Analysis
- max time kernel
98s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
17/08/2026, 15:25
Behavioral task
behavioral1
Sample
2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 2.3MB
- Sample260817-sty2vstbqb
- SHA256 5abe19e54e2bd020b29e3cad183f03164509dd46f045328448f64e72ffefaabb
- MD5 9919adb88d444744654ee588718faf91
- SHA1 128d62a5e7d41cee59e994860877ce1ac15315a3
- SHA512 cc65768efefce605cf5105969d9d00b519aa35275df22e912c6fdbedb1ec8ba35bf904c079d705036dc2c5ba34537c5d5a26353344988d5d5ac8cdac4296e093
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlYNzyuag1YTqMi8CtBd2QHCHmTBW50JIUIYTR:A3k03kHRJARJWsqJtb2IjJIUfqJtb2I
- TLSH T153B55A26F66886B5D077C0B9C5D29A56FB3238524B308ACB5385C32D2F277D19E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4192-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024452-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3472-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4192-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3472-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a0000000212fa-614.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022606-749.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024462-1247.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00140000000006cf-2057.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024452-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x000a0000000212fa-614.dat aspack_v212_v242 behavioral1/files/0x0002000000022606-749.dat aspack_v212_v242 behavioral1/files/0x0007000000024462-1247.dat aspack_v212_v242 behavioral1/files/0x00140000000006cf-2057.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3472 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe$ 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4192 2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe 3472 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_9919adb88d444744654ee588718faf91_amadey_cobalt-strike_elex_glassworm_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4192
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3472
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 5abe19e54e2bd020b29e3cad183f03164509dd46f045328448f64e72ffefaabb
- MD5 9919adb88d444744654ee588718faf91
- SHA1 128d62a5e7d41cee59e994860877ce1ac15315a3
- SHA512 cc65768efefce605cf5105969d9d00b519aa35275df22e912c6fdbedb1ec8ba35bf904c079d705036dc2c5ba34537c5d5a26353344988d5d5ac8cdac4296e093
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlYNzyuag1YTqMi8CtBd2QHCHmTBW50JIUIYTR:A3k03kHRJARJWsqJtb2IjJIUfqJtb2I
- TLSH T153B55A26F66886B5D077C0B9C5D29A56FB3238524B308ACB5385C32D2F277D19E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 d7526e48319a1e7332341225880cd57c4e70bbeb90b0a26e069f50d10546f779
- MD5 4ff55f22c4cc8a0f3135c88a548f4334
- SHA1 0971eb1f1edec7ee3cabb264b609038e80cf62a7
- SHA512 8fbf19a96e7e93a05b854aa1827975789f6a31ee3d570215c4cef6bee1b70e4682ef166219f50fb013c5cf18fc9b23f4a19fadcb4af45d053d25c86fa3f0bdfb
- SSDEEP 49152:A3k03kHRJARJWsqJtb2IjJIUfqJtb2IQPji0Aj:A3k03kHR+RUsmZjo
- TLSH T1FBD53A26F66887B5D077C0B9C5D2969AEB3234424B308ACB5385C72D2F277D58E3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\javaw.exe$
- Size 2.6MB
- SHA256 0f92c221ea5f34430b5aeb3ebb538cbd456a9e9bbf07a8cf5b5fbab82037b997
- MD5 f27d580bb441aac709bcd74037f225fa
- SHA1 1caf82a3fdff5104584bf9e7ee8b1563a6b6429a
- SHA512 898045c3fb7fcb7d9f3c703a4b21344bf05291d5c05f59d0cf5cebfe6f3dc86a4c34d0da4b47c6a8392480de90587e185b9e96f12df4198776f8f18bad37f66c
- SSDEEP 49152:A3k03kHRJARJWsqJtb2IjJIUfqJtb2INT1Llje:A3k03kHR+RUsmOLte
- TLSH T1A8C56B26F6A886B5D077C079C5D29A56FB3238524B30CACF5385932D2F237D19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 2.8MB
- SHA256 e186a9d4beace0284aae378ec8ed64afc221db647a9c4a9f95f28154a55969ac
- MD5 e29455283f6acf81af34e3156dbc570c
- SHA1 5e5a3bf176904c45f769d5123a8ae3b404b7c032
- SHA512 33883201bdea52c0ff42af75cda6343d3ed84fcf5178a7eecf242e6205250d43a697dd7666ea14fc831b5e6492029bb6ba006806dc546d1ce1d7885ef1a4b060
- SSDEEP 49152:A3k03kHRJARJWsqJtb2IjJIUfqJtb2I8UOlk09:A3k03kHR+RUsmP9
- TLSH T185D55B26FA6886B1D077C478C6D29646EB7238514B30CBCB5359D32D2F237D19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe
- Size 2.4MB
- SHA256 e20c1b701819abbf51436434c57571f3b4a9ac5fd0309e3e28d88aa6f980b240
- MD5 eff6d00f6ab19705d2a3ab9e02d73477
- SHA1 c19cf9ad325f5d040c953b3163a0f5a42179a8bf
- SHA512 a4a039f0d1c6942b08acf5e283a2d16b64e33c9dc5f977a3a3a6ad7ad69b9ba778bbccddc4e0314949de1233a83cb7e64928530fb70bef9aef732dfdaed8058f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlYNzyuag1YTqMi8CtBd2QHCHmTBW50JIUIYTr:A3k03kHRJARJWsqJtb2IjJIUfqJtb2Ig
- TLSH T136C54A26F6A886A1D077C079C9D29A56FB323C514B308ACB5345E72D2F337D19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.6MB
- SHA256 9bdb4af8f8a07f85a814dcf4618da5904aca3e5a9ede21940291846b94b2d624
- MD5 891044857725679ab4c868bf874e6ab0
- SHA1 33d7782917542372e155f3bdcf2239669a95f7ed
- SHA512 714e2f1a8e6eca2bd63e85b7c16470245b3f8966186a964028a66c65134841914c583a03b9bba483ed81b637754e318d443ab231491fe82478fd844c0acf1706
- SSDEEP 49152:A3k03kHRJARJWsqJtb2IjJIUfqJtb2Iai2WH3:A3k03kHR+RUsmJuX
- TLSH T177C56B26F6A886B5D077C079C9D2965AFB3238524B3086CF5385D32D2F277D18E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH