Analysis
- max time kernel
97s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 04:50
Behavioral task
behavioral1
Sample
2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 956KB
- Sample260730-ff96raca42
- SHA256 5aee16c2db41b5a08a52b6007b3f522d618b171a7b0ca08088fac5b702332a46
- MD5 e0270fa125abcf717ad9f62dd36c28ba
- SHA1 b57278224c0021a5ff6398f2e6f8722c07762e88
- SHA512 dcca53b986dab00e1ce6d10f3359ce8293b21b6436bda13965a6087e354d743d766c63c807b3ffec8efed5bb9d0848fc03f2bea91d2ae8591d64d254edf39d65
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2p1lc:A3k03kHRJp
- TLSH T13525AE13E79500E9D10AC1749AD68A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4328-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245a0-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4052-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4328-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4052-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000022b94-42.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-386.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001f000000016909-1275.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002000000002029c-1647.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000721-1976.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245a0-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x0005000000022b94-42.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-386.dat aspack_v212_v242 behavioral1/files/0x001f000000016909-1275.dat aspack_v212_v242 behavioral1/files/0x002000000002029c-1647.dat aspack_v212_v242 behavioral1/files/0x0004000000000721-1976.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4052 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe$ 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4328 2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4052 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_e0270fa125abcf717ad9f62dd36c28ba_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4328
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 956KB
- SHA256 5aee16c2db41b5a08a52b6007b3f522d618b171a7b0ca08088fac5b702332a46
- MD5 e0270fa125abcf717ad9f62dd36c28ba
- SHA1 b57278224c0021a5ff6398f2e6f8722c07762e88
- SHA512 dcca53b986dab00e1ce6d10f3359ce8293b21b6436bda13965a6087e354d743d766c63c807b3ffec8efed5bb9d0848fc03f2bea91d2ae8591d64d254edf39d65
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2p1lc:A3k03kHRJp
- TLSH T13525AE13E79500E9D10AC1749AD68A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 4ac1a99241ea59d1b5aab5f656854a3a0fb04270080639484deb188df4d7aaeb
- MD5 6b10c973c40f1239e9ffbd76b171b275
- SHA1 cf9036c5244d50b92b7ca1df752de8806da29f16
- SHA512 c3a11897c5e7616bcabe08515844fbf46249be6a877c4a4c3c3b43d7e66aa315cd3e09a55c8091b2273318da59285bdcb4a34e6c3301d4b5957547db802bf296
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2p1lYUr2d29dBrtpDiI:A3k03kHRJBUidGl
- TLSH T10C659E03F79404E9E05AC1748A968612EB76BC561B60E7DF13A8C2252F73BD06F3E365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 8062b9d9f4d576422f5bb13ef3f0ed1a3d307168cdf40e6c88b4fcef9ea8483c
- MD5 b368a40154d4dc9037fa646ba6144e4f
- SHA1 e49bea4e047216357f30477214e84fffc2f1f1e1
- SHA512 49f34b5d9a5754249a4166ebeebeac4ae11af5cffb2c78b7aa85db26a0634ba8c8930415d7de4fcd0782d39402afa245529c71a4b284e0c3ca2f8babdd72ac5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2p1lk0Le5ji0hmxNrM:A3k03kHRJVPji0Aj
- TLSH T1D7657C17F6A402B5D027C1B9C5D6965AFA7138821B3086CF1399C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 971KB
- SHA256 6a7292f3f8eb54176b1ea8f8fd6c481896aae1f931ed099cef61e97303a94b00
- MD5 5e0e2ed8c855a674abd30b8bcdab1558
- SHA1 02483b28e8552327cc0e2e39b98f20bf5721d818
- SHA512 01dac6c4bb9c0a71593d24a44ae39c27cea5be4fca9cd79dd0d3671e951e3543fb401041b18bd36207bcc54d1a2dcdf3aa13a3a456097b6cb66c32e48a3e71e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2p1lOa:A3k03kHRJ
- TLSH T10225AE03E79500E9E10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 980KB
- SHA256 9660b27410b61b41fb352616a763d22be7f5bdf93bc67431c40270a7e07bc417
- MD5 38e69a305fb0823e2c135105d6f60829
- SHA1 f85ad4860e7746015af859d3bad51007a15538fa
- SHA512 1d170daa34b266ee0baa0fdc8f1dce197405f2b41d4046bc54ad7a6b4d0806fef98e05f664b61b685915773aac0db8399a7704d95a5b4ca89ad7c4b549df0737
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2p1lQ9Q:A3k03kHRJe
- TLSH T14C25AF13EB9500E9E10AC17496D64A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.0MB
- SHA256 af7cf77d7e63c13980880d8ad58c9216158adb3123af5491255f7cee8e58f6a4
- MD5 c163e530e411464ab52069fbf360e2ff
- SHA1 d843ada077bfe3d11ef9c41096d34a8137df0b31
- SHA512 31f56ee226658b1032b0c15f8e1914e76f5311d4c2e277d410bd7faf34a19e0acab23cd038a71faef28d220ef5aca0558e958231582586d0d3109c3d5f7f278c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2p1l2F:A3k03kHRJv
- TLSH T188359E03E6D500E5D64A8170DE9A8A22FA35BD92176096EF2368F7152F727C07F3D3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.4MB
- SHA256 a93a35e7d564b9d6efeaf16dc13b4a854f4a768f8d387d7dd22c05f7968ec34a
- MD5 575d099390d0060f45088fec82841df5
- SHA1 53bbafe07dd927b226401922d6019c692488e769
- SHA512 2f4ffb08b18402f1428c6daab4018c08e5e77ff25522592adac701d238394e4c6ed1b6376834753291d05f9ea6b6dbf28ede00619066b9dd0807fda6a4f616e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2p1lH3npi63iC:A3k03kHRJkXpiMh
- TLSH T104656C03B7E940B5F1B746309AB55622EA79BC625F30D2CF239496091F71BC0EB39762
- MD5 SHA1 SHA512 SSDEEP TLSH