Analysis
- max time kernel
83s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 19:53
Behavioral task
behavioral1
Sample
2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.2MB
- Sample260818-ymd11azalg
- SHA256 d5c453f4eb06908e5b231a7efe8325faa98e38e932b972e2e0fdf3b4d3d88e81
- MD5 dd2eef849d3f3ab0ae369fb1fa884198
- SHA1 2967843f03277b1ec8eb6a27f7c20c508dd3ad1a
- SHA512 c98909693839a02c6a00e481b89b720ee91e7dbb121a010bc195185c051d55ac1120ba70ba7e0c04b6a731ddb1f63198fcc55ecfa15e97bb23a66af234ab5bf0
- SSDEEP 49152:A3k03kHRJpi+eW4SkZP4sz9MbmeW4SkZP4sz9Mb:A3k03kHRXiWfkZc+fkZc
- TLSH T18EF50756E7788B32F0AAC075C6D26669F933384907E285C7028EE72C1F376D585F532A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/1732-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024687-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4528-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1732-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4528-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235d0-137.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000212ce-524.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002163d-1251.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001300000001db74-1530.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024687-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b67-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235d0-137.dat aspack_v212_v242 behavioral1/files/0x00070000000212ce-524.dat aspack_v212_v242 behavioral1/files/0x000200000002163d-1251.dat aspack_v212_v242 behavioral1/files/0x001300000001db74-1530.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4528 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$$ patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1732 2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4528 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_dd2eef849d3f3ab0ae369fb1fa884198_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1732
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4528
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 d5c453f4eb06908e5b231a7efe8325faa98e38e932b972e2e0fdf3b4d3d88e81
- MD5 dd2eef849d3f3ab0ae369fb1fa884198
- SHA1 2967843f03277b1ec8eb6a27f7c20c508dd3ad1a
- SHA512 c98909693839a02c6a00e481b89b720ee91e7dbb121a010bc195185c051d55ac1120ba70ba7e0c04b6a731ddb1f63198fcc55ecfa15e97bb23a66af234ab5bf0
- SSDEEP 49152:A3k03kHRJpi+eW4SkZP4sz9MbmeW4SkZP4sz9Mb:A3k03kHRXiWfkZc+fkZc
- TLSH T18EF50756E7788B32F0AAC075C6D26669F933384907E285C7028EE72C1F376D585F532A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 3.7MB
- SHA256 8656e310c8477f85033223759f62eb274ef8c0bd36288d2262e1849602faa761
- MD5 44b7234a0919a6cd743e2a86b8a31dc6
- SHA1 92c1818825fda8653f2a51c81a73a42c1e508d6f
- SHA512 5d40a1f1e7edfe0e884c9c61037de349bdbc4b2b2632b811de29c8a09bf518ce26d97e28564d98013ad734283cbdf332d87ae5b9638a9fbcde87ae70b812b6c0
- SSDEEP 49152:A3k03kHRJpi+eW4SkZP4sz9MbmeW4SkZP4sz9Mb4Td9CHKyao:A3k03kHRXiWfkZc+fkZc+Cqo
- TLSH T13A061856E7788A72F07AC074C6926669F9333C4907E18ACB028DE72C1F376C589F5726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.8MB
- SHA256 3ff4a31fa38f7dce5aeebb7cca8df70ad12243e53eeea51caeed85e058af6c19
- MD5 454f0a50268ce23e8eb819639d6d4e96
- SHA1 c949b91a5a66d03726b2a35ad019aa1a9a460c67
- SHA512 9e4fe04825da78bd9023254ec257f2ac9b197e90715526a6644e6191ff6febf5de43a0cc0a1fa7e35c8d1ce95bcb33328298b9bfb8e2ee3519bc1ba4f99d900c
- SSDEEP 49152:A3k03kHRJpi+eW4SkZP4sz9MbmeW4SkZP4sz9Mb6Pji0Aj:A3k03kHRXiWfkZc+fkZcQjo
- TLSH T1A606F756F7788B32F06AC075C6D2A669F932384507E185CB028EE72C2F376D586F5326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 3.4MB
- SHA256 bbe85e4cc7a9f19ba0cfd191899fad4f32533cf2f9b5181cd5065a8ec29f32f5
- MD5 653ae2de339b0f46e8d1daaadfe03a7a
- SHA1 28d9822a0ccf65835024f6b3cffb3f02885b076e
- SHA512 9fe9aa65febae81f3d2d818e0ea2f18ce21895e11a99a51a7dafccf06f1f57f259c28b336077c54cc0ad37c430f8e74d5f9642076fdd9b7cc103f274ae972e76
- SSDEEP 49152:A3k03kHRJpi+eW4SkZP4sz9MbmeW4SkZP4sz9MbH:A3k03kHRXiWfkZc+fkZcH
- TLSH T101F50756E7788A72F06EC075C6926669F9333C0907E286CB028EE73C1F366D585F5326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$
- Size 3.3MB
- SHA256 cd9d142aab423bac310d78b9082465b3ba9462c90ebd2cb95cfc959e41eb6188
- MD5 40b2883267e229f44d97745600005258
- SHA1 dea3c3c45e940844ecb5a6ff20319843bee5ea20
- SHA512 c0b7455af4d804a2783a98b5190604f68002acfdfbda714041e785eaef942f56f3efd1a6c3a76ea1e4e51dfc9c4c43013eb38d74cb320947828eece6be6612d2
- SSDEEP 49152:A3k03kHRJpi+eW4SkZP4sz9MbmeW4SkZP4sz9MbQ:A3k03kHRXiWfkZc+fkZcQ
- TLSH T1D3F50756E7788B32F06AC075C6D26669F933384907E285C7028EE72C1F376D586F532A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.3MB
- SHA256 bee99ab7f1981a77577bb65754e65c05b88b60261d621c30246b0d52a1afb784
- MD5 cc405b74498b5791d7fe5e0d2f6125ce
- SHA1 c7c6473203e2591117e0a89068c2e2796eae9cac
- SHA512 26a484614f08fa6a71fa0e68a1845ecfaad520689fa42289d80c34374080437248aa8ab8e254046edb70402726d8a85b40970b2e612b83fbe6ef60ed17e8eef6
- SSDEEP 49152:A3k03kHRJpi+eW4SkZP4sz9MbmeW4SkZP4sz9Mb6:A3k03kHRXiWfkZc+fkZc6
- TLSH T16CF50746E7788B32F0AAC075C6966669F9333C4907E249CB028EF72C1F366C595F5326
- MD5 SHA1 SHA512 SSDEEP TLSH