Analysis
- max time kernel
93s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 10:47
Behavioral task
behavioral1
Sample
2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.8MB
- Sample260810-mvx83a11bx
- SHA256 9a6b7e171e92ca184fa90740d9a7531323e2f40ebc8da71559cf98e5f1721701
- MD5 1daa06d2d5640a5c6d1e291a82c118b8
- SHA1 26fce955d6d0720ccc9902115401e958a67534b6
- SHA512 c903379435bd159ad18896bfb066ec6d949e6ee1adcab3d0223e1bdaa8e03121af717a95f6ebfbf3394c49ee293db8447e61581db60c699e71c3fd132eac743a
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYq:A3k03kHRaFfkZc86
- TLSH T195D52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D7282F277D5D63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/2396-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002445b-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2652-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2396-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2652-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002354e-125.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000217e3-933.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a2-1279.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022927-1772.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022928-1771.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c00000001fa5a-2120.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000001dadd-2208.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002445b-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x000200000002354e-125.dat aspack_v212_v242 behavioral1/files/0x00020000000217e3-933.dat aspack_v212_v242 behavioral1/files/0x00020000000216a2-1279.dat aspack_v212_v242 behavioral1/files/0x0003000000022927-1772.dat aspack_v212_v242 behavioral1/files/0x0003000000022928-1771.dat aspack_v212_v242 behavioral1/files/0x000c00000001fa5a-2120.dat aspack_v212_v242 behavioral1/files/0x000700000001dadd-2208.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2652 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_89984\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2396 2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2652 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1daa06d2d5640a5c6d1e291a82c118b8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2396
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2652
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.8MB
- SHA256 9a6b7e171e92ca184fa90740d9a7531323e2f40ebc8da71559cf98e5f1721701
- MD5 1daa06d2d5640a5c6d1e291a82c118b8
- SHA1 26fce955d6d0720ccc9902115401e958a67534b6
- SHA512 c903379435bd159ad18896bfb066ec6d949e6ee1adcab3d0223e1bdaa8e03121af717a95f6ebfbf3394c49ee293db8447e61581db60c699e71c3fd132eac743a
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYq:A3k03kHRaFfkZc86
- TLSH T195D52A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D7282F277D5D63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe
- Size 2.9MB
- SHA256 b1444675726d1a9e56676c70d7be43eb9cef070a13271e98429e2d8cab2357fc
- MD5 9043e675c261655a5ddebaea86cb1e2d
- SHA1 cc9f80521c40170a4918fab968908cb74c91e9b7
- SHA512 06b9d8282a8f3c8b129683d1f3c1b285db3142a9b58b5f84b0e091c1e661a2279945027bc419ba639a82b47ee86e52a34a7f69dc336d387425c4b38f7a3740ff
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYqdw:A3k03kHRaFfkZc86L
- TLSH T1DCE52A16F6788362D073C0B9C5D2AA9AFE32344657308ACB1349D7282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$
- Size 5.6MB
- SHA256 6f218f446e96b234d72ab778595662d04c2eb27c3e97256055c12731f165bd1c
- MD5 918e1b4eca76428743a7b487248e72ff
- SHA1 1d9ca0e5f1d518dff9baa4ed13b7bab1704c90e6
- SHA512 436d77e4413e4120ee62ce50cc3227ac34dc688bbc93fca63cbcac8608789cc9e3e662baf1096863b17c755a0a08524535fd38df5043c8d4b6794160f80e5944
- SSDEEP 98304:A3k03kHRaFfkZc86V3k03kHRaFfkZc86N:A3k03kH0hP86V3k03kH0hP86N
- TLSH T1A4562A16F6788362D073C0B9C5D2AA9AFE3234465B308ACB1349D7282F277D5D63A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.4MB
- SHA256 09eb0ec90857cc4160280c23e355bcfa79b8ee3a2462f2cff53a1ddecd666e58
- MD5 4398254875c2c3d05d36622012587215
- SHA1 c492ba6e8a48da6c6acebd6345003c728c30c7b8
- SHA512 dcb6f1231d6300f5273a79c7987f060178901d4ae8bbf4ea46039b279b022170041671ee241e3d1b12b1c4b68ae644e47c9132b12aa3aec3119fb3ff417b2249
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYqjPji0Aj:A3k03kHRaFfkZc86Gjo
- TLSH T18AF52916F6788362D073C0B9C5D2AA9AFE3234465B308ACB1345D76C2F277D6963A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$
- Size 3.0MB
- SHA256 1f88b4256985abeb4e2cc57b31d6729aa63c6a03df66bc8d85368f8f62f2c188
- MD5 a0175c0624bacf3b1b7e91551008c846
- SHA1 b9e869f1ac0cba7ff48be2f34fe2f7891b2bd829
- SHA512 3d816887d65fd5881459dd1cc40a7ead8f96838823ca830e25ba3ac0f2ea5630223bcd0163a7b5a335d81364a28e48656d93edfc80d5aad27a014c5dacd48206
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYqk:A3k03kHRaFfkZc86F
- TLSH T1F0E53A16F6788362D077C0B9C6D2AA5AFA32344557708ACB0385D33C2F277D19A7A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE
- Size 3.5MB
- SHA256 36c8e33cf19df4d9ca93ad6ec86bd32e858fff408006886dfd3b1cec8b2bde58
- MD5 5ea7ca9fcfdf6a0ecb5ccbed0a66de5c
- SHA1 68d10642228d8b2efacc47b48fcf33bda45b5140
- SHA512 b2bdb75fc6eda0ea19eedd4dcdd8f984dea6b94ee3f5862419f66aeef54efb30ee1533e97446183dec1de0e8c9e4b5073b1724763fe9915225c912595755ed21
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYqAIWmKmd7DAS0S:A3k03kHRaFfkZc86vxGX
- TLSH T16FF54B16F6788372D077C0B9C5D6AA5AFA72384617308ACB1345D72C2F277D29A3A335
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.9MB
- SHA256 ac7e60d630bef0c6f09d62e4a48301ce4ab7aeea56d6f366fc2b25f57f3df41a
- MD5 88799ab81cd18f9d8fdfa8761187b418
- SHA1 5d85e7ac71fa7118660a7fab3cfa033a7157fb26
- SHA512 983fea06c4e6cbdb3516113d9f155d38434b32a0b0427935334d7b1aaba4b4f119ac0624f80217b846abdfc26b52871f659a94f1f88749f352679606653ad97e
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYqt:A3k03kHRaFfkZc86Y
- TLSH T17EE53B16F6788322D073C0B9C5D6AA9AFE3138465B308ACB1349E7282F377D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe
- Size 3.0MB
- SHA256 8ba188d049c40ccf7a464e4f2b681b324caea0d41c0bc1c2e88844778e5ff578
- MD5 31a6fb475f6027fb42e0fcf60d39200b
- SHA1 4108ba896491f02684401d6a2c44ec45df63b9a5
- SHA512 53f70b7e370d0d62e8d92b2ceedc44de0c6dc640406a7b020bca71c377401baf0dff04d4504545ac213f8b50e85307b5ab3797bed9ee818fd549a053f84ca145
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYqz:A3k03kHRaFfkZc86K
- TLSH T135E52A16F6B88362D073C0B9C5D6AA5AFA3234465B308ACB1349D32C2F277D59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$
- Size 2.9MB
- SHA256 2f2bf50602d42b50f7325f33205fb2db42abe6dbca5a88cedca5e7f40190ebd3
- MD5 afe2e93b90a14f838994bd7ad5b72817
- SHA1 2504e8d71bb418eadf6e906a03ba102aa97bfb30
- SHA512 45f387b6d2899bd2ee6a2084c06a4d9bd16b79aaf50173a84b3481277843a97e6e4bde24d97859d149b509d8b973fd47772babdfd455199f92a63063064227dd
- SSDEEP 49152:A3k03kHRJgqJtb2IEeW4SkZP4sz9Mb8pYqsccow:A3k03kHRaFfkZc865c
- TLSH T120E53A16F6788762D073C0B9C5D2AA9AFE32344657308ACB1349D3282F277D5DA3A735
- MD5 SHA1 SHA512 SSDEEP TLSH