Analysis
- max time kernel
81s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 13:59
Behavioral task
behavioral1
Sample
2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.2MB
- Sample260802-rapteathph
- SHA256 96366439cfe94a5a28b34fa258b9bcb4cf25e043df3457ffeb503d6af7bf365c
- MD5 990fd947237d65fd47197d57c466a77d
- SHA1 25b83314983024e211265fb8210fdf010cccedf0
- SHA512 64a2c050f01e42b939ae636684294111166f1dfd98a3673f7efa11ccf20320f14d1eced514f9b256dcfb350b991d486607f3a1762fe37f89d0221ecb2c656ec6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHLJ:A3k03kB56rQRJsTeX
- TLSH T144454907A6980AE8D15F81748A968672E7737C111F2097CF1364EE2A3F736D0AE39753
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4732-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024682-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5476-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4732-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5476-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a0-749.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0018000000021641-1108.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000246a1-1283.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0020000000020242-1530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000230b6-1748.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e890-1939.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024682-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x00020000000216a0-749.dat aspack_v212_v242 behavioral1/files/0x0018000000021641-1108.dat aspack_v212_v242 behavioral1/files/0x00070000000246a1-1283.dat aspack_v212_v242 behavioral1/files/0x0020000000020242-1530.dat aspack_v212_v242 behavioral1/files/0x00050000000230b6-1748.dat aspack_v212_v242 behavioral1/files/0x000500000001e890-1939.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5476 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4732 2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5476 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_990fd947237d65fd47197d57c466a77d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4732
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 96366439cfe94a5a28b34fa258b9bcb4cf25e043df3457ffeb503d6af7bf365c
- MD5 990fd947237d65fd47197d57c466a77d
- SHA1 25b83314983024e211265fb8210fdf010cccedf0
- SHA512 64a2c050f01e42b939ae636684294111166f1dfd98a3673f7efa11ccf20320f14d1eced514f9b256dcfb350b991d486607f3a1762fe37f89d0221ecb2c656ec6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHLJ:A3k03kB56rQRJsTeX
- TLSH T144454907A6980AE8D15F81748A968672E7737C111F2097CF1364EE2A3F736D0AE39753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.6MB
- SHA256 38435f6d1a8ad278480d93dae9c60f5f825a5f01573aecba528ad2ca898558b8
- MD5 c48baaac2f50b6eb7b2ef12e8743018f
- SHA1 ad7941a80a4af2effb15c8d6eb21edf0b3a142f8
- SHA512 95d55b9fd65503b7586abf2fd321fe490054b7f1ba9f5a9a0ce5ab54a410d6404b6cb536b57dce3e2f27ba44e97ebd16616f8eb50e12549d6136b9e8b4460c5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHLp3Td9CHKy7GZO:A3k03kB56rQRJsTeXTd9CHKyao
- TLSH T158755C16A7940AE4E16FC17489A68522E7737C551F2097CF1354AE2A3F337D0AE39B23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe
- Size 1.3MB
- SHA256 580ade85c39ed0563d171b2715af97087b54994c551e53fb5de1e0cb96b80960
- MD5 dbb6a7024bb66b46a842f2f5a4c2f956
- SHA1 343b18fa0f2f7bef7928100b10c54505217d0993
- SHA512 070bba3efdc552b3e3bb63e538108cc304a32a6b83e1f665917c78de4879898ea381d8ac544bc58cf918f9b8d89ca3a653f65615f920b14440457dd6bf49801a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHLzTjE:A3k03kB56rQRJsTeNw
- TLSH T1CC555A07A6980AE5D15F81748A968672E773BC110F2097CF1364EE2A3F736D0AE39753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe
- Size 1.3MB
- SHA256 26859fa05c2503689bb2601d35488693e9401c673261f00317f179f6485c3ea7
- MD5 eff56b4e84e645b418d734fdfd87774d
- SHA1 f3eac2057dd7250f9247875779d9e16a4b828ad3
- SHA512 fcb5f34f3c47ae989fc9a917e349729ad9360b785d32e3fcac774ffe3354f7c15190060409170f94a9c549a06f0f6159825f542c1f7a64343e5f845ece5de051
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHLUGen:A3k03kB56rQRJsTeJI
- TLSH T130554A07A6980AE9D15F817489968672E773BC110F2097CF1364EE2A3F736D0AE39753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.7MB
- SHA256 3cd3bfb90d538b7bd61e094dd0d31a2cb69067feee64f168c2b3fa6e60105dbe
- MD5 f474ce9baa4656a2931ef3da12abf34e
- SHA1 6006b69a7ecd95f95f62038b575e3b40a35e4d4c
- SHA512 7877064e18913bfed7b841e490eb70106970b177355adc0fc774fed77da1cb47b1ba90d7e6f83d2d766dce644ac732afd2412ae9c1b1b2305f108ac6671c13cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHL10Le5ji0hmxNw:A3k03kB56rQRJsTeTPji0Aj
- TLSH T100854A16F6A84BA5D06BC078C5929666EA733C411F3087CB0354DF293F67BD19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
- Size 1.2MB
- SHA256 2e6fc1d21e4b759c8ffc45829c4eec5e3fe40f55a2812665b2581921f390bcf6
- MD5 cc82a213bd86ed7239675cfeadcf5d90
- SHA1 ed3cf1b8213f69e05a4edc99812b010d5bcb5a7a
- SHA512 cea26733ff0b1d246163dec6764afefd65f3ccf58eb4fb35bcc913dbbc9034edacf7a235daf6a5f93ef469b44759dae5b93b7d24e4cf201e90c4089faefee3da
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHLVF:A3k03kB56rQRJsTe9
- TLSH T14F553807A6990AE5D14F813489968672F773BC510F2097EF1364FF2A3F326D0AE39652
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 1.7MB
- SHA256 c683d3d73f012225ac59806f0bb99df514c7b91e2a1d754fd5f032c3edd29b7a
- MD5 862b07e5bbccc628afcc87f35ca413ff
- SHA1 9478ccb0caab127939e74daa7a693e78abc174e6
- SHA512 ddfb7e70240f16240c8345562354cdf19800ffe0446cb6ec38f6874c6eb81b8060d67fa76c3fd3a20fb31e592ba8ae645c6ee5e61583210421a8b221afb20fe2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHLpUOlZ7q/c9:A3k03kB56rQRJsTejUOlk09
- TLSH T157856C17EA584EE5C16F857886968622E7737C110F2097CF5364EA2A3F336D06E39B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$
- Size 1.4MB
- SHA256 26adb52d5ccc001e416f8bee7fdf3984806f3eafdabf2208772937c5cd4212d1
- MD5 211c14b8fdb85e86e38e6d44f3b8925c
- SHA1 7c8654f110be8c71f0c690976c0d48bdb917acfa
- SHA512 1716f43ed0a5a2c013ba36498c1f1a5cc738995a627b96f647ff8d996db6e7786a6e038269146086b441711469b0e960187269687e7c7952123b4aca573e43a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJliN3yyCUq7lfHLg16:A3k03kB56rQRJsTeiE
- TLSH T149654902E6990BE4D29F813489A68662E7737D111F2097EF1354EF293F32690AF39753
- MD5 SHA1 SHA512 SSDEEP TLSH