Analysis
- max time kernel
127s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 18:03
Behavioral task
behavioral1
Sample
2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
12 signatures
150 seconds
General
- Target 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260522-wnhdpsew9w
- SHA256 124ce3794c2f7793a7079ab29a65570ec84862a17e11228267f77e040cdc3389
- MD5 bec3957f631eb71ba82f3d8b69b36558
- SHA1 e94dcf3dee8e35a9c8ac8e01109c706ae70ba5df
- SHA512 398e2800583fd36b916ec07c8a724d61c4e77147c89f62f3cd3c47af23198d755fd8964602304e08d4fd790b1cfc0acc6c7821ddb0f89f3fd1c5327f193244da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKdQfZe0p4Ek4niOkl/A04szE87JKTvm:A3k03kHRJpeW4SkZP4sz9Mb
- TLSH T1BE855C16F6B84363D0B3C0B9C5D6AA5AFE323446573086CB1349C3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4688-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245fb-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2380-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4688-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2380-47-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021fe7-874.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002161d-1289.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000021554-1532.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000231ad-1655.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022960-2057.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245fb-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021fe7-874.dat aspack_v212_v242 behavioral1/files/0x000300000002161d-1289.dat aspack_v212_v242 behavioral1/files/0x0005000000021554-1532.dat aspack_v212_v242 behavioral1/files/0x00050000000231ad-1655.dat aspack_v212_v242 behavioral1/files/0x0003000000022960-2057.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2380 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4688 2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2380 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_bec3957f631eb71ba82f3d8b69b36558_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4688
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2380
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 124ce3794c2f7793a7079ab29a65570ec84862a17e11228267f77e040cdc3389
- MD5 bec3957f631eb71ba82f3d8b69b36558
- SHA1 e94dcf3dee8e35a9c8ac8e01109c706ae70ba5df
- SHA512 398e2800583fd36b916ec07c8a724d61c4e77147c89f62f3cd3c47af23198d755fd8964602304e08d4fd790b1cfc0acc6c7821ddb0f89f3fd1c5327f193244da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKdQfZe0p4Ek4niOkl/A04szE87JKTvm:A3k03kHRJpeW4SkZP4sz9Mb
- TLSH T1BE855C16F6B84363D0B3C0B9C5D6AA5AFE323446573086CB1349C3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.1MB
- SHA256 21a082346ed9dbae456c2eecd4ddc103fbb6e5ef1412d243f389acdcbe6dca91
- MD5 6224bfb9910ae39695c863e46bb78af9
- SHA1 a30f0d71fa338b6a915218d99863e5379f3b15fe
- SHA512 9e38377e17ef64429fad9864e8ab6238a9d1308d233ab27d695b7b9d70e4d02504ec1d7449684df4187d5f1a4b81d7a6aea070e9e7970cc1e4e15c802bb49bb6
- SSDEEP 49152:A3k03kHRJpeW4SkZP4sz9MbVTd9CHKyao:A3k03kHRffkZctCqo
- TLSH T1AFA55C16F6B84366E0B3C179C5D6AA56FE7238461B308ACF0349D3282F277D19A39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe$
- Size 1.8MB
- SHA256 cb0eda81701a2985c2c3c0df8dbc5481df20e65cc1ef36dc54ddc1d4bb220042
- MD5 cdb7950794015ca2e5c3eeb41a16cd63
- SHA1 c3d02ca85b28caf7d8fba5c09ad996d9c415f3a1
- SHA512 ee9bb10adc9057aa38348f1708b0bcacc29fe95f9031e4b6ab4da96917b3fff401f2e576609e9d0ade6c3ff1292c71e6af7b24429a561d0811a2843857d6584c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKdQfZe0p4Ek4niOkl/A04szE87JKTvA:A3k03kHRJpeW4SkZP4sz9MbvI
- TLSH T1D1955C16F6784367D0B3C0B9C5D6AA5AFE32344657308ACB0349C3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 f7aa285b9d41dbd780963469d1eae63e38c78af807dbcb05618a523ac2156264
- MD5 b615e82dfc716648ea8fe47ff5f1fa2c
- SHA1 ae107ecdd27aff5bbe0da50c954dedd69ffbcd95
- SHA512 e487cc5716f7b5762154784f314e26330668b4ee828f9d843d4368c9017029fb11d634925bd56e20a8fcc49eda025c9e18d5b864a1f7965e9d1b2a8c9e18b686
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKdQfZe0p4Ek4niOkl/A04szE87JKTv9:A3k03kHRJpeW4SkZP4sz9MbBPji0Aj
- TLSH T1BCB53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
- Size 1.7MB
- SHA256 07d57db250cfd52233217e6696f1c3f58737ddb97db0a15711381e37fc4d4052
- MD5 e4c3f779a9c382fff7f7be7ec4a1ae42
- SHA1 46f736254ff9721a8ca24bc54ea4842df1e7540c
- SHA512 8889d5abdedef8b5a8daa2c902a11ff9671ea46473641099fc9ec9a6c28fec6f9882e605d9123e50b325560a3b885ec382a5d9753cb868e82176da6cbaf58113
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKdQfZe0p4Ek4niOkl/A04szE87JKTvi:A3k03kHRJpeW4SkZP4sz9Mbi
- TLSH T18A855C17F6784363D0B2C0B9C5D6AA5AFE323446173086CB0359C7282F277E59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.8MB
- SHA256 a732425e82231d03962d93c677e4f782f6b9eb820fe8c28e03571353ec5c1436
- MD5 cf455f092f51a8a6fb39dd989a59690b
- SHA1 2f98059c62572ffacbb35178583fd70565e76bea
- SHA512 c9712532695211f3e5ad1e9a265bac54da77fd3314742509fd0b8f73644ee7e12d598cab103ccbf9402bded6078ef1e4b6b65c20c001012bee9d251f14d4949b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKdQfZe0p4Ek4niOkl/A04szE87JKTvj:A3k03kHRJpeW4SkZP4sz9Mbj
- TLSH T16B854B16F6B84362D0B2C079C9D6AA56FA313C4617308ADB1349F3282F377D59A39739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 2.1MB
- SHA256 281af62c636bb4f802abd3858f7507cc35f8c00ef2d26bd165913abf892b6e63
- MD5 c8ff741c2d38b208b1729c525ab39aa8
- SHA1 fe756d36a268a83eda477a9811527605e75bb18b
- SHA512 66984a86332b766b5ca489d376c3f512ba676e8b70a9b74edafbb4db1054f4c862d6825bd92790d452a2a619ac8f790bb577e0e44f7ecca33c0e759fc13f56bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKdQfZe0p4Ek4niOkl/A04szE87JKTvC:A3k03kHRJpeW4SkZP4sz9Mbt3mZ5x
- TLSH T1C7A56B16F6B88373D0B3C075C9D6AA5AFA3234451B3086CB1349D32D2F277D19A3A769
- MD5 SHA1 SHA512 SSDEEP TLSH