Analysis
- max time kernel
87s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 18:16
Behavioral task
behavioral1
Sample
2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260804-wwxtcsbn2y
- SHA256 55b1b02e7fc1f09ec3f8b7907c4ceaf463a22e9d2a41312131f5a8a7dbf86c67
- MD5 c559fd2afd61f7eff290d26a7c8594a9
- SHA1 64c4c85b676a49c58934fa0d06fc8b51c3eb2bcc
- SHA512 f60e0c9c5152c7dc98853ecd015113dfcce50b728a7ef26cda76330c25f73839f3dae2f142e0873df03c30a1b83779e0f36d8de22bc7f078ac01d5bd2c97e172
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbE:A3k03kHRJH56r
- TLSH T1A0457B03E6940FA8D11F81749A964662EA777C125F6093CF1358AE153F72BC0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/4716-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245fc-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2192-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4716-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2192-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021274-362.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021545-723.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024609-1026.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000225f2-1292.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e9ef-1388.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e766-1652.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022935-2062.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245fc-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021274-362.dat aspack_v212_v242 behavioral1/files/0x0002000000021545-723.dat aspack_v212_v242 behavioral1/files/0x0008000000024609-1026.dat aspack_v212_v242 behavioral1/files/0x00030000000225f2-1292.dat aspack_v212_v242 behavioral1/files/0x000300000001e9ef-1388.dat aspack_v212_v242 behavioral1/files/0x000300000001e766-1652.dat aspack_v212_v242 behavioral1/files/0x0002000000022935-2062.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2192 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4716 2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2192 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_c559fd2afd61f7eff290d26a7c8594a9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4716
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2192
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 55b1b02e7fc1f09ec3f8b7907c4ceaf463a22e9d2a41312131f5a8a7dbf86c67
- MD5 c559fd2afd61f7eff290d26a7c8594a9
- SHA1 64c4c85b676a49c58934fa0d06fc8b51c3eb2bcc
- SHA512 f60e0c9c5152c7dc98853ecd015113dfcce50b728a7ef26cda76330c25f73839f3dae2f142e0873df03c30a1b83779e0f36d8de22bc7f078ac01d5bd2c97e172
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbE:A3k03kHRJH56r
- TLSH T1A0457B03E6940FA8D11F81749A964662EA777C125F6093CF1358AE153F72BC0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 1.4MB
- SHA256 ee0dde84c5f5bdb754ecea21805fdfecfc0bc2ea99ec02921848d8e0a88edd88
- MD5 d7d3097c043fc5978f27324305d675c3
- SHA1 94170811bd2fdbd64e524d3de335a55d57440cc9
- SHA512 787164cd4328c33dbb1742875c49fca3dcda7d0b551fe1f1301b1c58c6189edd38a8d3d29b1478dcd5b9523c96ab212359e75f5daeca7e0db6cebc74bfcfcc43
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbEF3UNUpEisI:A3k03kHRJH56r3UN+Eir
- TLSH T1EA655B17AB980EE5D11F817889968656F7737C110F2187CB23549B2E3F337D06E3A2A6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.6MB
- SHA256 872b9817771d58509b460dc420326619b0ca56ec98f3c4d725ec18f6a985b641
- MD5 42da8e2fcfe0e6c940336040b7bff55b
- SHA1 ee75cb1cb069592ae1b713b88cade20413d20410
- SHA512 11dd071fad0b4f76a83594e23da6bb5017eb347259469e80fb671d7c3057efaf5b5ca3dd2c03b18c10311d1537d551bedc78ae0210d7d49ca9ce5996f8c6fea6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbEbUr2d29dBrtpDiI:A3k03kHRJH56rhUidGl
- TLSH T1F7857C02A6980EE8D01FC1749A964662EA737C561F6097CF1394AE253F33BD06F3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 1541eac48a1e87824b40c3df19a6715048e84e634a2be9389f7772dbd6be4eea
- MD5 8ee7db9e8954f0f5e24ee123d34dec4e
- SHA1 6b49278cbfb7a3e70b83fa7db470336501b9b4d6
- SHA512 733e88a1a2d674f0791950a79e31a938a8f70b4b43f80a52cff46edb3d7ea6a2f84e5dade366f5629d26245eeb4f935066918cdfebdb3304d49fce2ebd6270be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbEP0Le5ji0hmxNrM:A3k03kHRJH56r1Pji0Aj
- TLSH T1FE856B16F6A44BA5D02FC178C5D2965AEA733C425F3087CB1354DE283F63BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe$
- Size 1.2MB
- SHA256 18755e6f5e5b4fc524e359a94223908b0e93638cc53d8db3c7d78da94d8d7f46
- MD5 b3bc1d1f46b8e2aaa90deefeb79a6778
- SHA1 a8f3132c5cf32bf799f13e7391751d418c7e00d4
- SHA512 4eaa26cdfaf2269c28720e2a1fe0fb27e18071b3e44ababcaa51ca6940b5ac36804ef5c2da7915bb6f1513c3dbb5c7176d977b2aef9eaf8b83ad26038bd15d9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbE/n:A3k03kHRJH56rx
- TLSH T15B457B03E6940FA4D11F81749A964662EA777C125F6093CF2358AE153F72BC0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE
- Size 1.4MB
- SHA256 538cfc1170d4470f4debe1424b5a793b848f8399a11e94897c5f9292e3645008
- MD5 94319bc6afdf55ddd1ae0db69940acf1
- SHA1 979c0d48badce958ca9d2cae739c15d07bb51c34
- SHA512 12e7235b07836a68e830228b83ce77c231137bbaa7d076efa1733f511516de9dd86a45d9b5604c8c5dae94f934c25aee24de5449e1d4448bf15bca151403f089
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbEsu2w2JUqr:A3k03kHRJH56rKO6r
- TLSH T1A4655A07A6940EE5D11F81749AA68672FA73BC421F2093CF1354DE2A3F727D0AE39356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.2MB
- SHA256 c0a72c23cd8587d01e335aa21218daf06eb7044642140e01b2e62185d07bcb7d
- MD5 27d8df5920a7161ca7908c1fb8175f0f
- SHA1 c5d47186f788c6bcff4ac0e0768bd73f44df50d0
- SHA512 33e9fda242d5bea037e96b6e3ed4978c4bf659f808909740e41cda799dc6caaf95e4834b7c1d3967be90ee629cc349160475824df5407f91511b7205949a2a39
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbESwE:A3k03kHRJH56ra
- TLSH T147457B03E6980EE5D10F81749A954A62EA777C521F6093CF1358AE153F72BC0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe
- Size 1.2MB
- SHA256 4a05f349d654e869422efff62fb89db7ec9ab2f0c9bf5bc4c6ddcf645254d010
- MD5 2e320e064fa0e299e145a45227ea02f9
- SHA1 1c833259e22760c52ccc96d82ef8ce83890abb39
- SHA512 5fd7903bf4788670b5291394377903a46623da065560d9b12692f99e208c0bf86664caee7338b36dafbcd94fc4dce520b0a2227565935afe1b84cb38e82d23f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbELF:A3k03kHRJH56rP
- TLSH T158456B03E6950FA5D64F813099964A22EA377D521F2097EF1358BF253F327C0AA39397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.4MB
- SHA256 9c86b5fdd222d2066f9dba6f2403282212305e6d7be5a36846393e3257341053
- MD5 c4616590343d63ee49ccb5e0ca2cbe60
- SHA1 1863391a0f296ae125b1c821dc3963ed2edba22e
- SHA512 b0e2b5c2e7a2faf81ad643890082eae02d2923514684e8d9d105d13ebd0b8819bda4a29e2a98d0b2e695189d8578572e114b61fa4cf3cdb6e3115aba7c311f4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2q6hVD5TvinrmbELV+PAk2hMH3:A3k03kHRJH56rli2WH3
- TLSH T15B659D23A6980EB5D11F813499A54636EB377C125F2183CF1354AE193F72BD0AE3A397
- MD5 SHA1 SHA512 SSDEEP TLSH