Analysis
- max time kernel
88s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 14:06
Behavioral task
behavioral1
Sample
2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260801-rerhssbf23
- SHA256 c3f74d3b8c8c60a67499ccf81ad8e2b72ef2a6e1d7693446dbe4ed574cf504be
- MD5 350c7bcc0fbcbc90b5826f38e1922ef7
- SHA1 46427732756fa8fe61e5abeb05e69708b435288d
- SHA512 3931401e71617af3de16b916e4b15433be58f4b9b03c12e95942d67821a00fd91af578e426b4f1bf087d3796e3422f1e0a294009f6a9d8b0809f08767d63a9d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoxKYYTqMi8CtBd2QHCHmTBW5YdYN:A3k03kB56raqJtb2IkqJtb2I
- TLSH T191A53A26F6A48B65D07BC079C5D2969AEA333C425F3087CB1349DB283F277D1953A722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2452-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ec-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3516-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2452-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3516-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202e8-200.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245f1-533.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021c51-1062.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000225ad-1269.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000737-1562.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245ec-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x00030000000202e8-200.dat aspack_v212_v242 behavioral1/files/0x00070000000245f1-533.dat aspack_v212_v242 behavioral1/files/0x0003000000021c51-1062.dat aspack_v212_v242 behavioral1/files/0x00040000000225ad-1269.dat aspack_v212_v242 behavioral1/files/0x0003000000000737-1562.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3516 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2452 2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3516 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_350c7bcc0fbcbc90b5826f38e1922ef7_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2452
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 c3f74d3b8c8c60a67499ccf81ad8e2b72ef2a6e1d7693446dbe4ed574cf504be
- MD5 350c7bcc0fbcbc90b5826f38e1922ef7
- SHA1 46427732756fa8fe61e5abeb05e69708b435288d
- SHA512 3931401e71617af3de16b916e4b15433be58f4b9b03c12e95942d67821a00fd91af578e426b4f1bf087d3796e3422f1e0a294009f6a9d8b0809f08767d63a9d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoxKYYTqMi8CtBd2QHCHmTBW5YdYN:A3k03kB56raqJtb2IkqJtb2I
- TLSH T191A53A26F6A48B65D07BC079C5D2969AEA333C425F3087CB1349DB283F277D1953A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe
- Size 2.1MB
- SHA256 ade3fe782ea2e70e4c3ed39ab0aabcb4a80c4a1be68b46f8c2abfb3e06a3e19b
- MD5 19cded44c2d04e46136d8be649be7ed6
- SHA1 65f5acacace66c342e6b895fe4fcda1e586f4980
- SHA512 4381a6607076ac94a2fd333363659fb1c807a519934853ce75ba54a76692cf6a933aae7f030dfd38846cd78f54ee329ae91707e18aabfac5764155b101d7653f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoxKYYTqMi8CtBd2QHCHmTBW5YdYg:A3k03kB56raqJtb2IkqJtb2Imw
- TLSH T16CA53A26F6A48B65D07BC079C5D2969AEA333C425F3087CB1345DB283F277D1993A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 9e9c15ad7152fad5ba677212f4d3620a37c01e039808dbca407ef518b2f13c47
- MD5 0a3373b91074c242f97149e5e46b60bb
- SHA1 bb08fd48b148787aa32b98ee1122108de6ffa5ca
- SHA512 6d1856801d5cc6aec9c01b4964fe8f73c2ce6db0c594da75d8668a0576dc1739b75dfe5ba933b7cdb31b548a67787df640234de26f8ce3d5183625f244202a9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoxKYYTqMi8CtBd2QHCHmTBW5YdYJ:A3k03kB56raqJtb2IkqJtb2IQPji0Aj
- TLSH T132C53A26F6648771D077C0B9C5D2A69AEA3238425F308BCB1345DB283F277D5963A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$
- Size 2.1MB
- SHA256 a478dcca4217ea2373ad3b70db5477b9b1c812316e8ddc8a8680d089a2a390da
- MD5 3723ea652096bf38753e545136639c99
- SHA1 6e9d0de95ff3d5ced7f01580859f40bea1a3c165
- SHA512 a56f7d6d37cdb464e289f021283385bfb4ffb9c47a800adb1c836042248b0316212f91115f3f183d8167ba0ce418d44621ae7c3828b1fccafc39325f9b6fa51d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoxKYYTqMi8CtBd2QHCHmTBW5YdYF:A3k03kB56raqJtb2IkqJtb2IC
- TLSH T1A8A53A26F6A48B65D07BC079C5D2969AEA333C425F3087CB1349DB283F277D1953A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 2.1MB
- SHA256 2c45f6d2825800cea28401c92e5463c0218f7f1ae5bcdc8a9990f12b14a6f135
- MD5 835167e9101f56aa5077bf0809044c4c
- SHA1 fb221311a7baf415532ef56714e0a10838d73afb
- SHA512 640b36a4ccb44cf011f112ffa3fedf7bcacbc81918308c9d4db8b9753038f70c09d41fd1ae463cea7278b9cc1a055b875dc882555447a011cbf0f45eb460d787
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoxKYYTqMi8CtBd2QHCHmTBW5YdYu:A3k03kB56raqJtb2IkqJtb2IJ
- TLSH T10DA53A26F6A48B65D07BC079C5D2969AEA323C425F3087CB1349DB283F277D1953A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$
- Size 2.1MB
- SHA256 7203457971390ed1d60a567d90e692330351643f83c20aefd1daf5ce925ba8d8
- MD5 1e39b741e306c6a993c7e4e60fcbec27
- SHA1 d5b2d8a1e35aca99b892da7e44ad164fbb64763d
- SHA512 cd1de21b3b95a26c796cb1fa50ba633880dd54668c51c255b337f38f5d152109e531daa44a66ed2fe5b11babdd370a2ea28c4aba340b807b5ca690ae489c7a5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoxKYYTqMi8CtBd2QHCHmTBW5YdYD:A3k03kB56raqJtb2IkqJtb2Ic
- TLSH T1E6A53A26F6A48B65D07BC079C5D2969AEA333C425F3087CB1345DB283F277D1963A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.1MB
- SHA256 58491bdb19c952f3336cdd0e7e998407f53b4b21d0d77397924b2ffb14a0a3ab
- MD5 aff81a31479c321a14e0c9b74380ee32
- SHA1 f87b27cbb9ad91977b2f8f29fee3b68ad7e29fd3
- SHA512 b4809b94c79a14ae54d3f6da8e36e6ad6cd60b6ee8fd803e4e7f974e39c7b9f2c32a950bea10fe2bb330ddb22053921c620f1c0375f67b77ba4609b2bed23b0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoxKYYTqMi8CtBd2QHCHmTBW5YdYX:A3k03kB56raqJtb2IkqJtb2Ig
- TLSH T166A53A16F6A48B61D07BC075C9D2969AEA323C425F308BDB1345BB283F377D1953A722
- MD5 SHA1 SHA512 SSDEEP TLSH