Analysis
- max time kernel
96s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/07/2026, 13:32
Behavioral task
behavioral1
Sample
2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260707-qs211sf14r
- SHA256 7a9dad322abac6a009ccb098c6e230d7bdb505273d81375acecb93b3430642b5
- MD5 0c5d5a33c1cd60ae4a56899b4d704139
- SHA1 d7cc8a1f80af7b83bd46a32effbd86194ce5b342
- SHA512 b56cb2a04559025d24939d2fd76ea8ef817c189787f1da18ae2aff987a0a8e19c6fcbfc7ef1842124e2216ecbd3d458d90b7e68044437923326fb179e21d53f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04szJ:A3k03kB56rxeW4SkZP4sz9Mb
- TLSH T122953916F6784B62D07BC075C5D6AA5AFA333C455F308BCB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/2420-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024580-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1232-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e69b-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2420-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1232-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021264-317.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030d-319.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0019000000021275-578.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002195e-1028.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024580-6.dat aspack_v212_v242 behavioral1/files/0x000300000001e69b-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021264-317.dat aspack_v212_v242 behavioral1/files/0x000300000002030d-319.dat aspack_v212_v242 behavioral1/files/0x0019000000021275-578.dat aspack_v212_v242 behavioral1/files/0x000300000002195e-1028.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1232 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2420 2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1232 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_0c5d5a33c1cd60ae4a56899b4d704139_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2420
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1232
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 7a9dad322abac6a009ccb098c6e230d7bdb505273d81375acecb93b3430642b5
- MD5 0c5d5a33c1cd60ae4a56899b4d704139
- SHA1 d7cc8a1f80af7b83bd46a32effbd86194ce5b342
- SHA512 b56cb2a04559025d24939d2fd76ea8ef817c189787f1da18ae2aff987a0a8e19c6fcbfc7ef1842124e2216ecbd3d458d90b7e68044437923326fb179e21d53f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04szJ:A3k03kB56rxeW4SkZP4sz9Mb
- TLSH T122953916F6784B62D07BC075C5D6AA5AFA333C455F308BCB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 3cfea1965dbf65305f1035182eb4387e273a7205651a79702f1aa99b5be0a4a3
- MD5 4a0e317f561d7a616afabaae603715d6
- SHA1 f372450dca19852509c280505fce5c4050b58bf4
- SHA512 9fc3f7e439b7e0728392aee0ae942f6d1b5695fa2d34f099430a0953e7ba2cb8293846bc6dbb1ea491ffcde5c07dae9ad0a333c89fc38733675de56a6f2fb7bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04sz9:A3k03kB56rxeW4SkZP4sz9Mb6Pji0Aj
- TLSH T1DBB52916F6784722D077C0B9C5D6AA9AFA3238451F308ACB0345DB283F277D5963A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 1.8MB
- SHA256 79cd656d74ef12a1c43b2f399e35c4c7cec334da65692fdb24bfece213d3f694
- MD5 61b7b7a0c76919e7c0878a7c2f49f0c9
- SHA1 ea87c7cd403c446ed513751d869ea427d556dd44
- SHA512 b24bd559b007e7b393e27dd5d916560e0d5f72b77ee6e47cb4e6bdcf967755c8f4f1ef9d1881300d8d5ce8cadc8e04d2cc27b999700eebcf7b3720037fb0256c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04szO:A3k03kB56rxeW4SkZP4sz9Mbz
- TLSH T104953916F6784B62D07BC075C5D66A5AFA333C465F308BCB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe$
- Size 1.8MB
- SHA256 2b7aebc56ad97ba944d17c5ebcf0ec7109803890a54e4ae59c8769f3e10b62df
- MD5 91ebe0316d0788a4a3c04384bca433ea
- SHA1 aef8ce70e7ee31bf69d5021b5d5d3c49e8f43e3b
- SHA512 a1479a0432388a4a75fc3a03d460ae8f7a52c0e2c00dd0f30e5b2be656a33e0c449983de0d98ed9335132fa4a686af161033e86793a9a44386916fa5fff4efa2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04szJ:A3k03kB56rxeW4SkZP4sz9MbE
- TLSH T1C6953916F6784B62D07BC075C5D6AA56FA333C465F308BCB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$
- Size 1.9MB
- SHA256 0f8c44d911327812e3bffa52092a5c4677b3ba66d42532a82033038eabb4d804
- MD5 d3f77ca6adcb4e65aeab70d768991253
- SHA1 16cb1c915720a8e9f0a19c39e3fecb22f50b5c86
- SHA512 2d40d0ddb74d61f501496317b766feeff60ff03a910bedd7e0520fb82a4262f45a268c02ce2268672b38317f0c4b8683c4126b61ab7a7e391984d0aa5704f844
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdkcRvMaFZe0p4Ek4niOkl/A04szt:A3k03kB56rxeW4SkZP4sz9Mbu7
- TLSH T155953916F6B84B62D07BC079C5D6AA56FA333C451F308BCB03459B283F276D1963A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.4MB
- SHA256 4a890b70af6692d30adf304eef979c9193dd8d72f44d365a50b3f182c0c046b9
- MD5 5a4e72a1f2ff82d973937bc13853f0f6
- SHA1 6e2c997b59eb4e5234cb65af7e39fd39dcd05520
- SHA512 51c418491b3d533334b7df57d2559432fe227bd202e25e04d1524324832ada0996e9bb03a5e58bbdb1ad67ead18943627909f427f40a57cd9d7698bb17cd6421
- SSDEEP 49152:A3k03kB56rxeW4SkZP4sz9Mbm8tDZqrKV:A3k03kCrlfkZcmm
- TLSH T11FB53A16F6B84BA2D06BC075C5E69A76FA723C410F3087CB0245DB2D3F276D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH