Analysis
- max time kernel
115s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 11:11
Behavioral task
behavioral1
Sample
2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.2MB
- Sample260604-m99weacz8s
- SHA256 5d4be5ea1db74f6250fefa923b29d798992a5456f9b036366c891e0c72ee6477
- MD5 0281e4a77a9cd05296e77b5e66cc8cbb
- SHA1 b9c940fa41317e5e26f29b24c5bbf46189bf0d4b
- SHA512 0bbbcf1ce104aa82a5bd7c1f4f870c38048ccf4692e1a5a037af20537d8e5499b1280c840136df96f1a598a63f0251b6935fa2d50e26806ea3bd5d9a1ce1ab80
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0JxwGEO/MD5TvinrmAYTqMi8CtBd2QHG:A3k03kHRJk56r+qJtb2IQPji0Aj
- TLSH T1F0B55B16F6A44B65D07BC0B9C5D2969AEA323C425F3087CB1345DB283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/3972-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b4d1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1536-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a428-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3972-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1536-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028da1-1282.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001e00000001a5f9-1525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002500000001a5f9-1642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000026782-1929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0011000000000673-2064.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b4d1-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a428-13.dat aspack_v212_v242 behavioral2/files/0x0003000000028da1-1282.dat aspack_v212_v242 behavioral2/files/0x001e00000001a5f9-1525.dat aspack_v212_v242 behavioral2/files/0x002500000001a5f9-1642.dat aspack_v212_v242 behavioral2/files/0x0004000000026782-1929.dat aspack_v212_v242 behavioral2/files/0x0011000000000673-2064.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1536 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{62B9A573-FEDC-4CA0-88A8-BCFC9656AA28}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Todos_0.33.33351.0_x64__8wekyb3d8bbwe\Todo.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3972 2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1536 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_0281e4a77a9cd05296e77b5e66cc8cbb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3972
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1536
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 5d4be5ea1db74f6250fefa923b29d798992a5456f9b036366c891e0c72ee6477
- MD5 0281e4a77a9cd05296e77b5e66cc8cbb
- SHA1 b9c940fa41317e5e26f29b24c5bbf46189bf0d4b
- SHA512 0bbbcf1ce104aa82a5bd7c1f4f870c38048ccf4692e1a5a037af20537d8e5499b1280c840136df96f1a598a63f0251b6935fa2d50e26806ea3bd5d9a1ce1ab80
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0JxwGEO/MD5TvinrmAYTqMi8CtBd2QHG:A3k03kHRJk56r+qJtb2IQPji0Aj
- TLSH T1F0B55B16F6A44B65D07BC0B9C5D2969AEA323C425F3087CB1345DB283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.7MB
- SHA256 4467c61e1067444b71b0828f755150821c6494022b410b1ed9af939f6eb0c3e2
- MD5 4b5ade11aed20d00fba580bb816f6c10
- SHA1 ce5b563d5fc34ed295c7b5f9d834028de2fbd147
- SHA512 5aff62d986f9edaeb37cabbc091cb7b22634bc34e6784f3f373608fed37bfbbfd08cb62431b7d1ed3daf83722d50ae3681c9d7f02d736af2212ea1474746bc80
- SSDEEP 49152:A3k03kHRJk56r+qJtb2IQPji0AjoTd9CHKyao:A3k03kHRDr+ZjoKCqo
- TLSH T1EBD56B16F6A44BA5E07BC175C5D29656EA723C421F308BCF13859A283F337D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.7MB
- SHA256 e447956e7a72e889728e98322ffe75b96e4cd58c7d5dc3185104dff37e2104cb
- MD5 14ed2166200e5e0ad929f8dc61178776
- SHA1 8d2458a472bd7eed44633b3037f19baf59f4f7d7
- SHA512 f573384aff7d9f949bebd5f5a17b240e5c687db430fc2e19a0169d4b8d3241a9d1798cff3150ba83c385c448e96be2620d0b605e3bc14598db6721ab0dc82a85
- SSDEEP 49152:A3k03kHRJk56r+qJtb2IQPji0Aj2UidGl:A3k03kHRDr+Zjo+dGl
- TLSH T1F3D56C16F6A44BA5D07BC074C5D2965AEA723C421F3087CF1385DB283F27BD59A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe$
- Size 2.4MB
- SHA256 550205d5d58191f51da3dfa376e452ff67807bf421003a6c897dee5726e84082
- MD5 5247df2cbdc6109294d7d07cf86c0899
- SHA1 f9fa98d9cbe278554e72b7a792599143b4311f28
- SHA512 022484df1c3723b743c9e2b44d9014acf23a7960e5206b92bd66d8384ce610c3869cfa4b55bd5eb5a8b5993edab941573bb7eb568251ffa1ced70a1afe93f5dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0JxwGEO/MD5TvinrmAYTqMi8CtBd2QH7:A3k03kHRJk56r+qJtb2IQPji0AjMI
- TLSH T185B55A16F6A44BA5D07BC079C5D2969AEA323C425F3087CB1345DB283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 68c160cb3349ad6b7ed1a0757b36844c6bf3d3665caf0680013086aeceac8904
- MD5 6ac4e9e232e921da74191e480d852e71
- SHA1 9f20f568317c3a72b13ae07ccb90227ba6886405
- SHA512 66a7e6abea8da48ed81540f6e3c4e5260a5af8a3bfb96436bec742f67d31c3716ac531480953d8c3981a6fb66a17417a43298065a6c31b577380adc2980ab8a2
- SSDEEP 49152:A3k03kHRJk56r+qJtb2IQPji0AjKPji0Aj:A3k03kHRDr+Zjo0jo
- TLSH T109D55B16F6A44775D077C0B9C5D2969AEA3238425F308BCB1385DB283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.3MB
- SHA256 85147e3a030a7b52c5fcee2ec7610d0f758c8e220dc096e5584b563ceb8b7d8a
- MD5 18d2b81af7883845defdfccd4cb8567e
- SHA1 26c662e11b3483939d5dcbb4a2688fce34e09ab1
- SHA512 cd0dcc20faadcf5d8e66124bb87967718128d11c089d435800aa7716e0d0377ece3da80febe5ce868eddb5105e7aeab78659579c670d6f06f5e638ce62b3f4c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0JxwGEO/MD5TvinrmAYTqMi8CtBd2QHI:A3k03kHRJk56r+qJtb2IQPji0Ajq
- TLSH T193B54B16F6A44B65D06BC075C9D2965AEA323C825F3087CB1345FB283F377D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 2.5MB
- SHA256 6f167d8aef318ffec9285817b7bda5c25265cda3920188458d1d8084a0ee8c40
- MD5 5d0b3687bd4f7d7b2898aba7484b7a72
- SHA1 4a6e72c840cef581a58ae914d069aec8f30267b4
- SHA512 7375e02929a10c543b8bca89617b0fd57d3f0159ce92b703a808f70463499a9930d51ff896f79c872952bb4d5a18d96333dfb6f62da4adabe95ff899e699c5cc
- SSDEEP 49152:A3k03kHRJk56r+qJtb2IQPji0AjYi2WH3:A3k03kHRDr+ZjoMuX
- TLSH T11EC55A26F6A44B75D07BC079C5D2969AEA323C425F3087CB1345DB283F677D19A3A322
- MD5 SHA1 SHA512 SSDEEP TLSH