Analysis
- max time kernel
106s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 01:21
Behavioral task
behavioral1
Sample
2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.8MB
- Sample260808-bq5a2axdjf
- SHA256 73d5643a52ee96433170d5eceaeea2b6ef2f42f675e63bafdc19da0bed0b430d
- MD5 54909ec6cfea4fa2c582827751328a60
- SHA1 abd6c658ba10280a184edfd573e4ba65977b916b
- SHA512 b73cb180a544f7c3595c9445050a9c5f90fc8939804ccbd11ac4c9fa73f8dcdbc2bdff5f09e76352e61e8aed7d23a6ebd8705eda094d2fa75ddb5403692939be
- SSDEEP 49152:A3k03kHRJTeW4SkZP4sz9MbkqJtb2IQPji0Aj:A3k03kHRdfkZckZjo
- TLSH T15ED52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/4328-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c48e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4328-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4784-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000019cc7-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019c9a-1281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a0000000064b6-1976.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001afdc-2063.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c48e-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cc-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-390.dat aspack_v212_v242 behavioral2/files/0x000c000000019cc7-1020.dat aspack_v212_v242 behavioral2/files/0x0004000000019c9a-1281.dat aspack_v212_v242 behavioral2/files/0x000a0000000064b6-1976.dat aspack_v212_v242 behavioral2/files/0x000300000001afdc-2063.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4784 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4328 2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4784 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_54909ec6cfea4fa2c582827751328a60_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4328
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4784
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.8MB
- SHA256 73d5643a52ee96433170d5eceaeea2b6ef2f42f675e63bafdc19da0bed0b430d
- MD5 54909ec6cfea4fa2c582827751328a60
- SHA1 abd6c658ba10280a184edfd573e4ba65977b916b
- SHA512 b73cb180a544f7c3595c9445050a9c5f90fc8939804ccbd11ac4c9fa73f8dcdbc2bdff5f09e76352e61e8aed7d23a6ebd8705eda094d2fa75ddb5403692939be
- SSDEEP 49152:A3k03kHRJTeW4SkZP4sz9MbkqJtb2IQPji0Aj:A3k03kHRdfkZckZjo
- TLSH T15ED52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.3MB
- SHA256 4e9f5578b03962e1e2a4a2128e8a26d6cabb08108207b107c2b1833d8245bd12
- MD5 a8a66d62bf9e83dc293e57d767f6fcab
- SHA1 e5a107ccb6afe6be992fe13b8946495ab73ffad8
- SHA512 1d41d83e14056ede5187af80a5089a855707437e337458df17bd46ae2335156d01a958a5b18278af13dd8ee32e8896f4b7b06d1117ed702ed710b9a8c3555c3e
- SSDEEP 49152:A3k03kHRJTeW4SkZP4sz9MbkqJtb2IQPji0AjKPji0Aj:A3k03kHRdfkZckZjo0jo
- TLSH T1BAF51916F6788372D073C0B9C5D2AA9AFA7234465B308ACB0345D76C2F277D6863A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 2.8MB
- SHA256 41ab5cf7a552170ceb3505a61aeace059b864f1d08ba1910de3aba1b2f075db1
- MD5 d49cd510a64aa6fa3d76003d19b0ed0f
- SHA1 42018549634e6510ed6efe54a352272359015495
- SHA512 221e0d5a395024d8366ff7450f3e2a23d47e2e1eac378334cc4545396a043800bbaed9d48da75c2c7c2e5efa930d2cc70cf53e1b839e4ecf075726740b99cbd4
- SSDEEP 49152:A3k03kHRJTeW4SkZP4sz9MbkqJtb2IQPji0Ajc:A3k03kHRdfkZckZjoo
- TLSH T10DD52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.9MB
- SHA256 e54cef5c09f0c68484cef2cef592038b5a3da11bd940cc420dc871fd6a9ad38f
- MD5 a07290e71e7fd9d3545b2f48f7a5f63d
- SHA1 01e82dd700461c1e8544d148bcf2a49947549478
- SHA512 f22a37b897bfadc142d2069845ac13cf98ff5359e6c26a76f8e53c453be5c2fa9136d9aad4202d2ed1d98d0aa21099d3c31c5ffa0396104dc67e3d038c185675
- SSDEEP 49152:A3k03kHRJTeW4SkZP4sz9MbkqJtb2IQPji0Aj7:A3k03kHRdfkZckZjoX
- TLSH T165D52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D72C2F277D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.9MB
- SHA256 be1c6c3a3e0ef9750657dc7b18cc235631ec77c4bb29d47b305b0076d8576dba
- MD5 d2f63e65db2bc3e2505c5d4d39870968
- SHA1 8bd613e6dc72797ba4a5d3381ba4e079b55aabe2
- SHA512 d1b15a7a1d74704e005c4bfd68454fc5270df8e6a582dc9a3a82db7026b1a9e0f7624ca9d9ed50120e3f52eb50c83b9d972ef7eee9138b47c287bb976450f42d
- SSDEEP 49152:A3k03kHRJTeW4SkZP4sz9MbkqJtb2IQPji0Ajq:A3k03kHRdfkZckZjo2
- TLSH T1E2E52A16F6B88362D073C0B9C5D6AA9AF93138465B308ACB0345E72C2F377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 3.3MB
- SHA256 22713e83b087ea2c1ba9ab847db88d4f71847ddc4a2f0fa21565e9f667d8b357
- MD5 d6b8e964899dbb6f3c3c3cefcd6bff0b
- SHA1 a09eb90c60e53eaf30b4169b140b772be892e281
- SHA512 ff8f8999de104051d301cc9b3d81382f9a5b468912fd10177874f5466f573c52a3beaf03267dc3e9b3bac703d05d13386cbfdee1ed637b75fcc5e274d51b0a52
- SSDEEP 49152:A3k03kHRJTeW4SkZP4sz9MbkqJtb2IQPji0AjRXpiMh:A3k03kHRdfkZckZjolpig
- TLSH T1F2F52B16F6B88332E0B3C175C5E6A65AFE7238425B3086CB1345972C2E677D1DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 3.1MB
- SHA256 1ec96a14a5aacda36b441d01f1760d5b08692ce2a2b6e13f38eecb42dc3e5a17
- MD5 eeb66b835b99630048c6a5a7611d2d0e
- SHA1 c4a132b20432efab1f3bebaf6ea241d28ed14be2
- SHA512 97a981aa1976584cfebb2898c34bce4f5f47dae245e6cd5c80fc75c8d9d7cbe31add26ee8fa0d5d15e5965dfd130d2af21ca7a64f981a49e69a0ee9d9bce05f4
- SSDEEP 49152:A3k03kHRJTeW4SkZP4sz9MbkqJtb2IQPji0AjYi2WH3:A3k03kHRdfkZckZjoMuX
- TLSH T15EE53B26F6B88332D073C0B9C5D6A69AFA3134465B308ACB1345D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH