Analysis
- max time kernel
112s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 08:41
Behavioral task
behavioral1
Sample
2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260731-klygcsff44
- SHA256 d906d1831a246ae6413811e9cc7fc391716756dce3203a99346fc14b25aade11
- MD5 face8d4a0aa6686e223ee5bd888a18f4
- SHA1 8808d5c704b6bf30a5f73c9c6853d9274298d7ea
- SHA512 cf6f4ddaa5c84620e22b05a315a693a018c63871a9c6c398183eea12b844a808db0104160e56da6a8bc9fa22eed6890f065a055b5ab74703cdca5db364a437f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacaxfZe0p4Ek4niOkl/A04szE87Ju:A3k03kHRJ6eW4SkZP4sz9MbE56rX
- TLSH T1FD952916F6784B62D07BC0B9C5D6AA5AFA323C455F3087CB03459B283F277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/2968-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5bc-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2968-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1984-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0dd-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019df3-1273.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001e0000000187fc-1532.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00140000000064cf-2085.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5bc-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000300000001a0dd-959.dat aspack_v212_v242 behavioral2/files/0x0004000000019df3-1273.dat aspack_v212_v242 behavioral2/files/0x001e0000000187fc-1532.dat aspack_v212_v242 behavioral2/files/0x00140000000064cf-2085.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1984 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 16 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2968 2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1984 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_face8d4a0aa6686e223ee5bd888a18f4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2968
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1984
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 d906d1831a246ae6413811e9cc7fc391716756dce3203a99346fc14b25aade11
- MD5 face8d4a0aa6686e223ee5bd888a18f4
- SHA1 8808d5c704b6bf30a5f73c9c6853d9274298d7ea
- SHA512 cf6f4ddaa5c84620e22b05a315a693a018c63871a9c6c398183eea12b844a808db0104160e56da6a8bc9fa22eed6890f065a055b5ab74703cdca5db364a437f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacaxfZe0p4Ek4niOkl/A04szE87Ju:A3k03kHRJ6eW4SkZP4sz9MbE56rX
- TLSH T1FD952916F6784B62D07BC0B9C5D6AA5AFA323C455F3087CB03459B283F277D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.2MB
- SHA256 bc98b83ff45ec1a2bbbe6befa98fe8bfbe71302615af3c21d4f4590214105214
- MD5 1dcbec7676bd1b9186c28ee8bb7fead5
- SHA1 7ec57fd8935e0c52b9e4e3ea8799e2ea478e6be1
- SHA512 8d69fbf92f6e09e6383a4035b99a3575d808385dca108a65f2d844c8bcf59662306f6edab2117772927373721c07608acb722e21b88ea6e3897095ac94f82d4a
- SSDEEP 49152:A3k03kHRJ6eW4SkZP4sz9MbE56rcT1Llje:A3k03kHR4fkZcBrMLte
- TLSH T129B54A16F6784B66D07BC079C5D6AA56FA323C461F3087CB03449B283F277D19A3A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 853c492ca2188cbb82e420e16a074e7c16cdee3b26e6aeaf374a357483af879f
- MD5 b9d2315e631153f5d015388214a50b28
- SHA1 46cea2527d81ec4f92b7eab38a189fc31b0cb640
- SHA512 178c60b73f5af162ab4e6f68dcb7ba12bdfa7b5070a7ec1dbf4549141e6cb2166cf46b3dd9a175af79a65f6a268f3dc21dec46a5ec91ab6cb03a58d7abf9f306
- SSDEEP 49152:A3k03kHRJ6eW4SkZP4sz9MbE56rTPji0Aj:A3k03kHR4fkZcBrLjo
- TLSH T17CC53A16F6784762D077C0B9C5D6AA5AFA3238451F308BCB0345DB283F277D59A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe
- Size 2.7MB
- SHA256 34954be6ab4c00ec99fa36655b9e123a1bbaf67363bfdf6767e4f719a9b0bdb6
- MD5 4094a4dc6fe30fd8d882b98d605c97e9
- SHA1 bebbc642a2b598051c1fb7d2ddef8b449f394546
- SHA512 a236e8cb1c75af5710c0e507863819433320ab08c7db3c6059818d749ae4ee809924760c04c1b44a9bc3e945fb5cf039c3529140a167ead237f4a8a1dec1cc45
- SSDEEP 49152:A3k03kHRJ6eW4SkZP4sz9MbE56r2uygmUSbHDUnT:A3k03kHR4fkZcBraUEW
- TLSH T15DD54A16B6B847A6E0B7C174C5A69666FA723C421F3087CF0344DB1D2F27AD09E39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe
- Size 2.0MB
- SHA256 05c129617932212a58fbaa35afb684c092caa6c753bc5580b28d46a1bab0e5c2
- MD5 505c9d4ac6a5d60450fcfbe9f4699898
- SHA1 064a21bcd57a5bf3c45c493847f359b440c6799e
- SHA512 63f9a38bf30e60809b99fc316071a92f4bb8f1bfba1f080d5454f57c599ef7d2c6d92a279b21b530fb954e49f7ba06f436154270abbcad6494529929f317578a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacaxfZe0p4Ek4niOkl/A04szE87Jm:A3k03kHRJ6eW4SkZP4sz9MbE56r9
- TLSH T1FEA53A16F6B84762D0ABC075C9D66A56FA323C451F308BDB0345BB283E377D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftWindows.DesktopStickerEditorCentennial.exe
- Size 2.2MB
- SHA256 59e0ca5533cf7f8c2dd1b7fc30500ea43f5a0e9f805979867f898510b13da6ac
- MD5 2b9c5aa3ea1484f6ce97c3627f304a6b
- SHA1 6458bbabf4d5624b174c475cea18305ee911991c
- SHA512 b24ab779aed9503446c5e1f9a49585c1a87dd9bdeea6ca8b46e78299dace4ac7bbff1b4666e0c449cfe0eb8bf18714911917203a99b4427806efbd7b43c9322d
- SSDEEP 49152:A3k03kHRJ6eW4SkZP4sz9MbE56rPi2WH3:A3k03kHR4fkZcBrPuX
- TLSH T1FFB54B16F6B84772D07BC075C5D6AA6AFA323C455F3087CB03459B283E277D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH