Analysis
- max time kernel
99s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 08:41
Behavioral task
behavioral1
Sample
2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.5MB
- Sample260709-kljcfaft8m
- SHA256 786558a540a462d14e8fd5e52441c2622639a6008a1a2d28e21775458a5c6ab0
- MD5 4907a33f01341acdec4530b33a874eab
- SHA1 568162009be27678053df04022f37fbce873700d
- SHA512 276106ce8696f1c506831a1fbc827881b545338b18f6befc9b6eb2e35f81de4c4c74d0166270b83ebc64f0d5c8e0ff43c9283f1cbdd710c779e4f58e64d8986f
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9Mb/TeTPji0Aj:A3k03kHRJfkZc/T2jo
- TLSH T163C54B16F6B84372D073C0B9C5D6AA6AFA7234465B308ACB0345C72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/3784-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001b6ec-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000016bcb-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3784-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4312-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001800000001c47c-529.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000019c1e-1021.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f000000019c1e-1127.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bf1-1213.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000600000001b6ec-6.dat aspack_v212_v242 behavioral2/files/0x0009000000016bcb-11.dat aspack_v212_v242 behavioral2/files/0x001800000001c47c-529.dat aspack_v212_v242 behavioral2/files/0x000c000000019c1e-1021.dat aspack_v212_v242 behavioral2/files/0x000f000000019c1e-1127.dat aspack_v212_v242 behavioral2/files/0x0003000000019bf1-1213.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4312 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3784 2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4312 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_4907a33f01341acdec4530b33a874eab_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3784
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.5MB
- SHA256 786558a540a462d14e8fd5e52441c2622639a6008a1a2d28e21775458a5c6ab0
- MD5 4907a33f01341acdec4530b33a874eab
- SHA1 568162009be27678053df04022f37fbce873700d
- SHA512 276106ce8696f1c506831a1fbc827881b545338b18f6befc9b6eb2e35f81de4c4c74d0166270b83ebc64f0d5c8e0ff43c9283f1cbdd710c779e4f58e64d8986f
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9Mb/TeTPji0Aj:A3k03kHRJfkZc/T2jo
- TLSH T163C54B16F6B84372D073C0B9C5D6AA6AFA7234465B308ACB0345C72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.1MB
- SHA256 75a17aeca64719c716280b75f4eeb560ebd1724dbf727607b7cc167609688734
- MD5 a40a9dd49e73badbd9b33c8a845614bc
- SHA1 c12d3af210a32e78344a7293f077ca8be1ebaac3
- SHA512 adbec3f8687252b17a10a52f7123814390f671b6b68b84a2ed439b9a5af77f0f8f5d5e62243e019d8cd545ce9c9a550aea95813103c03fa6d9831a14dc0233ff
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9Mb/TeTPji0AjKPji0Aj:A3k03kHRJfkZc/T2jo0jo
- TLSH T1FCE53B16F6788372D073C0B9C5D6AA9AFA7234465B308ACB0345C72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 2.6MB
- SHA256 c2fa95eaf07e42e3029b4ec83f990a23030534dc3be53bd0cf92e902f6616d2b
- MD5 ba699f5f1229d297660848ce310c9026
- SHA1 d0e02a76e565a69e48b92041df0413bd64bfbf6e
- SHA512 1df47f733e55d356caae4b15122b322e1bcd401930c40a9880eef6042ef5ed85e2915b80ef270d8a14d7d29dda6bdfd733ea12b8ee9d74d4ec264bd06ad64374
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9Mb/TeTPji0AjP:A3k03kHRJfkZc/T2joz
- TLSH T1D4C54B16F6B84372D073C0B9C5D6AA6AFA7234465B3086CB0349C72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.6MB
- SHA256 bf60064eefac8b1369fd935ba07ba079da713136b30448f1fd0883104b425581
- MD5 4ad725759b8f50880a59c05a0905d5e0
- SHA1 637d3edec4bcdffd727bddcf1c85f2e520f2d4e5
- SHA512 84ef353d6fdcc0b716ab5c7e4e2d6aafad61ebd7d3dc16ff792a23aedefd921d043cd34c2111813ff6928c0214457bb5c2149431eb254a3fbd5783ec8733acc3
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9Mb/TeTPji0Ajq:A3k03kHRJfkZc/T2jo2
- TLSH T1DAC54B16F6B84362D073C079C9D6AA5AFA7138461B308ACB0345E72C2F377D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.6MB
- SHA256 3bd8a30af749a4df2d3ec4f65b6bf8c1d8728d9268c383db2c4819ebfd789c18
- MD5 a35db254385895f64c7e37f41ca56bea
- SHA1 810f1754aab9107bf1f405e8063aadda92e3fb08
- SHA512 99170e8a8d9cfcc78abee82988a9b5763b8203ed0e595952c5a5f582aa53e45cddc22c72084d93195ec1f598154f6f6ea9db610130cf489c1866ef8bbeaf1279
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9Mb/TeTPji0Aj7:A3k03kHRJfkZc/T2joX
- TLSH T1D9C54B16F6B84372D073C0B9C5D6AA6AFA7234461B308ACB0345D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$
- Size 2.6MB
- SHA256 3d8ded7f23b479c9ffa8668463525d9ea6e5869f82eef4542a4078da0134252b
- MD5 ad1759bb43f05abcee794803611b9341
- SHA1 9124580a75d2829743d60e2043df72b2b203dc90
- SHA512 db84bbf50d64811b3d8efd58f61867845fc23b4e5633ad1517fd7aeb29507367870fb58ebbd315b09c78ed7985c918b5560433eb85b402f050c0d867e5bd1fe2
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9Mb/TeTPji0AjS:A3k03kHRJfkZc/T2jo+
- TLSH T13AC54B16F6B84372D073C0B9C5D6AA6AFA7234461B308ACB0345D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH