Analysis
- max time kernel
87s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/09/2026, 01:33
Behavioral task
behavioral1
Sample
2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 979KB
- Sample260910-byvfsscl9y
- SHA256 346ccf928b56efd4eae360e79c6fefa1fab78f3b58f993bdeeac70865082cf8e
- MD5 f706389758908eea73e54086e3f32c9d
- SHA1 16a054b3d50173297afbdadf72dc0c0864447869
- SHA512 e031e4481ef9d7020e87c685a345ba7a3149555930d51a4bb9632718d498e9140f7b26ca82f6516d88cb08ee35c24baa6d00b4a0ded49bfbe2d28dbea463d120
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbzn:A3k03kHRJARJD
- TLSH T1DF259E17F79900E8D14AC2789A968A22FB757C56173093DF2358C6152F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/5108-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e69b-7.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4200-13-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5108-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4200-95-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235ae-159.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021c94-1022.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000224cb-1020.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000022592-1286.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002400000002023a-1545.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002458e-1681.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023102-1767.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000300000001e69b-7.dat aspack_v212_v242 behavioral1/files/0x00020000000235ae-159.dat aspack_v212_v242 behavioral1/files/0x0002000000021c94-1022.dat aspack_v212_v242 behavioral1/files/0x00030000000224cb-1020.dat aspack_v212_v242 behavioral1/files/0x0004000000022592-1286.dat aspack_v212_v242 behavioral1/files/0x002400000002023a-1545.dat aspack_v212_v242 behavioral1/files/0x000700000002458e-1681.dat aspack_v212_v242 behavioral1/files/0x0003000000023102-1767.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4200 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_78859\javaws.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5108 2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4200 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-08_f706389758908eea73e54086e3f32c9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5108
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 979KB
- SHA256 346ccf928b56efd4eae360e79c6fefa1fab78f3b58f993bdeeac70865082cf8e
- MD5 f706389758908eea73e54086e3f32c9d
- SHA1 16a054b3d50173297afbdadf72dc0c0864447869
- SHA512 e031e4481ef9d7020e87c685a345ba7a3149555930d51a4bb9632718d498e9140f7b26ca82f6516d88cb08ee35c24baa6d00b4a0ded49bfbe2d28dbea463d120
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbzn:A3k03kHRJARJD
- TLSH T1DF259E17F79900E8D14AC2789A968A22FB757C56173093DF2358C6152F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe
- Size 1.1MB
- SHA256 cd62c63f2280127701f482c01ffe4461a8d820907086a0054ce0bd0f3222fb77
- MD5 809d162165d834fe728199db1f287453
- SHA1 d40cffd254fa24479c15dad6f0a3fb5b6746ec7c
- SHA512 28bea17e1c325f36a60cc6e6b55feb6f7609dce1df04fad920e2836ac6b1aec6b3b5b807466fb13a57caf50708bd0e82ca0250439f1ac0bfb127b29281bad209
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbz2Gen:A3k03kHRJARJdI
- TLSH T10935AE07F79900F8D11AC2749A958A22FB76BC66172097DF1358C2152F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
- Size 1.1MB
- SHA256 a24480aab2afdbfc6a989324ffd43dc1ec04051bef0b7510b1aa7567c67be6e1
- MD5 0d83232da8de741ee10c5c202621a31b
- SHA1 fd515a77ed437c65c5025bd094e95bc04bce64a2
- SHA512 aac47a4623b0feb0554bc5c1146bacd4b0cbe03470148504b980f918637845c331486b3db9166f2a2639460c6f1cd4a39d1460f4e4853ddc4887767945d19006
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbz1TjE:A3k03kHRJARJZw
- TLSH T1F935AE03F79900F8D15AC2749A958A22FB76BC66172097DF1358C2152F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 1.5MB
- SHA256 8989969a1d79af833a61061cb2d8017298eb28923f4f3cd7b09a33bd961579fa
- MD5 965c5cc0122182e2d3b7284aedd64192
- SHA1 d736911ef0fe6a3392b329102af8c3e66cc5dc92
- SHA512 905547f0092b13f37abb20818caedf2a94b2d07c35eff58d8e863a52454481ff74cc0d6bb6642f095be83b43ca3675ae56083af12486b8ae6f436b7d9c138185
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbzW86n9kAJ9tA3L:A3k03kHRJARJKT9t2
- TLSH T11B659E03F7D801E9E15AC1748A968612EB757C561B70A7DF13A4822A2F73BD06F3E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 1.1MB
- SHA256 9d267c72963fdbdb3f7a59901bd241927783c56d705f19268768d88477ace6a2
- MD5 62950245a82df9fb32fb974ed499b841
- SHA1 92190c32e3d89a61657217059072be45630a236e
- SHA512 05e18b0486f72b6db858291ce2f7b2121086f24783910ed829f0600890247f6c85466e392e3b2717cb654465a875ab3d966b042b7986b6a42101369c81b48c7c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbzQD:A3k03kHRJARJw
- TLSH T1A1354807E69800A8D10E8174DB964A22FB77785617E093CB13D4D63D2F62BD0AEFA357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
- Size 1.0MB
- SHA256 09645c0775e3499caf2288e4811d7bb58a1cebc801a962ac3881063fedab85f0
- MD5 7d75cb6d1a9834c744894a02c002f70f
- SHA1 774697f8fcf538c6885e22fc058458ef43294deb
- SHA512 da70772344d6ed09288b132f22b49e73eb7ef7ac88ca0c591826c6666e0e59a4e1847d763047e29017fd3fe9250defee7eedc770d2223fdb73d4cbaf6574dca1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbz3F:A3k03kHRJARJp
- TLSH T1DB358D03E6D500E9D64A81349E9A8A22FB35BD921B2097EF1358F7252F727D0BF39354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.5MB
- SHA256 757ff6fc5d807b8b5bbab6df9947b5388f67a1b0713e3c402b95019c5e45ae1f
- MD5 05f2a9ce312400858ecdb77ca911c957
- SHA1 b7e482d3676ab5fb52abd2a34f903efb1c4c54b0
- SHA512 e201b937f853114d3838ea86cb86a2c516acadf84718d93ff62fc08f7df494ae903e8ffeb30fd27bafddec80ca90efe7056ea9ceb78a5e007a7cd9ac60750fc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbzZ3N+tCn50ChWdArKV:A3k03kHRJARJ18tDZqrKV
- TLSH T181757C57EBA401E5D156D17886A68672FBB2B8521B2097CF5354C22E2F337E06F3E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$
- Size 1.5MB
- SHA256 f1eaa633e3c4548802931e12b22964bd4cad744b589655b35fdb3089398a0c83
- MD5 844b8ffaf2f7e98e14fe8e21167eee9e
- SHA1 6b7ef40af84cf100f4e0ce70716495c33ee44536
- SHA512 9a3e60950907295f7a9ede91d15eb197588670b3aca4983b751907174fc769bb0b3264bf32360efb1499631921f11a82a0578a5119cdce7dc14228b41f0a2c46
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFj2tmbzGwyCn50ChWdArKV:A3k03kHRJARJuDZqrKV
- TLSH T1FB757B57EBA401E5D156913486A68A72FBB6B8521B3093CF5354C22E2F337E06F3E724
- MD5 SHA1 SHA512 SSDEEP TLSH