Analysis
- max time kernel
89s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
24/08/2026, 02:15
Behavioral task
behavioral1
Sample
2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260824-cprtzscl2w
- SHA256 0bbae734a169695a4d5ba4947e10765e9ce7ce6cc598ed9456acdb2da9b2b72b
- MD5 a8cb10d3cb5d15ba5f6a8ace326baf43
- SHA1 2868783c689acbb23cce32d8a1757a8e05ac9a78
- SHA512 aefe483c719789cce25fa09e45b8aa306f2dddf4003bc9745752f12be5cd3b3a5c03eed61fea70caf4fb32081ed906fa85f7b3504adf4b077ae79e588c417718
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cMu:A3k03kHRJ13k03kHRJ
- TLSH T18195AE03EB9400E5E10AC1749AEA5A23EB75BC56176093DF2358D6152F72BD0BF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/2804-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024593-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4692-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2804-52-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4692-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023620-132.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000225f7-1141.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000226b1-1284.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e0c9-1380.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001600000001e0c9-1530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023485-2245.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024593-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023620-132.dat aspack_v212_v242 behavioral1/files/0x00020000000225f7-1141.dat aspack_v212_v242 behavioral1/files/0x00020000000226b1-1284.dat aspack_v212_v242 behavioral1/files/0x000300000001e0c9-1380.dat aspack_v212_v242 behavioral1/files/0x001600000001e0c9-1530.dat aspack_v212_v242 behavioral1/files/0x0003000000023485-2245.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4692 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2804 2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4692 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-23_a8cb10d3cb5d15ba5f6a8ace326baf43_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2804
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4692
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 0bbae734a169695a4d5ba4947e10765e9ce7ce6cc598ed9456acdb2da9b2b72b
- MD5 a8cb10d3cb5d15ba5f6a8ace326baf43
- SHA1 2868783c689acbb23cce32d8a1757a8e05ac9a78
- SHA512 aefe483c719789cce25fa09e45b8aa306f2dddf4003bc9745752f12be5cd3b3a5c03eed61fea70caf4fb32081ed906fa85f7b3504adf4b077ae79e588c417718
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cMu:A3k03kHRJ13k03kHRJ
- TLSH T18195AE03EB9400E5E10AC1749AEA5A23EB75BC56176093DF2358D6152F72BD0BF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 2.1MB
- SHA256 c8af94ca70ac7a63d40e9c5f3aca2b1e7ac95ea06f7d95fd6c9ca838ec1a9930
- MD5 840ef2ce270b2799d56c4d6caedcd2a1
- SHA1 dad6f29d212aad44b821642f7df4cc03beeb4125
- SHA512 dc50a929c32c9f50e6d827c641c7e11801f658c136db60485e4eed409b025d3ca6ed2fca7f30a8ca00b9f9a417616a4e52b79480b435859122c13f9ba75f21aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cMg:A3k03kHRJ13k03kHRJ4UN+Eir
- TLSH T1C7A57D17EB9804E5D11A817899D68722FB75BC511B6097CF2364831A2F73BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.3MB
- SHA256 6bf4b7f2ad198c411bc4323dc0a63aa629b5b00e828fdc41c732eff7148f642a
- MD5 2688a336f2acdc0cfe56a55822fa965f
- SHA1 ae76b417d1df7b0239e14668550d708c36f7425b
- SHA512 e5aba99f171f95e7bd9ec5fae860d56b4aa89ffc9decb412f19e1044b2fe4b6bc6428fc6e703ff3df2d27fbf93af89a6311804859aa5292c363e59c8f49250f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cMT:A3k03kHRJ13k03kHRJGTd9CHKyao
- TLSH T12DB5AE03E7D400E8E16BC2349AA64A22EB757C561770D7CF136896152F32BD0AF3EB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 76f9661854ceb531d049a5156a4a6b80e814b83d93de9edf1678a952fcfc8f32
- MD5 ccf0b92a4a9b18550359162f44ac4a80
- SHA1 7be35627db2d5b5d255814748e58127e13323ffb
- SHA512 125deea37522b6a3e1b7a79cea608c492951668753957e19d98a7a44928f81ff41ba0283c4a8117bb06da74d15548439755baf731cd84a88b5bd9ec992fa24eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cMG:A3k03kHRJ13k03kHRJ4Pji0Aj
- TLSH T135B58D17FBA401B5D026C178CAE69A67EA717C42173097CF1358C7292F63BD0AB3A365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
- Size 1.9MB
- SHA256 4f4ee11dbe28e1d94f22c09e6083a736e308195a2d6637bdca7c95327e5bf726
- MD5 d9cf2bb62c8cca5c852d57090541be58
- SHA1 7805a2b9bbf405c7b86ffe13f759b2e0a37e0af8
- SHA512 0260318886ed9b42eeb2edd3fffafd6a78e166aba1e1ba57fa6af28a2a3b7eaaf969932a79c93681b24c2763f9c85a23afd236f8f0cf36730797021d4172d5e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cMf:A3k03kHRJ13k03kHRJl
- TLSH T16E956A03E69400E4D10E8174D7965A22FA777C5617E092CB23D8D63D2F72BD0ABBA397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
- Size 1.9MB
- SHA256 01bee950b5c9d39676a14df1bfa530401b96e766e58d5f957bbf68f129d67c4a
- MD5 95a041eed073a79d55553dea2aac112a
- SHA1 2affdaf1b2fab6bc7e88df429674f5e0b9713002
- SHA512 46ce905673f8b857ec220639a416e73a3cb48c54599677434fce42fd2c275dc7faa0f0cb05426659a9651cb24ac2bcfc3cf39fc5cc94a6dbbd7837cf4661ff1b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cMy:A3k03kHRJ13k03kHRJ4
- TLSH T167959E03E79500E5D24A81349EDA4A22EA75BD52176097EF2368F7152F72BC0BF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe
- Size 2.2MB
- SHA256 62805654390cf5927e0bf5cb2c192976c40bfbbdb383c514b356fcbb58bf42ab
- MD5 fc228b28c69b2d00761211cd72791ea4
- SHA1 75b92beb6af7b2d1174d1b3a57d82aa4c6088bde
- SHA512 96d1369744b8885dd7ac66178e6583b8a407ebc4a6c1f34e859d4b5acf72ed7c4b6cfe486791b234e2d825135fce856892dc1d430d0f676d990107fd181be09e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cM1:A3k03kHRJ13k03kHRJj1lkWu0ya
- TLSH T167B59E03E7E504B5F1A786306EB59622EA75BC621B31D2DF135886091F32FC0AF39766
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe
- Size 2.0MB
- SHA256 c1f5895307c5eac8019aa939d41a745ac725395853698922746359e7505faae3
- MD5 e3ff92d73aa49b3d6ae80c138e5ce0cb
- SHA1 a5e563504a76c4bfa31d9832c79324310bf9453f
- SHA512 924da9c60d013fdd8f96b80a9137584e483ebd9e3e1b09a42081c249e65bdbce83f80a589cd88846568ad9f0ffe05da89584b30d39ec29807d0a744eb8ff7b14
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGK0T3aRaC3mnXoZ643mnXoZ6i6cMV:A3k03kHRJ13k03kHRJuQZ
- TLSH T1EFA59E13E7D400F5E15A81749AE68A22EB75BC521B60D3DF2358C6052F72BC0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH