Analysis
- max time kernel
87s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 04:24
Behavioral task
behavioral1
Sample
2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260710-e1c63scz4k
- SHA256 491f9b6c93fbfc0a78f017d15a4a07b78d7d1b94738e13621880a1b340f3ac30
- MD5 be91490d29379d015edf641eb05b6b15
- SHA1 7034c7d0d7da874c588fd6cd336eaf33c6e982b7
- SHA512 c2c2e6095831242fc28a3bf8c3bcfba56b14662af7c4703f0a76b3a467af6e149f675fed6da159626a0f489ad96827a5193a04ccab869d1a95b170904c10e725
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6iqD5TvinrmGZe0p4Ek4niOkl/A0j:A3k03kHRJARJB56rbeW4SkZP4sz9Mb
- TLSH T166953916F6784766D0BBC0B9C5D6AA56FA333C451F3087CB03459B283E277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/1700-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024400-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3628-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1700-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3628-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021311-519.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002440b-641.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021dcb-1141.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001e750-1259.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000020327-1645.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000721-1972.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024400-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021311-519.dat aspack_v212_v242 behavioral1/files/0x000700000002440b-641.dat aspack_v212_v242 behavioral1/files/0x0003000000021dcb-1141.dat aspack_v212_v242 behavioral1/files/0x000400000001e750-1259.dat aspack_v212_v242 behavioral1/files/0x000b000000020327-1645.dat aspack_v212_v242 behavioral1/files/0x0004000000000721-1972.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3628 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1700 2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3628 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_be91490d29379d015edf641eb05b6b15_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1700
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 491f9b6c93fbfc0a78f017d15a4a07b78d7d1b94738e13621880a1b340f3ac30
- MD5 be91490d29379d015edf641eb05b6b15
- SHA1 7034c7d0d7da874c588fd6cd336eaf33c6e982b7
- SHA512 c2c2e6095831242fc28a3bf8c3bcfba56b14662af7c4703f0a76b3a467af6e149f675fed6da159626a0f489ad96827a5193a04ccab869d1a95b170904c10e725
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6iqD5TvinrmGZe0p4Ek4niOkl/A0j:A3k03kHRJARJB56rbeW4SkZP4sz9Mb
- TLSH T166953916F6784766D0BBC0B9C5D6AA56FA333C451F3087CB03459B283E277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.4MB
- SHA256 23d3ccd4363bc2655d63fd9f64dc5c4641e09ef63c52bec6e06ce8551ecde497
- MD5 08e08bcbdbe7d59f7e096d3f06963fcf
- SHA1 00b6ceee99f6173e09f4d76e95881e9374d18210
- SHA512 900348a2e386034df6bf51da5a9811230c91c000d79ee94a91b8f72f7e3892cc5f491357f09918389666137db3d4500bfcb8c9070361ac7ec619f0e7448d3d7f
- SSDEEP 49152:A3k03kHRJARJB56rbeW4SkZP4sz9Mb9UidGl:A3k03kHR+Rsr7fkZc1dGl
- TLSH T14DC54A16F2B847A6D07BC079C5969A56FA333C460F3087CB03459B293F277D59A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 ac85e68b07847076ec143f06f469b2483078ee90c65c3787f6f0efc40cdd52b6
- MD5 8a5cb35036c1609283d506d77f3c91d0
- SHA1 7886bf1957c533baf6666f143a2312dd593d975b
- SHA512 face961a714b138634ae589f7e8837ac4173a4bf48180bf23a517fc47a6d78fb1fa4ce68b097f3b6303833cc3ddf5a66eba9d4ed4284905b4ac2d4539e6dd6ba
- SSDEEP 49152:A3k03kHRJARJB56rbeW4SkZP4sz9MbBPji0Aj:A3k03kHR+Rsr7fkZcRjo
- TLSH T168C53A16F6784762D077C0B9C5D2AA5AFA3238451F308BCB0345DB283F277D59A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$
- Size 1.9MB
- SHA256 85290a18c0e9fca3ef595761fa23938801bc4f0f63eec529726c662b661b460b
- MD5 0aef09b262fcba55a0ae4f3280e47442
- SHA1 1e46dcfe6289b5f526b0c7ad357e124babdcc158
- SHA512 59224da862c4f68353fb2bb03429c0be0f31ea888cbddadbcaba581a65a4f06fb12abbfd3fc0ac3fdcd2ad5924326a32dcbb03fa15cef020502900fe5be4d975
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6iqD5TvinrmGZe0p4Ek4niOkl/A0N:A3k03kHRJARJB56rbeW4SkZP4sz9Mbc
- TLSH T11C953916F6784766D0BBC079C5D6AA56FA333C461F3087CB03459B283E277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe$
- Size 1.9MB
- SHA256 e963bad28f3ff660848c3b77d5f18f9dfbd6931c108bfdf441e89f439c67d73e
- MD5 fd11498ed1e2ca6ebbbc820486da9193
- SHA1 4d91b8d44cac9ec7eea85cbff77506bf02251091
- SHA512 2ecebf01c28a62390cc34ab5d23aaa2338e98bc731808bf3b17f71746a129f9bb3a8e4c120e70a4036feb9df01a01bd9d898557418e4c64f28c57656f487ed1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6iqD5TvinrmGZe0p4Ek4niOkl/A0M:A3k03kHRJARJB56rbeW4SkZP4sz9MbN
- TLSH T1C0953916F6784766D0BBC079C5D6AA56FA333C461F3087CB03459B283E277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe
- Size 2.3MB
- SHA256 6f82628a763e2e190c742762f15c4a2792731f40f0cffd1abf5490f1b27c304d
- MD5 e631c31a156a37e83f7a850a7749e9bb
- SHA1 b2b9aa432c0fa366681a9525b6b0aafc08e398ad
- SHA512 ade8926207a9130739fe03911a060f932a19e732afaeba7331abca1fe0cb6aab4f4919674dd884dbdffdffdd9072f73cdd652edda3fe4ce6e2fd8e3c8aff3e32
- SSDEEP 49152:A3k03kHRJARJB56rbeW4SkZP4sz9Mb41lkWu0ya:A3k03kHR+Rsr7fkZc41lkNa
- TLSH T11AB53916B2B84766E0B7C174C9E6AA56FA333C521F3087CF03449B1D2E23AD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.0MB
- SHA256 911e1578cf52335295366031e4235c937921e83123803bf72e98262f241c33f9
- MD5 cb49f4ac82ed4a96d02106cd8609bdc5
- SHA1 5581e7e0dd46be54bcb7f0746d47fd005e3149d0
- SHA512 f8d033cf28fa3f0bb71ae2c1dc845a3183dd53cc4adad5ed27a70ffda453a41c95516c32c1e60cb48b4b8d4278088542f0e6cd0b266ba56e2cb5d79f968d4e1e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEagt6iqD5TvinrmGZe0p4Ek4niOkl/A02:A3k03kHRJARJB56rbeW4SkZP4sz9Mbj
- TLSH T15BA52A16F6B84762D0ABC079C9D66A55FA323C450F308BDB0345BB283E377D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.4MB
- SHA256 c162850fc8c6f9faa9554cb983a98085abd0c398440621c5185d07eba7ec1982
- MD5 bbef9004527c633d4eb3ea8719b1a16b
- SHA1 df96fae0d32289a8986a9f0e6ccda3b6827ff821
- SHA512 8cd625ca4e0dbd3f31f0a6ce15c06711cac154342342e568c4cbbba311ac4d20f68563b61f86618961c3740966d08f7f22abb6a8b83dfbcd8de21e20ea1d7ebf
- SSDEEP 49152:A3k03kHRJARJB56rbeW4SkZP4sz9MbgXpiMh:A3k03kHR+Rsr7fkZcMpig
- TLSH T198B53916B6B88766E0B7C175C9E6A656FA333C415F3087CF13449B2C2E336D09A39726
- MD5 SHA1 SHA512 SSDEEP TLSH