Analysis
- max time kernel
72s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/08/2026, 17:14
Behavioral task
behavioral1
Sample
2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260808-vr5gzavybs
- SHA256 d2c78a88ae987d78e1f907d465ea69a600de2c82539394caf96174e1ab9f3eb4
- MD5 d03612b11f3918dab8210f8a0c74180a
- SHA1 45e87157d39403a9db333f4eab9ff4b50820164c
- SHA512 0f54bc2408cbfceb8e08fe359e8989aeb49a1c4c64ac219fb68a630f6ff4c53ce4a295f1ea9de3f546a860d1c409714cdbf8ba4f630c6fdd4c2275dcdc4bc190
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87JN:A3k03kHRJpeW4SkZP4sz9Mb
- TLSH T1A9855C16F6784363D0B3C0B9C5D6AA5AFE32344657308ACB0349D3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/5824-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024659-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5892-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e44f-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5824-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5892-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202be-234.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002465e-240.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a0-754.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000225f0-1286.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0021000000020242-1539.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002313c-1773.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0011000000000723-2067.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024659-6.dat aspack_v212_v242 behavioral1/files/0x000500000001e44f-12.dat aspack_v212_v242 behavioral1/files/0x00030000000202be-234.dat aspack_v212_v242 behavioral1/files/0x000700000002465e-240.dat aspack_v212_v242 behavioral1/files/0x00020000000216a0-754.dat aspack_v212_v242 behavioral1/files/0x00050000000225f0-1286.dat aspack_v212_v242 behavioral1/files/0x0021000000020242-1539.dat aspack_v212_v242 behavioral1/files/0x000300000002313c-1773.dat aspack_v212_v242 behavioral1/files/0x0011000000000723-2067.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5892 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5824 2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5892 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-08_d03612b11f3918dab8210f8a0c74180a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5824
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5892
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 d2c78a88ae987d78e1f907d465ea69a600de2c82539394caf96174e1ab9f3eb4
- MD5 d03612b11f3918dab8210f8a0c74180a
- SHA1 45e87157d39403a9db333f4eab9ff4b50820164c
- SHA512 0f54bc2408cbfceb8e08fe359e8989aeb49a1c4c64ac219fb68a630f6ff4c53ce4a295f1ea9de3f546a860d1c409714cdbf8ba4f630c6fdd4c2275dcdc4bc190
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87JN:A3k03kHRJpeW4SkZP4sz9Mb
- TLSH T1A9855C16F6784363D0B3C0B9C5D6AA5AFE32344657308ACB0349D3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.2MB
- SHA256 7220f6fa85b83cbbffd4c712a79d32ade6dd659d05ff156493f8edd602c93997
- MD5 1ac8843e2b9fa88985f67da831f88a45
- SHA1 d0b5f772a7729295bef29e5f7e910272a535dea1
- SHA512 fea6f8df6f1499bf5091dc5881af21ff3ffcf4744e7d23f396f40253d95dbcc102e7a1aa9a3bf55c34587440c1bfc111b8a37c0c3bbb7ddeafbf6f223316e021
- SSDEEP 49152:A3k03kHRJpeW4SkZP4sz9MbVTd9CHKyao:A3k03kHRPfkZctCqo
- TLSH T1ADB56C16F6B84376E0B3C179C5E6AA56FA72384617308ACF034993282F377D19A39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
- Size 1.8MB
- SHA256 80fa9b4f46151e1e52cace6e9cc4d0da91aa84994e9777a84c7ab6676ff1629f
- MD5 e8751b9254e332602d009b241611e2b0
- SHA1 eb35006c8424af08abe164f4a1b3994f59380c1f
- SHA512 d22ff2251ae80b27696ff39cb8f494825fc8d84ee2550e2bb76088aca6779006cc526f327b55d7a4317bef060f049cdccb72f08dc2109e0ab54f93ff2b11ea3d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87JD:A3k03kHRJpeW4SkZP4sz9Mbjw
- TLSH T1F3955C16F6B84367D0B3C0B9C5D6AA5AFE32344517308ACB0349D3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 c7a20d55b8397031ff1febfd47bc5f4af4be1bc6703c6b31496ec8aae306d899
- MD5 4f5a80512a4cb5d2e9bb63d6b46dc81d
- SHA1 625a007b00638e0f46f245dad931f6ed1b64b227
- SHA512 0089332339e7b7dcf959ebbce18ca725837135b2db7c13e0bc7a289ac2db3f04a2f453887fb017b599b1f397ad1d701f1697a745e9f609aee26a87481fe275a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87JM:A3k03kHRJpeW4SkZP4sz9MbBPji0Aj
- TLSH T118B53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.8MB
- SHA256 46304bad21976679dbb12ed6d03b5809f80b2eda95c4223d093741739d6d1c4e
- MD5 2958c48c31b6a6d8d056eb2c521073ff
- SHA1 b59db85f4b8c48f328cc37541f359941197c0744
- SHA512 900371bf4c6f4e55d02291cd07f80b83ae1f99a7ea47a48f311c079e66f6519e1eb344a4729eadce368b2d161263c96cf678b6c01c2c1abb723f53b7c575640e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87Jq:A3k03kHRJpeW4SkZP4sz9MbB
- TLSH T191855C16F6784363D0B3C0B9C5D6AA5AFE32344657308ACB0349D3282F277D59A3A779
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.9MB
- SHA256 e46fe3e407df9707271e7857e225972079356396b6d89abf4c81d7498e32653e
- MD5 2fdd919b03401eecb135cd22dce6faeb
- SHA1 e5bbfef4b29ca85a2ba770172db38d82585f2a8d
- SHA512 48a8491dac00b55bc97d5bdb38cb42456efa5c71a4b934adaa6adb58ab90ab103e292938e4ab3798811e42c7c8aaa49c82fa9c2fe69a0afe9ef07046189a0636
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87JD:A3k03kHRJpeW4SkZP4sz9Mbjs
- TLSH T177955C16F6B84377D0B3C0B9C5D6AA5AFA32344657308ACB0349D3282F277D19A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.8MB
- SHA256 32cd40aa440d0dafa68f953cdf40a536a432ec2e4e1081b351b3cafdcd2dc2e5
- MD5 0c4158a2e412b09b511b684c1d088d7b
- SHA1 e2e62f073bea851ba1f2f9adc34b71079bf7c2e4
- SHA512 ff44b60fb610d585b34812976cf9eff9421bef58381d5d7dddf4b8c91c6b04f6836b42443f7e504f228d57a5a48cbfdd45afdd1dd69d40b771dc8312c3b38de5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87JA:A3k03kHRJpeW4SkZP4sz9Mbj
- TLSH T1FA953B16F6B84362D0B2C075C9D6AA56FA313C4617308ADB0349F7282F377D59A3A739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 2.2MB
- SHA256 584aa349b02ce19a6e295a6931d534a0cf55d2e992dd2f90e579a7445340a143
- MD5 0220f1d16f715b2394163294b3974dd0
- SHA1 04514d2730ad60e5e2f3de178d91f10ca86046e3
- SHA512 504243bf10f3d218acd17e173968344a174bf51833917c30085887a30a8e1f4bc586038982704538ac6721a3bbcc6b11bbfe3119bfdf12f88ab459b7075a5ae3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87J6:A3k03kHRJpeW4SkZP4sz9Mb9UOlk09
- TLSH T11EB56C16F67883A2D0B7C0B9C5D6AA56FA3138450B3086CB5359D32C2F277D19E3AB35
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.0MB
- SHA256 d9fc6e8ae167a675c08d6c53dc07555b8e0f3a73a51ba5d8cbc71370a8717060
- MD5 bba22fe95d152b199fc3b3fd22bda1f3
- SHA1 22ba159f603a746fbc1cc24142121e0b520aec39
- SHA512 f036f12ed113e5a85621501c404f5e759a4ec06bfe4e06328645ce51e973224e85588f9de6d9802bb4da7c7fdf6ba754b8da0be4f742b07acb091fbfc3b3c49b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaWaprTZe0p4Ek4niOkl/A04szE87JV:A3k03kHRJpeW4SkZP4sz9Mbxi2WH3
- TLSH T106A55B26F6B84373D0B3C079C5D6AA6AFA313446573086CB1349D32C2F277D19A3A769
- MD5 SHA1 SHA512 SSDEEP TLSH