Analysis
- max time kernel
108s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
22/05/2026, 16:15
Behavioral task
behavioral1
Sample
2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260522-tqa2asht8q
- SHA256 0ae7f2ee1c8c648c43784eb93189ff252f04835c3c667fbdfd873742ead23118
- MD5 4901b1573351d0abaa5f6cae23ca0af3
- SHA1 e4e553eb72b279ff475310d72bf8f3e2c63d23cc
- SHA512 564252d73619bee282f5b0aa874399c7aef2a9407b3ea6c517a9e30605581464428dd7a33915059c03493eb851aaefe51f942f97eb304150c8fa58ddfcb24c31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZG:A3k03kHRJaqJtb2IseW4SkZP4sz9Mb
- TLSH T126B52B16F6B88362D0B3C079C9D6AA5AFA313C455B308ACB0345E72C2E377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/2484-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b690-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2588-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a2a8-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2484-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2588-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0025000000028e2c-1258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a1d-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00100000000279c4-1534.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b6b0-1933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000002667e-1983.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a1e6-2074.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b690-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a2a8-12.dat aspack_v212_v242 behavioral2/files/0x0025000000028e2c-1258.dat aspack_v212_v242 behavioral2/files/0x0008000000027a1d-1373.dat aspack_v212_v242 behavioral2/files/0x00100000000279c4-1534.dat aspack_v212_v242 behavioral2/files/0x001900000002b6b0-1933.dat aspack_v212_v242 behavioral2/files/0x000500000002667e-1983.dat aspack_v212_v242 behavioral2/files/0x000200000002a1e6-2074.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2588 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateBroker.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{801B79ED-F2FF-4982-A51E-9DE43565C5B5}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{801B79ED-F2FF-4982-A51E-9DE43565C5B5}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2484 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2588 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2484
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 0ae7f2ee1c8c648c43784eb93189ff252f04835c3c667fbdfd873742ead23118
- MD5 4901b1573351d0abaa5f6cae23ca0af3
- SHA1 e4e553eb72b279ff475310d72bf8f3e2c63d23cc
- SHA512 564252d73619bee282f5b0aa874399c7aef2a9407b3ea6c517a9e30605581464428dd7a33915059c03493eb851aaefe51f942f97eb304150c8fa58ddfcb24c31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZG:A3k03kHRJaqJtb2IseW4SkZP4sz9Mb
- TLSH T126B52B16F6B88362D0B3C079C9D6AA5AFA313C455B308ACB0345E72C2E377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.0MB
- SHA256 0cf70a74700785fa6fc52b0be036065851cae817547675a717667f4cadacd6a1
- MD5 ecaab28e8f6fd099a870090d97cc198f
- SHA1 67e9d94867e0e08122f095c8a401690ece65d316
- SHA512 4348abe50eaff16a209e17e12a8a642d1f93f99dd0ac5da0a14f53044794ee9f67355cda2b23ca0c8c12a56f102aa0058565a1dd5c0f9882a8c7fe7c847fa2f1
- SSDEEP 49152:A3k03kHRJaqJtb2IseW4SkZP4sz9MbMVk0QGTvntQb:A3k03kHRY/fkZctHaib
- TLSH T136E55B16F2B843A2D0B6C179C5D7AA56FA313C4617308ACB0355E32D2F377E19A3A725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 2.8MB
- SHA256 fe0879985aee4695dd630f38807f3186abeffaa2f097fd905fa962fd2c7eebc0
- MD5 3e0bb50ef40e89e9642b5615f3fce235
- SHA1 792ee20c37df7ea929bc57bbf266fe8d4a160bc6
- SHA512 cd5ef71bd608cf596b8d3c68765062b2fa8d5e89bbc3f122b407900a0aad15bece3ff508a69ea4ccd250087a9f84471aede489a9e73cce0fdec731f67ca06e76
- SSDEEP 49152:A3k03kHRJaqJtb2IseW4SkZP4sz9MbVTd9CHKyao:A3k03kHRY/fkZctCqo
- TLSH T1A7D53B16F6B84362D0B3C075C9D6AA56FA323C455B308ACF0349A7282F377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe
- Size 2.4MB
- SHA256 f028c81aaf68e6aa53a5cf1aa72451e626131656733e425574472609a0be9ebb
- MD5 4fbd7c53ebdf3fb8d68f97153451d4a2
- SHA1 63edf2e33af262357e30abfa5ea63c301f2995df
- SHA512 151ab5ee16e07696961f521de39ba6fb38e05f24dcfa8a7ed3a834543d21ad51f0202c29cdf24ee14d7259cabd3278a997507f3beeee26286164bbd1deff2637
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZg:A3k03kHRJaqJtb2IseW4SkZP4sz9MbvI
- TLSH T1FEC53B16F6B84362D0B3C079C9D6AA5AFA323C4157308ADB0345E7282F377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 451b71bb4d38ef54b530a31a4f21284d0a13178a46297c4ff3b5eeb870ee4bc3
- MD5 c3347be1fbbe46064adc2cc519db19a2
- SHA1 ae9e2abfbcf099a05561f84ce2986f38fc77f22e
- SHA512 52705ce4744cd2ddc362ee304b68e40d07a8be79a77d15239f44b15367e74059c17c7bea8885c4b972285a67f8a4f99a6bc25bd86338016b9625576ab4c1f59d
- SSDEEP 49152:A3k03kHRJaqJtb2IseW4SkZP4sz9MbBPji0Aj:A3k03kHRY/fkZcRjo
- TLSH T1D1D52A16F6B88362D073C0B9C5D6AA9AFA3138455B308ACB0345E72C2F377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.4MB
- SHA256 a10c8c1fcb0182526f5bf800e3da070be3952971dfb26550a876b5b8dec5ee90
- MD5 eff88a6f5143f314ffc5afdfbd41378d
- SHA1 8f1ef774d24fa1b38bcc1dad9f17d83905b8df23
- SHA512 094f155e1dc3e0be9369ccbfded9671f876589a5a73764631bd8ec282d5c80a34f1a3618aa9aae7271df24f89346b8c8545f7eb9f08feadb69f140cdd8e69430
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZD:A3k03kHRJaqJtb2IseW4SkZP4sz9Mbj
- TLSH T195C52A16F6B88362D0B3C075C9D6AA5AFA313C811B308ADB1349F7282E377D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 2.8MB
- SHA256 e9c927717aaa35a24f668f91b03401e3293fb5f48591a2a1a4858dba0c078c46
- MD5 a07f9b2b9cfce97e39566b700813f28d
- SHA1 95c5a985d4406be423c2afc6d19c92d8eabf3fcc
- SHA512 61fcb92ccb6de55bc21831dc677a2070add80d52e02f9860fdaa14e35dfd7486e822eb361ff1b5a8998002cc44fe0e8258f2544a59cc69780e951396e33e2d9b
- SSDEEP 49152:A3k03kHRJaqJtb2IseW4SkZP4sz9MbgXpiMh:A3k03kHRY/fkZcMpig
- TLSH T105D52A16F6B88372E0B3C175C9E6A655FA323C425B308ACB1345A72C1E376D1DA36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
- Size 2.6MB
- SHA256 bc4c8f65bac0e12d09fa263b409a84dcfe1fad8521c6f8acaeba5d3b37803ea0
- MD5 2fb6ba01bab6b74f54c003d7f5a5790e
- SHA1 2673bcefffdd060687c8ebd562637e326d84edeb
- SHA512 8eadceb3906b4fdc15c7a3f676318d8da0e498e50e3fcfd9142819f0feb0b6489ac96276fb569ed48f7ccb90ab51a76f456b1c749b0f3391c239b249d40db02d
- SSDEEP 49152:A3k03kHRJaqJtb2IseW4SkZP4sz9Mbxi2WH3:A3k03kHRY/fkZcxuX
- TLSH T1B7C52A26F6B84372D0B3C075C9D6AA5AFA313C425B308ACB1345A72C2E377D59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH