Analysis
- max time kernel
86s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/05/2026, 12:13
Behavioral task
behavioral1
Sample
2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.2MB
- Sample260530-pd4evsby2x
- SHA256 e96a41bb60ffded519a8ceea74345ebe7dfc33bc27d5dd91e36dd1ce6248b7b1
- MD5 bbeff42bb801fb1f75784ec0af62658d
- SHA1 66281dda782c2e16cf10ab404ee38242c19795d5
- SHA512 c8611e98e2ad2c7bdf920e1c496cc4bd2e3b409974dabf6818630b09d5f4b70ff5eb64b70758d8b56418f2d54ad2b4196f8acd557c049f3251fc35f2bf902c25
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56rX:A3k03kHR+R4fkZcBrbrX
- TLSH T105B53916B2784B66D06FC079C5D6AA56FA333C465F2087CB0345AF283F276D19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4492-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024715-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3932-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c06-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4492-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3932-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021302-392.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022661-750.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f00000002162e-1025.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000226b2-1294.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002475f-1593.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0013000000016919-1934.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024715-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022c06-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021302-392.dat aspack_v212_v242 behavioral1/files/0x0003000000022661-750.dat aspack_v212_v242 behavioral1/files/0x000f00000002162e-1025.dat aspack_v212_v242 behavioral1/files/0x00020000000226b2-1294.dat aspack_v212_v242 behavioral1/files/0x000700000002475f-1593.dat aspack_v212_v242 behavioral1/files/0x0013000000016919-1934.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3932 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4492 2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3932 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-30_bbeff42bb801fb1f75784ec0af62658d_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4492
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.2MB
- SHA256 e96a41bb60ffded519a8ceea74345ebe7dfc33bc27d5dd91e36dd1ce6248b7b1
- MD5 bbeff42bb801fb1f75784ec0af62658d
- SHA1 66281dda782c2e16cf10ab404ee38242c19795d5
- SHA512 c8611e98e2ad2c7bdf920e1c496cc4bd2e3b409974dabf6818630b09d5f4b70ff5eb64b70758d8b56418f2d54ad2b4196f8acd557c049f3251fc35f2bf902c25
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56rX:A3k03kHR+R4fkZcBrbrX
- TLSH T105B53916B2784B66D06FC079C5D6AA56FA333C465F2087CB0345AF283F276D19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 2.7MB
- SHA256 324ad206edfe88887dedd5ddea9c0d68d45783be581dd4ebb12f129ef283502f
- MD5 94a0f098fb9c4b9a6ea7b31042c89bc3
- SHA1 4dc0972bdac765c8ebefaa8f5da5da609d830f54
- SHA512 779b3744631156d1e2acc4c88f570a089d8c067d04a5a30e12f5d2e63e6c7fb0357b8e75ebe1916c33f0f536509fb38a6b210dc3a1a0a1d1a398d2d8fa63bd4b
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56rvUidGl:A3k03kHR+R4fkZcBrbrvdGl
- TLSH T19AD54A16B6A84BA6D06FC078C5965A56FA733C460F3087CB03449F293F277D59A3A327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$
- Size 2.3MB
- SHA256 02a70367f95706d52de25225c82d92842561c5372c4c087753f249f54fd99c8c
- MD5 273587a09d7ff68dfb6c5b4c099e6b27
- SHA1 cb1bd02761d78fbc3551c2aeebea44004521072c
- SHA512 13cdf5a64b49453bf0e47b73d3d1d2a35706fcb9dbe08474ba1d644bee56981d62694cf520167c8387de7ef54b88ef8297452af1d83a1cbb8157efa8fd059630
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56rNw:A3k03kHR+R4fkZcBrbr2
- TLSH T104B53916B2B84B66D06FC079C5D69A56FA333C465F2087CB0344AF283F276D19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.7MB
- SHA256 ba28b7ac4a893936384db8c5a2c356e9d36e094dc60e735c601604378d4e96a9
- MD5 4f198876567d30246797bcb76df2fdf9
- SHA1 ed328046eb523591a484225e92e52086d4e90249
- SHA512 673032a80c8e46c1c75c2e69552e5b3000ea8ca540c44a93b9bb897f79d0e8c6b723466aff8441f81981400085c24e556ad2b7997325fb27bff6a02249dc8536
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56rTPji0Aj:A3k03kHR+R4fkZcBrbrLjo
- TLSH T171D52916F6784B66D07BC079C5D2AA5AFA333C455F3087CB03459B283F276D19A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe$
- Size 2.2MB
- SHA256 345872f03dcbf42931c3d10ffef88bdcf511e61eccb1209dc3f567c16310db4d
- MD5 cbbe035c0101cdf2cdb39b1246015294
- SHA1 bc4380d7a07cac9669730b97db692c8c9073f91b
- SHA512 6c6bb4b33c48c4c6e98a6a579957ce383fd2e006f745b7631f0c8df92b16820b6da2a8df54b37e4c97325007c0cf2409cac31d043da787aeeee527be0083aad0
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56r9:A3k03kHR+R4fkZcBrbr9
- TLSH T1D4B53916B6B84B66D06FC079C5D66A56FA333C465F2087CB0344AF283F276D19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 2.6MB
- SHA256 1af6e99085d2d702b0162bcdd1950d65f84a064b8983ace757e4b15b088a56dd
- MD5 fd23e0af8cde662344382536f37a805f
- SHA1 70cb443b63468d6250fbcfde7250437a4baa56f0
- SHA512 a577039ffb5c9a8d8854775785c80ad1da7156a3c7991eac68762427e2bd8293d14b3930b0636c9479d8abdac30a0b3ec37ecaed844a591a423cdf82a072693f
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56rjUOlk09:A3k03kHR+R4fkZcBrbrF9
- TLSH T15CD53916F6788BA6D07FC078C5D69A56FA333C414F2087CB1354AB293E276D09E39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.2MB
- SHA256 6c728597c9b2073d73ff54af8f2cf9982eaa3daec3eae0c5f02fbd36a79cd4b4
- MD5 d089fc282fe8eac83466cd6b181f3136
- SHA1 0c8f1744be5c3fb43d5f7556796c4a3e6fa0f22d
- SHA512 e8f2cfb9ae035393a1d8a9155566e593b28dd14e60d8cb72fcc8dda9f7d48aa24984b0114e72f09c5d610d48d494d5159d5ce736f93f27e02572e1aefd1954a1
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56r0:A3k03kHR+R4fkZcBrbr0
- TLSH T196B53916B6784B66D06FC079C5D6AA56FA333C465F2087CB0344AF283E277D19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\crashreporter.exe$
- Size 2.2MB
- SHA256 b9c2e0ae9f94610fcec050dedf03fea0c379e7a8d98c7190ec6d1ebc287052dd
- MD5 08fc3c0c40a6f1eba4898b01c78d1758
- SHA1 a8fa504f136a70b3a7270a659b49b17ff9d13f1a
- SHA512 b53c328fbb11cc4904ca33f61ae463a63e04f1a21e3a7f32b910bf20207b8b1d4da67d34cb903f1540ed2321a27ed99ee1a02cf83c05352c34cb29ff9b19e52f
- SSDEEP 49152:A3k03kHRJARJyeW4SkZP4sz9MbE56ru56r9:A3k03kHR+R4fkZcBrbr9
- TLSH T1BFB52916F2B84B66D0ABC079C9965A56FA333C454F2087DB0344BF293E376D19A39327
- MD5 SHA1 SHA512 SSDEEP TLSH