Analysis
- max time kernel
88s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 16:06
Behavioral task
behavioral1
Sample
2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260731-tkcb6sdb23
- SHA256 265ed003d00631688d9920fc0dc7f49549949512f317cdca37a8bcceef2ba720
- MD5 f7c191631e97e596d57d5162fdf22c7b
- SHA1 4e30940b7bbd4fc4ba091491fffea68f93186380
- SHA512 ceaf553a4d90e053a05a40b5be11b0a42ad8b7666a78069890a5ef20b571d3f67d32a97c4286deb44f9c3a7896c72b9c456ae89eda94e3a1e5bf4a683367eddb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaaL2655jcAkSYqyE3YTqMi8CtBd27:A3k03kHRJARJ7pYqOqJtb2I
- TLSH T13B955B16F6684275D073C0B9C5D2AA9AFE3234425B308ACF1385D7682F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2924-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c0000000243a6-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2864-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2924-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2864-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023531-613.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021774-1204.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001e809-1391.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002316a-1765.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001200000000071d-2081.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000c0000000243a6-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023531-613.dat aspack_v212_v242 behavioral1/files/0x0002000000021774-1204.dat aspack_v212_v242 behavioral1/files/0x001400000001e809-1391.dat aspack_v212_v242 behavioral1/files/0x000200000002316a-1765.dat aspack_v212_v242 behavioral1/files/0x001200000000071d-2081.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2864 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2924 2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2864 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_f7c191631e97e596d57d5162fdf22c7b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2924
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2864
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 265ed003d00631688d9920fc0dc7f49549949512f317cdca37a8bcceef2ba720
- MD5 f7c191631e97e596d57d5162fdf22c7b
- SHA1 4e30940b7bbd4fc4ba091491fffea68f93186380
- SHA512 ceaf553a4d90e053a05a40b5be11b0a42ad8b7666a78069890a5ef20b571d3f67d32a97c4286deb44f9c3a7896c72b9c456ae89eda94e3a1e5bf4a683367eddb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaaL2655jcAkSYqyE3YTqMi8CtBd27:A3k03kHRJARJ7pYqOqJtb2I
- TLSH T13B955B16F6684275D073C0B9C5D2AA9AFE3234425B308ACF1385D7682F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.2MB
- SHA256 90b2736912caaa1192cee48c4a0886f16e1953b1ea8216b7254e1b2079c222b9
- MD5 9bb04b612231e2dcbe00057bf4cb4ceb
- SHA1 827573f2e36f0e8f95ededffa6cd185264706057
- SHA512 f895f63b9a8a4029b6f1cf62f5db3b0344a0bba37856c3126c6fafb43a91ae00d104cdc34259d347113c433284191d23bb21ad2e93b0a1ce329fd92bba85ce60
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaaL2655jcAkSYqyE3YTqMi8CtBd2p:A3k03kHRJARJ7pYqOqJtb2IwUN+Eir
- TLSH T179B53A26F66886A5D073D079C9D2975AFA7234420B308BCB1385832D2F377E59E3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe
- Size 2.0MB
- SHA256 b15ea48b94d0b19755771029a075bff218090a8cd1887d4c34beb6ebd640d056
- MD5 ebe8820e08ed2a97a34a8c95518cb54d
- SHA1 d9af8f7e10eef0405e2b9fabc8c6b1312ba98b7b
- SHA512 2fc20751b41e516b3e5669a8cf3a7b3ab01d58a295007f6d74897e4ef142341b175cdaeeccfa679f792f26da7c736546c867398d923d433538f4c854fb5e8339
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaaL2655jcAkSYqyE3YTqMi8CtBd22:A3k03kHRJARJ7pYqOqJtb2Imw
- TLSH T14EA55B16F6A842B5D073C1B9C5D2AA5AEB3234425B308ACF1385D7682F277D1DE3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 24066a62c2af274e4c181d3f4bad1a00538af373caa2c1492f67f27b2ffbc9e6
- MD5 bb7e67e721e08e8c07f544c544d194ae
- SHA1 075f61c2a063a9a0546191e17c485c98692e5c43
- SHA512 8af0af8f3c80fdd2cf15ffb634b43b9145de3559046e808e3202b24c87c7e289c92084820e78ed10ca6596d8c24e24ee0faefe4bfb76b3e6f1994477899e893d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaaL2655jcAkSYqyE3YTqMi8CtBd2v:A3k03kHRJARJ7pYqOqJtb2IQPji0Aj
- TLSH T17AC54B16F6648375D073C0B9C5D2A69AEE3234425B308ACB1385D76C2F277E6DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 2.0MB
- SHA256 abe18c562c5de98a60fe2a017c9e050f5d4c76d82790d2be3ab718a1e2bdd38f
- MD5 15b6118e13052761b2457c74fa3f9dc0
- SHA1 a3f2f727268f02ccd148727229f60bcd96204ed1
- SHA512 5360b3771146cde10161646393fd534e197012af23f6ff2cfd737c090842c76ed2c09443b79eb64e63556a39090ec3d23c3993bf707766ee4ff01c44ce6164b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaaL2655jcAkSYqyE3YTqMi8CtBd25:A3k03kHRJARJ7pYqOqJtb2Iw
- TLSH T16A955B16F6684275D073C0B9C5D2AA9AFE3234425B308ACF1389D7282F277D5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe
- Size 2.0MB
- SHA256 90ad0e7271faa76dab3a8da9ce720f8388cab8578b8ab1a66e22ca24f4f266b4
- MD5 d8b0de42d021a1b4343fdd998d228d5b
- SHA1 fa24289d9208bad26005a45d7700e725820686b7
- SHA512 1d3961736a993cd195e0e24682f9e94ba3849b329c0f6a36847a48362d1b5016f47e9600df6aa113bf54bf2363e69ad981704508dbf9de8fcc3c2f3d47e86593
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaaL2655jcAkSYqyE3YTqMi8CtBd2w:A3k03kHRJARJ7pYqOqJtb2Ih
- TLSH T1AFA55B27F6644275D073D079C5D6AA5AFE3134460B3086CB1399DB282F27BF1AA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.2MB
- SHA256 f042c966fe57751c4ab0936ce6d9f9a877302e392831c48ccfe6347b5ed475e3
- MD5 7ec66e42d93a102aba258ba97bf54dc2
- SHA1 c7b07e528f7bdb5cce785837c68610192770faca
- SHA512 93a65fa58ffbab9eb0e0a1ec54a83a215feb6e4c8d252ecd88871b5c5119510899b343152d7c3126fb0c4ddfb2bd82c1790e8f7fa7c10751494b399cb4435a42
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaaL2655jcAkSYqyE3YTqMi8CtBd2o:A3k03kHRJARJ7pYqOqJtb2Iai2WH3
- TLSH T184B56C26F6A84275D073C179C9D2A65AFA3238424B3086CF1385D72D2F677E1DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH