Analysis
- max time kernel
119s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/05/2026, 20:51
Behavioral task
behavioral1
Sample
2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260524-zm8faaax21
- SHA256 296e71fe53e6c13d0a9ba9a70383128f9711a341502b7bef34ce7e261f901f04
- MD5 049d8824c480a71212a6b4e88d2bb02d
- SHA1 a5805d0ff4d4780dae882169fa179ef063964fb4
- SHA512 94c22cb3765c3c5c1816080880a62be2f3860d4b7a6485cdfccb0fa8be13b783f7e4daacd65977466960bdcf42617d8b25d78b0a9d690d814706dbb49008016a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4TjqbaBV0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
- TLSH T100758C17F6A402B5D027C1B9C5D6966AEE7138821B3086CF1359C7283F63BD1AB3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/4840-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000002a7ef-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1604-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a322-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4840-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1604-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028dca-1277.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027aa3-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000000f65f-1485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b739-1588.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b742-1692.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000700000002a7ef-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a322-12.dat aspack_v212_v242 behavioral2/files/0x0002000000028dca-1277.dat aspack_v212_v242 behavioral2/files/0x0008000000027aa3-1372.dat aspack_v212_v242 behavioral2/files/0x001900000000f65f-1485.dat aspack_v212_v242 behavioral2/files/0x001900000002b739-1588.dat aspack_v212_v242 behavioral2/files/0x001a00000002b742-1692.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1604 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaws.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaws.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4840 2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1604 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_049d8824c480a71212a6b4e88d2bb02d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4840
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1604
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 296e71fe53e6c13d0a9ba9a70383128f9711a341502b7bef34ce7e261f901f04
- MD5 049d8824c480a71212a6b4e88d2bb02d
- SHA1 a5805d0ff4d4780dae882169fa179ef063964fb4
- SHA512 94c22cb3765c3c5c1816080880a62be2f3860d4b7a6485cdfccb0fa8be13b783f7e4daacd65977466960bdcf42617d8b25d78b0a9d690d814706dbb49008016a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4TjqbaBV0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
- TLSH T100758C17F6A402B5D027C1B9C5D6966AEE7138821B3086CF1359C7283F63BD1AB3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.2MB
- SHA256 717ae06b58b5ef198f19c2883a518128154fe9cfe6f3fb04307cb4d2d0d5a60b
- MD5 ae1fbfecf522c1278c52414118e1a558
- SHA1 9d83157f9af71b56c9ce7411d5ce55d66d71acf6
- SHA512 9b565d8cd98f2c498469a3966610c32367dbacbeea4b9c5463ca5e2e9e1657d7b08453de6771c24b4ed04d1fd1811e834b7060aea53d334737187efac215cfe6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4TjqbaBV0Le5ji0hmxNrMqVkGDvQGw:A3k03kHRJZPji0AjPVk0QGTvntQb
- TLSH T1AEB58D17E6A802E5E07AC179C6D79657FA713846173096CF03A5C6292F63BE19F3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 1.6MB
- SHA256 ce4e6b7136fa423284430735c57d5cdc1cc601745cf3782a2b90dfc647b12b44
- MD5 f357f72452ce0170f8853f8032abd130
- SHA1 d20977dddafcc231188f2ed34c95a53123d0ba5a
- SHA512 ad5e844ad59dcf9fb37c116cb81ff1bb57254d4956eceaf4812d0dcff5c374923a5a4da4170346166ab1b274a6ca5dbb8ef2c74c01a806b2bf8d0f6ab887f8af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4TjqbaBV0Le5ji0hmxNrMzhk:A3k03kHRJZPji0AjOW
- TLSH T19E758C17F6A402B5D067C1B9C9D29A5AEB7138861B3086CF1358C7282F63BD19F3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
- Size 1.6MB
- SHA256 1b6a09fa034503a9a1fa59c1f80cf262f2376c4b3a801ef660e8037d5c58f1bb
- MD5 7bd639988326c9624dbe0760f748b47e
- SHA1 c6705bb29b262547b6077d078b9494f7e55cc2ff
- SHA512 cb6c97f348c54a756178064e6dd8ef198207d5bf05a2c2c0da6d9e707772153b517fbf67e7f8fe4dbde470ecf456235dd8808aaaa10e2af7e2b5e68c69f5f52d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4TjqbaBV0Le5ji0hmxNrMeGen:A3k03kHRJZPji0AjMI
- TLSH T1E5757C17F6A402B5D027C1B8C5D69A5AEB7238821B3096CF1359C7282F63BD19F3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
- Size 1.6MB
- SHA256 fa3cc379ccf8094f7cf616dfb80d6206ea1028fefd6c498cb52cb8b15ce16de5
- MD5 da4de0626f198232ac5cbae6f7a037d1
- SHA1 4d9bcc9f9c705b82636b4c99b4df20bbbdf85c2d
- SHA512 f5d60d96beffe5f0c4eb7737d86a4e7012a15bd14362cada562b59e3e8d2678e242cc9dca9dc75dc9badcbd5f5d94c3afc57b5991f088b7e7751c669c8ce0fe2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4TjqbaBV0Le5ji0hmxNrMdTjE:A3k03kHRJZPji0Ajow
- TLSH T1A2757C17F6A402B5D027C1B8C5D69A5AEB7138821B3096CF1359C7282F63BD1AF3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 ecc94e1d6ce2a809e50575c713f67cee22b567ada2f2f65bfca1603e1604f547
- MD5 9dbbed5c0fb34cbfe034add754855a12
- SHA1 d7d1c0bbeb4f84e1b714f6404f7e650c56ed8a2b
- SHA512 9fff5e6080c1657903ac7189c9f4bc4c23db9370927a5d9f6bcb285a6e1dcb152203094c7930318e3a5ea898eda256f20341c8b54d8b3159e6300730ef19b083
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4TjqbaBV0Le5ji0hmxNrMD0Le5ji0v:A3k03kHRJZPji0AjKPji0Aj
- TLSH T1B5A57C16F6B44375D033C0B9C5D2A69AEE7134821B3086CB1399C7283F67BE59A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 1.6MB
- SHA256 8389fa68b95e2a76f5638a7e307122f61494795f5295924ec0fcc1d15568e9e6
- MD5 8aed204082a0b1fdd81950896ee1cb35
- SHA1 8735f812b711c6fa2ce3e0387afa161ee53f39f2
- SHA512 e4856713cf6bfbb70ca368694edff214e23ca3cf9a05b9367795768195960f32264d02c5f82f63de70ca67b7d4671a004b8a9aca4fcaeeb2bf6345a3a9543aa2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4TjqbaBV0Le5ji0hmxNrMPF:A3k03kHRJZPji0Ajq
- TLSH T1DD756B17F6A402B5D066C074C9D6965AEA713D821B308ADF1358F7282F73BD1AB3A770
- MD5 SHA1 SHA512 SSDEEP TLSH