Analysis
- max time kernel
108s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/05/2026, 16:55
Behavioral task
behavioral1
Sample
2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260524-vfb2aae18x
- SHA256 0cf6fa2ba7d18fa52b426c6fa6303f81f05f6bd4a68ee6f7d21dd635c7713989
- MD5 15c402ad55f23677e77c29a8ff496848
- SHA1 370f283355816572462091ba43c265dc00002d04
- SHA512 c4263c1fcf61d92ca0e3d25e8ab5d5c497c485f0f107a905296d65649259c2ee303b690644cd35c480d77ab0c440bc6051c563beab0c6ed7c332b462497901f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/B2baByTfZe0p4Ek4niOkl/A04szE87JN:A3k03kHRJARJaeW4SkZP4sz9Mb
- TLSH T18A855C16F6784367D0B3C0B9C5D6AA5AFA32344657308ACB0349D32C2F277D59A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/4376-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000002b301-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3564-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a33d-13.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4376-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3564-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029d56-1214.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001000000000eeac-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000027a55-1433.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0010000000027a51-1495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025ee4-2066.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x002000000002b301-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a33d-13.dat aspack_v212_v242 behavioral2/files/0x0002000000029d56-1214.dat aspack_v212_v242 behavioral2/files/0x001000000000eeac-1376.dat aspack_v212_v242 behavioral2/files/0x0009000000027a55-1433.dat aspack_v212_v242 behavioral2/files/0x0010000000027a51-1495.dat aspack_v212_v242 behavioral2/files/0x0003000000025ee4-2066.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3564 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe$ 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{5525D1F8-E5EC-4986-B0C1-A2834D87F434}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$$ 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4376 2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3564 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_15c402ad55f23677e77c29a8ff496848_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4376
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3564
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 0cf6fa2ba7d18fa52b426c6fa6303f81f05f6bd4a68ee6f7d21dd635c7713989
- MD5 15c402ad55f23677e77c29a8ff496848
- SHA1 370f283355816572462091ba43c265dc00002d04
- SHA512 c4263c1fcf61d92ca0e3d25e8ab5d5c497c485f0f107a905296d65649259c2ee303b690644cd35c480d77ab0c440bc6051c563beab0c6ed7c332b462497901f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/B2baByTfZe0p4Ek4niOkl/A04szE87JN:A3k03kHRJARJaeW4SkZP4sz9Mb
- TLSH T18A855C16F6784367D0B3C0B9C5D6AA5AFA32344657308ACB0349D32C2F277D59A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.5MB
- SHA256 b5a2766a718162b24f0b7742811c3089409d631f42d42d282bb4d5fc97a20997
- MD5 a3815c26dc731f10b3164acfc7a0b05a
- SHA1 2e0ead3cd912bd368eac8ec71333d09e352b5e82
- SHA512 2a6ae9c819c42bd530e5a01aa4e1b02d552022ada6921f91b6682646eb44250adece7054df58b4a87b64a8f8a3bb35ffd5d9122c521f0c3a5ae5b28cf23c7291
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbMVk0QGTvntQb:A3k03kHR+R0fkZctHaib
- TLSH T14EC56C16F6BC43A6D0B6C179C5D7AA56FA71384617308ACB0355C3292F27BE19E3E324
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$
- Size 1.8MB
- SHA256 a4ea22677765f1a59a511288860a6151cd4e7d051281706d5a710b0aff27e55a
- MD5 3a5172c8ea002bcdec92889757064661
- SHA1 46e53332c0feae41b869d44db3e954f70cc6474c
- SHA512 7090329da7fc3acfb6ce90498e9f736d490c507c82e9abb0f075fefc91b4636f8eb22f590a2567e3f2ad7a330dcd75a739ade5d381cf6dbbf4c03b5143022b37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/B2baByTfZe0p4Ek4niOkl/A04szE87JW:A3k03kHRJARJaeW4SkZP4sz9MbI0
- TLSH T1BB955C16F6784377D0B3C0B9C5D6AA5AFA32344657308ACB0349D3282F277D59A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$
- Size 2.2MB
- SHA256 1adfdf128a2986d35c7319b9e6bef3d34c7fc91cc3f0799011467f58600b0a00
- MD5 d6b742a4e1de24eb03c80f528faee829
- SHA1 a16abd43dd0d0d1f0a2bace2c8654d23a7e8c0e7
- SHA512 d2dd464d0aae4ebf213839c8a35762282bf16ab73ce65e7edca901b6b843f1b6de5cfd78334a02be3abc921d067681c7e461390cf81538523988aedc7b3c3227
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbkTAGOme2:A3k03kHR+R0fkZckTAG9
- TLSH T1B6B55C16F6B88376E0B3C079C5E7AB5AFA3134451B3086CB1349972C2F277D19A39729
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 e8029361cacd732399d7e4b062893cfa7fe3b88ce9c9e24e81932bf559388838
- MD5 0abacb7247a692470d324dd7aec28509
- SHA1 c36c7d1f420a26528936b710bf7c5df561d773db
- SHA512 011429a2ada376248112959f8424193c8d99fb3298cda93ae5ed35d5a638ebda904c964de0d357a4584ee4d93c20cd42bcafdea234e7fc4482be32bc0d224766
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbBPji0Aj:A3k03kHR+R0fkZcRjo
- TLSH T158B54B16F6788376D0B3C0B9C5D6AA9AFA32344617308ACB0345D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
- Size 2.2MB
- SHA256 e1972e01d1b3b6c2e3e951a808a15144f808ebe969b30c50060970a58b92660a
- MD5 c93415c49feaa16e38d8fd5a9541157c
- SHA1 92ff4812a6bb3bdd989716e24c070ea69bbf23a0
- SHA512 8bc2d1d655c589d300eb070717b5491ba7b96391950346b14906d81dab3feb91d882d0a95241ce643360ec2dbbb5ea5bb7cdd43b638136dd529119f50144aa7e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/B2baByTfZe0p4Ek4niOkl/A04szE87Jk:A3k03kHRJARJaeW4SkZP4sz9MbDi6
- TLSH T193B52A43B7698E72F06AC074C4D29679FA323D0907E246C7124EBB191F367C95AF9329
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 2.0MB
- SHA256 a9de9dda157c0b7e5c258424d52dd09913848eac1cb40ac64c94e1dcd3a0474d
- MD5 14769b069ca43d66a282dbb85c7c7149
- SHA1 0b6ff9cd7606543b08629bf7589b43324f27308b
- SHA512 3e52247ec7163b0ffbe1c67eb6b40fa700a1fac9ba76ac5506d7488fbe9df184321244d07b6708e836ff3b9533ede26fbdb5aece3be526245a96b9193c73300c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFf/B2baByTfZe0p4Ek4niOkl/A04szE87JV:A3k03kHRJARJaeW4SkZP4sz9Mbxi2WH3
- TLSH T1B1A55B26F6B84377D0B3C079C5D6AA6AFA323446573086CB0349D32D2F277D19A3A725
- MD5 SHA1 SHA512 SSDEEP TLSH