Analysis
- max time kernel
84s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 16:15
Behavioral task
behavioral1
Sample
2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260522-tqa2asht8q
- SHA256 0ae7f2ee1c8c648c43784eb93189ff252f04835c3c667fbdfd873742ead23118
- MD5 4901b1573351d0abaa5f6cae23ca0af3
- SHA1 e4e553eb72b279ff475310d72bf8f3e2c63d23cc
- SHA512 564252d73619bee282f5b0aa874399c7aef2a9407b3ea6c517a9e30605581464428dd7a33915059c03493eb851aaefe51f942f97eb304150c8fa58ddfcb24c31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZG:A3k03kHRJaqJtb2IseW4SkZP4sz9Mb
- TLSH T126B52B16F6B88362D0B3C079C9D6AA5AFA313C455B308ACB0345E72C2E377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4844-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244b5-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4684-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4844-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4684-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002359e-299.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b8-301.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244c2-1181.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000244e3-1689.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001ecc7-1896.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e4f5-2074.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244b5-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x000400000002359e-299.dat aspack_v212_v242 behavioral1/files/0x00030000000202b8-301.dat aspack_v212_v242 behavioral1/files/0x00070000000244c2-1181.dat aspack_v212_v242 behavioral1/files/0x00080000000244e3-1689.dat aspack_v212_v242 behavioral1/files/0x000500000001ecc7-1896.dat aspack_v212_v242 behavioral1/files/0x000200000001e4f5-2074.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4684 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4844 2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4684 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_4901b1573351d0abaa5f6cae23ca0af3_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4844
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 0ae7f2ee1c8c648c43784eb93189ff252f04835c3c667fbdfd873742ead23118
- MD5 4901b1573351d0abaa5f6cae23ca0af3
- SHA1 e4e553eb72b279ff475310d72bf8f3e2c63d23cc
- SHA512 564252d73619bee282f5b0aa874399c7aef2a9407b3ea6c517a9e30605581464428dd7a33915059c03493eb851aaefe51f942f97eb304150c8fa58ddfcb24c31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZG:A3k03kHRJaqJtb2IseW4SkZP4sz9Mb
- TLSH T126B52B16F6B88362D0B3C079C9D6AA5AFA313C455B308ACB0345E72C2E377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$
- Size 2.4MB
- SHA256 f028c81aaf68e6aa53a5cf1aa72451e626131656733e425574472609a0be9ebb
- MD5 4fbd7c53ebdf3fb8d68f97153451d4a2
- SHA1 63edf2e33af262357e30abfa5ea63c301f2995df
- SHA512 151ab5ee16e07696961f521de39ba6fb38e05f24dcfa8a7ed3a834543d21ad51f0202c29cdf24ee14d7259cabd3278a997507f3beeee26286164bbd1deff2637
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZg:A3k03kHRJaqJtb2IseW4SkZP4sz9MbvI
- TLSH T1FEC53B16F6B84362D0B3C079C9D6AA5AFA323C4157308ADB0345E7282F377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 2.8MB
- SHA256 3150348a94dcc7ed6ccc43a3f575b3e29964d6e36ec2a6c5091bdef07c399b53
- MD5 eec3fe344c89ba2e6c22888698da2fb3
- SHA1 5316ebd0cbf85f58ff84130662aa34246387c74a
- SHA512 2c911290844e88a085735ed78244a9dfa7aabaa9b0c9ac599f1db4d5c68b9cf131bab960d161b0aca75facee21f0bab3e55be16a53460e54bd235eeeff049e20
- SSDEEP 49152:A3k03kHRJaqJtb2IseW4SkZP4sz9Mb9UidGl:A3k03kHRY/fkZc1dGl
- TLSH T10FD53B16F6B84362D0B3C075C9D6AA56FA3238461B308ADB0345E72C2F377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 451b71bb4d38ef54b530a31a4f21284d0a13178a46297c4ff3b5eeb870ee4bc3
- MD5 c3347be1fbbe46064adc2cc519db19a2
- SHA1 ae9e2abfbcf099a05561f84ce2986f38fc77f22e
- SHA512 52705ce4744cd2ddc362ee304b68e40d07a8be79a77d15239f44b15367e74059c17c7bea8885c4b972285a67f8a4f99a6bc25bd86338016b9625576ab4c1f59d
- SSDEEP 49152:A3k03kHRJaqJtb2IseW4SkZP4sz9MbBPji0Aj:A3k03kHRY/fkZcRjo
- TLSH T1D1D52A16F6B88362D073C0B9C5D6AA9AFA3138455B308ACB0345E72C2F377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 2.3MB
- SHA256 474cd79039fca344f887c95d0be7057359838c26734634701d5c6efc51ce7119
- MD5 f96372c4e9921f14b0958bafac8e9c27
- SHA1 dc27d7af01777fa84a9a9764a15e6bbdcbad6f82
- SHA512 340410d565a24f83d02d7e2c20ee01dcf4aed3920baf15b247d78e538ea1cb870849f065a2591b330124f0dae002aaaf032846c9dca5da5feb9594cec7ad103f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZY:A3k03kHRJaqJtb2IseW4SkZP4sz9Mb4
- TLSH T16EB53B16F6B88362D0B3C079C9D6AA5AFA313C455B308ACB0345E7282F377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
- Size 2.3MB
- SHA256 69bca82932d20787e6a489d870e1fb26e95e622fe2ab1b05d9a446f98a14d2cc
- MD5 f6ff9618fd8f3a7136856eb791b77753
- SHA1 b4313b130b149ff1c9b1e6b616603ac0cf7c069b
- SHA512 e3d14c3dc2b06dd5bcc8bb3a0e0d9a3f220d84f9ae0dc6c3bfd33f3f705da2727190fc6dbd060566f0477e2e77b1f92df740c80a928e8dc9fd1b2af610b7a5d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZM:A3k03kHRJaqJtb2IseW4SkZP4sz9Mbs
- TLSH T191B53B16F6B88362D0B3C079C9D6AA5AFA313C455B308ACB0349E7282F377D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 2.4MB
- SHA256 1a4b6cd7f72da852334db0dfa6729637f2f9f6149c24799a70bb3fbf211fb66d
- MD5 adcf2fd2d629f3625b3c846537b66997
- SHA1 d6004422c2175ccc7a9b5c2d03a2752319ae3424
- SHA512 412fb8fa761c9189f04c0cfa8b64ee4d36b86b5f8a01dec8d95494155af4675a4b9d25c7278e4899e1cbb43811694cfb8d202e5e3e26982bdb80accfeb2a17da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DHZt:A3k03kHRJaqJtb2IseW4SkZP4sz9Mbq+
- TLSH T1DCB53B16F6B88362D0B3C079C5D6AA5AFA323C465B308ACB0345E72C2E377D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.6MB
- SHA256 bc4c8f65bac0e12d09fa263b409a84dcfe1fad8521c6f8acaeba5d3b37803ea0
- MD5 2fb6ba01bab6b74f54c003d7f5a5790e
- SHA1 2673bcefffdd060687c8ebd562637e326d84edeb
- SHA512 8eadceb3906b4fdc15c7a3f676318d8da0e498e50e3fcfd9142819f0feb0b6489ac96276fb569ed48f7ccb90ab51a76f456b1c749b0f3391c239b249d40db02d
- SSDEEP 49152:A3k03kHRJaqJtb2IseW4SkZP4sz9Mbxi2WH3:A3k03kHRY/fkZcxuX
- TLSH T1B7C52A26F6B84372D0B3C075C9D6AA5AFA313C425B308ACB1345A72C2E377D59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH