Analysis
- max time kernel
82s - max time network
111s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
29/06/2026, 17:53
Behavioral task
behavioral1
Sample
2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.1MB
- Sample260629-wgf73aa191
- SHA256 233c2761d2ad8d30a55d62f2f3359c177b420d046d91092269cd68cdf2943f69
- MD5 1970dd1b1725197770d9b0d949bbeb23
- SHA1 430f56eedc02a67df34a9346ada6e1db4b72eede
- SHA512 049847464313f20c102c0db283220b29428d402d239519eff0da5f4d29c043c6f11f8565331f5a35e6809af5bea620e7baa8de589599804fc396d96084761183
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYq:A3k03kHR+Rt6YfkZcBrtTp6
- TLSH T145E53A16F6788766D077C0B9C5D2AA5AFA3238450F308BCB0345DB282F277D59A39736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/3900-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024672-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3900-57-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3856-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000218ef-848.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d00000002162e-1026.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000225f6-1240.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000020341-1538.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002312d-1769.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000e000000016919-1916.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024672-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-11.dat aspack_v212_v242 behavioral1/files/0x00020000000218ef-848.dat aspack_v212_v242 behavioral1/files/0x000d00000002162e-1026.dat aspack_v212_v242 behavioral1/files/0x00030000000225f6-1240.dat aspack_v212_v242 behavioral1/files/0x0010000000020341-1538.dat aspack_v212_v242 behavioral1/files/0x000300000002312d-1769.dat aspack_v212_v242 behavioral1/files/0x000e000000016919-1916.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3856 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3900 2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3856 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_1970dd1b1725197770d9b0d949bbeb23_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3900
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.1MB
- SHA256 233c2761d2ad8d30a55d62f2f3359c177b420d046d91092269cd68cdf2943f69
- MD5 1970dd1b1725197770d9b0d949bbeb23
- SHA1 430f56eedc02a67df34a9346ada6e1db4b72eede
- SHA512 049847464313f20c102c0db283220b29428d402d239519eff0da5f4d29c043c6f11f8565331f5a35e6809af5bea620e7baa8de589599804fc396d96084761183
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYq:A3k03kHR+Rt6YfkZcBrtTp6
- TLSH T145E53A16F6788766D077C0B9C5D2AA5AFA3238450F308BCB0345DB282F277D59A39736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.5MB
- SHA256 4108762bdeef008352124076aa293068657c3ce3dd8edef2bc2d43ec66655ac0
- MD5 2e781a8d456a5b1ee1f650d68db53605
- SHA1 330081c3ba21bec80e0e68ce2375042f5309859b
- SHA512 282c2ee6edd257de498dc6a00a75abaa5aa21f6180764385e34b56598532ebfca63388b0c38323c676570d9352e84b3a951b5ef683ab4c218f4e100780d41b3a
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYqHTd9CHKyao:A3k03kHR+Rt6YfkZcBrtTp6YCqo
- TLSH T11E063916F6B847A6D077C079C5D2AA5AFA7238450F308BCB0345DB292F277D19A39732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe
- Size 3.2MB
- SHA256 870316f61b996f178b1e357449473521e3dbbf2f389bb2f316911770f237818f
- MD5 85df0a092d3c843d11d41f1da504277a
- SHA1 2eb437796f87f6a0216e82f0edb6db937fc061bb
- SHA512 552a8cd8cf6b4f199d1671860cb7036085ed41b519319e559e87f1ca0075ab029517729af05b5581ce641ad031b73ea2310bfd962bab74608fdc07b66e10aa49
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYqdw:A3k03kHR+Rt6YfkZcBrtTp6L
- TLSH T1A1F53A16F6788766D077C0B9C5D2AA5AFA3238450F308BCB0345DB282F277D59A39736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E3C293D9-92A2-430F-A573-2511CDB7A4F8}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 3.2MB
- SHA256 71cbf2f1f70ab7ab8d8c67caf1c2fbe0fed7dafc5e16b64f4d875df641f13ca0
- MD5 1e48ab8f974d3d64efa0990e7ef535e0
- SHA1 103458fad2e4f9d14ca05c5b858f9a008033a12d
- SHA512 79c0e778529a60cfc9f026470a0a5214834dc9b7d2d72c8281893ccbc694cfb8a7a09b3ceb8a17d62f24ca7338d0d6c2c98bc29b8c9b769fc7960a5ed2b6ea5e
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYqtBPVAU:A3k03kHR+Rt6YfkZcBrtTp6UBPVl
- TLSH T12DE53A16F6788766D077C0B9C5D2AA5AFA3238451F308BCB0345DB282F277D19A39736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 f8dcf6ed4de0f616cfd7c41fc628d57bd23f50d57b849e0790fb2a7cd043bba0
- MD5 058edd20128e2a05e763d463f0b74912
- SHA1 1b74d449fe77422ad1e409bdd4256e4204cac56a
- SHA512 0a8c507d00c20e4aefac28a660712a3a0e0d75c82010ae6dd8af71f656eb02006a8d19bd8787e13f4d95edb1def95b33cb36c7f470c9cea77f56a9ef0c8dfdf9
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYqjPji0Aj:A3k03kHR+Rt6YfkZcBrtTp6Gjo
- TLSH T125062916F6788772D077C0B9C5D2A69AFA3238451B308BCB0345D7682F277D59A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE
- Size 3.6MB
- SHA256 40e38329d5188e037ecda4b5a9623fb8449fc0d11c58b3afba9fc72900827677
- MD5 c2ec920092785adf6261caeebd47471e
- SHA1 0389b7d47d867d575e829c5800caca01ba2ffd80
- SHA512 f2510a9e21acfc24b918c8acd84f68354a5aa5cf5750780927aabdbac40a530e6d0b97d18b384c0c4946f4b0dc2ce15a6090a3c08a9221f17597ca99643ca717
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYqe44gBm:A3k03kHR+Rt6YfkZcBrtTp6j
- TLSH T163062916F6B847A2E0B7D179C5E2A666FA3238411F3087CF0245D72D2F27AD19E35722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.1MB
- SHA256 b552dbdd61de25fa306889a5ddadc1c295918785d03a9b7a0d455a58b2fec144
- MD5 a9d8686b55fd0982c339f4fe0a8c3791
- SHA1 86ad054b9c247c20b2aaae3b95aa0888e5cee965
- SHA512 a187360bcb05403f41f802d3f308886c22af45fe06c0393acfbf1f3cb4e7263276e8dc6bffadf39112d148b257c7b87bf4e28dce2ffe2680da5062136ccdb8bb
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYqk:A3k03kHR+Rt6YfkZcBrtTp6t
- TLSH T111E53A16F6788762D077C0B9C5D2AA5AFA3238451F308BCB0345DB282F277D59A39736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe
- Size 3.1MB
- SHA256 1f5e72672052c889cda1e781e3690e3b8feedde71de155ac647b84dab87ee883
- MD5 61886fa7b5ec4a3267c3486138211be8
- SHA1 9a9c65017037427c99e32185e03218b06d599609
- SHA512 41f4c6aa52002dfe5d710eda4e6b4c74c8d064aecb224ca8a2e5cd53802f355ba9351c554f42a892ec8f9e61d817a317a32c2ef4e6613a18d9c5f4b9a96b6da4
- SSDEEP 49152:A3k03kHRJARJjpYqLeW4SkZP4sz9MbE56rtTeapYqt:A3k03kHR+Rt6YfkZcBrtTp6Y
- TLSH T1B4E51916F6788766D077C079C5D2AA5AFA323C450F308BCB0345EB282F376D59A39726
- MD5 SHA1 SHA512 SSDEEP TLSH