Analysis
- max time kernel
103s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/06/2026, 04:24
Behavioral task
behavioral1
Sample
2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260601-e1mqhsct2x
- SHA256 915a243f9b4ef38b68ed827702de1f855526a81f3f3afecd5073cf1c76010f37
- MD5 8c54b2fd12214fe7f3f594a8103eebd4
- SHA1 8611da30e11571ac85932da4a2cbd0584b9f95fe
- SHA512 5ccc311940d7b8c30b992686c1e5c3b84babd705e95b62a380f58677d3d83eb6d42da7c4afa0332f286465ba9b4e6b57a2223c35acabd57dcc7096da063abfe4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJs:A3k03kHRJP56r+3k03kHRJP56r
- TLSH T1CA955A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/5428-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024583-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5428-57-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3388-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023660-134.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-455.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-452.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0017000000021902-1258.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001200000001db39-2062.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024583-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-11.dat aspack_v212_v242 behavioral1/files/0x0002000000023660-134.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-455.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-452.dat aspack_v212_v242 behavioral1/files/0x0017000000021902-1258.dat aspack_v212_v242 behavioral1/files/0x001200000001db39-2062.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3388 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5428 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3388 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5428
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3388
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 915a243f9b4ef38b68ed827702de1f855526a81f3f3afecd5073cf1c76010f37
- MD5 8c54b2fd12214fe7f3f594a8103eebd4
- SHA1 8611da30e11571ac85932da4a2cbd0584b9f95fe
- SHA512 5ccc311940d7b8c30b992686c1e5c3b84babd705e95b62a380f58677d3d83eb6d42da7c4afa0332f286465ba9b4e6b57a2223c35acabd57dcc7096da063abfe4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJs:A3k03kHRJP56r+3k03kHRJP56r
- TLSH T1CA955A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 d77415c8f79a150cf721eaca7faa413132c9154fd536c58b3147de279a2ca828
- MD5 25ba31f24d380e95cb5f205d2f84d3c0
- SHA1 f3403f51a8535f2f70dd6871247570c25e5b3e6f
- SHA512 02481d02edda240bb3e0f5bf6854b55f7e059bfba4a83cbc890aff666f598beea9a6744fd91f63e8e6bb85fec87c784217b3e37f727626772213bf13fc7ec6e7
- SSDEEP 49152:A3k03kHRJP56r+3k03kHRJP56rbPji0Aj:A3k03kHRir+3k03kHRirjjo
- TLSH T16DC55A17E6A40BA4D02FC178C5969666EA733C411F3097CB1354AE293F77BD09A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 2.0MB
- SHA256 50cd25f8fa53ee768eaa8811a80642b51d3c00eeffc88c9c3066d592f38e1780
- MD5 38cac22d59cf7eda438ee1173f17e173
- SHA1 eb67ee813e4e88c82d78253cc7b23c11b0e63231
- SHA512 2dfc650284ff0f55e61da29dbd584ca0bb26e05a9b0782b948611e714f1470bf64a1094ed7ee672f76d33d41af91f81adbf6a23325b57ae195304388cd5c06d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJl:A3k03kHRJP56r+3k03kHRJP56rs
- TLSH T1CDA53806E6980BA4D11F8174C7964662F6737C114FA097CB13D4EE3D3F72AD0AABA253
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 1.9MB
- SHA256 25e47028139dd3546fdd9d1492534fbf5026a7d12e98e89c03630a5d3b7ed7f4
- MD5 f1be70bf569e8fe057e2cbef756a6ffe
- SHA1 a56e8e8dc1c8734862bfea4ed245ea0328cfc3d0
- SHA512 44670dba1089af697c707b1cf543c5256894efb6418d8486b50534e6b185089d193d8fa1e8e63ab48eb5fd873ae08a31f275c7c2c016f7ccad37955e78ee426f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJA:A3k03kHRJP56r+3k03kHRJP56rB
- TLSH T152956A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$
- Size 2.1MB
- SHA256 b35fed3b470d0c187a2dc7d26905fd14507d9cdbedd445761d4069390c2b0985
- MD5 15f695ae5cda88cab22c3fe604233187
- SHA1 542fd8e674c49f68b33070f1da6769dc2ba47bd0
- SHA512 49ccdcb5260bfca70fce7a0723eacfc78289ce62753afe6a6f0727c87b93ad81dacfe308512eaca93085717cbe51d9ede7e2f532c14a0182c365e13f0a012031
- SSDEEP 49152:A3k03kHRJP56r+3k03kHRJP56rxC17IwZ:A3k03kHRir+3k03kHRir67IwZ
- TLSH T1F9A56B17A6980FA4D15F81789A968662E7737C110F2097CF1354AE253F32BD0AF3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.0MB
- SHA256 26c7ea052b421446ce09dc23e2bc1f56651499696e50ceae538b47aab902a2e1
- MD5 9c64a9a1f618e3302d3c4662b65ef299
- SHA1 7b3f154bd8cbced145c04dd8f5dd22bbdeb24fbe
- SHA512 ee42aad9753263e38d2fff19468f810d3520143f64ed3c6f88d2c8d89d396a5dce0bd37367c6bcbef16ab6252c19af9512d67906b4b420ef3e9e949117244ba1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJ4:A3k03kHRJP56r+3k03kHRJP56rV
- TLSH T14EA56A03E6980FE8D15F81349A968A62E6777C510F2097DF1354BE253F32BD0AA3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.1MB
- SHA256 4fb0407543a12aac460361fb05c2e215ba12488f14257bdd191dcec7201e0aed
- MD5 105f5cccd2b5064b942fc81b3cd603f8
- SHA1 33c5c4c47f986bb8c5179363bdb5441bf33cf232
- SHA512 01f1bb252a7d640fdd7f8cd9506683581d74948506641efd042bb04a07669e258b36f7738f2e7b805abbc753b70a27e543c9e6aac8dda64684a19b6337e7e48f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJd:A3k03kHRJP56r+3k03kHRJP56r3i2WH3
- TLSH T1AAA57C13A6980FB9D11F81749AA58666E7777C110F2093CF1354AE1A3F72BD0AE3A353
- MD5 SHA1 SHA512 SSDEEP TLSH