Analysis
- max time kernel
111s - max time network
96s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
05/06/2026, 12:16
Behavioral task
behavioral1
Sample
2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260605-pfxebsey71
- SHA256 9e786228ae3fc2cdf6e0f335bc14b2c305357b8d0ebf1b1db7d155a341c5b91c
- MD5 3d5ababb12bbccd48b284052a2268c03
- SHA1 15efd80f167821eb1ee542eff8e2939f3aba779f
- SHA512 d7c6a80456a722e6f0a8fc327dd10de45cc1475fa4ac138453a3ad010bdc23a3c93cc7d7adb4230a08e529f0305759105e2284e9e04987c5dbb28196bf0672a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+iEzD5TvinrmAYTqMi8CtBd2QHCV:A3k03kHRJ656r+qJtb2I
- TLSH T165856B16F6A84BA5D06BC174C5D29666EA333C425F3087CF1349DA293F337D19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/3356-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b375-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4016-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a33d-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3356-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4016-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0022000000028acb-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001000000000eeac-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000027a5d-1484.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a876-1867.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0011000000000673-2067.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b375-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a33d-12.dat aspack_v212_v242 behavioral2/files/0x0022000000028acb-742.dat aspack_v212_v242 behavioral2/files/0x001000000000eeac-1373.dat aspack_v212_v242 behavioral2/files/0x000e000000027a5d-1484.dat aspack_v212_v242 behavioral2/files/0x000300000002a876-1867.dat aspack_v212_v242 behavioral2/files/0x0011000000000673-2067.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4016 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3356 2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4016 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-05_3d5ababb12bbccd48b284052a2268c03_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3356
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4016
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 9e786228ae3fc2cdf6e0f335bc14b2c305357b8d0ebf1b1db7d155a341c5b91c
- MD5 3d5ababb12bbccd48b284052a2268c03
- SHA1 15efd80f167821eb1ee542eff8e2939f3aba779f
- SHA512 d7c6a80456a722e6f0a8fc327dd10de45cc1475fa4ac138453a3ad010bdc23a3c93cc7d7adb4230a08e529f0305759105e2284e9e04987c5dbb28196bf0672a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+iEzD5TvinrmAYTqMi8CtBd2QHCV:A3k03kHRJ656r+qJtb2I
- TLSH T165856B16F6A84BA5D06BC174C5D29666EA333C425F3087CF1349DA293F337D19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.4MB
- SHA256 db34bb75dbb31f0b767385294c0d7e00d027758517111572acfa1c1c92592512
- MD5 dbf79e40591a9b73cf523f1eaf7c0154
- SHA1 67bb8b6185320f521fe7b0157dd7b1f073c6a828
- SHA512 e118fa311e251fefde30bf30aa3cbe84a30891729e637db8ea7b021a77bb2ebc72882160089b74bf1a97bc0dbe9cfd31cc1c6225ffa4ba8be915b37b037bdbd3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+iEzD5TvinrmAYTqMi8CtBd2QHCR:A3k03kHRJ656r+qJtb2IRVk0QGTvntQb
- TLSH T128C56C16E6A80BA5D06FC178C5939656FA723C461F3097CB0355DA293F63BD09E3E322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.8MB
- SHA256 66e89e5cb680ce8951c3c3d97f48135a274e93b9b934010d4fba1bf1cb1a5665
- MD5 3eb7ed03a69f0622699a0223964e990f
- SHA1 bde9e8217f8c664950df2e5a1598a05c13825b26
- SHA512 c0af17121a5e8ff28ad615d4db643c2077d6831161f193d8427fc421a45666ad5c00fd751774befb7c457603fb1cf2e19b3ceb8cc34579072244247152e802be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+iEzD5TvinrmAYTqMi8CtBd2QHCI:A3k03kHRJ656r+qJtb2I0W
- TLSH T1A6956B16F6A84BA5D02BC174C5D29A56EA333C425F3087CF13499A293F337D19E3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.8MB
- SHA256 ea50cf43f85d7d2619bd1af462057ddcae2495197d03c21011b234e7e95cc5d9
- MD5 47322415b63c4602e5e1a66c4c7941b0
- SHA1 dda76e31fd21a2f0833dcd4aa87104bcc42c5e38
- SHA512 b4cf44de8c8baab628e334e253ff8a83d08c5b404b568a57f048916c6beb9b527fb619382af3d8a294a09452036d8fdec560ca9a5ebbd3d5b865254344b8ec72
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+iEzD5TvinrmAYTqMi8CtBd2QHCl:A3k03kHRJ656r+qJtb2IcBPVAU
- TLSH T16F856B16F6A44BA5D06BC074C5D29A66EA333C425F3087CF1349DA293F337D19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 4d2a361e67f7b2abe3b4a63edadb7059e6ef18c726e0a2f9568007301a6f918e
- MD5 4bcb6505910d658f15467416dc27abe2
- SHA1 41f7a7a60d2215476e0594cb51fa559b18d60874
- SHA512 0c87f33e6fb96a2437b38e65718643596752f4bc883c0f8f6b5e3a7179d5a5c4cb6f4fc4d0c628540a8d9f1485681dab85b3144cd8ec2b2ba6d1373c3ac3424c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+iEzD5TvinrmAYTqMi8CtBd2QHCh:A3k03kHRJ656r+qJtb2IQPji0Aj
- TLSH T1E2B55B16F6A44B65D07BC0B9C5D2969AEA323C425F3087CB1345DB283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 2.2MB
- SHA256 ba18de7573be93e09316ecb9696e2252f4d1eac5eb138e3461a5f61955e6aada
- MD5 36494a5aa3a6c19634cf058547c606a3
- SHA1 dbe3bfa7235f846f580b46ac3f5b9454686ed84d
- SHA512 e769b5ddcf3c7082fdfc20611ead70d7479093c300aeb5b96a8d5ef060b85765fbef9d6e1737e5018551a7a13d381d7341229e84fafb7fcbf764a031a0d6c3a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+iEzD5TvinrmAYTqMi8CtBd2QHCB:A3k03kHRJ656r+qJtb2I8UOlk09
- TLSH T179B56C26F6644BA5D06BC178C5D28656EA733C425F3087CB5358DA293F337D09E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 1.9MB
- SHA256 ab79aefd2b8d266ef37a37910424c80b0cc0a6b8debcd3daeccd8f8ac6c24e56
- MD5 10e14d5ceed352f9f29d630951339979
- SHA1 0938c1e50329f496336f9338e8c4421c97a95e32
- SHA512 037b2b4c5173af9e03a4e87505dab21b235aea21b022f04fa09c3aea064a16924709dcc8da9307821e9ded790517a61ec50c4981d6522861b490a4e834473727
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l9TRzy0XTF+iEzD5TvinrmAYTqMi8CtBd2QHCu:A3k03kHRJ656r+qJtb2Iai2WH3
- TLSH T155956C22F6A84B75D06BC174C5D2966AEA333C425F3087CB13459A293F737D19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH