Analysis
- max time kernel
83s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 23:37
Behavioral task
behavioral1
Sample
2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 3.0MB
- Sample260802-3mls3atepc
- SHA256 b39131254f891dbd4a4c9c4b2f0d52dd0bb88a415e8e214b280cbb1160b63334
- MD5 d1a384ba035f19250d11ff387b6ae881
- SHA1 23e01b12c531f173453ce8abc97973966acc3502
- SHA512 09676ff6c8c993e0f2a55c46cc20af245c531c5619350abf2409476b82ffe8d79141c120ad430b654ac015634b69ac8b5e4a00730e8001837663c0ad4e064586
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYq:A3k03kHR+R8fkZckrBz6
- TLSH T19FE52916F6B847A2D077C079C5D69A66FA723C450F308BCB0245EB2D2F376D19A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/1140-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002441e-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3396-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1140-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3396-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000900000001f282-146.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000021720-1077.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0006000000021651-1281.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000020287-1430.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002100000002021f-1528.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023124-1914.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002441e-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x000900000001f282-146.dat aspack_v212_v242 behavioral1/files/0x000b000000021720-1077.dat aspack_v212_v242 behavioral1/files/0x0006000000021651-1281.dat aspack_v212_v242 behavioral1/files/0x0007000000020287-1430.dat aspack_v212_v242 behavioral1/files/0x002100000002021f-1528.dat aspack_v212_v242 behavioral1/files/0x0004000000023124-1914.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3396 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1140 2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 3396 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d1a384ba035f19250d11ff387b6ae881_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1140
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.0MB
- SHA256 b39131254f891dbd4a4c9c4b2f0d52dd0bb88a415e8e214b280cbb1160b63334
- MD5 d1a384ba035f19250d11ff387b6ae881
- SHA1 23e01b12c531f173453ce8abc97973966acc3502
- SHA512 09676ff6c8c993e0f2a55c46cc20af245c531c5619350abf2409476b82ffe8d79141c120ad430b654ac015634b69ac8b5e4a00730e8001837663c0ad4e064586
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYq:A3k03kHR+R8fkZckrBz6
- TLSH T19FE52916F6B847A2D077C079C5D69A66FA723C450F308BCB0245EB2D2F376D19A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 3.1MB
- SHA256 8785fc4ad743048eccae5be8ae8917793263b4131cd436a8064b7d39829bae71
- MD5 dea8a3e1a05e68a6a7145058e60c1ee6
- SHA1 355c38bf4a96901c3d199402216b58a7ba03d614
- SHA512 fd8bfa35c359b62e0995d7ea08a3ae1fcd47b7b117f0b31ea383817e563abb14ae6bf807c66b3fb1b20e3ff45cd196b874ca23e0968582a5d4210d7653ccb751
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYqx:A3k03kHR+R8fkZckrBz60
- TLSH T1D9E52916F6B847A2D077C079C5D69A66FA723C410F308BCB0245EB2D2F376D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.5MB
- SHA256 873a8306ce1b91c3883e4614a45902b407c5b8b2421713200f286a3039b66892
- MD5 aaf95e120450e8f09776239a3b5cc9c2
- SHA1 79d013f68995b2565ccb03233be35525f52bab32
- SHA512 faa6f7bb480975bdae6f9e5d4b5c5295571f638820abd4ef66e8f8a98e5d223c2a225d91869551d92dde75cfb680a275ce5662fd3aa2127d0775f171d20b5298
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYqHTd9CHKyao:A3k03kHR+R8fkZckrBz6YCqo
- TLSH T1D3064A16F6B847A2D077C179C9969666FA723C450F308BCB0354EB2D2F336D19A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
- Size 3.1MB
- SHA256 20ee1b0010f28c7b6776c4fcec9b9f41af55b66e0c3e4cb15ee43c4150aa07f1
- MD5 3b9b2bbf3196e9287349299491291c9b
- SHA1 ddf3c99d9b6338df64021df7ca33b143b6b4e385
- SHA512 3df091b95c845d5460845e3b343725837108bb0a1409571c784eaed48e9ab170514abcd23e5610aa82a779d82875ab322be7d6beab36a8158f9129f5b82b9ed6
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYqZI:A3k03kHR+R8fkZckrBz6KI
- TLSH T1F9E52A16F6B847A2D077C079C5D69A66FA723C450F308BCB0345EB292F376D19A39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.6MB
- SHA256 365cc0ae297d07ff195c24aaa891e080680f1823c116a5d6f5835a056bd2fbe4
- MD5 776788d4e2473d0119e987b63bef34d6
- SHA1 3ce8af548b652542068959e148d60b450f8b58c9
- SHA512 586bd8bf93e568473e913aca3b08e6a7f477c63e9fcb2107696cfc85e2c9e747b44da6ffdd6ecfddd84faba475515ca87939657487d35be56505e5d4bd8a003b
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYqjPji0Aj:A3k03kHR+R8fkZckrBz6Gjo
- TLSH T1A9062A16F6788762D077C079C5D696AAFA723C450F308BCB0245E72D2F376E19A3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$
- Size 3.2MB
- SHA256 8782f68d89b3ccf359e7350958d2dbb172021b449bcd858fe02723b47d0568b7
- MD5 b4df12f09acbea9956d646f5636ad5d6
- SHA1 258302c16ea7f4543ad9ce001dbf2fdd09c7f970
- SHA512 5a16aca84dcfb32ca32a955fd83451a60b60a9bd2bf1fca5162e6545de0e2de2cc2f16124e53786ff0887dc98e890c45131490d7588f6079dd10e44f5aca1cea
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYqk:A3k03kHR+R8fkZckrBz6F
- TLSH T108F53916F66847A2D07BC079C6969666FA333C410F7087CB0285EB3D2F376D19A79722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 3.1MB
- SHA256 364b810bce96796ba3b4ba2cf77ac0bae3ab454f8bb739cd0028b8d7b5813134
- MD5 33a8149d7fdf647dbff24f13af0b9a91
- SHA1 1b75ec7e90e4ccf208597774f239ad2d51cd08ed
- SHA512 eeb115f20938c7f4a057abaa4314e4b62d61be6fe16b02845f47fe50315c10cf93806df498fc9974820a30a5c506294f57be5d09e9b0d97e42a0fdbc38244361
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYqt:A3k03kHR+R8fkZckrBz6Y
- TLSH T140E53A16F6B847A2D0B7D075C9D69A66FA323C410F308BDB0245FB292F376D19A39721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$
- Size 3.3MB
- SHA256 4bbad86e642466d1e31d117d1641598746db45d28688f5c7217860daec33567e
- MD5 50e58f44825b97c54199fe455b2e7b70
- SHA1 0c6faf6e0f89734aa6037ac25fb5b5cc484d26f5
- SHA512 ce85492eee4f8896493b260983fa1f8b638118d6ef3000648aed635033c25a3c17a294836e65350c0def16e3947070bb135055281253fe7d11ded0aefc2773c6
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9Mbz56rB8tDZqrKMpYq3w7OB5:A3k03kHR+R8fkZckrBz6o7
- TLSH T100F53A16F6B847A2D077C079C9D69A66FA723C410F308BCB0355EB292F376D19A39721
- MD5 SHA1 SHA512 SSDEEP TLSH