Analysis
- max time kernel
113s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 13:21
Behavioral task
behavioral1
Sample
2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260720-ql4k9sdx31
- SHA256 ce075b841125f36e5ce4bc70f3152a671ac416cd18ae65b667ab819184159eb8
- MD5 1bf4b1f5c514061a90e156553edbccaf
- SHA1 ca742042cd1eeab6ee7e606221b2f97833a62f84
- SHA512 564c7208c598b1b97861006cbdd78c7cc53397fdb27f869b079335bcb9916e1e2608a4fd141c12881586b5c3ddc68362073b3639d7ba71055f5ddade20d16030
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBvOD5jcAkSYqyE:A3k03kHRJVpYq
- TLSH T1B0658C17F6A445B5D023C1B9CAD29A66FE713846173097CF2359C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2080-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c51a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2080-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4304-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x003300000001990f-614.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bcc-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b74-688.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bea-686.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac33-1225.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c51a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x003300000001990f-614.dat aspack_v212_v242 behavioral2/files/0x0003000000019bcc-616.dat aspack_v212_v242 behavioral2/files/0x0003000000019b74-688.dat aspack_v212_v242 behavioral2/files/0x0003000000019bea-686.dat aspack_v212_v242 behavioral2/files/0x000700000001ac33-1225.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4304 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2080 2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4304 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1bf4b1f5c514061a90e156553edbccaf_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2080
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4304
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 ce075b841125f36e5ce4bc70f3152a671ac416cd18ae65b667ab819184159eb8
- MD5 1bf4b1f5c514061a90e156553edbccaf
- SHA1 ca742042cd1eeab6ee7e606221b2f97833a62f84
- SHA512 564c7208c598b1b97861006cbdd78c7cc53397fdb27f869b079335bcb9916e1e2608a4fd141c12881586b5c3ddc68362073b3639d7ba71055f5ddade20d16030
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBvOD5jcAkSYqyE:A3k03kHRJVpYq
- TLSH T1B0658C17F6A445B5D023C1B9CAD29A66FE713846173097CF2359C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 c66eb8b85fc4bae058505527cc60b469d69ec8fdc0074dab6c103c90b9f48642
- MD5 b19281043124b881ef82994221301886
- SHA1 a71c8cb4ceb55b93d71bb48611a6334c119060f9
- SHA512 089498b0005c0043ed6e9370e155c7dc09de3167157e03230544bf53b68c9b1431e1e528a6d47cc7e004b402d9c6fc642a8f990175967d95ca17f1c9555157a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBvOD5jcAkSYqyED0Le5ji0hmxNrM:A3k03kHRJVpYqjPji0Aj
- TLSH T1E1957C16F6744275D073C0B9C5D2A69AFE7134861B308ACB1389C7283F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 1.4MB
- SHA256 e313402cb9e1973a2a8b3a1ad052016895ed2c558c818ddd868e089d8ee1d332
- MD5 88d4ee05496257eeb988f630b9bd115d
- SHA1 f8682c9fd2fcd2b72765d9f30f6597801ceb2097
- SHA512 36e3949ea48a48e0f5ba4afc7e6add5fe447acdfc69d414cf0b253d27ccf7e94d7b0c31c3728582cc22c0f8c72ff06d8cfbee259fca2553607c23cd99a1cdeee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBvOD5jcAkSYqyE0M:A3k03kHRJVpYqJ
- TLSH T132658C17F6A445B5D023C1B9CAD29A66EE713846173097CF2359C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$
- Size 1.6MB
- SHA256 a8029607cbab5d04697fd193f8b650c950d67fe83f3bed1c2bd3463ca5e0d540
- MD5 0a1f9e630310be463519a2bcdd6034d3
- SHA1 620c0538e4f661977409024c6cc1da01b0c8ef8a
- SHA512 80a3fdb03f6f921ea5ed5edf2fcb225553071b8b3751c512e2ba6d479dc0026c6f85f29f7cff07e25de6f56756c579b174eef50e8c5d625fc0b072546d88725a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBvOD5jcAkSYqyESZM9zFVSOX:A3k03kHRJVpYqyZM9zf7
- TLSH T187859C17F7A405B5D023C179CAD29A66EA7138461B30C7CF1398D3292F33BD1AA3A765
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
- Size 1.4MB
- SHA256 e3c5ba79ea0487f10383798fd412fd4c0ff9bf6dedbe1276e0ea40a585fd3fc4
- MD5 5a156e18c5ba62c388862c44fd19a5d3
- SHA1 d6c9c9309aeafdf219d8945caf8de1cf5799ac9f
- SHA512 e7395e53b00e95cb89d81c9859376b71a4941f0b66e4c9428bc620d21aed9873fd63a3f6e47cc9e46fa916effc3446dd4db64b0912352037592d77bed39e1cb8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBvOD5jcAkSYqyElT:A3k03kHRJVpYqp
- TLSH T177658C17F6A445B5D023C1B9CAD29A66FE713846173097CF2359C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe$
- Size 1.4MB
- SHA256 e9ed5b6d2ca4aa46226573e78403f5274ffba770c2d2c70af23c702033e0ad74
- MD5 7bcdb2aaf440356b2e77e5712a15c773
- SHA1 c70cad1361c6c79f803f6b03440528bc4ae71688
- SHA512 5aff41e7d2a15bf7c6a19b2421ea0173155b6c20abe75d02f305af48fb272128ebc9171598bad63f9c7013fbc79e284d6085e3ef335a7eee52077c5b886d4c79
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBvOD5jcAkSYqyEt5/:A3k03kHRJVpYqD/
- TLSH T1F5658C17F6A445B5D023C1B9CAD29A66EE713846173097CF2359C3282F63BD1AB3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$
- Size 1.8MB
- SHA256 d51787cba156d67ba265aa863dd735c9bd0fa1ac4b228559c719704539dfef08
- MD5 58e0416c73bb636f5ca2db5d6e843eb8
- SHA1 e12129bae8bc4b31161e1aab430244529c5924c2
- SHA512 f75ac5c9da43e9b82ad15114edcaaf84a77c99b5348c4b152e6f735a2883be829eb30d83e22fd2ad68a4c3e7957324f9b60cbe57309acb6b0346dee1cdbf4508
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBvOD5jcAkSYqyEpi6:A3k03kHRJVpYqJi6
- TLSH T1D6953A83EB558CB5F01DC474C5929239EA323E5907E386CB134EBA192F367C95AF8325
- MD5 SHA1 SHA512 SSDEEP TLSH