Analysis
- max time kernel
77s - max time network
137s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 18:10
Behavioral task
behavioral1
Sample
2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 1.1MB
- Sample260810-wr7srsvbqa
- SHA256 dd7b571b5ced0f7eca9492fde1920c8619d78b3250d0755c98933cf59e9dcfcd
- MD5 d92fc1f91b460d1ec0d54f3d55ad7e5f
- SHA1 ea173139f27811591bd178740d8864558c912962
- SHA512 4023e5bf794126ee2ea831fd5027b3e95aa1e5c905330431039f7729c4a4d12a1302df9cc495c65e306d6599a77922ff41063c1353c12e72652498e7da49b46c
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5TvinrmC:A3kMhT1Llj556rX
- TLSH T1CA357B16A6940FE8D52F813889914922E7737C164F6087DF1364AE263F337D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/2168-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024435-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3756-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2168-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3756-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023544-185.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002268a-1278.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00100000000006d1-1592.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001e0fc-1700.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000001da68-1978.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e50e-2068.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024435-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x0003000000023544-185.dat aspack_v212_v242 behavioral1/files/0x000400000002268a-1278.dat aspack_v212_v242 behavioral1/files/0x00100000000006d1-1592.dat aspack_v212_v242 behavioral1/files/0x000400000001e0fc-1700.dat aspack_v212_v242 behavioral1/files/0x000800000001da68-1978.dat aspack_v212_v242 behavioral1/files/0x000200000001e50e-2068.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3756 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2168 2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 3756 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_d92fc1f91b460d1ec0d54f3d55ad7e5f_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2168
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 dd7b571b5ced0f7eca9492fde1920c8619d78b3250d0755c98933cf59e9dcfcd
- MD5 d92fc1f91b460d1ec0d54f3d55ad7e5f
- SHA1 ea173139f27811591bd178740d8864558c912962
- SHA512 4023e5bf794126ee2ea831fd5027b3e95aa1e5c905330431039f7729c4a4d12a1302df9cc495c65e306d6599a77922ff41063c1353c12e72652498e7da49b46c
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5TvinrmC:A3kMhT1Llj556rX
- TLSH T1CA357B16A6940FE8D52F813889914922E7737C164F6087DF1364AE263F337D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
- Size 1.2MB
- SHA256 28ee422996b6e03fcc5c97e43f5e0bc894e348d3e7e16b51c4e9720038ecb810
- MD5 64e7449e3927aa73815026cae21ea312
- SHA1 88e4cfa46eda4096dc97b0b80c6bb0e01a7d9c1e
- SHA512 610fc9cc0bc9259bd50309ea6628b3d5d62a2f8f118709ce9b7e7c3b67086957387ea4b1e474021772af90f63a5706765d90e8c255701c6dd8fd1543ee74402f
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5TvinrmpGen:A3kMhT1Llj556rJI
- TLSH T16D457C16A2941FE8D52F813889914922E7737C264F6087DF13646E263F337D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$
- Size 1.2MB
- SHA256 25e9dfed828fea033b02382ddabcd9db39e68c459d6a2ff3ebb57b9c4880bb58
- MD5 cded77d8d8e6bbac34156d8abb026f40
- SHA1 8f506af0f3a20d4610cb9cb0ffb27b12177a8925
- SHA512 c07ee35d18052679f5cc12b69d2dd5751e1ec9088bfc52f888469ce352899b786674bc7baa46e5660e88cfcd49fabce2d88f2a92ce780009a4d897a68a9b5cb9
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5Tvinrm+TjE:A3kMhT1Llj556rNw
- TLSH T1C6457B16A2941FE8D52F813889914922E7737C264F6087DF13646E263F337D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 f3084641b9d4e049373d3deb6a25eceab37c8998dc36aed263677aabf76949da
- MD5 f77c8df04f218dab281ff0cf6c793b03
- SHA1 fb45258acb712586d609b9bb529036079f219159
- SHA512 3dae47b9a67798efaebfff8b748e2a9775a22723c1349e9e0e7c1f43e56e73916d9baa51be71b77de2bb02dfc2777f6f796f6a3bcb9264ac797ae3d8eba9f032
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5TvinrmC0Le5ji0hmxNrM:A3kMhT1Llj556rTPji0Aj
- TLSH T16D755A16F6A44BA5D02BC179C9D2565AEA733C420F3087CF1354AE293F337D19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 1.1MB
- SHA256 62b77c2d41f1e8828c5a96fc86fc0183b033d4a85e60415a711dc3157221f231
- MD5 7147f8f12db3173953fd0cbffbabb91f
- SHA1 5b556824d473a6895a2ac146a83f2472daa5e48c
- SHA512 c2850a2e669d318618872d164e10e6c677b58c061d2c58dd1acb76076de942662e2ea3e2382ef9bb4a9c398467d1d32cf045f7c17ed03c2e9f6f5978efb72e53
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5Tvinrm/s:A3kMhT1Llj556rT
- TLSH T172357B16A6940FE8D52F813889914922E7737C164F6087DF1364AE263F337D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
- Size 1.2MB
- SHA256 e9edb5c25ce2ba229fca98cf08772aecd213384e40d1c0118ffab531f33ecd89
- MD5 3337e9d35bbe54b869ea6fc8a470131d
- SHA1 773614590a9ec3c4c7ed96118ffa8c12cbc4cd3d
- SHA512 b4c78d3c33ef28622dab34dc9ea11feecf05744622453eed2ad2ca164856b57e06bd9d1d01afe138b9b3b2a17357455dabf262c24a444f784777b3b2a05306e3
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5TvinrmgF:A3kMhT1Llj556r9
- TLSH T14E454912A2940FE5D95F8134CD964A22E6737C560F208BEF13647F263F337906A2A767
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe
- Size 1.5MB
- SHA256 84044f8cb5c99a013f5f25cfe5a6d44f000b1ca1227420a816148680775ad3df
- MD5 c841f1906aa09bcca97252a6fb2ae513
- SHA1 2f159afceb9ca93bf8cbca13d8d32fffc9de5d37
- SHA512 d41ea119167879db5df61cc899a41ba223cd67eddfd2569ea769ebac76605f19607334ff5b14170d00df8afc98a0e3f1102a285c6c589876577e5f10d6aeb22e
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5TvinrmJ3npi63iC:A3kMhT1Llj556reXpiMh
- TLSH T1F8755B02B3E44AB4E5BB46349AB54522D7777C225F30C3CF13946E193E72690AE39B63
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.3MB
- SHA256 b7510b71de63074a00b8858e4d5e16587cb7c79fa850248d75b09b53e218478c
- MD5 d855bb2d23d72879ea530b33c95e19d1
- SHA1 e78e5092255fafb911d135a6f1be1b92e000e177
- SHA512 634c19431a87b6a862b47bc8fa7c6735fdbd034b12e98bbb36683343fd8157b432ebf92a1803ea1eefa18a8f9597ebc7d6bc4f26ad3b6c6949bf6e8b296484c2
- SSDEEP 24576:A3mnXoZjzyUTWaLl3z0zDMCpGdXEK2AVD5TvinrmXV+PAk2hMH3:A3kMhT1Llj556r4i2WH3
- TLSH T132558C22A6940EF5D52F813489A54526E7737C124F2083DF1364AE2A3F737D06E3A7A7
- MD5 SHA1 SHA512 SSDEEP TLSH