa750ba7d250c7ca17355a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJlE:A3k03kHRJn3k03kHRJ
- TLSH T11F95AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/5088-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ca-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4148-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5088-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4148-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023631-135.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001300000001ee98-1372.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002500000001e734-1521.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ea-1600.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000016919-1910.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d0000000006d1-2124.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245ca-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x0003000000023631-135.dat aspack_v212_v242 behavioral1/files/0x001300000001ee98-1372.dat aspack_v212_v242 behavioral1/files/0x002500000001e734-1521.dat aspack_v212_v242 behavioral1/files/0x00070000000245ea-1600.dat aspack_v212_v242 behavioral1/files/0x0010000000016919-1910.dat aspack_v212_v242 behavioral1/files/0x000d0000000006d1-2124.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4148 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5088 2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4148 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8f717c946924bbeeb81621cf72f979d8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5088
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4148
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 411b4e551851f6b5f12432511a69cb9b86a8794bf66e85029e187f2f28aaa7a6
- MD5 8f717c946924bbeeb81621cf72f979d8
- SHA1 d7ea129527c34176e17f89addeb3625bbe379a0a
- SHA512 8ab9d23d520185776b59d7288234ec74b1acd1a64bc188816309a7e4197294a6d56a55a4b19bdb598b769a0211e45bed06783d4554aa750ba7d250c7ca17355a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJlE:A3k03kHRJn3k03kHRJ
- TLSH T11F95AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.2MB
- SHA256 9112c38e9ae7bb380e1e2ed72609c40cfda00a3d52187a7f8d4214d985d03f6a
- MD5 ca06fa21aea930a44415990eeed9f429
- SHA1 b274915b379a58a1c52a0285c8b6cd1014a8eb64
- SHA512 0454eac967b1a5759e9ab92d09087110f830c0ac4d793827aabc010a42f2efaa811f54d3f05230683c647c050d4a7bb237372265ebaa1c5b345e43352f0f6df4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJli:A3k03kHRJn3k03kHRJeUN+Eir
- TLSH T189B58D17EB9804E5D11A817499D68722FB75BC511B6097CF2368831A2F73BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.3MB
- SHA256 7c3f20b8b32b8d02d778a6814d7b493ce03da5c243424570876cbd63342d3fd6
- MD5 e26b517d9b09eb315343fd46f033dfdb
- SHA1 85bfbb383d45b7408906bdb6e7bb79742292f099
- SHA512 f842519463c3a49c8fe88298572cb53ac0a2fc5d2a34c72ef1908d0979f15abd27cb4456fda4ca11c6c5b59e38dbde636980a820ece3b524b8bba0455e220242
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJlB:A3k03kHRJn3k03kHRJETd9CHKyao
- TLSH T1FBB59D03E7D400E8E16BC2349AA64622EB75BC561760D7CF136896152F33BD0AF3EB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E3C293D9-92A2-430F-A573-2511CDB7A4F8}\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 2.0MB
- SHA256 bf28713b0db167799faa0be9034c5db7c36e117d1c128dacee014ad048292745
- MD5 85f83f5594f3077ed2b28fb867f0ac27
- SHA1 7c2df52e156a7982f55b56469a4c23abb168b2f1
- SHA512 b3e1f3c414ab5a9bcb0f062e59352a8b7ef68bda39338cd3119b97d8af39c3af6030b053564f792f91782eb6e1c816f81ae92f6cc0054a3cb7ead2a0163ac4f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJlq:A3k03kHRJn3k03kHRJ6BPVAU
- TLSH T1CAA5AE03E79400E5E10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe
- Size 2.0MB
- SHA256 a185a7f5dd5b1bce29c24e38fa8d81caa40ec3a527c7ea23fdbc2ebcabfdbd5b
- MD5 6228036a76f6879233a9d813916e74f8
- SHA1 984f9349ea223c88243ed9314588183e1b4c49db
- SHA512 c8d48b822604292fd15ec7f4cb3d653ec12aee9bcf9201fba4457f6b6d7f8caa7ed4e364985246bd725246e7435d57e7df33276d261e81ed4d1114ee680f41f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJlj:A3k03kHRJn3k03kHRJcw
- TLSH T133A5AE03E79400E9E10AC1749AE69A23FB75BC52176097DF1368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 1d7538f1bbbe31416e1463405ff255d17f432b972217e0bce566a58b9f5c3981
- MD5 d21a94e33a05eca514f6f9b4e521f014
- SHA1 c96a24dd31f78732eb9a684de5bf4f9c024c181d
- SHA512 6cf8b1d24007b553178148b8372faa433570e7cac5b8520e35a104f2664d69371aef852eb671022b824b7aa99ccaa45b6e477a7abf2f4e25db4b9366d84f25ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJls:A3k03kHRJn3k03kHRJmPji0Aj
- TLSH T1DAC58C17FBA401B5E027C174CAE69A67FA717842173096CF1358C7292F63BD0AB3A365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 2.0MB
- SHA256 b8b233eafb1a9cbdc3b2d44075eb4c2f9b14333683a56d9a015b305b89407403
- MD5 5637b83bc6ba71a5ae346ff3efe0f369
- SHA1 b1fe351705b941744b17df54934ee2217afc2c3f
- SHA512 6a4c2e5c1665af12077d6895cfb032195bb95ab5cdbe8c79d5094436d4b393558ad6e33e376a0653f1d45be72a6fdef22f7492c7e8a918abf750c506c0ce8de6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJlt:A3k03kHRJn3k03kHRJb
- TLSH T14BA56A03E69400E9D10E8174D7965A22FA777C5217E092CF13D8D63D2F62BD0ABBA397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\StopDisable\WatchUse.exe$
- Size 2.1MB
- SHA256 f26de8a2c78e8bf249f7485faf340975344d98814bd8da78ba6ac8d46c620b7e
- MD5 a8676afb0365df5562241c76fac75b58
- SHA1 03c12a8f06773667253de07f1a062fe5131936c4
- SHA512 bbadf1ca68c8fc811a874edd9aa903cfafcb92a230fac903346c08b39323705a89764af82caabc2cfda9cb20e4506df3aa0b231edd028b6062cf64363c4e3ece
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaiT7zCC3mnXoZ643mnXoZ6i6cMJl1:A3k03kHRJn3k03kHRJEi2WH3
- TLSH T188A5AE13EB9400F5D11B81749AE99636FB75BC52172093CF2368D6092F72BD0AF3A3A5
- MD5 SHA1 SHA512 SSDEEP TLSH