Analysis
- max time kernel
83s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/07/2026, 03:38
Behavioral task
behavioral1
Sample
2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260705-d7ah4ahs2x
- SHA256 58c12006afeeaae4c9cf6510e30f649673a2b82c12fb4d1e5c1f23183b7e045c
- MD5 95a324a06f4275506aa8af2b83a7db0a
- SHA1 64c45196b54777643380349f96a183d0466985f8
- SHA512 9b853ba441ed3ff5438b9eb2877bc121cb2c67ef3188f49feaa2988c1aa1a391df3b5ff953fc94af6f4f0f35a8862c8da00ad12fc6c1ca725b14d873637adf1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrM:A3k03kHRJHPji0Aj
- TLSH T11C657C17F6A402B5D027C0B9C6D6965AFA713882173086CF1399C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/4332-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243e3-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2536-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4332-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2536-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002259f-751.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243f4-963.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021ab5-1036.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021673-1279.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00100000000006d5-1542.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e970-1928.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000723-1984.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243e3-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x000200000002259f-751.dat aspack_v212_v242 behavioral1/files/0x00070000000243f4-963.dat aspack_v212_v242 behavioral1/files/0x0002000000021ab5-1036.dat aspack_v212_v242 behavioral1/files/0x0002000000021673-1279.dat aspack_v212_v242 behavioral1/files/0x00100000000006d5-1542.dat aspack_v212_v242 behavioral1/files/0x000200000001e970-1928.dat aspack_v212_v242 behavioral1/files/0x0004000000000723-1984.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2536 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4332 2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2536 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_95a324a06f4275506aa8af2b83a7db0a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4332
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2536
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 58c12006afeeaae4c9cf6510e30f649673a2b82c12fb4d1e5c1f23183b7e045c
- MD5 95a324a06f4275506aa8af2b83a7db0a
- SHA1 64c45196b54777643380349f96a183d0466985f8
- SHA512 9b853ba441ed3ff5438b9eb2877bc121cb2c67ef3188f49feaa2988c1aa1a391df3b5ff953fc94af6f4f0f35a8862c8da00ad12fc6c1ca725b14d873637adf1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrM:A3k03kHRJHPji0Aj
- TLSH T11C657C17F6A402B5D027C0B9C6D6965AFA713882173086CF1399C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.9MB
- SHA256 79bbb3c0349d6d072e7a210b63598cb192375325a4982aef80dd9ff3a49132e1
- MD5 fb5c2d64e7ec01b8e0fd45c0fbce0eb3
- SHA1 7091975b3f480ec6cfc787db346b7a319c19f950
- SHA512 fb5ccf9ec6514ddb2b33ee6b06640546c9dbfcfabde0f2904b0035a466da9924a4415d995dd40bd22632ef9e1a510cd7baac69dbd7f56204b537e29b1f2d2b7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrMX3Td9CHKy7GZO:A3k03kHRJHPji0AjoTd9CHKyao
- TLSH T1E2958E16F7A402B5E077C175C9E29656EA7238461B30CACF1394D6292F33BD19E3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
- Size 1.5MB
- SHA256 6cffb552cf4608d424cef976164d4bdd35d0560df7af8f8ed8b9d633d3d84056
- MD5 3d583361094ec1270dff1a8ebcc75b96
- SHA1 965addd8fcb02586fe01f95a4e31c95e1f421c26
- SHA512 2b6c6441afd6ee2c6e4f02f58b9dd0e65ddadc74918fa13c679a97c8cc7570a0482b0ee36b2f0e8b3182b1489d528dc1485a68ccdb899cab898abde1837bb38a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrMeGen:A3k03kHRJHPji0AjMI
- TLSH T15D756B17F6A402B5D067C1B8C5D29A5AEB723842173096CF1398C7282F67BE19F3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 e3730393a48b7dc6ac68f3242c29e13ee075c6b740f287770506c6e31bb08dbf
- MD5 5330d728e0d6d55d01e1e15b5a23ed07
- SHA1 8e8811e0e376f96f030273661bea9c5403826f8f
- SHA512 75f979c2c633ccb540af6de1a36681f7534dcdd1b47a2d2ab29fec22305939bf29284b6ec6d2a3a0265c9e069702594c5c176e1776c2348bf44e7b257bb5dc7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrMD0Le5ji0hmxNrM:A3k03kHRJHPji0AjKPji0Aj
- TLSH T1DD956B16F6B44375D073C0B9C5D2A69AEE71348217308ACB1395C7283F67BE69A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 1.9MB
- SHA256 0b3216f43907ecb511824efe9c85c4cb95cef155d370734e5e284ba05d51087a
- MD5 25db07697e0987fcdb91bea5b0b62274
- SHA1 0d0cf077083542c13fda54f7bd85e9f2c860bf62
- SHA512 4384c44a099a455312f63942a1542d11bd6984d195d0bba06b2eca94be24201b88cb9e59abf3189fe146e9c5a5aa5fc7f6da0c7a78d79ac261e48f21a2ff9b25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrMzUOlZ7q/c9:A3k03kHRJHPji0AjqUOlk09
- TLSH T1DD956C27FA6846F5D077C1B8C6D29656EA7138420B30D7CB5358C3292F23BD19E3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
- Size 2.2MB
- SHA256 9f5a463f41ea9e43d13824d0d0a6e8d1dabbbe98664fe6120c85e72783184f32
- MD5 3c88cfd3da91c543d25117e4af87031c
- SHA1 28d8d43bf3fd33ac60860fdb7eee1102a6785603
- SHA512 166adde9879b8fce1ead852b48a85989f17d267aa11450898b1f9253b13068c9f910a69e9eec65637c2033e313fc074ce06ee59925b89d606c9aaab21e994c74
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrM2zWj8PSeWygmNWf:A3k03kHRJHPji0AjruygmUSbHDUnT
- TLSH T12CB54A56F7A805E5E077C17489A69676FA7278421B30D6CF0354C22E2F27BD09E3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE
- Size 2.0MB
- SHA256 31d39f7c7f9d21f388e819e2b69daa3b48b297d599d9f50712040765fc97276d
- MD5 d06a54327dd02cff59e89faa903c8599
- SHA1 708c84af4f47d209efb8685154a154b115fb7522
- SHA512 3d23e3b784e10dd77b832ee55d33a17fa074860bb6ef32e0913da63110f5b052069053a0cbb55b3058acf77908785d79d449051984e39c6b428c746d7b5cac83
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrMR3N+tCn50ChWdAk:A3k03kHRJHPji0AjW8tDZqrKV
- TLSH T1B3A56B16FBA442F5D026C178C6E696B6FA7278421B3097CB4354C72D2F277E19E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.5MB
- SHA256 79b83865e640ce0d7fc3c6dde27bf7712f9a913bee6f1cd7cb86f0452217c8e9
- MD5 5a2c70169d0993352e436554647a3ebf
- SHA1 83e9569a68a89c2e966f539f50a389455f2f51f4
- SHA512 bc5794a86d6d1bc7842dc4dd02fe532b052788514bcc301d07f33e632c68915a1a4376853c98971d39b731da339ca851c08e4d49623c56f3d16de5f3d097427e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrMPF:A3k03kHRJHPji0Ajq
- TLSH T148756B17F6A402B5D067C074C9D6965AFA717C821B308ADF1358F7282F73BD1AA3A760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.9MB
- SHA256 216a075ab18b808cfcd0370286661d56f60eb37bd539f6049bbbc4c0de3e7a54
- MD5 a394e8cd402dbfa3cb16103db54f52b7
- SHA1 cc2fefc5ceda79aec8feac23de46df164717818d
- SHA512 c49667641eec8112c44dc2c773db95b7f84711c6277cc8a0616603b51cbdf7ac476115bb4c9a16fa40559412994f3fdb1ada97ce4bcbca756c7e1df965305852
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGELYU7J0Le5ji0hmxNrMu3npi63iC:A3k03kHRJHPji0AjRXpiMh
- TLSH T165955B12F7E84275E0738274CAE69656EA727C525B30C6CF1394861C2F72BD0DA3A772
- MD5 SHA1 SHA512 SSDEEP TLSH