Analysis
- max time kernel
83s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 17:14
Behavioral task
behavioral1
Sample
2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260522-vr856abt9j
- SHA256 1609745e84ba7aebeb4c01ff022fd49109171c2da589e3004f673c5a64687472
- MD5 85d4cdbf9992dbd107d55ac909e3d9ff
- SHA1 11d22d1cd75203d14c9312fcac61c00619cb1f85
- SHA512 37ce9dd1ca2fe6984f7257b44d07976950cd3d2e6ed5eba9dd12c346c0dfdaa7527034de0d07be57a57b3d888558d0e52087c1ea5d4ff26b2bb769440b1d22f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCDK:A3k03kHRJaqJtb2I756rX
- TLSH T1D0854A16E6A44B65D06BC074C9D29656EA333C425F308BDB1345BF293F337D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/3152-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024443-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3944-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3152-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3944-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024446-147.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002154d-754.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216ba-1272.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00160000000202e1-1546.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000230cb-1892.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e8f0-1964.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024443-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x0007000000024446-147.dat aspack_v212_v242 behavioral1/files/0x000800000002154d-754.dat aspack_v212_v242 behavioral1/files/0x00030000000216ba-1272.dat aspack_v212_v242 behavioral1/files/0x00160000000202e1-1546.dat aspack_v212_v242 behavioral1/files/0x00020000000230cb-1892.dat aspack_v212_v242 behavioral1/files/0x000500000001e8f0-1964.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3944 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3152 2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3944 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_85d4cdbf9992dbd107d55ac909e3d9ff_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3152
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 1609745e84ba7aebeb4c01ff022fd49109171c2da589e3004f673c5a64687472
- MD5 85d4cdbf9992dbd107d55ac909e3d9ff
- SHA1 11d22d1cd75203d14c9312fcac61c00619cb1f85
- SHA512 37ce9dd1ca2fe6984f7257b44d07976950cd3d2e6ed5eba9dd12c346c0dfdaa7527034de0d07be57a57b3d888558d0e52087c1ea5d4ff26b2bb769440b1d22f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCDK:A3k03kHRJaqJtb2I756rX
- TLSH T1D0854A16E6A44B65D06BC074C9D29656EA333C425F308BDB1345BF293F337D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 2.1MB
- SHA256 9420e5a20a0aac05459a7b6f06ee09e349934db6baf0681a0afa72277fcdbbd3
- MD5 43bbb627d93e1ce128a912ebe0932f73
- SHA1 45e66a09bcbd41f3b0653a17dd68c1db22f6a803
- SHA512 5a46cbae64116d21923a5571f37d91d4105fcc684019d8e8daa61ae08c8ead6363b16bb984515a19344eb1e583657e54408a4430d4f338ebfdddee49110f319e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCDr:A3k03kHRJaqJtb2I756rXTd9CHKyao
- TLSH T1D0A54A12E6A44BA5E07BC174C9929656EA733C411F308BDF1354BB293F337D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{74A5E9DB-42A6-4629-9DA9-DE27556EBF1E}\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1.8MB
- SHA256 698eb8ae92e0b746a580d302a93b4ae17335d8f37e01a977ca0ebc9a0863674c
- MD5 e594fff08c65c75c431854d39c332745
- SHA1 f81b526a1127c69c9a58ec25f118652488e22c4d
- SHA512 6da4a49500a0d6bc9b65b515c6c4bddd755ee45255f709b6fb5a34cc85c2bd700a7c17328d68d841e2fe9b66adb571d92b2f677f3842046cb77f57c5825f8a97
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCDk:A3k03kHRJaqJtb2I756r9BPVAU
- TLSH T122854B16F6A44B65D06BC074C9D29656EA333C425F308BDB1345BB293F337D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe$
- Size 1.8MB
- SHA256 d01336d07115557ad3d3a6e61fb8d0644952c0efa74889c263cca424082b73f5
- MD5 6e71edfee6281aeb583103c842c9d85b
- SHA1 caf5ff212dae366eba9d88dadaaaf862d530c302
- SHA512 fd09038b842dc3eb7a24ba6a1e9e89594b54a4cc050dfddce0e5096199385caaf4aaddefc2eff554feee3bbb2eb21ab2694f02be88f9f03e2798df93b09ecc1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCDJ:A3k03kHRJaqJtb2I756rJI
- TLSH T147954A16E6A44BA5D06BC174C9D29656EA333C415F308BDF1344BB293F337D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 bbe30b0c0f3893950ede1efbd1d2d0520df1e9df5eab35e57e41ef6d5eea460c
- MD5 7febb15fca2d619726df799cb136d074
- SHA1 51ca93be437296bdb1e7d6fcc812898728d8ba9e
- SHA512 ae9744ad0b558fb22efc76228f0000e983c436f5917523400c2f1e2d1b194872c8ca283f0948c1ff0157cce3df107fd886077a2f4cddf2720546b69f343a34ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCDu:A3k03kHRJaqJtb2I756rTPji0Aj
- TLSH T183B54A16F6A44B65D06BC075C9D2965AEA323C421F308BCB1345FB283F377D59A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.8MB
- SHA256 020719b7caf114c4db57a8fe10f18967a497714a918cde2288d383495f495202
- MD5 d5713edaa34bc4c16be16fc33f5985d5
- SHA1 eed6e2d5206df671b588fef91d35b1c27a11ee6a
- SHA512 70148486187f9df45852eff2081922273320c8089f45ca23bf0efb011d0e6fb6853527bb48522203797dad37887371631f3f8dd17dcb7d18e995e240308e05fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCDn:A3k03kHRJaqJtb2I756rU
- TLSH T120950816E6A44B65D06F8074CB925656FA333C415FA087DB13C4FA3D2F326D09ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 2.2MB
- SHA256 1714e8541c1d64c54a605c17aba4eb7a7bc619f7b57ebdeca5c29f5663b8b950
- MD5 9634db4e46bcf75a8a46150a59e98545
- SHA1 427216d21d87b626a62d8a2a9ac439a66948f3dd
- SHA512 1b43e5d7ccf5e6046deb4570389c817abde1e79521fba9ce1ea82ee50c9ce5d249f4b565aeaacaa167667932129562b622d2626ef3ef351e9249b9b458f7365a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCD4:A3k03kHRJaqJtb2I756rjUOlk09
- TLSH T15EB54B16E6A44BA5D16BC174C9D28656EA723C410F3097CB5358FB293F337D09E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe
- Size 1.8MB
- SHA256 cb60991e7e8f9c97a5dd853415888e6c9e8f4848f56f575c88bf21ab88cc12fb
- MD5 0331a22949f8651722c15ef49890582b
- SHA1 8e361654b031c4f4ca5ca57bf97e158aff3a3cde
- SHA512 34095e14f1b59c2ca03620f3b502d86439adf73676a328f3c72f23e365040014e052393ba8d86a202f81d40f92a8c3d052aa9b15fbe5936f40d19a09a125f146
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JIraERa8eYTqMi8CtBd2QHCHmTBW5DCDa:A3k03kHRJaqJtb2I756r9
- TLSH T178853A12E6A44B65D16BC074C9D69656EA333C811F208BDF1354BF293F337D1AA3A722
- MD5 SHA1 SHA512 SSDEEP TLSH