Analysis
- max time kernel
89s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 14:22
Behavioral task
behavioral1
Sample
2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260802-rpmycsvcrh
- SHA256 7ea23e9ce0589bd14fd3e68313c78013a2c6eeaefba0f377815706511babb86d
- MD5 6405ae1845068ab47f7156ebb7468108
- SHA1 93ef0d5ee9803765284a90a5499156a563108165
- SHA512 ca373409e1d8d04d11481cbf6e9931de771912802f062a63060872031909f5674e3be90ca6f69cd4b628547a37495bd87bc3fdd1ab404d38925fecf1d5bf112e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrM:A3k03kB56rQRJ+Pji0Aj
- TLSH T16B654A16F6A44BA5D06FC078C5D29656EA733C421F3097CB0354AE293F77BD19A3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4600-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243d4-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4600-51-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1852-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021f4b-810.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000226ab-1014.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b00000001e4ea-1270.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000231f3-1629.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001ec77-1947.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000731-2138.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243d4-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021f4b-810.dat aspack_v212_v242 behavioral1/files/0x00020000000226ab-1014.dat aspack_v212_v242 behavioral1/files/0x000b00000001e4ea-1270.dat aspack_v212_v242 behavioral1/files/0x00020000000231f3-1629.dat aspack_v212_v242 behavioral1/files/0x000400000001ec77-1947.dat aspack_v212_v242 behavioral1/files/0x0003000000000731-2138.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1852 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaws.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4600 2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1852 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6405ae1845068ab47f7156ebb7468108_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4600
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 7ea23e9ce0589bd14fd3e68313c78013a2c6eeaefba0f377815706511babb86d
- MD5 6405ae1845068ab47f7156ebb7468108
- SHA1 93ef0d5ee9803765284a90a5499156a563108165
- SHA512 ca373409e1d8d04d11481cbf6e9931de771912802f062a63060872031909f5674e3be90ca6f69cd4b628547a37495bd87bc3fdd1ab404d38925fecf1d5bf112e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrM:A3k03kB56rQRJ+Pji0Aj
- TLSH T16B654A16F6A44BA5D06FC078C5D29656EA733C421F3097CB0354AE293F77BD19A3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe
- Size 1.6MB
- SHA256 238dfb9861bb1e7a5daed3a023a91092c3563ca4cd68e3b7784fcf8fb9cca696
- MD5 29a629e1d9423ffb174f655ce8709192
- SHA1 ffd843476ee4fe12e418b80fcf3ffdae3fb8a95a
- SHA512 773f5e40f5d13807bf08165192437199c3bb646659ac660779f1b280dd512bcc2f5b374cfeb1866515e0b19cf04b8db36f40b44d65360bdba3d25d7aa28605b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrMeGen:A3k03kB56rQRJ+Pji0AjMI
- TLSH T190755A16F6A84BA5D06BC178C5D29656EB733C410F309BCB03549E293F27BD19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 1.6MB
- SHA256 df307428aecf8fac0c6a2ee165beeb46ee75c17dac7cf255fd502625c42b469b
- MD5 748ce7361178c4e9fad5c46cd754c1a0
- SHA1 6b30692a27dcd6682fccda0fdb3976cc6eb4d540
- SHA512 1c63235f77ee79a2ecf744b0bafd7f37932fdb9ecab84f4a1223717b348ccc21f4067c148abc9aac485257f834c2f34c878d3013b474f76c1ee4b1a41489062c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrMdTjE:A3k03kB56rQRJ+Pji0Ajow
- TLSH T17C755B16F6A84BA5D06BC178C5D29656EB733C410F309BCB03549E293F27BD19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 9e4622831bd636563ee40e9737a3197325f02eea70457f32cc5a4be931bd0312
- MD5 26f95c23a9998da6dfb05e3a727300d1
- SHA1 6b720671ca50f4801bb656b15346230df0f9f9d8
- SHA512 fae595408a68d727f3c798e66c96fccfef36b6d98d3312e84ae372fe34f1217eba62f341bdc4eb3cbaad337a80039a8019b87b204b3b4dc1f6739a9c8e885fd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrMD0Le5ji0hJ:A3k03kB56rQRJ+Pji0AjKPji0Aj
- TLSH T150A54B16F6644B75D07BC079C5D2969AEA723C411F308BCB0345DB283F27BE59A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE
- Size 1.7MB
- SHA256 b2fc625abfeddd3259b4d087df902cf9f03966196ff773632765eb4e04df2548
- MD5 a47ea317a52d76f78d2491440fff4843
- SHA1 72018a26305e149549934549210c68b04d123cbd
- SHA512 ff66f912f7606991bee7bae344abb6141b1bc98c555284d9f02e3f2da0463391f33933c24c794994799a8ab2121755614d5d4317e49715d4102fa507b6d01872
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrMdyyCUq7lfF:A3k03kB56rQRJ+Pji0AjoTeX
- TLSH T18C854A16F6A84BA5D06BC078C5929666EA733C410F3097CB0354DF293F67BD19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 1.5MB
- SHA256 40be3b8aa1d44dd75906b34eeac61b9a89928312fca3ac32e28dc6576f063845
- MD5 af987f45e36d5a1b42e74d4d9cba31e0
- SHA1 3499c8b93497e0b1cc91bf61d329a9377afa1aea
- SHA512 3473e34caab48fa3002125c15ccaa360b5b138dceadd8fefc21837d7bdd07c0ed952c2550bb8373478b44aa1dd01cc8b64a04bf75a75a5c8ffc2854886338173
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrMuwE:A3k03kB56rQRJ+Pji0Aj7
- TLSH T1F7755B16F6A44BA5D06BC078C5D29666EA733C411F3087CB0354EE293F77BD19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.5MB
- SHA256 75938108ea5dba9a243b070452d4be041d77183373b892cc255e9e9ff6ae9b70
- MD5 19165c45372ac0e661aa8d90c11cca87
- SHA1 f2e66a4fada2ed263c4ec4e0455f9688b3d423f2
- SHA512 39545796c0ed67619798a1fd0f73e491b040b11f92719ae5af54bc30b853e354dd403ead162b54962a29b295fcd117cc86e1f17a38bcabda36e322818137cd00
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrMPF:A3k03kB56rQRJ+Pji0Ajq
- TLSH T16D754A16F6A44BA5D06BC074C9969656EA333C810F308BDB1354BF293F377D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe
- Size 1.6MB
- SHA256 0805ac793e7e93299b12e3a7c2001ef74a09ca9daa262539b8e0db97f2acd19a
- MD5 95dc692bcd235d70d852166833854ed7
- SHA1 9ea13ec73aad771224a924fd601daa012482cc98
- SHA512 bf5694a3423ca9a47702527a85e31a2ac5e58c2c5505c4486e3f98428f8fd81186cfcc41060e449b2e39bc5a3b60352cbdbe19eb600d8453c6ec30b0f33e467c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaE8ncMJlfUP0Le5ji0hmxNrMhTanBzQ:A3k03kB56rQRJ+Pji0AjJnB0
- TLSH T15D854A16F6A84B65D06BC178C5E29656EA733C421F3087CF13549E293F23BD19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH