Analysis
- max time kernel
83s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 03:42
Behavioral task
behavioral1
Sample
2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.7MB
- Sample260730-d9dcrsbc52
- SHA256 39c3261b8a8f20d598d48144af88307608683fbe210273914730992470509070
- MD5 34dff686aa87f014d92fb9b2c86c42f1
- SHA1 02c11aa2806db43fc872de56164e8a6f3c817c0e
- SHA512 78ec7524a73875361485da70a99a68b05d5163395f7948ad15ffecaf54a00332d434a0b618a9e7f6873b56c214ac7621aa310e555d942e7a0ba4b0cb1dba71c8
- SSDEEP 49152:A3k03kHRJJ56rY56r+qJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rNeW4SkZL:A3k03kHRYr1r+FfkZcNfkZcBrRfkZcq
- TLSH T11036E716F5788B22D0BBC0B9C6D66A99FA3338455F308BCB0285DB2C3E276D58535727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4496-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245f8-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1712-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4496-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1712-17-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235e6-123.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000214e6-744.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021c51-1069.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021653-1271.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000002153b-1713.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245f8-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235e6-123.dat aspack_v212_v242 behavioral1/files/0x00070000000214e6-744.dat aspack_v212_v242 behavioral1/files/0x0004000000021c51-1069.dat aspack_v212_v242 behavioral1/files/0x0003000000021653-1271.dat aspack_v212_v242 behavioral1/files/0x001400000002153b-1713.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1712 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4496 2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1712 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_34dff686aa87f014d92fb9b2c86c42f1_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4496
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.7MB
- SHA256 39c3261b8a8f20d598d48144af88307608683fbe210273914730992470509070
- MD5 34dff686aa87f014d92fb9b2c86c42f1
- SHA1 02c11aa2806db43fc872de56164e8a6f3c817c0e
- SHA512 78ec7524a73875361485da70a99a68b05d5163395f7948ad15ffecaf54a00332d434a0b618a9e7f6873b56c214ac7621aa310e555d942e7a0ba4b0cb1dba71c8
- SSDEEP 49152:A3k03kHRJJ56rY56r+qJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rNeW4SkZL:A3k03kHRYr1r+FfkZcNfkZcBrRfkZcq
- TLSH T11036E716F5788B22D0BBC0B9C6D66A99FA3338455F308BCB0285DB2C3E276D58535727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$
- Size 5.2MB
- SHA256 7e9d0f14ef391300f7981d3b7cfba9d4485ffc23486e1b684e5b08eace1926aa
- MD5 5eed22edc4fc7ebb9d8f1c9bbd4422ac
- SHA1 a7d6878ce36a7e24a6aa138134f3b727d402daf7
- SHA512 1c1609593fca75174bcb6d8cc31b8ed2561fa0cf9b7a6c3c72c5c4d4fca120fb80c536182cab242060a4407653e17ffac93229527b0d1734ad8bdc0960036154
- SSDEEP 49152:A3k03kHRJJ56rY56r+qJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rNeW4SkZH:A3k03kHRYr1r+FfkZcNfkZcBrRfkZcV2
- TLSH T17B460816F5788762D0BBC079C6D26A59FA3338455F308BCB0285DB2C3F276D58A36726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.2MB
- SHA256 8aea387992ed799f6265e3d09056f340b146e7f9269b4caefb5b139f237060b1
- MD5 3673856928cd79afc110440f51011ef2
- SHA1 ebff890940f92cbdab1bbc1f78b4b118fec19d69
- SHA512 c1618a0c3b388b7ce43c24fb277f8c12cee00e6c1b8dd0ffb7d199758671166a18d452554c84bebdc4254ab9600b8ae5cc552be5305654e1557c554db69ccfb4
- SSDEEP 98304:A3k03kHRYr1r+FfkZcNfkZcBrRfkZcQjo:A3k03kHKR+hPpP19Pio
- TLSH T15746F816F5788722D07BC0B9C5D6AA9AFA3338455F308BCB0285DB2C3F276D58536726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$
- Size 4.9MB
- SHA256 b03cddd42efd15a604faaa6827ba9e7b00488c3d1e9f2c802901002e1508c319
- MD5 da7549abdb9005a7a0972f847c4d69b1
- SHA1 f42843eaefbca7026857008d221110170be4adc6
- SHA512 73c052a8d28dd6d5f0247bd583a4372c2489128124dc4ddd4c1f8be57431ece6351fb13faf066dcaea523441b8fc6f397186c0c35a15e7adb0214b7a214dff9f
- SSDEEP 49152:A3k03kHRJJ56rY56r+qJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rNeW4SkZw:A3k03kHRYr1r+FfkZcNfkZcBrRfkZcH
- TLSH T10736E616F1788722D0BBC079C6D26A99FA3338455F608BCB0285EB3C2F276D58975727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 5.2MB
- SHA256 a6e15af31cc803686abbf54ec3cc12b974f42680a39a6be48bf2ec67572979c7
- MD5 ead58803e8a29dbd0ef008aa29d971af
- SHA1 c1cf9f85e20fa59489f97d76c20dc34027f9cb28
- SHA512 703d023e3e9e5d75a42f28ce6498e351ed72c1704458023deefff87abadcc2c08dd0c8b414fdf9228dccbb22b7bf157a5ecf4ed59116653b75fe54fb45f9561a
- SSDEEP 49152:A3k03kHRJJ56rY56r+qJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rNeW4SkZv:A3k03kHRYr1r+FfkZcNfkZcBrRfkZc89
- TLSH T17C460816F5788B62D0BBC079C6D6AA59FA333C454F308BCB0285DB2C2F276D58935726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$
- Size 4.7MB
- SHA256 a8c9f2e5846e5e72ee91bdbd25d759f1a0e2e09712805928cab0dafde85e856e
- MD5 0d4558b8c35c533e54a7a61d718bf91a
- SHA1 9e543ab1f49d16cc0d766ab413198795b5e82f88
- SHA512 360f6ea7d2151bb08de20234be9a6421622dc45580ef82cf79ce7e3e02592517e59445a9875ec85b11011277f5d499d83a5fd874b178fb8199152e7f19497ddd
- SSDEEP 49152:A3k03kHRJJ56rY56r+qJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rNeW4SkZR:A3k03kHRYr1r+FfkZcNfkZcBrRfkZcy
- TLSH T13436E716F5788B22D0BBC0B9C6D66A99FA3338455F308BCB0285DB2C3E276D58535727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 4.8MB
- SHA256 2848a4f2089deb567c7727076d885f7bd48883b0d39d76637f09cb38013812d8
- MD5 2f1abe962bfe70cd65d7ec08141a6d65
- SHA1 7eed33ab922340bf5ee6de71bd283516177abd14
- SHA512 98d2ebbe88ff74e3461a5fa2e7e48d95b4c06859242eaafd975e70923105dd628530b92e61cd7682f54e134aa4dadf16b87abbcc3b8b54454e0598613186b5a8
- SSDEEP 49152:A3k03kHRJJ56rY56r+qJtb2IEeW4SkZP4sz9Mb5eW4SkZP4sz9MbE56rNeW4SkZp:A3k03kHRYr1r+FfkZcNfkZcBrRfkZc6
- TLSH T10236F716F1788B22D0BBC079C5D6AA99FA333C455F308BCB0285EB2C2E376D59535726
- MD5 SHA1 SHA512 SSDEEP TLSH