Analysis
- max time kernel
105s - max time network
118s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 15:01
Behavioral task
behavioral1
Sample
2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.3MB
- Sample260809-sdy2xstsfs
- SHA256 7b53439921bb367089866e80b2cf880ac761ec6712b0cd18ced810229443801b
- MD5 02f8441fa63fe98371f0ba7cb9a03bc4
- SHA1 a25ea3e73b35ec1f790dd2f951e8f3db343fcd32
- SHA512 c50370ae5d8a9ef1c4be5cd91c3eabcacee92b572facd27f4dfb38d3667cb6586af41b890736e3d4cfff811f55d74f9fe6755edc137a3113e5ca59780b658560
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rheW4SkZP4sz9MbE56rf56rX:A3k03kHRirnr+Jr1fkZcBrgrX
- TLSH T199F5D516E2A88F66D06F8079C6925696FA333C414F6087CB0285FE3D3F366D19979723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/3448-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024600-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2284-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3448-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2284-30-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000022602-752.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021c6f-1041.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021619-1285.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000020308-1386.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0006000000000727-1541.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024600-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x0004000000022602-752.dat aspack_v212_v242 behavioral1/files/0x0002000000021c6f-1041.dat aspack_v212_v242 behavioral1/files/0x0003000000021619-1285.dat aspack_v212_v242 behavioral1/files/0x0008000000020308-1386.dat aspack_v212_v242 behavioral1/files/0x0006000000000727-1541.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2284 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe$ 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3448 2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2284 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_02f8441fa63fe98371f0ba7cb9a03bc4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3448
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2284
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 7b53439921bb367089866e80b2cf880ac761ec6712b0cd18ced810229443801b
- MD5 02f8441fa63fe98371f0ba7cb9a03bc4
- SHA1 a25ea3e73b35ec1f790dd2f951e8f3db343fcd32
- SHA512 c50370ae5d8a9ef1c4be5cd91c3eabcacee92b572facd27f4dfb38d3667cb6586af41b890736e3d4cfff811f55d74f9fe6755edc137a3113e5ca59780b658560
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rheW4SkZP4sz9MbE56rf56rX:A3k03kHRirnr+Jr1fkZcBrgrX
- TLSH T199F5D516E2A88F66D06F8079C6925696FA333C414F6087CB0285FE3D3F366D19979723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- Size 3.6MB
- SHA256 0e4fa843b38f7e5a1943a7402d7adc7d52a0d4a8027fa0d2f858db1ff5858573
- MD5 02b1264eb7744a157d104298c8b15f2c
- SHA1 e421fbdef5c4d3359e85d92c6b0b8bc37dd74a57
- SHA512 d6c4aabaa2489434c097b12327d054f5e5f6ffa7a9681090ba64ec59fcc633a1ed0d3c43a32fda9604b4efe09fa1c4998e5e407c64d818e191a861537f32b5e0
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rheW4SkZP4sz9MbE56rf56rtUN+Eir:A3k03kHRirnr+Jr1fkZcBrgrHE
- TLSH T1DD06F616E6688FA2D06F9079CA929655FA333C414F6087CB0285AF3D3F376D59939323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 3.8MB
- SHA256 23950a4b14114a8dd699a2f864d00d49e68cb4e11950a07b8fd6f8bd7a68543c
- MD5 55ffad405cb667b516615c26baea773c
- SHA1 b763f4a50fd9b66295258f68d1af7f955563edd6
- SHA512 d77fe84465dc88c3d47415812c55c7458017723d27e19d1a1ba7f127cf507e5e4dda074a5f1a75e3201f939d55cb736766abdadbcbadb996db4acd9297bd7491
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rheW4SkZP4sz9MbE56rf56rXTd9CHKyao:A3k03kHRirnr+Jr1fkZcBrgrTCqo
- TLSH T15906F616E2A84F65D06F8079CA925656FA333C454F608BCB0284BE3D3F376D19A79723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.9MB
- SHA256 c9da903d1510a9675f739ca70b44b4b0d86b505ec88bd0b53daaae7707c9c05c
- MD5 d28ce3a5b32520c7aa4519b3fac0c011
- SHA1 aacd9efc04c86df7eb90d08417f6d6f22809d01a
- SHA512 ac19e0a90e01accc0678b35ca591d5a8abd97fc2548e45ccc3146442c5e32b851158773d6aef516dfd7bb7df31068df7d6c1710a31517f016afecc92b78e187a
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rheW4SkZP4sz9MbE56rf56rTPji0Aj:A3k03kHRirnr+Jr1fkZcBrgrLjo
- TLSH T12616E516E2684B65D06FC079C692969AFA333C415F6087CB0285EE3C3F376D5993A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
- Size 3.8MB
- SHA256 a3ccba4ca9262050cf34728e7248af804de4e3610ea149fae429cb0451e65046
- MD5 8c242e2c6d4bcf39edd05bf64cb3e279
- SHA1 3c4b9e5b0c839aa787638fddf861df395190c131
- SHA512 83277027a1b4bec9b76f0e87e2ba5511667f9760be0b8f6a0942ff03661cf1b01e7b2dbaa7404dbd64a30f28f2fb354879fdb565fe488e0d3ca111a814e27a48
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rheW4SkZP4sz9MbE56rf56rjUOlk09:A3k03kHRirnr+Jr1fkZcBrgrF9
- TLSH T15406E516E6688FA5D06F8078C6929656FA333C414F6087CB0285EE3D3F376D19A79723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE
- Size 3.9MB
- SHA256 4e819e619f4b777ccd0fedb527f8f3e42e5517ce6c94eb7115f90073469f605f
- MD5 f27c648905efdb004d6cc99500d43a4e
- SHA1 628eb226f45bc654d1d0f05329ca90d346d5f0d8
- SHA512 09a03c9b694912968890bee98e5ee4d49aa08cafb7214b88954b2611d44f3f20a5bd6d808ebcc93d36b82a175e5bb526a1df892d373a2dc5d8d5c36a1e1103f2
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rheW4SkZP4sz9MbE56rf56rOLbLAUKv6D:A3k03kHRirnr+Jr1fkZcBrgrlu
- TLSH T1F416F716E2A84F61D06F9078C69296A6FA733C414F6087CB0285EE3D3F376D19979723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.4MB
- SHA256 f66c1f82f7f3a845cc5f7a39cfa60870b97f36bf30c0ef02dbe8fc886c9c01ca
- MD5 fa4c8437b8c1353bd528bb73f11f58d8
- SHA1 cd9d6f82cb0df06dd23d44091dfe4156fbaf379f
- SHA512 d30cfa590478c88e5e177f0ad6e1ea876dae3d8118731a0c28ea1d36d60cc355a7e22194c8efbde07ec6e0aedf1df9d67e0da5fee241da71a0222454991e10e7
- SSDEEP 49152:A3k03kHRJP56rK56r+qJtb2Ij56rheW4SkZP4sz9MbE56rf56r9:A3k03kHRirnr+Jr1fkZcBrgr9
- TLSH T190F5E516E1A84F66D06F8074CA929696FA333C414F608BDB0285BF3D3F366D19979723
- MD5 SHA1 SHA512 SSDEEP TLSH