Analysis
- max time kernel
97s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/05/2026, 10:57
Behavioral task
behavioral1
Sample
2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260527-m2rd4aes2x
- SHA256 52644f61134e7c1be716521ada344d35041a014c37b9c1d03b8a07bfbe270410
- MD5 d432d4d5cb9ecbf6676ccaedf8e77ac6
- SHA1 15726030d1ae766d94892597028f24d7cd25b586
- SHA512 9144a8ea8e1604051f82c40433106601bf1989619c4fa42ec5395766c6389c9e26aeeeff02785cb22c251b25934acafcab5a133fcd24f921680b595ed21bc4bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9x:A3k03kHRJv3k03kHRJ
- TLSH T17A659D13E79500E8D10AC1789AAA9A33FB757C561730A3DF2358C6152F62BD0AF3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/3552-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024464-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4728-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3552-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4728-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021650-1282.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022c01-1373.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d0000000202d7-1484.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00130000000202d7-1530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000016914-1950.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022995-2066.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024464-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x0003000000021650-1282.dat aspack_v212_v242 behavioral1/files/0x0002000000022c01-1373.dat aspack_v212_v242 behavioral1/files/0x000d0000000202d7-1484.dat aspack_v212_v242 behavioral1/files/0x00130000000202d7-1530.dat aspack_v212_v242 behavioral1/files/0x000b000000016914-1950.dat aspack_v212_v242 behavioral1/files/0x0003000000022995-2066.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4728 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{D85901DF-D0DA-4964-AECD-B8E8AF22AD43}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3552 2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4728 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-27_d432d4d5cb9ecbf6676ccaedf8e77ac6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3552
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 52644f61134e7c1be716521ada344d35041a014c37b9c1d03b8a07bfbe270410
- MD5 d432d4d5cb9ecbf6676ccaedf8e77ac6
- SHA1 15726030d1ae766d94892597028f24d7cd25b586
- SHA512 9144a8ea8e1604051f82c40433106601bf1989619c4fa42ec5395766c6389c9e26aeeeff02785cb22c251b25934acafcab5a133fcd24f921680b595ed21bc4bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9x:A3k03kHRJv3k03kHRJ
- TLSH T17A659D13E79500E8D10AC1789AAA9A33FB757C561730A3DF2358C6152F62BD0AF3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 1.7MB
- SHA256 305313c3cc676fe6d74f180eb840529bd933a1bc42d808ba0ced45b97d1963e7
- MD5 b0be54f623447790633abc07e2fef8fd
- SHA1 cc2642fc0cee226279f9540b546a4f38e62a8e48
- SHA512 f898feedc6ae9bf9a94568d4c89371c143e8b05fdef1ac326ef8a8de09b118aa4f7f3acfbbd8ee6ea5af8637a93e5aba239fc9f20d5019451a244a9a01dcce58
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xF3Ue:A3k03kHRJv3k03kHRJGUN+Eir
- TLSH T102857C17EB9804E5D11AC1785A968722F771BC510B2197CF2364831A2F77BE4AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.6MB
- SHA256 9c0b096bcae1918ce59b449188b56af3f87c5a94625db2daadb217a49845507e
- MD5 641a67d9faba263b6c80146d1e7942ba
- SHA1 9518558046ec43c62f944479b2f54f9bb746184c
- SHA512 593f4f48466cf642b378694fcd0c0de3e4fbc346774310dfca5ca100aa8f773a76c90a1ccaec59239e84a2ab628bc803719e95d0de751843ce1a3e375ccb0f51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9x/hk:A3k03kHRJv3k03kHRJyW
- TLSH T107759D03E79500F8D10AC1789AA69A22FB75BC561730A7DF2358C6152F63BD0AF3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.9MB
- SHA256 2dd7add39fce5d410a8032e93ec84faf27368394d89d88c880521ef84d99d825
- MD5 036017a6541a5552cfe75e1f095ccca9
- SHA1 d7c0f6e773c9f3026f03d4dcf15c4d163df542f3
- SHA512 82d45ae10397420f95bba33a83d40d60d5902d2d1ba174d3e493e15c70048d776ab448b6e373b24c49d85c0e48cedb3f67363103b30105a139d6fd78918b4061
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xT3TQ:A3k03kHRJv3k03kHRJcTd9CHKyao
- TLSH T1CC958D13E7D400E8E06BC2749AA68A22EB757C56173097CF135896152F33BD0AF3EB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$
- Size 1.6MB
- SHA256 a0ac1770b6491db639311b7704e16e1d8aa411dc09e93621626a1f5418be20b6
- MD5 47cacef74916d9fa135286080e86f3ab
- SHA1 a7c628791e710b5c73877bdc2b842c817b56a8ca
- SHA512 54ebfd0c530f1d9fda34ca41bdcf0413ea73c606795814883d52179ef7b05a8a742b27fb741fa9c807fd3e5f3a58df5c56e71360a9527846cb615521ff94c084
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xqGen:A3k03kHRJv3k03kHRJAI
- TLSH T1F6759D03E79500E8D10AC1749AA69A32FB75BC661730A7DF2358C6152F63BD0AF3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 cc82e556379236ff31561babb2940ea31b50de97f002c078b7079cff96736f76
- MD5 81c249f1fccdeaa63aa9118c36463423
- SHA1 971a7779253734f4b409c5295feb253aeed73d9f
- SHA512 07a96bfb6cbe1ba5668253d6456940c86a11be3b8072955342343785273113a2adc1b690f81445c89dcad67f8a01512b694e4f22e26ec1c5d6d4f8b4943cd4a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xP0Lu:A3k03kHRJv3k03kHRJuPji0Aj
- TLSH T1F9A58C17F7A402B5D026C178CAD69A66FA713842173096CF1358C7293F67BE0AB3E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.5MB
- SHA256 56bc1b0558dbfd9ff283b172775d31621faaff46788b3c0c64874031820e1174
- MD5 bb3623aec527592872db7e9afce7fcf2
- SHA1 c35266bafebea1a2af6b60010a39e9cc35dbbca3
- SHA512 83d006f144b10d206bd059f676bcddb5a2f03d814ec9491447b9922ba207d2f604ba868f0616ee68db73d3ff12ca30a8e033ac97fdb52b6cae8a89b9da098d01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xLF:A3k03kHRJv3k03kHRJW
- TLSH T1CF758C03E79500E8D14AC1749E9A8A22FB75BC921720A6EF2358F7152F72BD06F3E754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
- Size 1.7MB
- SHA256 6b0f42696f0ebeb15b5c1d90d86c17407c67e46a679ee39e762a91497eba9a52
- MD5 e2b4b603112ef06dd2e795edb368f2ab
- SHA1 01efa673962d07630658a522ee736d422e20408d
- SHA512 6a7c83712554a909770888c103b5fdc2ada0651d588d630e81f57ccbe5a0b5be319b13321946abf1336788d015ee64eae973afc727c967efd334f03941465493
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJla0auar9xC3mnXoZ643mnXoZ6i6cMJla0auar9xLV+r:A3k03kHRJv3k03kHRJsi2WH3
- TLSH T14E85AD23E79500F9D10AC1345AA99A32FB357C521730A3DF6358D61A2F62BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH