Analysis
- max time kernel
81s - max time network
116s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/07/2026, 04:32
Behavioral task
behavioral1
Sample
2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260701-e5ynkset5n
- SHA256 8f8fed9f133ce2ad67e9ccdb6091fb744e5fcfd60bc91ce265a380af82914362
- MD5 69f4c8ee6d86a3288cb16fedb8a62859
- SHA1 a7dac2323ff0f8440a65e487f6acf343da15c9cb
- SHA512 49abfedf0cc403c03a48aededcee5326d23f3911a8de552850ab4d6f1a509cbc2e55b9107f0f7dd05cacee948e801edf6cbb2589742a94c7ca20078328c4ff63
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2Rm8Qu+YTqMi8CtBd2QHCHmTBW5:A3k03kHRJpdqJtb2I
- TLSH T161758D27F6A442B5D067C175C5D2AA6AFE3138425B30C6CF2349C7282F63BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4236-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024485-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2508-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4236-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2508-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002029f-219.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002029b-227.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216ed-1144.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021679-1252.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000745-1577.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024485-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x000300000002029f-219.dat aspack_v212_v242 behavioral1/files/0x000400000002029b-227.dat aspack_v212_v242 behavioral1/files/0x00020000000216ed-1144.dat aspack_v212_v242 behavioral1/files/0x0002000000021679-1252.dat aspack_v212_v242 behavioral1/files/0x0003000000000745-1577.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2508 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4236 2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2508 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_69f4c8ee6d86a3288cb16fedb8a62859_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4236
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2508
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 8f8fed9f133ce2ad67e9ccdb6091fb744e5fcfd60bc91ce265a380af82914362
- MD5 69f4c8ee6d86a3288cb16fedb8a62859
- SHA1 a7dac2323ff0f8440a65e487f6acf343da15c9cb
- SHA512 49abfedf0cc403c03a48aededcee5326d23f3911a8de552850ab4d6f1a509cbc2e55b9107f0f7dd05cacee948e801edf6cbb2589742a94c7ca20078328c4ff63
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2Rm8Qu+YTqMi8CtBd2QHCHmTBW5:A3k03kHRJpdqJtb2I
- TLSH T161758D27F6A442B5D067C175C5D2AA6AFE3138425B30C6CF2349C7282F63BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
- Size 1.7MB
- SHA256 8db2828a2a65bed30a90e3ae28f0c2005795688d7e8034ef27c057b326d16da6
- MD5 933b1d38ac4669088f16e55c04aab62c
- SHA1 0769fc7291f9b122b79515dbff5b1ae90556ca98
- SHA512 c509ad2457f451ca57565a71422d9f4034239cc994384bb410fcaab599e7d05bd4d051b3d2e7f1ce2c31102d6476c69758e84057539ec14cc47872dbd8d0e31d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2Rm8Qu+YTqMi8CtBd2QHCHmTBW5JTjE:A3k03kHRJpdqJtb2Imw
- TLSH T16B857C26F6A442B5E067C175C5D29A5AFE3238425B30C6CF1389C7292F23BD19E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 977af63fd70fefcd082d69a0ea6f0208de58c340dc1555e84f51e77a72db22fd
- MD5 0d5801835d390f206e4985a53c594825
- SHA1 056526e5aa1beb99784374019ee208af99f5572a
- SHA512 10e9aefe4421a5c425c94c1e256b756c3fb3dbdbf8d1c3b5bfe9296dfd237d579033f9945c95192ed841f8cd8772fe5316cafc416422bbcdb384b89153de57b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2Rm8Qu+YTqMi8CtBd2QHCHmTBW5X0Lu:A3k03kHRJpdqJtb2IQPji0Aj
- TLSH T15BA56C26F6A44375D073C0B9C5D2A69AFE7134425B308ACB1389C72C2F67BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.6MB
- SHA256 2f18963585e62ffc2a27976a5fc7e8982bdf2821f24b6a9c64c38e106ebac0c1
- MD5 b3796ca0ee72c1ba4d9b1ae55b41c310
- SHA1 48f621e2582eff991613d8c2fb57af778a09b4a3
- SHA512 33e947f848cc08babba2fe0c96641a9533e0de7f8ff45c28a5c412f06a05f5fc0e182adf39d488357e40a893be7e7f2f695d319298f9894840103360c943522c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2Rm8Qu+YTqMi8CtBd2QHCHmTBW5qf:A3k03kHRJpdqJtb2I7
- TLSH T136758D23F6A446B5D067C175C5D2AA6AFE3138425B30C6CF2349C7282F63BD19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 1.9MB
- SHA256 0054a13457786d4234efd85f817929f267cb99071e910b6deba69bfcaad454c8
- MD5 0b01140f9fcffc3936b818a0d07adbef
- SHA1 81f916f3c7d870534374c33c217631f4c66b2bb7
- SHA512 172b2a020b5e46095d429b24e8a4871a4d1a8d2ad549269cee2955a12c94e6fc50c46c6b9f5d057fbabbe27d5e5b93a4a834a2fb91a75147b0903fca75a64719
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2Rm8Qu+YTqMi8CtBd2QHCHmTBW5FZMg:A3k03kHRJpdqJtb2I6ZM9zfu
- TLSH T1D6959D22F6A446B5E077C179C9D29A5AFA7138421B30C6CF1389D3292F337D19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe
- Size 2.0MB
- SHA256 928ec236a7780db12cad6f3ebc69aabeca712e1e7b64c25996dfaae20993925b
- MD5 72d902474d226f9e6d51387b6afeeee2
- SHA1 d264f5aa9c234f15d02d76d3ff824a32e9dd34f7
- SHA512 1dde45ab69353b4fe9895807dfe979c008cc465e984c9913827bef8905c0c99c867effea3b150f888a54cf7f83d8a8ef69220d5ecfd70d5133e41906a3e637fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2Rm8Qu+YTqMi8CtBd2QHCHmTBW5S1oU:A3k03kHRJpdqJtb2I71lkWu0ya
- TLSH T1E5A55A12F7E44675F0B3C274D9F2A65AEA3678525B30C2CF1348861D1F22BD19A3A772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
- Size 1.7MB
- SHA256 6b2139aecf31b03f09ca8d0498a73b96f8806bd871c39daf290799c777dd9321
- MD5 90f5fa337fe84f469f0719fd70b3498e
- SHA1 73872642940a2d1e3216c48d7a1a3aa898aa87ae
- SHA512 f90aeddaeea0b31badb8e1d275dd798f9a10236d9bcc05ebad5f4cec470357b0ec7af37cdbfdcbf87f0579060e48d495fcd4afa6e6ee367601e34c7d698e9219
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR2Rm8Qu+YTqMi8CtBd2QHCHmTBW5DF:A3k03kHRJpdqJtb2Ig
- TLSH T130857C12F6A442B5D067C075C9D69A56FA313C821B308ADF2349F7292F337D1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH