Analysis
- max time kernel
87s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/07/2026, 05:10
Behavioral task
behavioral1
Sample
2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 2.2MB
- Sample260710-ft151aex2v
- SHA256 5e29085d8e085d582d7ab402b87606988eb2e69ec58232fae468bde1980018d7
- MD5 99355afc395a479d3d86f69c4602b89d
- SHA1 fb1e8691df90f14799ea22e032b72b1c6497355b
- SHA512 dac47c513a21bb65b548b0ccc6664c726656349c074f071205341082a796662bdc570061b07fb62c9e50e3759966cfcfdbd818dfce62b74f0206855479ef982c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyS6XAUcD5TvinrmGZe0p4Ek4niOkl/A04szE8b:A3kMPen56rbeW4SkZP4sz9Mb
- TLSH T179B51716E26847A6D06F8075C7965A55FA333C054FE087CB02C4EA3C2F276D19AFA727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/2352-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000242f5-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4664-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6e3-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2352-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4664-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021667-1262.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000070f-1382.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000006fd-1532.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000721-1976.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000242f5-6.dat aspack_v212_v242 behavioral1/files/0x000300000001e6e3-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021667-1262.dat aspack_v212_v242 behavioral1/files/0x000300000000070f-1382.dat aspack_v212_v242 behavioral1/files/0x00080000000006fd-1532.dat aspack_v212_v242 behavioral1/files/0x0004000000000721-1976.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4664 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2352 2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4664 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_99355afc395a479d3d86f69c4602b89d_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2352
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4664
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 5e29085d8e085d582d7ab402b87606988eb2e69ec58232fae468bde1980018d7
- MD5 99355afc395a479d3d86f69c4602b89d
- SHA1 fb1e8691df90f14799ea22e032b72b1c6497355b
- SHA512 dac47c513a21bb65b548b0ccc6664c726656349c074f071205341082a796662bdc570061b07fb62c9e50e3759966cfcfdbd818dfce62b74f0206855479ef982c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyS6XAUcD5TvinrmGZe0p4Ek4niOkl/A04szE8b:A3kMPen56rbeW4SkZP4sz9Mb
- TLSH T179B51716E26847A6D06F8075C7965A55FA333C054FE087CB02C4EA3C2F276D19AFA727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- Size 2.5MB
- SHA256 cf7c3b3df82346f31742f96ce77a63df1a308d9ca00d5649b16c858fd8db40d0
- MD5 a9c5f341b66b4612e9078a6f470f049d
- SHA1 756b2a4f78c756b401bf7d09f86d2a7a8edc0c7c
- SHA512 6f85375e0d09a4a3f629291c9e7d8861d213b74509e9faa30350183628bb98baff7e37fe896719020e8b8ec078bc32f7daa148c9f7309a6d0315a688db8ff04e
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyS6XAUcD5TvinrmGZe0p4Ek4niOkl/A04szE8k:A3kMPen56rbeW4SkZP4sz9MbjUN+Eir
- TLSH T198C50616E6684AA2D06F8079C7925645FA333C110FA08BCB12D4D73D2F376D19EBA727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.7MB
- SHA256 b75e01804f0f2bee72ce5cb49cf2c22db3acfb08dab44320805dd906720ef37b
- MD5 31e30c10a4fabe8d74a62c39bd9bba46
- SHA1 c6dabd39efc9d99f3346c4c989a14984d8a877f7
- SHA512 3be1c72fe7c320fb584e5813763291ade1ac19261ef35aa177cc89bd22f2094ddf4c94d5057aa9a052eeaf6dfc2e2dddd98485f9fa2cad1e65f0055e1f62689e
- SSDEEP 49152:A3kMPen56rbeW4SkZP4sz9MbVTd9CHKyao:A3kMPeor7fkZctCqo
- TLSH T1A1D52916E2A847A6D07F8175C7925655FA333C450FA08BCB02C4EA3D2F336D19AB9727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 90faf168d363d44a21c6b72d37baad8f9a57db6dc861f2313af76314aa7c9e78
- MD5 644767c34f37c8bf059974c03fcd6393
- SHA1 2c4930360f47eb006db55bee781335f28988ac2f
- SHA512 f0afe6dde321a0db670733722c7fdde48cf426c9c76ca065c762aaa6de1f4ca78b8f34554afbe25901755db0214825acb3b18cff7891940bbfc1db7dc5df99a9
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyS6XAUcD5TvinrmGZe0p4Ek4niOkl/A04szE86:A3kMPen56rbeW4SkZP4sz9MbBPji0Aj
- TLSH T14AD50816F6684766D07FC079C7D2565AFA3338414BB086CB02C5DA3C2F276D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.3MB
- SHA256 2a787753b85bb37022a1b82b108a026d5e4737dcf7b1b1ec9ee3419ab5d22b9f
- MD5 9ce7d7a4b47526beae5f5fc31b69ff6e
- SHA1 c7579d64196835d1ded4d86321257ee7e0d63604
- SHA512 ac63e2bf568230d4c957e999c3990b352baf3c035d888119f1a0fa308745750c2c64c56161b6c2968516e53ac85c355c0d6fae74eb3b8ad29cc5c3d9aacfb569
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyS6XAUcD5TvinrmGZe0p4Ek4niOkl/A04szE8u:A3kMPen56rbeW4SkZP4sz9Mbj
- TLSH T101B50716E2A84762D06F8075CB965A55FA333C414FA08ADB02C4FB3D2F336D19AB5727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.7MB
- SHA256 5c92bf321daa5f2ef2f2bba4cebd04927a6f6c4f8be64afeb08ee79fa931344c
- MD5 5c475ee6520752f66f79da1e69401adb
- SHA1 b4e1db144890c81e2d3494c53339659d541b37ed
- SHA512 8f9498c738c5c428813a58d4d5905fe05fc024c3fa15e8d9c9a535a0d33f4ee5cd694ab2cc1ed029eb145219a8e64c2bb28a1370fb04d179db7eeef6ce444803
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyS6XAUcD5TvinrmGZe0p4Ek4niOkl/A04szE8f:A3kMPen56rbeW4SkZP4sz9MbgXpiMh
- TLSH T146D51816E2A84766E0BF8175CBA65655FA333C514FB086CB13C4DA3C2F326D09AB5723
- MD5 SHA1 SHA512 SSDEEP TLSH