Analysis
- max time kernel
150s - max time network
124s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/05/2026, 11:41
Behavioral task
behavioral1
Sample
2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.6MB
- Sample260519-ntfhasaz4y
- SHA256 8e150aa3c67be0cbb7c6fb19cf7258f3ed154497a375e8325695ff8386ad90a9
- MD5 a58c5003561bf4b903a254e8bcd25488
- SHA1 ee3caacc54f7fd922979c7bcb52127ca28867bdb
- SHA512 da7f27ff9d7a3e5d3fc463c1c5ca3d342ddb3611943d0c441fb2c78693886dab07658deda6473b03743a6bca58bc1af16678b84d2b09944afa672be43423bffb
- SSDEEP 49152:A3k03kHRJP56ruqJtb2IdqJtb2IQPji0Aj:A3k03kHRirucZjo
- TLSH T1A8C53A26F6648775D077C0B9C5D2969AEA3238425F308BCB0385DB283F277D5993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2904-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002451c-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4900-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2904-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4900-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023621-141.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001000000002162e-1025.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002265b-1265.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000020341-1526.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001ebd2-1969.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000800000002451c-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023621-141.dat aspack_v212_v242 behavioral1/files/0x001000000002162e-1025.dat aspack_v212_v242 behavioral1/files/0x000300000002265b-1265.dat aspack_v212_v242 behavioral1/files/0x0010000000020341-1526.dat aspack_v212_v242 behavioral1/files/0x000500000001ebd2-1969.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4900 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2904 2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4900 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_a58c5003561bf4b903a254e8bcd25488_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2904
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4900
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.6MB
- SHA256 8e150aa3c67be0cbb7c6fb19cf7258f3ed154497a375e8325695ff8386ad90a9
- MD5 a58c5003561bf4b903a254e8bcd25488
- SHA1 ee3caacc54f7fd922979c7bcb52127ca28867bdb
- SHA512 da7f27ff9d7a3e5d3fc463c1c5ca3d342ddb3611943d0c441fb2c78693886dab07658deda6473b03743a6bca58bc1af16678b84d2b09944afa672be43423bffb
- SSDEEP 49152:A3k03kHRJP56ruqJtb2IdqJtb2IQPji0Aj:A3k03kHRirucZjo
- TLSH T1A8C53A26F6648775D077C0B9C5D2969AEA3238425F308BCB0385DB283F277D5993A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.1MB
- SHA256 2d9a518512c1a19984aaa23fdb8cc8e0552b6f4a80e22a271e20cbd247f359eb
- MD5 832dc17e33a9e8c0fea41e6241fdfcd8
- SHA1 ba096a5d978fe28599bd69fcb9b145a5b1b51549
- SHA512 d83a6c159503406dea1a68021041bfe9ef13b03dacf01ddf2afbeea0a520988562108e212610607b3fc0f724f6c842c97ab898ef014bf27a02b365764474769b
- SSDEEP 49152:A3k03kHRJP56ruqJtb2IdqJtb2IQPji0AjoTd9CHKyao:A3k03kHRirucZjoKCqo
- TLSH T174E53A26F6A84765D077C179C5D2965AEA323C425F308BCB03859B283F377D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe$
- Size 2.7MB
- SHA256 21792628749d75944d58e663cf11e62441b76bd398edb67ef0bab9d652a2ef20
- MD5 b8ada5f8a3959d002a4848cd125297d7
- SHA1 a7cdc5a6013c1fae146fe1e1270fcbd5622dd208
- SHA512 f5c21b474274974d57c17f1630edfe0b61b3c41e0ddf5bcbf0d7a3e968a66d4649be3f9c7a624ae7fe3c10ca739ecb48f917e149f4bc04420522b6e98ea0590e
- SSDEEP 49152:A3k03kHRJP56ruqJtb2IdqJtb2IQPji0AjMI:A3k03kHRirucZjogI
- TLSH T114D53A16F6A48775D077C079C5D2969AEA3238425F308BCB0385DB283F277D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.1MB
- SHA256 d6d12e8388d874d3be0733aba0da641df39d12898e1cdb557e481fe5866b8303
- MD5 1272bcdf7043834fef576af1e297df18
- SHA1 df0c33987c9a2765fc6900f4056b59ef0695be1b
- SHA512 b054563d884f281d2968efd0200650b0267b0a59b4a4e9044d9948a234c3118108325d27bbe643cd7f08ace1595505f31a528d782407c27a5f10d00e00a1ce59
- SSDEEP 49152:A3k03kHRJP56ruqJtb2IdqJtb2IQPji0AjKPji0Aj:A3k03kHRirucZjo0jo
- TLSH T1F7E53A16F6648775D077C0B9C5D2A69AEA3238425F308ACB0385DB6C3F277D5893A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.7MB
- SHA256 99910d9c67687c6749da3bf9c61a95078d40e263f460dfe96548c1754b6f820e
- MD5 ee77297adbbca5ef6e30cf886a6dbd0e
- SHA1 de66bf940ddb821a48825711c4021f25953d0850
- SHA512 b1d894078b1479b7a7bf1e15ed9f9f9e1fe12c6013c9d2a4df9afcb864a8c760281ad0d7328b0f4bf318cdb86e1a0c656f293c6942bb06105e7576be5cbfb826
- SSDEEP 49152:A3k03kHRJP56ruqJtb2IdqJtb2IQPji0AjX:A3k03kHRirucZjoT
- TLSH T191D52816F6648765D07BC079C6D2969AFA3338425F708ACB0385DA3C3F276D1897A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.2MB
- SHA256 37c0d63fa1dae1baabdb968633885861ad0bafcfa23c1d218127cafa50554ab3
- MD5 fc0f2ed3b1264673f8e9412fba292daa
- SHA1 870ab96e9f41e9eed43d80c32efef4c248a520cb
- SHA512 99873a1f92d1766f7ad566763fbb72f73ee01ecef5a2b9d1852eabd94533bd74bbd8d2d5639dc46de9bedde0cbe2522ddf2e4f2ab37d60f8f733079542e6f9f2
- SSDEEP 49152:A3k03kHRJP56ruqJtb2IdqJtb2IQPji0Aj1DZqrKV:A3k03kHRirucZjoP
- TLSH T165E54A16F6A487A1D077C079C5D296AAFA7238421F3087CB0345DB6D3F276D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
- Size 2.7MB
- SHA256 a95673b0562ca534de403b4c07c3dbf41def5a1067fb17794b9e1a7caae99068
- MD5 23917635275e6a849de19132aede1358
- SHA1 0b98d68a97db81c80d04448a601ef12978900d9c
- SHA512 9bc153b04d2b927115443dbf436d482ea7e7f51326db2cd21b8c82a14db69f84b74723c4140cfadcf2ca4a6b46cec8129b4bc81a184dd14c3f20e551d52f11c2
- SSDEEP 49152:A3k03kHRJP56ruqJtb2IdqJtb2IQPji0Ajq:A3k03kHRirucZjo2
- TLSH T1F4D52916F6A48761D077C079C9D2969AEA323C425F308ACB1345EB283F377D5993A732
- MD5 SHA1 SHA512 SSDEEP TLSH