Analysis
- max time kernel
93s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/07/2026, 06:39
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260729-hexkdaxcjf
- SHA256 a6a4d5b71eaec8dc44839f4aab0307101fb7022f934fcf713bb0eced911fd2f9
- MD5 b2d46babae16feb4fc01d8082943fadb
- SHA1 412b64e49609a852ccb7e8aba1d4c1e0c92a2c12
- SHA512 c9278519cb4211fedc549c52553d76f0ff9c62e5a62d2df7985a8a0cbff45280773ad74f7c7ba5de55829d2156bd9ce1129608e777327ef22678d9e38bb73704
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBp:N7iw2G+07iw2G+o
- TLSH T1BA954B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/3872-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024442-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3736-7-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000021275-736.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0006000000021e56-1173.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000002023c-1362.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021544-1509.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3872-1517-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3736-1621-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002444a-1661.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024448-1735.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f000000016917-1876.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3736 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3872 2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3736 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_b2d46babae16feb4fc01d8082943fadb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3872
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3736
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 a6a4d5b71eaec8dc44839f4aab0307101fb7022f934fcf713bb0eced911fd2f9
- MD5 b2d46babae16feb4fc01d8082943fadb
- SHA1 412b64e49609a852ccb7e8aba1d4c1e0c92a2c12
- SHA512 c9278519cb4211fedc549c52553d76f0ff9c62e5a62d2df7985a8a0cbff45280773ad74f7c7ba5de55829d2156bd9ce1129608e777327ef22678d9e38bb73704
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBp:N7iw2G+07iw2G+o
- TLSH T1BA954B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.2MB
- SHA256 d1d39601c55272b4fd80955bb2572e0a549c76387649b51725904ab3619e3a3e
- MD5 c0d9a37400d12590c3711ffaec1bcd20
- SHA1 3a280cad5e2211be281fbf8ce7782577d071959d
- SHA512 434e08577b98b5591f1b5a30e75fbe45ba47a5b63d84941d0fc30b830e16f953e7e177d9e4302d07431f4c76fb0e33d6f52f919201b7fc5db75ba305a861b0c5
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBH3UNUpEisI:N7iw2G+07iw2G+QUN+Eir
- TLSH T1B0B529277BEC48A1E563613048F98756E672F8550B3086CF22688B2D1E73BF17D39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.3MB
- SHA256 fb30dc9bcc52f9e230ff808b943c9554a3b1c404aec4176e47f437bb9650db1e
- MD5 dfb499edeb1c6f269a073c93a0d6e297
- SHA1 86fcb281136d69320a1caf10db1117d4c1201833
- SHA512 fb39f14620a37887203a1863a344a8496c0f012bb0726484a69b3fa415de4cd88ed82bfe371e25dc1b8dcb2c69a5397ab2d1b0dc90a6a5d62987371fc854a919
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBJ3Td9CHKy7GZO:N7iw2G+07iw2G+OTd9CHKyao
- TLSH T1CAB54A13B7E84865E5B3613088F98616D976FC551B30C6CF12A88B2D1E73BF16D38B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
- Size 2.0MB
- SHA256 6916a0325d511b2bb6fdb555a5693d58638b870d0fcf4c768d2922030e8fef62
- MD5 77b9023eeea0db73b6c390ab8e8cb7ba
- SHA1 7883ab2f63a4a0561457e52cb8d213e971004e4a
- SHA512 afcb295495062dec537597bcf31adc299e2b93ba74017cfca1277391288f6e6ad54d7cabc0b07c3a1dd9a93f6399be3b799ad8b57f24179104f7463a328baa07
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioB0Gen:N7iw2G+07iw2G+SI
- TLSH T171A54B1777E84865E5A3613048F88656DA76F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe
- Size 2.0MB
- SHA256 a9c34d2330a8f5e3f41142e4c848e7319399431f5f41b9d6e211dc4b23f36da0
- MD5 388e874d70cfd2d4d1e56e64443dab6c
- SHA1 22cba0903803b304f6e6d32acf4c36e50ae8a460
- SHA512 2f6fedb452d3062687742825e888a3ba3535c668f72701d7e594ffadd0b7fb88bf045de1a3c02d7d21aae79607c91101a25d493f642648406dabd795a78dbe54
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBTTjE:N7iw2G+07iw2G+Gw
- TLSH T19FA54B1777E84865E5A3613048F88656DA76F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{1D3AEF70-1DB8-49F2-839D-DA72081B59A0}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 2.0MB
- SHA256 bd6d41ddbaf5b4e0cf4d5e307d3063f8f240aec89a645fb5a6c50b1c7afd34d3
- MD5 70dceb5d621db94aab4d222948258014
- SHA1 1971c0c74d46e69b8e5b3ef22b80bb2875d05acf
- SHA512 6eb4db8f05456f29a9c91702ea85433b32c64f840d5b2b3f4d4e8651f69d513ee733f7c95379246c6d2c01dc0376704f1392d2e41e00329ecf4490c187697f2b
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBTbBPzBAU:N7iw2G+07iw2G+8BPVAU
- TLSH T198A54C1777E84865E5A3613048F88666D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 a37db57dfeedebbdec55c3859d4260e7881f2676caaa0faec262e2ded6426c47
- MD5 be132c91ba3a82ff60a939dbafa115c8
- SHA1 337ba47eb91e9a7c7ed7d5fc6c19b5fd97133a47
- SHA512 7bab0b8f9ade2c122b4d36ff5d1fb05501357e3b59fb793b069e6a612537e61b5cab2976812c1e0869bc83e7305f75a5672fbf8ca07adb8d5c1c7428086291e1
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBV0Le5ji0hmxNrM:N7iw2G+07iw2G+wPji0Aj
- TLSH T19CC55C27B7E84565E073913088F5965AE972B8451B30C6CF12A8CB3C1E73BF1AD39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 2.4MB
- SHA256 34b4df84fee890d9fce1ea63b11a5a011629465194ad044d2de32d485cd8751e
- MD5 043787cf4c6ffb06541641f8818f92af
- SHA1 e56f00e5aee90b1e0847cd5c9e7e32535070a0ed
- SHA512 6b4173cb2b0c5c08d3086fa32bd46eb7a5573bb57752d84c6cc75ae152b2f107b0a9de8a97223f2f277ac63a7198884738bdd5b502ccb0ed5d51e5b3706f0c18
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBJUOlZ7q/c9:N7iw2G+07iw2G+cUOlk09
- TLSH T1A5B54B27BBE848A1E5A7513049F58616DA76F8550B30C2CF626C872D1E33BF17D38B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
- Size 1.9MB
- SHA256 5496327c14cdca70873054ed4ba72021fded5f0011e9ffca3a276650a50e256c
- MD5 d02f3405b7d39612e370b0584645f770
- SHA1 2aed399e79d6b892efd38d37d54b6e602d12e61f
- SHA512 f43d3a65dfb4be34789235594d962075c7509a55558f7fd7a7c4db7786cf413dc288e15026cf86f736d18940b9a2d9c53f5ebaf0ca2404d0f9e8d19cbe15847f
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaioBN/sCv7rTiw24DtD+qBAaioBP2+:N7iw2G+07iw2G+/+
- TLSH T14B954B1777E84865E5A3613048F88666D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH