Analysis
- max time kernel
114s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/07/2026, 17:01
Behavioral task
behavioral1
Sample
2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260722-vjpfsawsfw
- SHA256 00bdef40dfd5193fb627b18ac8839e3f06a9ff26a686bed8ebfd67dd8d2195c3
- MD5 cb856b3cc79f0b63d00645af8673dbd1
- SHA1 8365521ab68b259d75cc6a5837fc206aa3facdff
- SHA512 427d348fde27a6737269edf2d605792326cc0a95cf33eeb1abb9c2498b36f8daadbfe0a622ebd3766a4033d9d95dfc236b126e17aa434f4078b8c13ea1487ca5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsccdYTqMi8CtBd2QHCHmTBW5X0Lel:A3k03kB56r0qJtb2IQPji0Aj
- TLSH T10DA54A16F6A44B65D07BC0B9C5D2969AEA323C425F3087CB1345DB283F27BD1963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/3332-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c54d-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3332-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5456-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bea-652.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b1f-653.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019da8-1030.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cca-1283.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b827-1650.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c54d-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019bea-652.dat aspack_v212_v242 behavioral2/files/0x0003000000019b1f-653.dat aspack_v212_v242 behavioral2/files/0x0004000000019da8-1030.dat aspack_v212_v242 behavioral2/files/0x0003000000019cca-1283.dat aspack_v212_v242 behavioral2/files/0x000200000001b827-1650.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5456 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3332 2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5456 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_cb856b3cc79f0b63d00645af8673dbd1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3332
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 00bdef40dfd5193fb627b18ac8839e3f06a9ff26a686bed8ebfd67dd8d2195c3
- MD5 cb856b3cc79f0b63d00645af8673dbd1
- SHA1 8365521ab68b259d75cc6a5837fc206aa3facdff
- SHA512 427d348fde27a6737269edf2d605792326cc0a95cf33eeb1abb9c2498b36f8daadbfe0a622ebd3766a4033d9d95dfc236b126e17aa434f4078b8c13ea1487ca5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsccdYTqMi8CtBd2QHCHmTBW5X0Lel:A3k03kB56r0qJtb2IQPji0Aj
- TLSH T10DA54A16F6A44B65D07BC0B9C5D2969AEA323C425F3087CB1345DB283F27BD1963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$
- Size 2.1MB
- SHA256 306cfc2a54468198e533f578e2f347a1667d970683ec8cfd0e71de9e7ae1c4cf
- MD5 30c66e6e4c7d024f99a4676a97af2929
- SHA1 c450867ecb004a13b977d46a13c33d60e341b734
- SHA512 af8c77b83f1bce43324bb0bfe4dca24d42f624ddb6492a6758485aeefbbb71980d52a1c24b7494e218da5caeadc28d43d88a97a37188f6489c63952a07cb40f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsccdYTqMi8CtBd2QHCHmTBW5X0Le8:A3k03kB56r0qJtb2IQPji0Ajow
- TLSH T1AFA53A16F6A44B65D07BC079C5D2969AEA323C425F308BCB1345DB283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 4244c98ad61edb947358ccc19fc2bdad6e8e047e6a43c5d2ad6559a772f5edc6
- MD5 daaf49f614bd1ba90e8ad16f0c3555d9
- SHA1 615c64e71cb1dc1051e78d136b774e1d9985fe9b
- SHA512 b413ecdbf9c64eb1d84c28fa277abe6255a66fdb30ff6eb5aef4e1e074e53fbf63d7a6ed4caabafbc46b0d9b51a5581fad8d2654400cb088357e641e95fdcadd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsccdYTqMi8CtBd2QHCHmTBW5X0LeN:A3k03kB56r0qJtb2IQPji0AjKPji0Aj
- TLSH T1ACC54A16F6644771D077C0B9C5D2969AEA3238425F308BCB1385DB283F27BD6963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 2.0MB
- SHA256 509677ff5c0f3a31089bda597de60741dd2217044beb6d21ad71cb390ed2c399
- MD5 3cb2b3b6a11f0c93a4e660c0b2f3d4b9
- SHA1 f6dfedc31c6e2263e757c58b98a797c6452294f1
- SHA512 2c938be97f44cb2d76c1b7752a0a46c0ff0a8ee4be05e001bde9869aa5c4ac93e3a8561c3a3078946b7a0e981c846fb15b1235428a4c420ec51cca63e0d36946
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsccdYTqMi8CtBd2QHCHmTBW5X0Lex:A3k03kB56r0qJtb2IQPji0Aj8
- TLSH T1F1A54A16F6A44B65D07BC0B9C5D2969AEA323C425F3087CB1345DB283F27BD1963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe$
- Size 2.1MB
- SHA256 8ec91acd9e930ca849717138c66f3333f839dd9d717cd6a505b9eb25fec0299a
- MD5 f7b1a37a180d7d3f2ef0bc02893c9afe
- SHA1 1c38546d28d6e21c7b1f7c634036c4cc032464b5
- SHA512 9623bd9957f5a0c99e20dcf598f95eaab17ed49fc77b6ec785f3240a6aeb97c9edfdf39382c39af83a80cbcc8a32f1ec67dca7bc23aac0e544e1a91c2fa406ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsccdYTqMi8CtBd2QHCHmTBW5X0LeV:A3k03kB56r0qJtb2IQPji0Ajk
- TLSH T157A54A16F6A44B65D07BC079C5D2969AEA323C425F308BCB1345DB283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.0MB
- SHA256 8adccbecf767c7fc8b0298071c394d10c876ed3c90b6242289b0ebf1a99a45fe
- MD5 f63a9cde40dd50c6d8adfa782a23bd4a
- SHA1 e37a8ae48cafd69206a431fd2c3183f44f072dc7
- SHA512 92b00d701f235ed41968c3e6cb67143b380a1b547fbbee09f5b899cd77058e27f1ee7f3a3e9ad5c9102a495cbf26086beabddb18a67d1a15b7c4c94dc87bbf47
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsccdYTqMi8CtBd2QHCHmTBW5X0LeT:A3k03kB56r0qJtb2IQPji0Ajq
- TLSH T10DA53B16F6A44B61D06BC075C9D2969AEA323C425F308BCB1345FB283F377D5963A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.0MB
- SHA256 ed83dc12d4d75afdb72812a26d0e915ce43a7be931b9cfa50eaa72e3732d66dd
- MD5 3eb0fdec7ed35d0245ac78a0ec30987f
- SHA1 5166d60398fc49fbccbc1c208c211b6eb4ea21dd
- SHA512 18c0112438a6e33295399ed0fefe39be9528cf12fd250b6090868d1e84138d10b5fec529758efba1904d5d280a18240ade0ade8a7d6354db672d6c6e60d2d713
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsccdYTqMi8CtBd2QHCHmTBW5X0Lee:A3k03kB56r0qJtb2IQPji0Aj7
- TLSH T15BA54A16F6A44B65D07BC0B9C5D2969AEA323C425F3087CB1345DB283F277D19A3A732
- MD5 SHA1 SHA512 SSDEEP TLSH