Analysis
- max time kernel
124s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 19:54
Behavioral task
behavioral1
Sample
2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.4MB
- Sample260604-ymrbbsdv7s
- SHA256 8b1f022c1e27d811846948cea7e0f0a5e59deb4eeb93c179cdc995a120b503fe
- MD5 1231005f01c4da4ac7145a6bbf5c11e3
- SHA1 d40b7d7b77724e8d47471352b7ac29935d5744cf
- SHA512 bd144f6fbd697c70ab1af46f22c8a7e004743bf62fb5c08a5ede39631c7f611a4b952d8332cc17916a0d85787e3a12f3a9ff90f991a5c8ce70eaa645b0d39a04
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzu5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5V:A3k03kHRJupYqOqJtb2I0qJtb2Ig
- TLSH T112C52A16F6A48375D073C079C9D2A69AEE3138825B308ACB1385E7682F377D5D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/3828-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b590-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5044-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a3f1-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000002a3f1-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3828-46-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5044-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x008b000000028983-1269.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a0e-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1977.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00120000000004ab-2066.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b590-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a3f1-12.dat aspack_v212_v242 behavioral2/files/0x000500000002a3f1-39.dat aspack_v212_v242 behavioral2/files/0x008b000000028983-1269.dat aspack_v212_v242 behavioral2/files/0x0008000000027a0e-1382.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1977.dat aspack_v212_v242 behavioral2/files/0x00120000000004ab-2066.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5044 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$$ patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3828 2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5044 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_1231005f01c4da4ac7145a6bbf5c11e3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3828
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 8b1f022c1e27d811846948cea7e0f0a5e59deb4eeb93c179cdc995a120b503fe
- MD5 1231005f01c4da4ac7145a6bbf5c11e3
- SHA1 d40b7d7b77724e8d47471352b7ac29935d5744cf
- SHA512 bd144f6fbd697c70ab1af46f22c8a7e004743bf62fb5c08a5ede39631c7f611a4b952d8332cc17916a0d85787e3a12f3a9ff90f991a5c8ce70eaa645b0d39a04
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzu5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5V:A3k03kHRJupYqOqJtb2I0qJtb2Ig
- TLSH T112C52A16F6A48375D073C079C9D2A69AEE3138825B308ACB1385E7682F377D5D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.1MB
- SHA256 cd647c84650f76589806df231ab7f0c632e56029dde69944c99dbd6cac89ff34
- MD5 ed83684c8b03359bb877e52ffbd2edd1
- SHA1 feb47512da3734996201edbc6a948915b4772d33
- SHA512 a450c99ac089739443201b76527e558a9ed1915f920110453800531766106d46cceda201781b3017294252618663a82fb549cb23747e367058671296b34a94a8
- SSDEEP 49152:A3k03kHRJupYqOqJtb2I0qJtb2I5Vk0QGTvntQb:A3k03kHRU6lXjHaib
- TLSH T1EAE55B26F2A843A5D077C179C5D39A5AFA313C4217308ACB0395E7292F777E1DA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 bba379e3d11b43eac194612dfbed7d0f6a1e8cc8007d90cd8708422aeafa7abf
- MD5 43a2bde718eed7634793b3f49f6a67ef
- SHA1 5e63f74cfb698600cebfb0ff041e75bebc0b85d3
- SHA512 41cd5b2eba155c8fca1ce9e35240963a2691dde350dbff0a66d5c6ba9ff131d9c7938fecd2044f9f3ebde3c8a5a2a71a1d612028c1bcc7eb378c828e6b2628a7
- SSDEEP 49152:A3k03kHRJupYqOqJtb2I0qJtb2I4Pji0Aj:A3k03kHRU6lXfjo
- TLSH T102E52A16F6648375D073C0B9C9D2A69AEE3138825B308ACB1385E76C2F377D5993A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.4MB
- SHA256 cff7babf21845f42ee8ef74dec3c12d7dc3e9f9d6b7b6104f55ef3338dd15271
- MD5 7f1c61057f67b580dd829171adfa5663
- SHA1 edfd0e2afd47445a6ce7b1815c25dab037379f94
- SHA512 cddf053592b9f4a6d7d6828cf5e08948da124b24f9896fda359f116ca7f7375da9f698586db04e4945d81748ca10be39096ef479476f7bbed1b7fff5aeda97a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzu5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5O:A3k03kHRJupYqOqJtb2I0qJtb2I
- TLSH T1C0C52A16F6A48375D073C079C9D2A69AEE3138825B308ACB1385E7682F377D5D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.5MB
- SHA256 7260d93db6549fac44024027f7f40cf11bfca36c20c3a6522c919bd6ff70fc3f
- MD5 0ebff0496619b1c369a281f248853e0c
- SHA1 4b5566b37669e7100997837ca86d93cd1d709c4f
- SHA512 c5e9225e26b43ef19d414920bb420fff66b62bb5ed4004b9047aa09b9cf775ea6ce03fa7214cadce69362652ba163bc05ffcb6be03cc5ad58ae4f5fe446f8e4a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzu5jcAkSYqyE3YTqMi8CtBd2QHCHmTBW5T:A3k03kHRJupYqOqJtb2I0qJtb2I4
- TLSH T1F1C52A16F6A48361D073C079C9D2AA9AFA313C825B308ADB1345F7682F377D5993A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.9MB
- SHA256 76960c2522d63220b3f0a3a6b0f66607a4cc7c3be5d2c277306b672780aa9477
- MD5 43161488e75f5e800bdb1da76ea6275a
- SHA1 5ad39ecc0f82515bc2e5d6fd40a325245bbc376c
- SHA512 9860534b51bac8bfa83b0426ee71cd0f425caae38dbee1bfd6ba66aa511ed3c4accd7dfab70760c419f884c329ba4b2b27d68184a101ad7ac484f78b356df2a4
- SSDEEP 49152:A3k03kHRJupYqOqJtb2I0qJtb2IrXpiMh:A3k03kHRU6lXGpig
- TLSH T17CD53B16F6A48375E0B3C175C9E29656EA323C425B308ACF1385A72C2E777D1D93A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 2.7MB
- SHA256 2b9ad04d16a12c487b3b2c0e63f77074de62c3b9072f0937b1fb046e7a4a3d55
- MD5 11cde97b16e9efaf24424a59fdb21373
- SHA1 1033a4a5d4aa3b1da6e1ce004c8e5cf8f614e253
- SHA512 1274cd914623cfe5f57e9b8545bfdc3f0120a50f6c90e39483f876312679422d49804d051bdb59c6a5918846b120b24da5bed038a0f4b6a716550af4fd3ce37b
- SSDEEP 49152:A3k03kHRJupYqOqJtb2I0qJtb2Iii2WH3:A3k03kHRU6lXzuX
- TLSH T1D6D53A26F6A48375D073C079C9D2A69AEA3138825B308ACB1345E72D2F377D5D93A731
- MD5 SHA1 SHA512 SSDEEP TLSH