Analysis
- max time kernel
107s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/05/2026, 13:21
Behavioral task
behavioral1
Sample
2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260518-ql2rnsds9w
- SHA256 c1dbb7e77e945140b61457fc77eb9f47472e976d47b6a99319ada5a4e1807a70
- MD5 8433004e508882225e22f198cecd6a43
- SHA1 d8fd5acfc039e00ec2f247365141d7432468333e
- SHA512 043fa7e33f50746845170937d4934724c91c07e7657526fc853c824fd97d70d16d92727b05f7354004f8bccbc575670e9bf5fceecfee0930dbcfbac356f1923e
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmC:A3k03k2pYqq56rX
- TLSH T18F454A16F6644F65D06BC078C6D29666EA333C450F3097CB1385EE283F27AD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4656-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024582-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024479-30.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bcf-32.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4656-75-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/60-76-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002286d-123.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a0-750.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022637-1274.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023143-1920.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024582-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x0008000000024479-30.dat aspack_v212_v242 behavioral1/files/0x0003000000022bcf-32.dat aspack_v212_v242 behavioral1/files/0x000200000002286d-123.dat aspack_v212_v242 behavioral1/files/0x00020000000216a0-750.dat aspack_v212_v242 behavioral1/files/0x0002000000022637-1274.dat aspack_v212_v242 behavioral1/files/0x0003000000023143-1920.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 60 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe$ 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4656 2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 60 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_8433004e508882225e22f198cecd6a43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4656
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:60
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 c1dbb7e77e945140b61457fc77eb9f47472e976d47b6a99319ada5a4e1807a70
- MD5 8433004e508882225e22f198cecd6a43
- SHA1 d8fd5acfc039e00ec2f247365141d7432468333e
- SHA512 043fa7e33f50746845170937d4934724c91c07e7657526fc853c824fd97d70d16d92727b05f7354004f8bccbc575670e9bf5fceecfee0930dbcfbac356f1923e
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmC:A3k03k2pYqq56rX
- TLSH T18F454A16F6644F65D06BC078C6D29666EA333C450F3097CB1385EE283F27AD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe
- Size 1.3MB
- SHA256 74f73fdfcb10bb93fb58d6db3f11e587d0d589a4d1bb0397bf2eeb2085f6d2f5
- MD5 a2b18b7cd2a31f792fcdde3d7d45580b
- SHA1 73d3cb0d9110116ab4df8a53d88746060f10055c
- SHA512 851231ea62df3c6c7489116ee013afe4a57009bd423698d9ed3aece3180f12907e5f3daeb38defcc8f630055fafcc38fd03781ec50af095afe83b7539427aaf8
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmpGen:A3k03k2pYqq56rJI
- TLSH T108554B16F6644BA5D06BC178C6D29666EA333C410F3097CB1354EE283F27BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 9486bb89596cd5224d7ed62a79a9b8fff30d88508feae23d0f3d8c0daaf4d854
- MD5 ddde625deca6560859f4c1c83fafb49e
- SHA1 1d7d87f9aa9c7eb31f06642505e9f45628d15c2b
- SHA512 48573ae132774f5e66a8ac9de1f62051f9be4395858830077caea8d2f5c885c01ee76c9dab621cdf31bff374f4dd5b48cb7fa3bc1d85653e691b75c33fd8d26f
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmC0Le5ji0hmxNrM:A3k03k2pYqq56rTPji0Aj
- TLSH T12A853A16F6644B75D07BC0B9C5D2969AEA333C411F3087CB0385DB683F27AE5963A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 1.2MB
- SHA256 2bfcea26eaec7b5226432f254087fd0ab37de5f4a77189dd08366df65de6bb61
- MD5 feb2a62303a3da2c23abcb8e519464ed
- SHA1 118dcfc55f7cee8ad3746303ba3444cbebd6ec07
- SHA512 200c0a598d7da7a80b2e99e797e0cf8f0a272b450181976a63bbf017ad489325eafc0c68014e627fa8163ce7d387aaeff02a1108aba46170478fe74f3da9879c
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmMa:A3k03k2pYqq56r
- TLSH T1AB454A16F6644BA5D06BC078C6D29666EA733C450F3097CB1344EE283F37AD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe$
- Size 1.8MB
- SHA256 2e34f90aa290a8fe2b2c687d2ae38c1e1360a889bac28105603c0d8c1398f1a4
- MD5 12bccc4ace0abb5b1aabb46739ccabd5
- SHA1 3be6b84a418c7e8d0aae9367a8b5199bcb0107b0
- SHA512 c0693b4b53387d8f7fbf0e2a8a32ba0021b8eaf965b1d236c6aa3ae92ce31f9eb66e268aa20720289e6defef83c192572b6afc23ba73ef463560d9ed05057a55
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmCVbqPb88hv/l+7:A3k03k2pYqq56rLVO88hXl+
- TLSH T1CD953A16F6648B65D07BC0B9C5D2969AEA333C414F308BCB1345DB283F27AD5963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 1.3MB
- SHA256 2ead99de4c8664dd5441f7f48510f7733659176498b11e90345bae1d187f802c
- MD5 f5bd1d9b0eec12f139217faa368adae9
- SHA1 f8f43ac0b2913adec558d78b75f216fbf06db1b5
- SHA512 2084549b3dabea2b2ab2b86c6f3d754afbd70fd6bd43cb94a89acc3bca5decafd7acd9f53cd6823ae08881d3fafcc415f063554840a1348e4c01024cd2b17dee
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmrD:A3k03k2pYqq56rU
- TLSH T1D8550716E6544BA5D06FC074C7929666FA333C410FA097CB13C4EA3C3F266D19ABA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 1.6MB
- SHA256 f5448f510f3086e6ff0d3e12ae2810580a8430d947383b1414aff6b927d747b9
- MD5 51e804d205605792eeafb4f3482b8de3
- SHA1 fd03d363dcc0215fe8445087f246e6d28493805a
- SHA512 915da223b4fefceff4335bcede014fcbc8a6cd0926e2c86f78dbb8cc13ac34852f4675cfb13a6ca73a3e76f7f99234b771b14619d91bf74e12ea5870590692b4
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmyUOlZ7q/c9:A3k03k2pYqq56rjUOlk09
- TLSH T1C0854C16E6648BE5C07FC178C6D29656EA733C410F3097CB5358EA293F236D19E39B22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe
- Size 1.2MB
- SHA256 dcee34113ce7d2f0eb02c60477d3a1b36b44e54b776d1bf2caa004b53a1b2ecf
- MD5 1386df4de90792538dfd39e79dee8782
- SHA1 0ee858701af6c7fc52debc4090038555ce494276
- SHA512 06e510023cb1e5a5c454bd9e81d24c0c3307646a6b4f532894f7d8ce0aeef4274ac8f688527f4c9c39c2c8478ab0dc3f621d29564cd1ccbffa29f37ca0c49fd6
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ofECD5TvinrmgF:A3k03k2pYqq56r9
- TLSH T15D553A16E6A44B65D06BC074C9D69666EA333C410F309BDB1354FF283F336D1AA3A762
- MD5 SHA1 SHA512 SSDEEP TLSH