Analysis
- max time kernel
122s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 17:13
Behavioral task
behavioral1
Sample
2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.0MB
- Sample260712-vrn5zsf14s
- SHA256 c69163e479223d45cfc40ca36a37b4528782ad77ddf84f79217cd5fd46b9e460
- MD5 4d7cc39e21aaed62731c91da874a283d
- SHA1 cd48418e086ee81e60742fe2f6f1288e69a06a2e
- SHA512 df0ab939e5fe29f57be94797f8d8945d81b4c3869fe12ce15ddda5c6a765404ec065d7e92869658db71ee3cae7d09e140982b32b60de1a7f245a000bb3da1a1a
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2I:A3k03kHR+R66YfkZcdfkZcer+
- TLSH T1D4161A16F6788722D0B7C079C6D2AA5AFA3338455B308ACB0285E73C2F376D59935736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2356-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4a1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2356-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4984-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4a6-382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b96-620.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b0a-700.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000019986-701.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0019000000019986-757.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001a182-1038.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4a1-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x000d00000001c4a6-382.dat aspack_v212_v242 behavioral2/files/0x0003000000019b96-620.dat aspack_v212_v242 behavioral2/files/0x0003000000019b0a-700.dat aspack_v212_v242 behavioral2/files/0x0014000000019986-701.dat aspack_v212_v242 behavioral2/files/0x0019000000019986-757.dat aspack_v212_v242 behavioral2/files/0x000700000001a182-1038.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4984 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2356 2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4984 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_4d7cc39e21aaed62731c91da874a283d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2356
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.0MB
- SHA256 c69163e479223d45cfc40ca36a37b4528782ad77ddf84f79217cd5fd46b9e460
- MD5 4d7cc39e21aaed62731c91da874a283d
- SHA1 cd48418e086ee81e60742fe2f6f1288e69a06a2e
- SHA512 df0ab939e5fe29f57be94797f8d8945d81b4c3869fe12ce15ddda5c6a765404ec065d7e92869658db71ee3cae7d09e140982b32b60de1a7f245a000bb3da1a1a
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2I:A3k03kHR+R66YfkZcdfkZcer+
- TLSH T1D4161A16F6788722D0B7C079C6D2AA5AFA3338455B308ACB0285E73C2F376D59935736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.5MB
- SHA256 d282a23ea0bc04c3b36195de7b2ec5dfd0bfad945cd16ac6983d9a47066986ce
- MD5 2068f78d218484e414a35b73e0fd205d
- SHA1 836db5b0a547fd433e162e7a7f13f34785122725
- SHA512 a68e40e5f084e2e5fd34b8772ca6d992b06e4320a9e097fca57706b11741db409e78d5a9389c4f9eab85c2a513487793cf8fa618154b18d6437467feece5654e
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2ISPji0Aj:A3k03kHR+R66YfkZcdfkZcer+zjo
- TLSH T113261A15F6788722D077C079C6D2AA9AFA3338455B308ACB0285E73C2F376D59936736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 4.0MB
- SHA256 40bb761e5bcefb1330c2c04ad663cd5ec6e4f5d0814dbac3c090c9415fa15856
- MD5 d5080e2e09a3fac0852ea1a46e5e4072
- SHA1 bd344241b74dfceb202734a7ffc340afccc418a6
- SHA512 d48f7f6ba640be93600812b6161185228efde82de6e557ed6f31a920cbfbc4a5ebd32a1fcbfc3db2ebc4b31f3fc33ac15a36c855665f2e1b71c17649dd1d5864
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2Ie:A3k03kHR+R66YfkZcdfkZcer+B
- TLSH T1BF161A16F6788722D0B7C079C6D2AA5AFA3338455B308ACB0285E73C2F376D59935736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 4.0MB
- SHA256 6fb84572688e6d75a262d591172df1677f437580b68e3b4f9846d2905f6679d5
- MD5 28e0b5a76ac0fe11a44f39b353213208
- SHA1 0252561e1749dcfa8fd71f0fdb2bfacdd5215810
- SHA512 810cdd76148f2f68abf4d705dfcda6ad518cc85725b5d6cda2356cca751f90c7adb2eaac28ba9784fd90beeb68dd1e51166b1d5403bfdc12b684116bde4b471b
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2IS:A3k03kHR+R66YfkZcdfkZcer+R
- TLSH T11F161A16F6788722D0B7C079C6D2AA5AFA3338455B308ACB0285E73C2F376D59935736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 4.0MB
- SHA256 354990b45741e707e8a8896106cad0f35c9855a52ecc5466dc66ece5dd014a89
- MD5 48662aa41b7a9605f4ed9c2fdf3a894b
- SHA1 f9b282cad4334705b1064bf41b7131c46e01d6c6
- SHA512 b285537381bd5ad67a516c22f3d1af8adddb679cb1e3b8bcf4f6262756c27717ab7d4f8bfa81a899a6e3bcda0885694f71faa11f0e3c512981c76f99738f6e1d
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2Io:A3k03kHR+R66YfkZcdfkZcer+z
- TLSH T1BF161A16F6788722D0B7C079C6D2AA5AFA3338455B308ACB0285E73C2F376D59935736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$
- Size 7.9MB
- SHA256 4096fc52eefd0067a21a9650a74f5babebb147d97f6227104e91e3872addc892
- MD5 760678389127e3fb8843746585dd1552
- SHA1 88009885fb828ba80358637c3cd154050a22d51f
- SHA512 8d76aacb9762ece4861e146a51f68a0ae2e4250b1bbe47c7900ebf75f7ad73ccdb140f3d3e0aa71e4fbb34509f36272d5c3b221e6346d61a1abc003d0afdac1f
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2Ip:A3k03kHR+R66YfkZcdfkZcer+E
- TLSH T17B861915F6788722D0B7C079C6D2AA5AFAF338454B308ACB0285E73C2F376D59935726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 4.4MB
- SHA256 a9647128455c09e97dc0772a1440f9a0075d77cd3b74c3eca810cd75f2d4eca7
- MD5 f7203727c178ac5433d1900db369e914
- SHA1 df73fa424257ed7c1ba67b4cdedbfd0a0dc07db2
- SHA512 fb66c12086f56df23e43dbfb36ba556b76cbef4e5a55b6af2d9d3b1dd606153a08303e67e952c3ad8e9e603937c29be3405394fe078aab0f535363eb4655379f
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2IiUOlk09:A3k03kHR+R66YfkZcdfkZcer+N9
- TLSH T1BA261A16F6788762D0BBC079C6D2AA59FA333C454B308ACB0285E73C2F376D59935726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 4.0MB
- SHA256 0c4ebf27b0b1a31c2a9c229b89686726ed9bca18a9a3ea26aa15742121f92a6c
- MD5 db5e64121728f2d28cb16ce61f7873df
- SHA1 300a971bafafe6f3fc2149c6562b9eccda85c932
- SHA512 552433cb81cb33035118a93b2509985e5d481c058f628b52c4cccb9f4e28fdd8d30c33544c538c3da642566daf2e6546eb532183108961743b5d8073b0d0043e
- SSDEEP 49152:A3k03kHRJARJopYqLeW4SkZP4sz9MbpeW4SkZP4sz9Mbd56r+qJtb2IT:A3k03kHR+R66YfkZcdfkZcer+c
- TLSH T104161A16F6788762D0B7C079C6D2AA5AFA3338454B308ACB0285E73C2F376D59935736
- MD5 SHA1 SHA512 SSDEEP TLSH