Analysis
- max time kernel
100s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 15:00
Behavioral task
behavioral1
Sample
2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260817-sdaz4asfrc
- SHA256 2cca3d761905000af1c0e71793495eeb35f1e1dd98dc35ff946ce0936d530a76
- MD5 d35cda045856e2f9dd43a242b6046e5a
- SHA1 0040d76a202c4a7a585b9a6d5f0f88da6923e15a
- SHA512 180124759dac250060f4943135f89b09379ba5e540625c4abce4db3ea38e5873791e590244a590e0ac6eccab4d59178a5ee374e2ee15e6274aa08996feca1127
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5TvinrmC:A3k03kHRJARJg56rX
- TLSH T1F1456A07A6980FE8D11F81789A964A22E7777C124F2097CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/4684-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4e5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-69-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4072-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-456.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-453.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a728-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac2a-1067.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a8a3-1115.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a8a4-1120.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4e5-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-456.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-453.dat aspack_v212_v242 behavioral2/files/0x000300000001a728-1060.dat aspack_v212_v242 behavioral2/files/0x000700000001ac2a-1067.dat aspack_v212_v242 behavioral2/files/0x000300000001a8a3-1115.dat aspack_v212_v242 behavioral2/files/0x000300000001a8a4-1120.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4072 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_132812\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4684 2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4072 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_d35cda045856e2f9dd43a242b6046e5a_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4684
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4072
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.1MB
- SHA256 2cca3d761905000af1c0e71793495eeb35f1e1dd98dc35ff946ce0936d530a76
- MD5 d35cda045856e2f9dd43a242b6046e5a
- SHA1 0040d76a202c4a7a585b9a6d5f0f88da6923e15a
- SHA512 180124759dac250060f4943135f89b09379ba5e540625c4abce4db3ea38e5873791e590244a590e0ac6eccab4d59178a5ee374e2ee15e6274aa08996feca1127
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5TvinrmC:A3k03kHRJARJg56rX
- TLSH T1F1456A07A6980FE8D11F81789A964A22E7777C124F2097CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 8de812e3d571dffb1f4850bdc78165dd2c98a6edc2f08eb8dd7b82d58675dc4d
- MD5 5f3ec2ae9b0992ecf9476131b0d6d52c
- SHA1 227fd7a041dc50e73ae2d0dfbcd5404ca3bf3dbd
- SHA512 d375d5952e48f9bdc44a1aeaf87e44f6d15b35bfef6ad84eaa05f7aa57e780446637ab2bf99be1841c7baaeb84acabf1c8f6b4d868139f01e2239dbebe973ab8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5TvinrmC0Le5ji0hmxNrM:A3k03kHRJARJg56rTPji0Aj
- TLSH T1DE855A16F6A84BA5D06BC178C5D29656EA733C420F3087CB0354DE293F67BD19E3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 1.1MB
- SHA256 9cb4071a5b567871330f4af4098a37f82a6d1e36785009ace86af2c335e53ea0
- MD5 60bdb425db12a2661996f0ddccfe4023
- SHA1 79c3b2f0e7b54adbd4f6a75ceded2a7871be447f
- SHA512 01a1e9b5a362c897d4bd01317d3ab37cdd1603804f9ed7c15728605c08ef16812b2bee8276a7e8ac47f957281a06286421521108c49edc02628a4df4f643c8c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5TvinrmBM:A3k03kHRJARJg56rp
- TLSH T143456A07A6980FE8D11F81789A964A22E7777C125F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$
- Size 1.1MB
- SHA256 3c45ad8f73c21b7536b3dcf473ad26a80e6727fbdc593ed3b292f242adc13e40
- MD5 fe2d42bfaea553455397a70f20ad0249
- SHA1 0a3cc49d1929b133f965f9ff19da0dde41b70494
- SHA512 779ddf0f2f5d28ce62a498ec95ef0ea734c8d2abc4e3f985944a21888c74afae6910be0742293fe6886e2a1fff05cae5568b42f6c706806933298c9d4a54134d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5Tvinrm7L:A3k03kHRJARJg56ro
- TLSH T10F456A07A6980FE8D11F81789A964A22E7777C121F2097CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
- Size 1.6MB
- SHA256 5d2952661dfb0d5072788d0c3c3eb136a19c0f4a6851669e9ab41715a0976ebc
- MD5 8e7ca74a0f2b12769eae6a1a91e4e437
- SHA1 f739a2378af35196c3aa7b36e55f593e13be95b1
- SHA512 074df1d54c4ea771c3ed5061de79ec9770075cb7a42bce443108dfe9093a21358e7923b64cb25555d21955763e10ea83f8f771afb2940ba54c0f1ff094f723d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5Tvinrm9Y3xkjHvBlIDyUUKm:A3k03kHRJARJg56rOLbLAUKv6D
- TLSH T1FD855A17A7984AE4D15F917886A68A72F7B7BC510F2093CF0354DA2A3F336D06E39712
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe
- Size 1.3MB
- SHA256 a9e178fbbb9bd23284ab1d62c29d773a193fd5d42024e84e3afffbdb4d2cd935
- MD5 92b77e42f597d81efe5dbbe4234fedcd
- SHA1 d7c6e3ae0b1940c52cb98d93fbe668028161eb50
- SHA512 153544afe08aebcce65ef4e0b22a38899656c076ab2d53b4195b9686a80dbd7b66d7dad74dd8128a1713f5ffb4b883a546e4a817203caab99d9c8b7cc7902def
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5TvinrmRWolMk:A3k03kHRJARJg56r8N
- TLSH T1AA552802A6540AB4D11F81348691962EE7377C15CF235FCB1354AEDEBFE2AD09E39272
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
- Size 1.1MB
- SHA256 6c672688b33ccc84bd07c9b997e4e66993e1341d5f42616e2a06ccf0902151b2
- MD5 045f3ada88d65ec94ab7af9905c179d1
- SHA1 b38f842e0a7058ef0b48460fcabe5f7c5f965955
- SHA512 d7225323fac503704e44fbac38a2ef90aad64f573dccdfe8a2c09e740deddbc8ffec5547cd728f4643c7cce70e1d538a68fc7dabfda7bc97090b95b31ee84418
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5TvinrmaWl0:A3k03kHRJARJg56rv
- TLSH T1AE456A07A6980FE8D11F817496968A22E7777C121F2097CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe
- Size 1.2MB
- SHA256 c9867ef212b77519120bed13340580ea62770be9e40c23cac4bbb3fb9841fbdc
- MD5 35eb924dbce679c02fd8439b4a342b85
- SHA1 1fc621f2dd8211f0754d2d662e5ae3921f6046a1
- SHA512 c6b3907acae8ff570176ce8a6c12540728bcc493e816f90128f95ae302cdbfb7937efa6e4d4a74101a44d6730ac4ad7ed44f28e89f33919444beac77ad8f16cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFTChQfDaaCD5TvinrmlY:A3k03kHRJARJg56roY
- TLSH T160456A07A6980FE8D11F81749A968A22E7777C121F2097CF1354AE253F72BD0AE39357
- MD5 SHA1 SHA512 SSDEEP TLSH