Analysis
- max time kernel
118s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 18:00
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260731-wla7lsed76
- SHA256 7a24becd3f05e427d7a4bdd8ad15b92e106c59941372e7169a35307f723469f7
- MD5 6d3d42c93dd17b66732d5d2d919ccdc9
- SHA1 293ec58fe8653dc35a8b86cb6b3474f1aba2e442
- SHA512 9feb4cee78fce9c67d41fbb8fc9e6db2f20f0ebfb749a29a9671c062cf584d35f1714e8aa4200f438b015b730851f4ae17157a2e1227e06f9681b6bb63960c39
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrM:N7iw2G+o56rTPji0Aj
- TLSH T147853A16B6A84B61D07B9174C8E5965AE9737C450F3087CF12689F2C3E33BE1A939723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/5420-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c457-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-290.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c45e-294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001995c-502.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001abd2-1000.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019dc7-1255.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5420-1358-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3372-1359-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001000000001891f-1510.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3372 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5420 2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3372 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_6d3d42c93dd17b66732d5d2d919ccdc9_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5420
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3372
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 7a24becd3f05e427d7a4bdd8ad15b92e106c59941372e7169a35307f723469f7
- MD5 6d3d42c93dd17b66732d5d2d919ccdc9
- SHA1 293ec58fe8653dc35a8b86cb6b3474f1aba2e442
- SHA512 9feb4cee78fce9c67d41fbb8fc9e6db2f20f0ebfb749a29a9671c062cf584d35f1714e8aa4200f438b015b730851f4ae17157a2e1227e06f9681b6bb63960c39
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrM:N7iw2G+o56rTPji0Aj
- TLSH T147853A16B6A84B61D07B9174C8E5965AE9737C450F3087CF12689F2C3E33BE1A939723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.1MB
- SHA256 cb189e7c3841b4cf477ebd61fc05de2bed710598b24f7bedb082d16e8f75ea3c
- MD5 3d23feb5d4ef6193d7f5ded60c97b265
- SHA1 ef83a6de62e5d8f91d3e6dd3cf734a56e13dbd34
- SHA512 6fcd38a5e7f4d83ebaffae02d82a17f1cb88ef2e9832062ef257e64b391adc44518538620deee7f4f63cadf739eadf5a71468b50f900ef9978f768f72bde79b0
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrMX3Td9CHKy7GZO:N7iw2G+o56rTPji0AjoTd9CHKyao
- TLSH T1E3A54B16B6A84B65E0779134C8E58656E9737C450F3087CF12A89F2D3E33BE19939B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 1c777b7743d4fbcb127b45c12b3285d0358c07d9e0804e72de02cecd126b3592
- MD5 ae19f212055759845556e14d006b78a1
- SHA1 e79d1911aeea0d23ad22e5aa3d65385b5441215c
- SHA512 c8acae303f97672af6a628e0c31d6f31b28bc81301571f6e17d602e27f27ddda5539c9d50a7fe1d42b6f1720b0160887721147706111cfd68b6ee5063f4dbb2a
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrMD0Le5ji0hmxNrM:N7iw2G+o56rTPji0AjKPji0Aj
- TLSH T173B53A16F6A84B21D077D074C5E2969AE97378450F3087CB1299DB3C3E27BE29939732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.7MB
- SHA256 a53e57c1e1474245d221116701b3ec98306d4d11f77780c79f571972cecbeac9
- MD5 40b5e2f57a9f6c4fb7e2772361b71cb9
- SHA1 fe28295856d3cf5a9c9b1d9c51cfe1429e23d225
- SHA512 315cf5ca36ed822f09e9e50ffe03c29dd35d8f6fa44f948e2edf227f0374082df969e55ba9daefebf939fa33784a1f4c09aadf927654b5b07b738759e748816b
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrMeF:N7iw2G+o56rTPji0Ajd
- TLSH T156853A16B6A84B61D07B9174C8E5965AE9737C450F3087CF12689F2C3E33BE1A939723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 1.7MB
- SHA256 00bd3c08df14204d6389147a85b2fa52e2b278be12182cbfd9b99ec327875353
- MD5 4fd677f89ea45f3c0040f943bbe656e7
- SHA1 2d1eff2afcd1fd757858628b40ba8a09f68b5b26
- SHA512 4ec97ea58bc1365d760fdb89cf3a3d79e21846194ca4fa513b32272d3b40addb8f948c367745759cec1bec0af2dc990948fabdafc933c9f724a857848b01cafb
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrMaN:N7iw2G+o56rTPji0Ajr
- TLSH T159853A16B6A84B61D07B9174C8E5965AE9737C450F3087CF12689F2C3E33BE1A939723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 1.7MB
- SHA256 69e9772a0b195005df4b103035b027517314efb9abcd49fdf8532d260a7367a6
- MD5 d6862b3eba91e0d849942aae810f977c
- SHA1 2146514eb62a75c9a7643a3312d0b9552e2c3b56
- SHA512 489eb3732e4981a02a2890bd722b53f8d4f978b5e05b7513060874b871819a92dc3e09e28374eb716f1153cef325c88d5d23d25783754db0cb150fc80e6cf110
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrMNj:N7iw2G+o56rTPji0Ajm
- TLSH T1CA853A16B6A84B61D07B9174C8E5965AE9737C450F3087CF12689F2C3E33BE1A939723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 1.7MB
- SHA256 fbb776547b2b1bf7dd2ef94e62ca0c5afed651e3bbd782c83d7f3a9f1b615c28
- MD5 6f2eb4c25a4ed7f785355f321a05ae68
- SHA1 ef8629d6f7f88dabface4eebff6d0493248c7db2
- SHA512 8abfccd0ca98be5ba17dadc5f97d4458fb2416a3abd3a175b834cb3045f4d0d8d9fddc21b034d78d8be35816043f79a2d09a07bb99dd053b0ee75e7769ab51d4
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrMuwE:N7iw2G+o56rTPji0Aj7
- TLSH T1D6853A16B6A84B61D07B9174C4E5965AE973BC450F3087CF12689F2C3E33BE1A939723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.7MB
- SHA256 034d65cd4f8be32ced65c7a04fb5b08fb0acbdd82e07fc82bdf8ccd33e69d545
- MD5 0ea11977f85e7212fc7d38d30f2b0ad1
- SHA1 2319800b856a2dd9e0d261dfabc85e7afdde9d05
- SHA512 d4acddca65e80993864a4414ac9fe303b8c0358e55c70aa933c643b6c1650b054568b3ea6c177e91816aa3ac12dffd921335471bd4c5551f371b2d8a36992419
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaBCMD5TvinrmC0Le5ji0hmxNrMPF:N7iw2G+o56rTPji0Ajq
- TLSH T1CB852A16B6A84B61D06B9174C8E5965AE973BC450F3087CF1268BF3C3E337E1A935722
- MD5 SHA1 SHA512 SSDEEP TLSH