Analysis
- max time kernel
117s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 11:01
Behavioral task
behavioral1
Sample
2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.4MB
- Sample260523-m4py2sa14w
- SHA256 01971c1251f943afcf1a2667bb17c389291f1da7dc76c5487bdd3a5f529f63c4
- MD5 2cf3e5cbefa2ff7284911cd06c9cfc6f
- SHA1 a9ca41fcf56105abf8ab819b09e8eefbde915566
- SHA512 52f5caad32348fc41cdaa2853833f0cf2c408bf67574b90c819326b50520e671e22f7b2e8b50ca435b182af56d3ab21c3846489a6aadc26153e0b3e53bde4d8f
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mb:A3k03kHRWr+FfkZc
- TLSH T119C53A16F6788762D077C0B9C5D2AA5AFA3238415F3087CB0345DB283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2704-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002465c-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2428-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2704-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2428-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000021641-1021.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000225f2-1254.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a000000020242-1393.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000022be2-1543.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e50f-2070.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002465c-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-13.dat aspack_v212_v242 behavioral1/files/0x000b000000021641-1021.dat aspack_v212_v242 behavioral1/files/0x00020000000225f2-1254.dat aspack_v212_v242 behavioral1/files/0x000a000000020242-1393.dat aspack_v212_v242 behavioral1/files/0x0005000000022be2-1543.dat aspack_v212_v242 behavioral1/files/0x000200000001e50f-2070.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2428 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2704 2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2428 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_2cf3e5cbefa2ff7284911cd06c9cfc6f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2704
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.4MB
- SHA256 01971c1251f943afcf1a2667bb17c389291f1da7dc76c5487bdd3a5f529f63c4
- MD5 2cf3e5cbefa2ff7284911cd06c9cfc6f
- SHA1 a9ca41fcf56105abf8ab819b09e8eefbde915566
- SHA512 52f5caad32348fc41cdaa2853833f0cf2c408bf67574b90c819326b50520e671e22f7b2e8b50ca435b182af56d3ab21c3846489a6aadc26153e0b3e53bde4d8f
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mb:A3k03kHRWr+FfkZc
- TLSH T119C53A16F6788762D077C0B9C5D2AA5AFA3238415F3087CB0345DB283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.7MB
- SHA256 b078626ddef87796abc9d8d753e77339e7bb3b94dea50714bd2d946c3a41609a
- MD5 8ec6627347f412a3cf9d57d48e943e94
- SHA1 361171cc8842da9d5257b5b446955dd172dc304e
- SHA512 037bf5f0c05f8d6b30f413adf4e800bdaa38951ddea0f17c23cdaf51cacb8215245ea8f18fbb433f8c56f72120ab76bd2e96402826af2e50dc4c5a916dd36a01
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9MbjUN+Eir:A3k03kHRWr+FfkZcVE
- TLSH T1FAD52916F6788B62D077C079C5D2A69AFA3238414F308BCB1245972D3F277D59A3A336
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.9MB
- SHA256 0830b3585b3eb635836ab71f94b3f878eb57cef7824586ba860bb7fde9bd1438
- MD5 3a6960a82292d6811c809dce9f1004b1
- SHA1 0aebda63cfb6161a2e81f770205e193c3ec130d6
- SHA512 fe9ca771106d2f72e77ee5232e94fe7a9e1c38e393ed1cad85aad553a4a435cc49f94e83b03a73ee2462c2358b7f499b7f709a27ee94752029bf8ca421d565dd
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9MbVTd9CHKyao:A3k03kHRWr+FfkZctCqo
- TLSH T145D54A16F6B84762D077C079C5D2AA56FA323C465F308BCB03459B282F277D19A3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.9MB
- SHA256 b61e7303652b541428815e080db5953686c6fa2da444c36d4db1a11dc0554829
- MD5 dfceaabab693f29ae1824cb94aafc976
- SHA1 36986aa0853eaeabef741d9df068fd6d012cc4ed
- SHA512 7f745a9acaac5865bf7714a0709a541e4505837d8850c20ac2c17eb206701e4303aad23ffc3a3ba1b922f48767a1f8ae90759065711d8931083814e6b25f26e0
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9MbBPji0Aj:A3k03kHRWr+FfkZcRjo
- TLSH T1C7E52A16F6788762D077C0B9C5D2A69AFA3238415F308ACB0345DB283F277D5963A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.4MB
- SHA256 51053eccc1fb8ba6c4feedabb6ff539308159194eaeb274b23f2fdad160180ab
- MD5 c0733a1a6ee2b29e69fa40c6f00efecd
- SHA1 05d8c52e9084b53268f4fe32a2d458a4996a0a73
- SHA512 e76c68fe7da37b82fa5ec6bf24bfc4b125047a43bf85a4d19c40a6f081b5954927c4f375c807c986a03170a249c0aa453c4b7434f1c175bda05a10b2b49efc3f
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mbu:A3k03kHRWr+FfkZcu
- TLSH T1A4C53A16F6788762D077C079C5D2AA5AFA3238425F3087CB0345DB283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
- Size 2.5MB
- SHA256 20749ef6478ef7eac6b9997d023983d376863cb648f0238a1833cda419ef521d
- MD5 1a4c209767b82b6fa52ccfe0d87afcd6
- SHA1 0d2050433e1a01cddc3344f4047df0e884f50a37
- SHA512 6372720f7f9f0048de092355d02c8b84944d0f3e04bf29d279fe6d42dc58f9c6eb50405ad17a468b38e03ba96e27521f3ba3e567eb62627a6091cf5a708706b8
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mbj:A3k03kHRWr+FfkZcj
- TLSH T18BC53A16F5B88762D077C079C5D2AA5AFA323C415F308BCB0345AB283E377D5963A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.6MB
- SHA256 241b8f24194b59dcd539cd2476f06d8c4255b08ff6d01ae6150f61e257ef86cd
- MD5 ead9b1e71c76a2aed0078a3ef1acb33c
- SHA1 c3c20f018ec7b5ef482c3abeb4ddf9a51157b9d5
- SHA512 c44696dc3cecb982292c8cc2ef97d9519e787c3ea4aa4af8a022f686e5a23540b60bd5d6d7a702f6974ae5404af1d9cdbe05485fef954ef4793eea659b54449f
- SSDEEP 49152:A3k03kHRJ756r+qJtb2IEeW4SkZP4sz9Mbxi2WH3:A3k03kHRWr+FfkZcxuX
- TLSH T166D53B26F6B88772D077C079C5D6A65AFA3238425F3087CB03459B2C3E277D19A36726
- MD5 SHA1 SHA512 SSDEEP TLSH