Analysis
- max time kernel
109s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
03/06/2026, 14:17
Behavioral task
behavioral1
Sample
2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.2MB
- Sample260603-rl3jmsgz9y
- SHA256 69b200ec1198876910ed75a81ca34ca23395aac52c5a4b098e3d4a529a09e299
- MD5 cbf76ba4217d03e93eb03947bd508763
- SHA1 6ebd8d52be3ba75acc54a58d810686d8674b9bd1
- SHA512 a329cd7618863d22d84b4ea14ddb227a9ec8113d10da8d976818a9a0c831bcabfd6bc092272d9236a5b915b27b39e00dd4b9503ffc30ca08c7e8cf71c47115f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCncq7jCXF7IwZ:A3k03kHRJARJaC17IwZ
- TLSH T1BF45AD17E79500E9D15AC1789AD68A23EB757C56173093CF1398C2162F63BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2224-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000002a2af-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3008-13-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2224-76-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3008-77-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x006b000000028a74-1250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a85-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000002ab02-1625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002a8e4-1646.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000000476-1873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000673-1976.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000600000002a2af-7.dat aspack_v212_v242 behavioral2/files/0x006b000000028a74-1250.dat aspack_v212_v242 behavioral2/files/0x0008000000027a85-1377.dat aspack_v212_v242 behavioral2/files/0x000500000002ab02-1625.dat aspack_v212_v242 behavioral2/files/0x000400000002a8e4-1646.dat aspack_v212_v242 behavioral2/files/0x0015000000000476-1873.dat aspack_v212_v242 behavioral2/files/0x0004000000000673-1976.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3008 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Time.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ABFE1D03-25DD-40E1-8BAF-A69810AC7F7C}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_164703\javaws.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2224 2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3008 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-03_cbf76ba4217d03e93eb03947bd508763_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2224
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3008
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 1.2MB
- SHA256 69b200ec1198876910ed75a81ca34ca23395aac52c5a4b098e3d4a529a09e299
- MD5 cbf76ba4217d03e93eb03947bd508763
- SHA1 6ebd8d52be3ba75acc54a58d810686d8674b9bd1
- SHA512 a329cd7618863d22d84b4ea14ddb227a9ec8113d10da8d976818a9a0c831bcabfd6bc092272d9236a5b915b27b39e00dd4b9503ffc30ca08c7e8cf71c47115f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCncq7jCXF7IwZ:A3k03kHRJARJaC17IwZ
- TLSH T1BF45AD17E79500E9D15AC1789AD68A23EB757C56173093CF1398C2162F63BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 1.9MB
- SHA256 2a3ae60eaf250c82e966ef221f18654888e88e4cc380f0667b4c20e2be3028f3
- MD5 6854712f98a7b1f2bc9ba801bace60c3
- SHA1 2f34ac7ede4d8362ab63b6a87626674be3b2e414
- SHA512 9e237ee93af4e32c139481e2fa6ac2df8257d76f5c9c932a3e08c887a166d36aa0891a401b800b2862d1c12ad1453d169acf5b5547b1366be7373f757be86cc5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCncq7jCXF7IwYVkGDvQGs94iGWWdTS:A3k03kHRJARJaC17IwYVk0QGTvntQb
- TLSH T1F8958E17A6E801E9E0AAC27886978517FB717C56133597CF03A4C61A1F63BE0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.7MB
- SHA256 bac191b38fb9736c0dd36050a014fbc5e30cc2a0efd7c70c4beb1fe4b8dd741b
- MD5 ace87195f6d6a9f0417794df92728a46
- SHA1 df2bfebcf977251ae3d509faf932d2cb4561cb6b
- SHA512 75051ba8c7555b24c9f4123cc609829ac1b51cbb8d58e4cbca40af821a8d1ebbc524b72704c190efdbf4a8114b6b487f9071cf2325a8a01705120b5b80cc2f5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCncq7jCXF7IwxUr2d29dBrtpDiI:A3k03kHRJARJaC17IwxUidGl
- TLSH T1B6859D13F79800F9D06AC1748A968616EB767C560B70A7CF1394C22A2F23BD46F3E765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.3MB
- SHA256 d98394df54703c9d127b34cae0a026ab050e093a5a07e2d1591f7af1c7db6823
- MD5 3dbc6ced66e6d33e5452c3d5ba1fdc39
- SHA1 0ec88002b0d7a98517aad966dd1d3fb759b373cc
- SHA512 465c81f1c185ca57ee52a45580364184fac2f344c7f419400ee0bd1624730b4b2090878cde09a577fd00001a50c35c0507e0c1e173cacfd08cd4284a5106cd9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCncq7jCXF7IwDbBPzBAU:A3k03kHRJARJaC17Iw3BPVAU
- TLSH T1EB55AE13F79400F5D15AC1789AD68A22EB757C56176097CF2398C2162F23BD0AF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
- Size 1.3MB
- SHA256 661dcc07e57166e60a0f206922be357ef6b58fc7417915a3eb9c36ffa7c5fc72
- MD5 51b8103ba9806952a2dc8d66ba0320a3
- SHA1 bcd5a975ca6202f7caeaeb032483140554bd60d4
- SHA512 b36b261b5f9f7fd3ace956654622e6fc069c8e6d0c326ff43142a5e3486c8d22b54519dc44578b27a6409371634043a28b2ca3c45882bf71152eb04b61da8367
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCncq7jCXF7IwjTjE:A3k03kHRJARJaC17IwPw
- TLSH T11F55AE17E79400F9D15AC1789AD68A22EB757C66173097CF1398C2162F23BD0AF3D7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.2MB
- SHA256 e1b940a1750ff92b1e314e3bc31db0acf03358fe514cd7623133a3cb44736641
- MD5 c9d2252e66e018f554f90a67c2b9ced0
- SHA1 376463ede3b5b245cf55be0de225b06e7c059e15
- SHA512 fe591d11444e9ddb139842d11642020d066b698ee2d940ea3b54f86bb2570b3c7e7385976859986562d8ba458d2f829275fc6f409c9d9ddb4449d8ce7eddf303
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCncq7jCXF7IwFF:A3k03kHRJARJaC17Iw/
- TLSH T1DE559D03E6D500E5D69A8134DD968A22EB757D92072097EF1398B7262F337D07F393A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.6MB
- SHA256 a0f3056a5593ae4893d501ac8f84e514392c198eeb9a4e5489585edf9c217293
- MD5 7b5820718e82ffacd96f3ea68ceeab16
- SHA1 a6c845a156aa54457959a76d4b357f6dc384d336
- SHA512 fee2a23491a682b5d0df89b4c7cf530bb059145d33d702c4976c73959500d173a9464f1969b3cffacb236404e64b52f322e322e1207cd8eef8768039cbac89d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCncq7jCXF7Iw03npi63iC:A3k03kHRJARJaC17Iw0XpiMh
- TLSH T100757D13B7E800B5E1B786349AB58622EB767C615B30D3CF239446191F72BD0AF39762
- MD5 SHA1 SHA512 SSDEEP TLSH