Analysis
- max time kernel
115s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
29/05/2026, 16:26
Behavioral task
behavioral1
Sample
2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 3.6MB
- Sample260529-txps2abs3n
- SHA256 a7646772e04f5c5349b7d6cebf173f026a335f1aeb3c528f330a8e3040980e24
- MD5 fd77968caccf21f7ade403b252f9352d
- SHA1 c7fafeacc99ce8157d1e117f656a5a2741ac6dca
- SHA512 8c19b46c292165c6669783666f10eed707e162f7b24a97a0254993474576833f5c1b06f65b9cafc170a6f0ebbb020d2e9386c2cc776612720daea7363511bb41
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56rX:A3k03kHRWfkZckFfkZc9rX
- TLSH T14B063B16F6788762D0B7C0B9C5D2AA59FA3238455F308BCB0345D72C2E277D58A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 14 IoCs
resource yara_rule behavioral2/memory/876-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001800000002b86c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2916-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a322-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/876-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2916-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x008700000002776d-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x008b00000002776d-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002aa1c-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000027ac8-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001700000002b875-1593.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000027a37-1595.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000027a37-1662.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0011000000000673-2071.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001800000002b86c-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a322-12.dat aspack_v212_v242 behavioral2/files/0x008700000002776d-1022.dat aspack_v212_v242 behavioral2/files/0x008b00000002776d-1140.dat aspack_v212_v242 behavioral2/files/0x000200000002aa1c-1391.dat aspack_v212_v242 behavioral2/files/0x0002000000027ac8-1393.dat aspack_v212_v242 behavioral2/files/0x001700000002b875-1593.dat aspack_v212_v242 behavioral2/files/0x0014000000027a37-1595.dat aspack_v212_v242 behavioral2/files/0x0015000000027a37-1662.dat aspack_v212_v242 behavioral2/files/0x0011000000000673-2071.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2916 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{DEDD914E-84D0-49B4-9D48-44B1238479F9}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 876 2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 2916 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-29_fd77968caccf21f7ade403b252f9352d_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:876
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2916
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.6MB
- SHA256 a7646772e04f5c5349b7d6cebf173f026a335f1aeb3c528f330a8e3040980e24
- MD5 fd77968caccf21f7ade403b252f9352d
- SHA1 c7fafeacc99ce8157d1e117f656a5a2741ac6dca
- SHA512 8c19b46c292165c6669783666f10eed707e162f7b24a97a0254993474576833f5c1b06f65b9cafc170a6f0ebbb020d2e9386c2cc776612720daea7363511bb41
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56rX:A3k03kHRWfkZckFfkZc9rX
- TLSH T14B063B16F6788762D0B7C0B9C5D2AA59FA3238455F308BCB0345D72C2E277D58A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe
- Size 3.6MB
- SHA256 b8531ee3979ccf238312dd7d68f67412b2445afe3ede2e319c22c5b7d8757f3b
- MD5 afea123ace6161540726833df83ceff8
- SHA1 f20422a3c93da2944dc6cf6c81d2aed487264778
- SHA512 1de203ac982c670d50abff6cfa496e3cfd1d09939c2ff707a762461cef5806f111b4cfeec7e65aa192b25b45f4c067317cb0fd0da2dda70d74ab7de161f08636
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56r:A3k03kHRWfkZckFfkZc9r
- TLSH T114063B16F6788762D0B7C0B9C5D2AA59FA3238455F308BCB0345D72C2E277D58A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$
- Size 4.3MB
- SHA256 9b3d123a092422a2564da2fea254771dba81b84a1150f17b5648bbdf6eb29d20
- MD5 71de0921da2da533e0a9dafee6efba50
- SHA1 220f302e112c021cb83143aecea6ed44953e2518
- SHA512 744785fca25b2c6d2183c54035f10dde8743d57ee61031659c9b26ce109b16e0f664077eaf85a8edb08c4100d682cd2fc2d4a870d1aeead4e9d38753db03d36d
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56r6Vk0QGTvntQb:A3k03kHRWfkZckFfkZc9r3Haib
- TLSH T1FC265C16F6788762D0B7C0B9C5D3AA5AFA3238451B308BCB0255D72C2F277D19A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 4.1MB
- SHA256 833d3e6769bc60f4d1a7edec4375cfdd2f4c6c8990271d6fdbe01c2367c61615
- MD5 4d9984282a65b2174b2aa78a866fd123
- SHA1 a73bac11fe006aed485f8396ac1824f02e6c25d0
- SHA512 a6d37c7729a7b5a17fdfbe94598071076c3ba76f8a874d1313dea4465c869653a72eae4198a414a658aaccf461646aeb3566b52189320d7fc0a46526891b1be2
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56rvUidGl:A3k03kHRWfkZckFfkZc9rvdGl
- TLSH T1C5163B16F6788762D0B7C0B9C5D2AA59FA3238455F308BCB0245D72C2F277D58A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
- Size 3.7MB
- SHA256 f967be7d03649213ee03379807bd57adf313369fe900e8012aa40d6b52881349
- MD5 7f20e00667ed84dd2f4f84a82a76c98e
- SHA1 35d1113ced94c44a46093aca299e27f4842ef726
- SHA512 a46e40db9ef6e0503349ac1a7d5836f61960f6d3e025e454685f9502dce99c9a195681e42b5c70492be6195f5a2259f9849c22e282a0e62f1e614adc8b379540
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56rNw:A3k03kHRWfkZckFfkZc9r2
- TLSH T149063A16F6788762D0B7C0B9C5D2AA59FA3238415F308BCB0345D72C2E277D59A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$
- Size 4.4MB
- SHA256 6fd12aa2ccff7b8f29812403254d1a8996f5da43e7087a4a7c5c6d2880a81c6f
- MD5 9d28c7f5556207bb67c5224b7275fb8c
- SHA1 e6f594ede49e45f32473f26572e80ff40d9f2e2a
- SHA512 be12f51fb564d2d9ab9555be7123056b53f75eea9d79e5cbb51b293e2c3eee946705d8f0cc1de936b5fdde287ec4164d8c50c83c3b92e60b638f68931e8a51f9
- SSDEEP 98304:A3k03kHRWfkZckFfkZc9rFMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMML:A3k03kHWPkhPZ6
- TLSH T163264B16F6788762D0B7C0B5C5D2AA59FA323C415F308ACB1249E72C2E377D19A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.2MB
- SHA256 e39581b9214e5a51c9620a1f84591c57c74861daade3357c398a9e6cd60b62f7
- MD5 1310cf4de2ff8597302af281467b120b
- SHA1 453394c96e2de5929d3c055482a40c55d317be80
- SHA512 f1cd499b201cf4e7b20594fe5f7d52e725d8c98f79e6e19b0538add15939a2a7639724b6f9164d29c879ce0e3da329c54b51e31897b91f64630df91ba6219186
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56rTPji0Aj:A3k03kHRWfkZckFfkZc9rLjo
- TLSH T1C3163B16F6788762D077C0B9C5D2AA9AFA3238455F308ACB0345D72C2F277D58A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.7MB
- SHA256 6eba3053c851f19c371cd37427ec56e2fec99b5c6c609957494353c40af4d626
- MD5 12872e5120cec248962e7272db7b66d3
- SHA1 8c3d1b021baa28b04cb8d69ab001abe06e0d225c
- SHA512 5a2361dd4da0ce8587f43f5390ca8ae41dfa421e1455bb3614c50b2811534d37ef9771542a9deef7dfc0a464d6381936e87bea25ea88c3a065d9a523396f19c5
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56r0:A3k03kHRWfkZckFfkZc9r0
- TLSH T1B4063B16F6788762D0B7C0B9C5D2AA59FA3238415F308BCB0345D72C2E277D59A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$
- Size 4.0MB
- SHA256 8c4fcf8b5f29fbfddc0ed71ea63970eef3c178e30aea6f4431e44bad631dbbf5
- MD5 8a515902dd80c69d96fdb1788cec2acf
- SHA1 4ce402def8cc163f76a6fc157788dd41b2d00f77
- SHA512 9a725fbdb62724a7732cdebd11075aa263e2b362ab1e5455c440c935652ac2747063f7564a43d81b0013ef895693216fe4ed1b6830109c4403a7ae37da457534
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56rO1lkWu0ya:A3k03kHRWfkZckFfkZc9rO1lkNa
- TLSH T16A163B16F6B88762E0B7C179C5E6AA59FE3238415F3086CB0345972C2E27BD1CA35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe$
- Size 3.9MB
- SHA256 84193d0beeaef99909d2e2d707a11b9cf7f0b6380ff1e5419130a795322f8f65
- MD5 9cfa9cd435fb5d0419bec105a0ba32ca
- SHA1 9c2c8fe04b2a82c5f6b52457004fa0b5c1a17ce5
- SHA512 b5e612643571ac8b193c0f5e38e4e3dfc7e84f118d8151e1617f4008b17529caacb4b58a2e46876e37640ec2e8bc07c9bd1f8f06ee5c0af61bc066b1f14c1852
- SSDEEP 49152:A3k03kHRJAeW4SkZP4sz9MbkqJtb2IEeW4SkZP4sz9MboJIUd56rPi2WH3:A3k03kHRWfkZckFfkZc9rPuX
- TLSH T12A163A26F6788762D0B7C0B9C5D6AA99FA3238415F3087CB0345D72C2E277D58A36736
- MD5 SHA1 SHA512 SSDEEP TLSH