Analysis
- max time kernel
86s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/05/2026, 10:55
Behavioral task
behavioral1
Sample
2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 3.3MB
- Sample260519-m1dfvaev9q
- SHA256 d2bf835ffa6251bec3dae2476480c995ff5e76bfdb9b45d4c065105d052e060e
- MD5 1b46be5135a1019f3a72ba2dd6114769
- SHA1 02ba5048f685710fe2ca362e16f214de4d4f0817
- SHA512 eb4e98df4821ab8b744fef23812ea616947677741e8144331ada118057fba981bda0f8859b06b258929a63290fbe548ae6fcc3e26b7920c80aa3027912b99534
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2I:A3k03kHRir86Jr7fkZck
- TLSH T1B9F51A16F6788B62D07BC0B9C5D2A656FA333C415F308BCB0245DB2C3E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/1268-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024323-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3016-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1268-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3016-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023442-133.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021a95-1022.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021678-1257.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000e00000001691d-1868.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e502-2073.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024323-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023442-133.dat aspack_v212_v242 behavioral1/files/0x0004000000021a95-1022.dat aspack_v212_v242 behavioral1/files/0x0003000000021678-1257.dat aspack_v212_v242 behavioral1/files/0x000e00000001691d-1868.dat aspack_v212_v242 behavioral1/files/0x000200000001e502-2073.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3016 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1268 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 3016 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1268
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3016
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 d2bf835ffa6251bec3dae2476480c995ff5e76bfdb9b45d4c065105d052e060e
- MD5 1b46be5135a1019f3a72ba2dd6114769
- SHA1 02ba5048f685710fe2ca362e16f214de4d4f0817
- SHA512 eb4e98df4821ab8b744fef23812ea616947677741e8144331ada118057fba981bda0f8859b06b258929a63290fbe548ae6fcc3e26b7920c80aa3027912b99534
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2I:A3k03kHRir86Jr7fkZck
- TLSH T1B9F51A16F6788B62D07BC0B9C5D2A656FA333C415F308BCB0245DB2C3E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 3.4MB
- SHA256 676fc1fb72f6ff1ede1e3bc62a10e23672efaeab3cdd67b26c35a0fc48be7b24
- MD5 09549a0ed4df2a055eee0832de347ee6
- SHA1 210c416ee15ce13912a9ca3741ba4b404ce68ef1
- SHA512 e5e40607a9bf34ff5de294034f39574f8933407afe5c00b5a63ac5739875d824a9600134bceb29f387ce523b3c5bd982263ebde097e028ace709d283126ba22c
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2IcBPVAU:A3k03kHRir86Jr7fkZck7BPVl
- TLSH T1ADF52A16F6788B62D07BC079C5D2AA56FA333C415F308BCB03459B2C3E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.8MB
- SHA256 c8ef0fd4dfc0f817a0a0c56debd80b238f10e9241958815972b0b6c3d44699b4
- MD5 e1a534da1c2cb1541fe3350016e856bc
- SHA1 931b580ee713f2a5e2e0a6e9fd79cd2758f6bae7
- SHA512 c18b67cd72c1ee16c1466ce3de406c4d0d5ccfa763c2307f1cfcd1a3327446533ea758075db10a3fa726abc8c0b93e72c834f6e3a6740e13fe07f3beed3fadd4
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2IQPji0Aj:A3k03kHRir86Jr7fkZckZjo
- TLSH T13D061A16F6788B62D077C0B9C5D2A69AFA3338415F308BCB0245DB6C3E276D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
- Size 3.4MB
- SHA256 e94240fccacb6c8d7c3ab5c1205aed9b739c8e6f9bc90b362322a787e725f8f0
- MD5 5d698471074a0a7f75ed59a1c3aefd03
- SHA1 f57255e558c3c3be62512a6ad8d58ecebb34605c
- SHA512 2f4bcb0373b7498a68410b1050c3e04c28bc950254c19754a98cc92876b1ef3c9a0b2b7d63cb4857469b48c63e4efe6884bec238a8daf634854855e01d66012a
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2It:A3k03kHRir86Jr7fkZcky
- TLSH T1DFF5F716F6688B62D07BC0B9C6D29656FA333C414F7087CB0285DA3C2F276D5997A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.3MB
- SHA256 7deab39236aafe5f1f911c18f86ceeb4d291eef43a9c5e5d193393acba17e375
- MD5 060f62edce17a11c7a252918f8c53760
- SHA1 26d63c2e146753a7af08c9a2e1aea660ef166b1d
- SHA512 17860318359a745a5883531b0dcb6bfe8fc1aa300cc836ae4310383019feee43351f49b7b0fde48f9a577d95f379bdfa2b759d6459e2754b1b40fbcae1baf7e6
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2IV:A3k03kHRir86Jr7fkZckW
- TLSH T1A7F51A16F6788B62D07BC0B9C5D2A65AFA333C415F3087CB0245DB2C3E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.3MB
- SHA256 d368847a11b160e3d973bf4f30fffc20fe0c8f3ddf5e2535e595a194ca7de619
- MD5 cbb2d73c3c385812550af7db4d3b1c80
- SHA1 b7f276bde666497390eb10673be5b20ec2957d4b
- SHA512 4f8829966514684537cacf0c1090c3d27e141d0a32644f3e72be283cfd9f28158d38e1badc25873407c85345184c27ca2c9c5c3370f70d08acde4e2bb4253d5d
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2Ig:A3k03kHRir86Jr7fkZckr
- TLSH T18AF51A16F6788B62D07BC079C5D29A56FA333C414F308BCB0245EB293E376D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 3.5MB
- SHA256 134249a028aace8e0c8bff92d0d12f1d7c63cc310b18adc9b0dbae714fbc9e70
- MD5 618db5a48b4b528466144a9947b4b5fe
- SHA1 11f5c9a32d47453359ac623eb5955a12fa20b9a9
- SHA512 6e6ebe311dd22d3ae9e7e64a0fe8802c613ff25915849cc99db6dd015308a3d960520256229d90a4c36e4be3dd683446042361353b0862ea64daaeaa0598af25
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2Iai2WH3:A3k03kHRir86Jr7fkZckJuX
- TLSH T1FE062A26F6788B62D07BC079C5D2A65AFA333C414F3087CB43459B2D3E276D5993A722
- MD5 SHA1 SHA512 SSDEEP TLSH