Analysis
- max time kernel
79s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
19/05/2026, 02:56
Behavioral task
behavioral1
Sample
2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260519-de79naft7v
- SHA256 d5bfb8a4545df19b32371eb171878f7453d5daa5d82847d83e73bacf558861eb
- MD5 39c67aac5e98fc5ab9cdd11e643bf554
- SHA1 213911539a94aa98bae63559ed1db99ae201a0ec
- SHA512 a0a05201b011d0938e730ae768f203516ce7af6efed79b867db56071319e81fcee868b569ff12a887bb0eaf98ad09d6400afed22dad8cb14013376feb4898e19
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi43mnXoZ643mnXoZ6i6cMJlCUQ0l98bs0:A3k03kHRJN3k03kHRJI
- TLSH T1F475AD13EB9500E8D10AC1749A9A9A33FB75BC561730A3DF2358C6152F62BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/1636-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000024419-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2880-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b67-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1636-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2880-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000235d1-162.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000004ea-1032.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000002023c-1388.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00090000000244cd-1588.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244ed-1704.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0010000000024419-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b67-13.dat aspack_v212_v242 behavioral1/files/0x00030000000235d1-162.dat aspack_v212_v242 behavioral1/files/0x00080000000004ea-1032.dat aspack_v212_v242 behavioral1/files/0x000a00000002023c-1388.dat aspack_v212_v242 behavioral1/files/0x00090000000244cd-1588.dat aspack_v212_v242 behavioral1/files/0x00070000000244ed-1704.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2880 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1636 2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2880 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_39c67aac5e98fc5ab9cdd11e643bf554_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1636
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 d5bfb8a4545df19b32371eb171878f7453d5daa5d82847d83e73bacf558861eb
- MD5 39c67aac5e98fc5ab9cdd11e643bf554
- SHA1 213911539a94aa98bae63559ed1db99ae201a0ec
- SHA512 a0a05201b011d0938e730ae768f203516ce7af6efed79b867db56071319e81fcee868b569ff12a887bb0eaf98ad09d6400afed22dad8cb14013376feb4898e19
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi43mnXoZ643mnXoZ6i6cMJlCUQ0l98bs0:A3k03kHRJN3k03kHRJI
- TLSH T1F475AD13EB9500E8D10AC1749A9A9A33FB75BC561730A3DF2358C6152F62BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.8MB
- SHA256 70140a382716fa64c9064b42aeef195df17b3b247703b3883e196f4de764b9e3
- MD5 ec942557b9a14d7b9ec2b5f2e8b7bf68
- SHA1 223e7cbf814d3ad3a71885a53f613a9ad054c0ab
- SHA512 de14e30f315dfdf9b6c0ce5461e3fbe7bcfbd4b6c1a6aeb033adf99cf0306059b8bc2571f9baacd3b091428a107ba0e97880122503501ee1e89848d10d890d2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi43mnXoZ643mnXoZ6i6cMJlCUQ0l98bsu:A3k03kHRJN3k03kHRJwUN+Eir
- TLSH T18B958D17EB9804E5D11AC1785A968722FB71BC511B6197CF2364831A2F73BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
- Size 1.7MB
- SHA256 729ac3d896ee5494b5f61f891ab394f11075fe9897453072d6ebd30694dcab57
- MD5 782921e2afbc26d111a2ca15087dceb9
- SHA1 a250f1da721357c84f36b35b32004f58ad6ca13a
- SHA512 5dd9dba159a7bb76f04dcb1ec11105d564a43ca03e7b5c1efa89a420caf561d2609319c95856f55154aceb062d1d095242ac5f3210566fb0c2a7e3279d8e5603
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi43mnXoZ643mnXoZ6i6cMJlCUQ0l98bsH:A3k03kHRJN3k03kHRJyI
- TLSH T17285AD13E79500E8D10AC1749A968A32FB75BC561730A7DF2368C6152F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
- Size 1.7MB
- SHA256 d29e4c996346363eb6f8316f659faf61f1d690f55c6bacc877c8483acb04b064
- MD5 f9632db945fdf3eb6738a7d9b9ab346e
- SHA1 80d82c0deb07688ec81c2427f27bc53fc7ed539b
- SHA512 885c7a6d164b4649dcb0f7a67f5e3567fa52009d868bd324d82d92992aa61ed3a379c63340cc274c94fa77204da51ca7492e22178e1845599676c9f1eab1f442
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi43mnXoZ643mnXoZ6i6cMJlCUQ0l98bsH:A3k03kHRJN3k03kHRJmw
- TLSH T1B585AD13E79500E8D10AC1749A969A32FB75BC561730A3DF2368C6152F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 1f39ffbb5ee267aff6c38c9658c97e78101b1af0fb0ed7906ede2732031135f8
- MD5 b3ecbbca2dea26a21edea1e92d32cabc
- SHA1 c6d30a5c84d1b8d4daa608414b309aaac9f0ab50
- SHA512 9c37266afd5bad070954de61d3d126c4c7d0d679d37b9345b2250d034cf6edbd3894b9fda2a1909f7976ef41d5b35cbd74e84c580607f64f8b7d91c38d860fb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi43mnXoZ643mnXoZ6i6cMJlCUQ0l98bsI:A3k03kHRJN3k03kHRJQPji0Aj
- TLSH T1F2A58D17F6A402B5D026C1B8CAD69A66FA717846173097CF1358C7293F63BD0AB3E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.7MB
- SHA256 3814d008011c519d124d7b04f0259a637f8ed7d27965927dd7326422c07563a2
- MD5 49b506c56e3e7b887a001a7d622a759d
- SHA1 caef89065411ed74ada442b0fcadf66f0884431d
- SHA512 7ff4c02c97e8990c06814b97e2bcc11cbd735e6453a3e71285474712555c9b0736e5c9966606285f27c9ea2650d60693887aec7f4b2b6a4157e8676f847a89e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi43mnXoZ643mnXoZ6i6cMJlCUQ0l98bsB:A3k03kHRJN3k03kHRJt
- TLSH T1E1855A03E69400E8D10E8174D7958A22FA777C5617E092DB23D8D63D2F62BD06BFA397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.6MB
- SHA256 ba83e66ff2dfa711d47a7798272b34939cce10a9d9b7e3053b71742d950de49d
- MD5 4692b70f090dec5977b58a450685f3cb
- SHA1 763266ad39bde4b040c91ceba2cac6fb9bb79bf0
- SHA512 a9a4cbf39ebaafa859a958c44cc8d414f9fc5925505db7432a3e73a817d0ac7243f6b75c46c7cdd0f259a6aa6854b2bd7eb88fbb310a5798c0c3d3b2b562728d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsi43mnXoZ643mnXoZ6i6cMJlCUQ0l98bs5:A3k03kHRJN3k03kHRJV
- TLSH T1FF75AD13EB9500E8D10AC1749A969A33FB75BC561770A3DF2358C6152F62BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH