Analysis
- max time kernel
95s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 08:42
Behavioral task
behavioral1
Sample
2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.5MB
- Sample260812-kl3fbasfmf
- SHA256 61b7425c45841d1972e29c73378a6288c435003e80f41f19066a2d7c38259433
- MD5 749c7dea85dfbb611dfec845f698977b
- SHA1 1b37f3b9aa63aa1be373c5ce605f3c49cf2a1604
- SHA512 ad95c688d068b2640f0e7d620b41e642d88c9f17a82163ec7097043441109256c44239beb18dd7e66d32ba01e3ebbca4fd750e964a65f4b23b6c7d220dbfba9e
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbkqJtb2IEeW4SkZP43:A3k03kHR+RgFfkZc+fkZckFfkZc
- TLSH T198260916F6788322D0B3D0B9C5D7AA9AFE3234465B308ACB0246D76C2E277D5C636735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4772-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243c7-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4816-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4772-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4816-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002268b-1253.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00150000000202e1-1532.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001000000001691b-1879.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f0000000163e2-2174.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243c7-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x000300000002268b-1253.dat aspack_v212_v242 behavioral1/files/0x00150000000202e1-1532.dat aspack_v212_v242 behavioral1/files/0x001000000001691b-1879.dat aspack_v212_v242 behavioral1/files/0x000f0000000163e2-2174.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4816 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4772 2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4816 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_749c7dea85dfbb611dfec845f698977b_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4772
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4816
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.5MB
- SHA256 61b7425c45841d1972e29c73378a6288c435003e80f41f19066a2d7c38259433
- MD5 749c7dea85dfbb611dfec845f698977b
- SHA1 1b37f3b9aa63aa1be373c5ce605f3c49cf2a1604
- SHA512 ad95c688d068b2640f0e7d620b41e642d88c9f17a82163ec7097043441109256c44239beb18dd7e66d32ba01e3ebbca4fd750e964a65f4b23b6c7d220dbfba9e
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbkqJtb2IEeW4SkZP43:A3k03kHR+RgFfkZc+fkZckFfkZc
- TLSH T198260916F6788322D0B3D0B9C5D7AA9AFE3234465B308ACB0246D76C2E277D5C636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 5.0MB
- SHA256 9672ed86a314b1d19fe10a501ff9456ff3ad274b53381736bd85f95fa5205fb9
- MD5 6efc8adf69140c0fad21bdbc8ee4636e
- SHA1 d86d15d2ec9c87f2d700c5c4d427f158538e5738
- SHA512 13da68ed9062ed3a3e66cb9ade8583a9a509f0cabca0a9425f415b01a6ce87006443f5a5d219f73d96ca3c32fdf57602f0dbb9994eb2283d78b3b6ffc3e6c0a7
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbkqJtb2IEeW4SkZP47:A3k03kHR+RgFfkZc+fkZckFfkZc+Cqo
- TLSH T12A361A16F6B88362D0B3C0B9C5D6AA9AFE3234465B308ACB0345D76C2E277D5C936735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{74A5E9DB-42A6-4629-9DA9-DE27556EBF1E}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 4.6MB
- SHA256 853f4fd279e755352bacaab7aa7b473a07d1c13e18aec7fcff55bd4bc84141a7
- MD5 bcab96dc4c46ef5d86aac0a54d6cebe7
- SHA1 2c727118d96d01c8489b9702d1cc344041c778f3
- SHA512 42b816031cf8a3ad685c699b2a7728562c39271044e6f50a882aee6dbeda39045e97445094e26e7678aa3fb6810d3eff0c00f14a04f41c7081de7d20fdc7c0ec
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbkqJtb2IEeW4SkZP4U:A3k03kHR+RgFfkZc+fkZckFfkZcOBPVl
- TLSH T175260A16F6788323D0B3D0B9C5D6AA9AFE3234465B308ACB0246D76C2E277D5C636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.1MB
- SHA256 2bbd1f6199d1fb86e722e03dad852752cc27d64c185bf78ad81baeb3b89307c4
- MD5 36d0910f1a9024e8135adbab08f21b13
- SHA1 809872daebabfb7b660c0b03a6550f1ecbc9b9ec
- SHA512 336ee388f576e5f672cb66860a73ba42ec28773e2d2548f04e753dba3f37ff89561eaffb08a0998bb030db4f7bffa49017681f5aae30e411411a6d36a6162801
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbkqJtb2IEeW4SkZP4N:A3k03kHR+RgFfkZc+fkZckFfkZcQjo
- TLSH T117360A16F6788332D0B3D0B9C5D6AA9AFE3234465B308ACB0246D76C2E277D6C536735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
- Size 4.6MB
- SHA256 ad8d239f4edd870c9cd98797f11a1108e4c2d241431f79bdafd7c227ac855d0a
- MD5 7d9cf699ab719e7f2c6b8cff9133c9bf
- SHA1 622514c65d20ac53aef049ed535d22826c3e1206
- SHA512 816def6b742c7935ebeadc5be150da44ffbd6abc486e5d466587901d46eb032bb565d16dff9a69fa2c307b1390cf7c78a7bd77170d1a422f86a0c912e3b8b169
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbkqJtb2IEeW4SkZP4q:A3k03kHR+RgFfkZc+fkZckFfkZc6
- TLSH T1ED260916F6788322D0B3C0B9C5D6AA9AFE3234465B308ACB0245E76C2E377D5D636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe$
- Size 4.7MB
- SHA256 5f4c8700e178d0bc9374a862a41f2f460ef29111b6d7126d2b7de56cd48a1241
- MD5 ee2c0b80c2d1dbed25f5e431e9b7e07f
- SHA1 53bec6f0adcad90fc16a01a04aabfc0de9789aa0
- SHA512 9825446bf9bc48ae0ca077892dc780877103a25117835a38ec12ddbffab41351efc397e81803dcbe9eea8e5ac63c91d5630cf0bee12981ac3d8808003899fbc3
- SSDEEP 49152:A3k03kHRJARJ+qJtb2IEeW4SkZP4sz9MbmeW4SkZP4sz9MbkqJtb2IEeW4SkZP46:A3k03kHR+RgFfkZc+fkZckFfkZcq
- TLSH T1E4360A16F6788322D0B3C0B9C5D7AA9AFE7234465B308ACB0246D76C2E277D5C636735
- MD5 SHA1 SHA512 SSDEEP TLSH