Analysis
- max time kernel
83s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/05/2026, 16:54
Behavioral task
behavioral1
Sample
2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 2.4MB
- Sample260518-vesyeahv9t
- SHA256 2b82fba61d868d2724a3497ac17b08315290cac1dd9f224da54520a272c91bce
- MD5 47ed3ae471f2d3ba6473adb5fae0ee43
- SHA1 16fdce1596a3ab72900b897a3051054fda14b934
- SHA512 0e8070d633a20945df32f10af9588ef753261845e30e7ea5fbb299ea6f6ed93d7c21c129e646af5ca96c3cc02c6627a6f2719658cb1c982ad31e253e04961018
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKV:A3k03kHRirnr+JrBm
- TLSH T111C52916A6A84FA5D06FD178C5928676FA733C410F2097CB0254EE293F376D19E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/712-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a8f9-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5400-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a411-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/712-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5400-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028a94-547.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000295bc-807.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000028ea1-1264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a85-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002a804-1792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025ad7-2105.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000300000002a8f9-6.dat aspack_v212_v242 behavioral2/files/0x000200000002a411-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028a94-547.dat aspack_v212_v242 behavioral2/files/0x00020000000295bc-807.dat aspack_v212_v242 behavioral2/files/0x0004000000028ea1-1264.dat aspack_v212_v242 behavioral2/files/0x0008000000027a85-1385.dat aspack_v212_v242 behavioral2/files/0x000400000002a804-1792.dat aspack_v212_v242 behavioral2/files/0x0003000000025ad7-2105.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5400 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 712 2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 5400 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_47ed3ae471f2d3ba6473adb5fae0ee43_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:712
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5400
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 2b82fba61d868d2724a3497ac17b08315290cac1dd9f224da54520a272c91bce
- MD5 47ed3ae471f2d3ba6473adb5fae0ee43
- SHA1 16fdce1596a3ab72900b897a3051054fda14b934
- SHA512 0e8070d633a20945df32f10af9588ef753261845e30e7ea5fbb299ea6f6ed93d7c21c129e646af5ca96c3cc02c6627a6f2719658cb1c982ad31e253e04961018
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKV:A3k03kHRirnr+JrBm
- TLSH T111C52916A6A84FA5D06FD178C5928676FA733C410F2097CB0254EE293F376D19E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.2MB
- SHA256 44f458f2908de6e7b464c8bdc1187069287abfcb47c0b0903bb1d390824e506a
- MD5 2fe965e6961ce43d7fec8dde98a46312
- SHA1 b2092e8c45146c927422c9d65e0bd7babd499ff5
- SHA512 be9c2d44b6c6969ab773106fd8bec7b69228f71a604f9f5f756c2111c9bbdfa9446fae4e70c3c45e9d2efcab45f2926b7d437dc225e0b5db62c47b42e49617a2
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKcVk0QGTvntQb:A3k03kHRirnr+JrBaHaib
- TLSH T1CFE53A16A6A84BE5D06FD178C5928566FA737C410F3097CB0254EE2A3F376E09E3A713
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
- Size 2.6MB
- SHA256 5a224ddb6c4f0c8e6389643e0fb1e5c6b73f587135855a9fa226d940e90fb280
- MD5 64c2a1259080066cfc317c25c508d455
- SHA1 88f2a4c6cdfa72471815dd9f970fc7f020a4c18a
- SHA512 28c1f1e18fc89fe7b28b68f3f692a02d7e9c78495a499ed2bc5762fa1e8ee168f1e9d39d672ac42f24e886466bb925ef177e7488d3b1772f59613d3513632846
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKzw:A3k03kHRirnr+JrBZ
- TLSH T111C52816A6A84FA5D06FC178C5928676FA737C410F2097CB0254EE293F376D19E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.0MB
- SHA256 32a0f2eedbbd2f0e7aa2dfd23b3246c0ae64888a957c099784dd4ef9e09aef80
- MD5 fabfe8a0899e332d33875fa3d3ef1e57
- SHA1 52f6b93cc28c47c34b4e782acda29f7e515759ea
- SHA512 e2b99adc1e58b75650bb477af61f2d429e0fdde2e1c2d6ec53d458743a23ff97a1b8d5aab283da9b35817b119390c44798f3d1a9ab7f492c45e73f6db310a8dd
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKRPji0Aj:A3k03kHRirnr+JrBcjo
- TLSH T1D2E51916F6A44BA5D06FC178C59296A6FA733C414F3087CB0245EE293F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 2.5MB
- SHA256 ccc07c89e9e38a8a8a0606884f228f71ac698607dfc15df472e21106cb14ac4f
- MD5 78a5f2cbacbb253bb6df3abe36caf7d8
- SHA1 708312951d93163cc8182b1d019acb374ddb3070
- SHA512 ecac1d001c2141700c316b28288ff3b8cb66155b2b66d2d8e496e31d8534e2155a5db928f74cf214692e4b1edf1d70531f8e50c4a915724aab5986a5147f46d3
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKP:A3k03kHRirnr+JrBu
- TLSH T189C52916A6A84FA5D06FC178C5928676FA733C414F2097CB0354EE293F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE
- Size 2.7MB
- SHA256 9785e02a4b0a6954806defb11b00d6acc5c99b2807df776ba75a1ac836e491b6
- MD5 35e5a76411e5f9639aa9773f542fb6d8
- SHA1 c368601b51cc1da764d2e09558829ea3db1216fe
- SHA512 4f10a941235ca8d8a86412de9d7018618f055058be96a1f8e48d1b5dddddae739a03d54bf21b9e42776bb41ace61b0009728be0db8ee180cc978c8f93a7901c4
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKPTeX:A3k03kHRirnr+JrB0TQ
- TLSH T1D4D52816A6A84FA5D06FD178C5928676FA737C410F2097CB0254EE293F376D09E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.5MB
- SHA256 990e404f952a5b78813e3efe68b860511d6e0ebd6a5020a67b9e53e7fef89146
- MD5 bbcc49a2ee8b6a2692f33ad99c9a4876
- SHA1 cf318e24e47ad1b3282ccf4a4f28a41f6ae4158f
- SHA512 4e8b94628eeac8e7990613f1a42625b3ed5b4caf8d7fb3088f099370f459472316ee533412102331f5d4c94887ae5bc67fbe7900431989edfd54004c3418c97d
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKT:A3k03kHRirnr+JrBe
- TLSH T194C52916A6A84FA5D06F9174C9928676FA737C410F2097CB0254FF293F376D09A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.7MB
- SHA256 6d9c18dbb40dae3e493f83f2b1e583b0c1591ee2ad0c89c9615ec5470da32c7a
- MD5 156d938209fa9d17b248db96d7bbbc7b
- SHA1 e13933dc6551019932d7dc46cc7f0519ac2a4ce4
- SHA512 4a62f90e26db0de02bb996f9a0064b449bc132f33bf2f56a45de3399fa16c04186d738b724bda456a791acc2b4f0ca0119c8a6b4ad5672dda7245acf6f00b2f5
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rB8tDZqrKhi2WH3:A3k03kHRirnr+JrBEuX
- TLSH T12CD53916A6A84FA5D06F8174C5A28676FA737C414F2087CB0354EE293F376D19E3A723
- MD5 SHA1 SHA512 SSDEEP TLSH