Analysis
- max time kernel
110s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 15:00
Behavioral task
behavioral1
Sample
2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.1MB
- Sample260604-sdl3cshy5p
- SHA256 aef04a7864885e867e4b5bbdd7b927bc3bd92642d7209930ac850447df565f00
- MD5 19c0e8619cae960bd633db1c3d01a7f1
- SHA1 88765222732af993b00716e587d54491f3e5eea8
- SHA512 d71aefc47f454828f227797aab3cec529ecad671c4c29a249879d393d029b9da7053a74fcb8516cfa411489493954c23bd6de39a8852affc578b1dd4ce6daaca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXRmq0J6D5TvinrmVD5TvinrmGZe0p4Es:A3k03kHRJ156ru56rbeW4SkZP4sz9Mb
- TLSH T1B2A53916B6B84B62D06FC079C5D66A56FA333C465F2087CB0344AF283F276D19A39367
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2276-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b3eb-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1268-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a33d-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2276-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1268-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0027000000028e06-1246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000000eeac-1481.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8e9-1630.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0019000000000476-1891.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b3eb-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a33d-12.dat aspack_v212_v242 behavioral2/files/0x0027000000028e06-1246.dat aspack_v212_v242 behavioral2/files/0x002000000000eeac-1481.dat aspack_v212_v242 behavioral2/files/0x000200000002a8e9-1630.dat aspack_v212_v242 behavioral2/files/0x0019000000000476-1891.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1268 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\TerminalAzBridge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173546\javaws.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2276 2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1268 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_19c0e8619cae960bd633db1c3d01a7f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2276
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1268
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 aef04a7864885e867e4b5bbdd7b927bc3bd92642d7209930ac850447df565f00
- MD5 19c0e8619cae960bd633db1c3d01a7f1
- SHA1 88765222732af993b00716e587d54491f3e5eea8
- SHA512 d71aefc47f454828f227797aab3cec529ecad671c4c29a249879d393d029b9da7053a74fcb8516cfa411489493954c23bd6de39a8852affc578b1dd4ce6daaca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXRmq0J6D5TvinrmVD5TvinrmGZe0p4Es:A3k03kHRJ156ru56rbeW4SkZP4sz9Mb
- TLSH T1B2A53916B6B84B62D06FC079C5D66A56FA333C465F2087CB0344AF283F276D19A39367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.2MB
- SHA256 5ffbb005ee04dc1486cf3e2c9898fe1f6c03f6a03efe92884c81990c2154adc1
- MD5 b2149c5ad54fa66dbfbd202f2607e5e2
- SHA1 59f41954d0e84b506f9865a5e727fc29e74d5003
- SHA512 f38faf86ea1d06d3935fe7784559bc4db91e416c793f58aecd4de6316c7403853902fd318662bc4a4a60a339e11be83972e14babfa4b6212d5a3da5e468c73b5
- SSDEEP 49152:A3k03kHRJ156ru56rbeW4SkZP4sz9Mb5W:A3k03kHRUrbr7fkZc5W
- TLSH T1B5B53916B6B84B66D06BC079C5D66A56FA333C465F2087CB0344AF283F277D19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 2.6MB
- SHA256 d69468e4b8b7a9d531040c8a90e487c4085d9e9cc9e347bbe154c4b276b6a65b
- MD5 b9fb3d5698ddea4551ad06078ac1f8c6
- SHA1 dbf59bd280a57f467e5688e152f1d5a445ee80a5
- SHA512 c244a17c543825206e2b030ee29a19f8d38c4fbf15fb85cf5a782a65c300dc9062980ebc29f3c81d43e38d4d825f105c130da47629b572f0e76d8dfa63b25ee4
- SSDEEP 49152:A3k03kHRJ156ru56rbeW4SkZP4sz9Mb9UidGl:A3k03kHRUrbr7fkZc1dGl
- TLSH T1F9D54A16F6A84BA6D06FC074C5965A56FA733C465F2087CB0344AF283F277D19A3A327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 2.3MB
- SHA256 f4984f95c4b01f9ac2cbef380b58c008483f5836c2ae182b5523c4356b854e38
- MD5 9318b1ee06ee252e287d837c8e36a3ac
- SHA1 6b858197cae8eb09c7baf2681c4e0b8d0a6ce98a
- SHA512 a5b206cf8d306570fe16474463ee39d681809408314e997535aa9dd5d29c8af69de73af64b29756edcd06dd751f5e74cead477d8ff16eeec779cb58a13236f16
- SSDEEP 49152:A3k03kHRJ156ru56rbeW4SkZP4sz9Mbjw:A3k03kHRUrbr7fkZcs
- TLSH T1EAB53916B6B84B66D06BC079C5D66A56FA333C465F2087CB0344AF283F277D19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 d8445e542a34f4367438b6da02bcdc1f97b10b67eb81e4989349218a4d0f5ec7
- MD5 53a47ad765ebd9bf8b5712591ff415a2
- SHA1 59fe7933092778d4bcf833934676a4143cf5e489
- SHA512 08392165b63267a68d950cc9c214dd98962cd229d7073472ee497c0fabf7f297d8b86f8a7ab8a17b2aedb492efbda7fbf6fd080d6997dceb71812049a6b21499
- SSDEEP 49152:A3k03kHRJ156ru56rbeW4SkZP4sz9MbBPji0Aj:A3k03kHRUrbr7fkZcRjo
- TLSH T1E7D52916F6784B62D07BC079C5D2A65AFA333C465F3087CB03459B283F276D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.2MB
- SHA256 2814988e2a29b12f88bd8520e69a5574238ceff84106da032c704fc5e5b0fe59
- MD5 9aec0374a23ef815707e237e28e8cf04
- SHA1 743c25fe192475bd8fa707189d256865f71a7d5c
- SHA512 224fb6823b53690662164e94b6cf2aa60283a89ca4de15efa88bb3c99d8e4302dee3d6ff7635132da82dd805cea2bb62d68950197f763577d219a80f3318f4ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiXRmq0J6D5TvinrmVD5TvinrmGZe0p4Ep:A3k03kHRJ156ru56rbeW4SkZP4sz9Mbj
- TLSH T196B52916F6A84B62D0ABC075C9D65A56FA333C465F2087DB0344BF283E376D19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH