Analysis
- max time kernel
88s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 20:37
Behavioral task
behavioral1
Sample
2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.3MB
- Sample260720-zeat2set3j
- SHA256 688b552c9d2d10130c52ee1e8c3aab540ba3fdd839fc81a87884940ed4e18479
- MD5 4b06d9fb249a3c30ba4234726e845753
- SHA1 6fb3111030a50fb4e077d1b1493b497e7f5a192a
- SHA512 694f2d79787569f25d5d7202c97a6bfd814ada01b9832e66c2c8f4adb59e80424c1bb13bfd80215244e1cb74ecb260f8c0be1e02501547a85fb1ba18b438cf81
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapebAD5TvinrmVD5TvinrmgF:A3k03kHRJf56ru56r9
- TLSH T141656A02A6980FA4D25F8174C9968A62E6777C524F2097EF1364BF253F327D0AE39353
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4864-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244a5-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2276-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4864-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2276-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-427.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001e746-1286.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000002153b-1536.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000002318e-1647.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000002291b-2061.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244a5-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-427.dat aspack_v212_v242 behavioral1/files/0x001400000001e746-1286.dat aspack_v212_v242 behavioral1/files/0x000600000002153b-1536.dat aspack_v212_v242 behavioral1/files/0x000500000002318e-1647.dat aspack_v212_v242 behavioral1/files/0x000600000002291b-2061.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2276 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4864 2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2276 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_4b06d9fb249a3c30ba4234726e845753_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4864
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2276
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 688b552c9d2d10130c52ee1e8c3aab540ba3fdd839fc81a87884940ed4e18479
- MD5 4b06d9fb249a3c30ba4234726e845753
- SHA1 6fb3111030a50fb4e077d1b1493b497e7f5a192a
- SHA512 694f2d79787569f25d5d7202c97a6bfd814ada01b9832e66c2c8f4adb59e80424c1bb13bfd80215244e1cb74ecb260f8c0be1e02501547a85fb1ba18b438cf81
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapebAD5TvinrmVD5TvinrmgF:A3k03kHRJf56ru56r9
- TLSH T141656A02A6980FA4D25F8174C9968A62E6777C524F2097EF1364BF253F327D0AE39353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 1.8MB
- SHA256 cb1c19a41b3a1c9bdd0adbdec3a4e8c9c565d55bb7690bf40189b36cd1211522
- MD5 de5cc342937cceaf72a785b698453c72
- SHA1 707f6ae41253dd4de73ed6b4c4d9518d3822fbec
- SHA512 5913df2a43acce5cdd588723735fc6ab45ab847704634377f6d3a2c9d62db2bf7a03dd1cf9544e20910da2cea531b814b541414eb2a3f100fd0c527cc8a9bfaf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapebAD5TvinrmVD5Tvinrmg13Td9C/:A3k03kHRJf56ru56rtTd9CHKyao
- TLSH T1EE954A02A2D80FA4E16F8134C9A64662E6777C555F209BDF1354BE293F327D0AE39B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.8MB
- SHA256 2e09c2a25e1ccf6e603cea20e0df297e791176b3ad74b400c88f789e1d6bfbbb
- MD5 1403dc0e38bae4379a9c5a22ee5b484a
- SHA1 b02f5644d80d0493f84595772a3afbd2020048ad
- SHA512 193c02ea5e901f8a2ce5f6b3fded696089a66aa342f9ae817a29beba4545605e6b159c5e23f5327a7f3cd0bcae72f524d6db797b68b40b01a0de8a4fc0ed48f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapebAD5TvinrmVD5Tvinrmg9Ur2d2r:A3k03kHRJf56ru56rlUidGl
- TLSH T133955B02A6980FE5D15F8174CA964662EA777C520F2097DF1394BE293F327D0AE3A713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 d00671b55ca0b1b3c206fb63743bc229282b0bdda210e7245f4a55e07aa8498f
- MD5 43368e0055d74060d57b605196abf047
- SHA1 57c84316010e94fdb610afd32faa22c38e0afa23
- SHA512 b10b0298a28a489dfa5e799f5022ee4a8b127d651529bb8c46061a240fb6dc0f33e7a91cfabf612e73b1507105408ec65407aa9026a6b967b8db80ed02b83d72
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapebAD5TvinrmVD5TvinrmgB0Le5jn:A3k03kHRJf56ru56rJPji0Aj
- TLSH T1DC953916E6A84FA5D06FC074C9929656EA733C411F2087DB0354BF293F376D1AA3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 1.4MB
- SHA256 8a918dc86852e759b4980b40b0f37074b8157bd00a589cdf6ff55a7d71cebfa1
- MD5 b495602c0deb70102c26c2bf276ea969
- SHA1 ae6d3ef9a530b05cb0db0580325e01d27725623b
- SHA512 95b8d65fb91fc5d5c7691f6b1e800f13c3c76071c587001be05ef2203c49405de5e08c3a0795fe8ca74bc2907670f4c50a672c0706a0ffb3ca28403bf09d83f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapebAD5TvinrmVD5TvinrmgB+:A3k03kHRJf56ru56rQ
- TLSH T1D6656A02A6980FA4D25F8174C9964A62E6777C524F2097EF1364BF253F327C0AE39357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.4MB
- SHA256 816471408c5819d979654fa66417578cdce21e2b5f7de31b80d2d342201fec38
- MD5 1ffc9e4443909a104f10077517895623
- SHA1 e4d53248bfe1d5ea7f16d17c6a5e03f83cb115c0
- SHA512 bfe6f89dee2dad79a9432f47b1970586b45b842cdfae100cf41f5c7cad2e7d16c7f2ca79623f0205e1c42a423c5dbae963235dca489b02f6ce8c103e49f0c42a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapebAD5TvinrmVD5TvinrmgRF:A3k03kHRJf56ru56r7
- TLSH T16F655A02E2990FA5D65F8134CD968662E6377D910F209BEF1364BF253F327C0AA39653
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.6MB
- SHA256 1ba5b9b3fc10b248042b2e7c2002523e372c8ce6891e6f15150bc0ac8e585497
- MD5 503a609b499a6ac2cae636793b9436c9
- SHA1 0003c1efd2f057c54613caa79652c690f15091d9
- SHA512 66d4285de0fdaeee076958d0d52f4e9ad0b53198f633929bdd2e5c2c2daf363545a307d04134238568fb9dc381c2299bd263b4057e0bd3ecc1df7fd1b86e2cc7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapebAD5TvinrmVD5TvinrmgxV+PAkz:A3k03kHRJf56ru56rZi2WH3
- TLSH T138757B12A6980FA5D25F81348D968666E6377C524F2087DF1354BF2A3F327D0AE3A353
- MD5 SHA1 SHA512 SSDEEP TLSH