Analysis
- max time kernel
96s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 14:09
Behavioral task
behavioral1
Sample
2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260802-rf46aavard
- SHA256 e65a51faf0ae523a7d58ed023d3f3749d634d14a7b2754022ce23b9a08f03eef
- MD5 81f09eb8ff8cb48d964cbbdcad4a01eb
- SHA1 4890d0b70806540aa11f6399402cf4da72ed36a7
- SHA512 05509c2eda1b7ff05100f14828e4c06f4a04af6ca50b8f3731b3c61342ed5d9978e47042abb85235cbbd37632e897f033aa9019a4f2020e55e11b801026373d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxhxYoP0Le5ji0hmxNrM:A3k03kHRJjPji0Aj
- TLSH T1EA658C17F6A402B5D067C1B9C5E69A5AFA7138421B3086CF1398C7283F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4684-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c000000024203-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1560-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6e3-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4684-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1560-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000219e9-747.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0029000000021654-1256.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00150000000202bb-1524.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f00000001691d-1871.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001d0000000006cf-2130.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000c000000024203-6.dat aspack_v212_v242 behavioral1/files/0x000300000001e6e3-12.dat aspack_v212_v242 behavioral1/files/0x00030000000219e9-747.dat aspack_v212_v242 behavioral1/files/0x0029000000021654-1256.dat aspack_v212_v242 behavioral1/files/0x00150000000202bb-1524.dat aspack_v212_v242 behavioral1/files/0x000f00000001691d-1871.dat aspack_v212_v242 behavioral1/files/0x001d0000000006cf-2130.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1560 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$ 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4684 2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1560 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_81f09eb8ff8cb48d964cbbdcad4a01eb_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4684
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1560
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 e65a51faf0ae523a7d58ed023d3f3749d634d14a7b2754022ce23b9a08f03eef
- MD5 81f09eb8ff8cb48d964cbbdcad4a01eb
- SHA1 4890d0b70806540aa11f6399402cf4da72ed36a7
- SHA512 05509c2eda1b7ff05100f14828e4c06f4a04af6ca50b8f3731b3c61342ed5d9978e47042abb85235cbbd37632e897f033aa9019a4f2020e55e11b801026373d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxhxYoP0Le5ji0hmxNrM:A3k03kHRJjPji0Aj
- TLSH T1EA658C17F6A402B5D067C1B9C5E69A5AFA7138421B3086CF1398C7283F67BD19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.9MB
- SHA256 662f5ca82d52802f52b7bb699455bcdb22448e5d0bf9a6ee71eb75053a1455b9
- MD5 4336e1b83223fa0d195d737e0f074fc4
- SHA1 a972f9eb9409adb25d6f832961b7eeaf614e4cf7
- SHA512 10caf45306c4bd27988c008463b99dc10de9865b4c1e7af622aeac1ddcd14047701983011a4b38cff7a6e0de4d95619dc0efe44eb8439eafa37158976978e9ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxhxYoP0Le5ji0hmxNrMX3Td9CHKo:A3k03kHRJjPji0AjoTd9CHKyao
- TLSH T1E0958D12F7A402B5E077C175C9E29656EA7278461B30CACF1394D6292F33BD19E3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{87EB8AE8-DCC9-4923-8C88-7CEABF61AB19}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.6MB
- SHA256 6b0a1c43b45f25d5f194ce77c883ea7c3a323d152d080aa334660899a52f9bd0
- MD5 004a74a6a86e71e54f24a6a87302f4e9
- SHA1 d46a12cd8247f5e742acb78f1d4892a329ef4d5d
- SHA512 28be0d75a51614dcba5b8b5f30efddae4b3777a484c27b9f0d310fe09aa66208be844ccb18df5a86dcce995759fee427070356853ff6c9f89a9ccbfdbb4d5b5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxhxYoP0Le5ji0hmxNrMZbBPzBAU:A3k03kHRJjPji0Aj+BPVAU
- TLSH T1CC758D17F6A442B5D067C078C5E69A5AFE7178421B308ACF1398C7282F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 749cbbd93b57447f6be28b6b314d13a928eea3c9e1849c583d8da3446213e776
- MD5 5f81de55d96cde86ecbabf3eb72cc83a
- SHA1 3be2b199097d596d472b7e537be1dd0334a88ed4
- SHA512 d226407d025a827207ab83170bfe4f9b46ae59287ec55657867b0ebe7aaecffb6e1a812034c08bd7bb6707599933a46090c1cd2a6735ed7110e625f1fc299357
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxhxYoP0Le5ji0hmxNrMD0Le5ji0v:A3k03kHRJjPji0AjKPji0Aj
- TLSH T180A56C16F6B44375D073C0B9C5D2A69AEE7134821B308ACB1395C7283F67BE59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 2.0MB
- SHA256 38e06ce7273500303e9b31a57238001e791da755dc2756a1666352b632b84a70
- MD5 733b8c538087b1b78f3c3a2c666add8e
- SHA1 8cb51611a0d1c22414e9c9d414440e6c6147b058
- SHA512 5cbcd0ba240fff5bd82c51ca45cca893f7f9a0bdf5e58113565c4542b3f9a17ce2c5a811eee0425aef79059226a5a8ad4a90f9708d0193259deb1d65b9f498b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxhxYoP0Le5ji0hmxNrMzUOlZ7q/4:A3k03kHRJjPji0AjqUOlk09
- TLSH T192957C27FA6846F5D077C178C6D29656EA7138420B30D7CB5368D3292F23BD19E3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.6MB
- SHA256 eda792701a3a6d9b3c0c09935b453c2a71dafdbd192db5e76cc33bda0d748b8e
- MD5 416f8124f05af0f6d087af20bc7ea322
- SHA1 fe8cef1b2c5137cb62e9fbf9f3a41608a4883676
- SHA512 46169be39c16d485a55458ee16c98283d79bb03670d1b2cf78758a9ac1d8fd491c23f35898588698badd02e908372f59b08d31879ec79b64e6454deabe7fc96d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxhxYoP0Le5ji0hmxNrMPF:A3k03kHRJjPji0Ajq
- TLSH T192756B17F6A402B5D067C074C9D6965AFA317C821B308ADF1358F7282F73BD1AA3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$
- Size 1.7MB
- SHA256 ffeaa990c85d5ea2dd55a83b494a26cfa282f34c007f60bab8467b350ae7c9c3
- MD5 96f737d8c6870bfb20f80e2cf8c89104
- SHA1 3620d9246ad0ab1a9e783966d43c876e7ba33156
- SHA512 1ce9aa7541a3bad245cdf42be6eb413dc14ee9e62b94609ca687cae3e529d13ca9e1cac09ad8f551a7281fee8c0be3c06ae4e879282e424dcff8fedc9e9f6bcc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxhxYoP0Le5ji0hmxNrMRpJFCfb:A3k03kHRJjPji0AjgJwT
- TLSH T1A9857C13F7A802A5E077C1B4C5E2965AEA7178425730C7CF235CD6682F63BD19A3A372
- MD5 SHA1 SHA512 SSDEEP TLSH