Analysis
- max time kernel
119s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/07/2026, 03:41
Behavioral task
behavioral1
Sample
2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
General
- Target 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.6MB
- Sample260705-d88saacy2j
- SHA256 164f4b9d1d354e05db4caa5e02577af4ece6f487ca5a292aeaebf09ef7857f2e
- MD5 81a0733e3ad1ebae1d11e159e2756d20
- SHA1 4a2d16fd33f55a8441dc46c58d5bba8acdd5509c
- SHA512 54fdbd1aa32168180b5ab101a1dd00114f228c1a87e88bac990990402a70be2120a5b84de711196ad697cc8081e5c305aefc62a50fb2a712f50fa114df706639
- SSDEEP 49152:A3k03kHRJARJ256rbeW4SkZP4sz9MbkqJtb2Ig:A3k03kHR+Rtr7fkZckr
- TLSH T156C53B16F6B84762D0B7C079C5D6AA56FA323C414F308BCB0345AB283E377D59A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/1716-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024571-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5100-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6a3-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1716-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5100-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000225eb-1250.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001300000001ee98-1379.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000072b-1539.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b00000001e4b0-1714.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001000000001b362-2026.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024571-5.dat aspack_v212_v242 behavioral1/files/0x000300000001e6a3-12.dat aspack_v212_v242 behavioral1/files/0x00050000000225eb-1250.dat aspack_v212_v242 behavioral1/files/0x001300000001ee98-1379.dat aspack_v212_v242 behavioral1/files/0x000300000000072b-1539.dat aspack_v212_v242 behavioral1/files/0x000b00000001e4b0-1714.dat aspack_v212_v242 behavioral1/files/0x001000000001b362-2026.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5100 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\identity_helper.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1716 2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5100 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_81a0733e3ad1ebae1d11e159e2756d20_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1716
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.6MB
- SHA256 164f4b9d1d354e05db4caa5e02577af4ece6f487ca5a292aeaebf09ef7857f2e
- MD5 81a0733e3ad1ebae1d11e159e2756d20
- SHA1 4a2d16fd33f55a8441dc46c58d5bba8acdd5509c
- SHA512 54fdbd1aa32168180b5ab101a1dd00114f228c1a87e88bac990990402a70be2120a5b84de711196ad697cc8081e5c305aefc62a50fb2a712f50fa114df706639
- SSDEEP 49152:A3k03kHRJARJ256rbeW4SkZP4sz9MbkqJtb2Ig:A3k03kHR+Rtr7fkZckr
- TLSH T156C53B16F6B84762D0B7C079C5D6AA56FA323C414F308BCB0345AB283E377D59A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.9MB
- SHA256 a9b754314a325b69209c2909a212414d790655b766aacd9c365819af9348bb62
- MD5 429d0ab15fe28c775162f14a3976966c
- SHA1 d9e8cd1ddc780bb2f11b4dab036157c46759bfe5
- SHA512 04ef9e64db01e0e448f8655b55204c351eca7071749c71f79d346aa59e530b7c8296c59fc4e434fe945837b896ea3bc21b8f9972d42f5c53d44de634fbef7553
- SSDEEP 49152:A3k03kHRJARJ256rbeW4SkZP4sz9MbkqJtb2I4UN+Eir:A3k03kHR+Rtr7fkZckTE
- TLSH T1F0D53A16F6B88BA2D077D079C9D69659FA323C410F308BCB1345A72D2E377D5993A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 3.0MB
- SHA256 33c2032586cbc7ec756d7a7769afe98682d5073190a3b0cf61853fea3880e85b
- MD5 3490bd6d4b61e13574fd8e63f37ab446
- SHA1 98f1f6cf0b148dbe5f4210098167843aa1dbe1ba
- SHA512 dbad983dcd7781f26dc55aaa46730f9aba68209f137428c887d56143ee0d804d391f9a72fdf0a2a64b0939e7bbfdffca1f6331b57e1a5d7e2409e476fe7d6ddd
- SSDEEP 49152:A3k03kHRJARJ256rbeW4SkZP4sz9MbkqJtb2IGTd9CHKyao:A3k03kHR+Rtr7fkZckPCqo
- TLSH T19AE53A16F2B84762D0B7C079C9D69A56FA323C451F308BCF0345AB292E377D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 3.1MB
- SHA256 3ae6fbad00be78373540bf748937f655843b880521d64f645d2f6656101fca80
- MD5 6a1c11dd86b496dd0dfd8feec6ba65d1
- SHA1 ed6b404910f84ed52ef2a6650ce85ed6fa559cd5
- SHA512 a1b6379c882e6477a267251279688e568687b3b88532e2f4b297bb22fea8c105b3cd1fed25d1ad6a5345162919e43da8d59ff9f10bc01cefbd76bb54e0515df8
- SSDEEP 49152:A3k03kHRJARJ256rbeW4SkZP4sz9MbkqJtb2I3T9t2:A3k03kHR+Rtr7fkZckE2
- TLSH T1F4E54B16F6B84766D077C079C9D29A56FA323C410F308BCB0345AB292F377D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.1MB
- SHA256 a3f34efcb5d8a953880b3c07cdd939df593402d69cbcb4ca9220b4214ae3a113
- MD5 606cfb3ba8d8c788d06d5969d5fb91cf
- SHA1 a4257e84e7ea6f78268daf7d8c78b6e17ccf39b1
- SHA512 39426762d6a3af851abe33acffc95d52e52b1cf88280a914dd10c5d66b02c224f42de0609cbe7465f236da65099bd14fdf8824a268be1facddafb4739c65aafc
- SSDEEP 49152:A3k03kHRJARJ256rbeW4SkZP4sz9MbkqJtb2I4Pji0Aj:A3k03kHR+Rtr7fkZckfjo
- TLSH T1BEE51A16F6788762D077C079C5D6AA5AFA323C415F308ACB0345EB282E377D59A36732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.6MB
- SHA256 2ae7f83a56434e22550ea6d159d49c4e664880c8385a0d076abb94a3cd8a5f9e
- MD5 f88f854861a14428a04c6f732792821f
- SHA1 c6ad5b52dead138c231b63a0751729eaddffd813
- SHA512 d80bf0f3527570d9650e355b90851bc9d8ca8dbf7efc1771751d17118eff61b5b25a11136e95212093d1fbc4259378ad2c33d5c92fcfcfe1015b37b905d3581a
- SSDEEP 49152:A3k03kHRJARJ256rbeW4SkZP4sz9MbkqJtb2I4:A3k03kHR+Rtr7fkZckJ
- TLSH T13DD53B16F5B84762D0B7C079C9D6AA56FA323C410F308BDB0345BB282E377D59A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
- Size 3.2MB
- SHA256 1b78241f88288a6466f0da55c8add45da3413262b7422ad39fd018a22a1ad31a
- MD5 ae2f7bee668996bc18d0d1456a4e20ed
- SHA1 1e4cecd652d35311b2880403d482576c8c2f6d86
- SHA512 68fc989b3a0e968daaf95d148ef5763709a39ab2fcb8c9b1d1f98030f0ecc8c3fe40442dd5caa81bc17ec15e9cd131ec35f462bde27907f0374d65339b3e0ba1
- SSDEEP 49152:A3k03kHRJARJ256rbeW4SkZP4sz9MbkqJtb2IFRjvQo0nGH1:A3k03kHR+Rtr7fkZckWRjYFGH1
- TLSH T1BDF54B26F5B84762D0B7C075C9D6A655FA323C451F308ADB0385EB2C3E376D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH