Analysis
- max time kernel
112s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 16:17
Behavioral task
behavioral1
Sample
2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 2.1MB
- Sample260709-trv3vsdt3p
- SHA256 0c2d8b2d53fe1ecf77334cd57bc1359531b722f7fff62e48f7e24d94d6723e7c
- MD5 de64fa109671afb84f60af0c0a05660a
- SHA1 e0189bd1263465e2ad5f0fe04d96a8e34b88969c
- SHA512 d80bfe85db7350019a00a760df37ad9b3f7faae2295b36f551d62fef6876441766ac8a8f1d54b036128f0d6643ecb3ddfddfe5393a31f81a50c8008e651cc837
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMiB:A3k03kHRJb8tDZqrK0qJtb2I
- TLSH T1C7A56B16E7A442E5E067C178C6E696B6FA7278421B3097CB1345C32D2F337E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2700-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c519-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2700-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3588-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bd1-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000019b0e-664.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b67-662.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a000000019cf4-1033.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b730-1716.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c519-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019bd1-616.dat aspack_v212_v242 behavioral2/files/0x0005000000019b0e-664.dat aspack_v212_v242 behavioral2/files/0x0003000000019b67-662.dat aspack_v212_v242 behavioral2/files/0x000a000000019cf4-1033.dat aspack_v212_v242 behavioral2/files/0x000200000001b730-1716.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3588 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2700 2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 3588 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_de64fa109671afb84f60af0c0a05660a_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2700
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.1MB
- SHA256 0c2d8b2d53fe1ecf77334cd57bc1359531b722f7fff62e48f7e24d94d6723e7c
- MD5 de64fa109671afb84f60af0c0a05660a
- SHA1 e0189bd1263465e2ad5f0fe04d96a8e34b88969c
- SHA512 d80bfe85db7350019a00a760df37ad9b3f7faae2295b36f551d62fef6876441766ac8a8f1d54b036128f0d6643ecb3ddfddfe5393a31f81a50c8008e651cc837
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMiB:A3k03kHRJb8tDZqrK0qJtb2I
- TLSH T1C7A56B16E7A442E5E067C178C6E696B6FA7278421B3097CB1345C32D2F337E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$
- Size 2.6MB
- SHA256 da0f6d128e6fc4d01c74fd6c9b7c3b8850bc05f3486ebc1ef6a29688f6080630
- MD5 981bb91e2811c8c416159be3904421a5
- SHA1 cb6bf84cbd05c755ae46e7f542efe59281dbeb06
- SHA512 f6dfd190961a55d8dfc8bfd137fb0e61a56e385f4dc1ead1109610aa1e503b6b19373267ba00aa8d021c6f61beadba7103ba72b0e9dea9de258ea7824f24dd38
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMiN:A3k03kHRJb8tDZqrK0qJtb2I4T9t2
- TLSH T1C8C56B16F7A446E5E067C174C6A28676FA7278821B3096CF1394D32D2F337E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 650089f4b5f174889f107cf6e8b45f3ad6ec4c2c9bbb4648934b03bc9b82a7e1
- MD5 b965d6ceba7dea382f55d94a49b8eb28
- SHA1 b0d34c723b92882c4c47227cc649a3764040f401
- SHA512 11b2f7098a262e0bdd1f4599e8f84b58c564e92be42d4ceeab0f3c15da9515f10d8ffee2d6739b498dd05d605e170da3e65b55f463fa053ee264f9874885d667
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMil:A3k03kHRJb8tDZqrK0qJtb2IRPji0Aj
- TLSH T1FAC56B16F6A443B5D073C179C5E296BAFA7238421B3086CB5385D32D2F277E19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 2.1MB
- SHA256 86d0d7d1b51c928bcb081d717ccc3de75f610d517146ab1a232c5bd5a91647fd
- MD5 bd347e6045eca514446a59fd5596fa29
- SHA1 7925680da3bba7e198dcf77a1540871f2f40fa9f
- SHA512 5f6d82870a0ae1e57e1ccd347aaaab8b1f6a8a6c4f9a8872573c89c04d63950a011dd432b955136e53d333463958f6ba7eb8e178f04d993612f74b09a7f7c19d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMin:A3k03kHRJb8tDZqrK0qJtb2If
- TLSH T193A56B16EBA442E5E067C174C6E69676FA7278421B3097CB1349C32D2F337E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 2.1MB
- SHA256 9f4bb061d1a80c4fc658238f258dae7faae0a122078a4c60a57baaf802b9d8f0
- MD5 246fe47229f485c98d6ef16280c74ab4
- SHA1 4dd257e395c3775beeee51ed220050b2e23270bd
- SHA512 85ebec8a81a83c4e29b3c80a9da82bcedb8986ee6f2c1b21d75113fff16dea8d0f9c4ce0c1aa36da2482bb43668c5145e5541b586d9cdd755027e582add09c28
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMiZ:A3k03kHRJb8tDZqrK0qJtb2Ih
- TLSH T1BDA56B16EBA442E5E067C178C6E69676FA7278421B3097CB1345C32D2F337E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe$
- Size 2.1MB
- SHA256 9d8c79e9ccfcd155d4e0053e1d3009bc3ca884211a35b1bf6d6f3fe855f70722
- MD5 cca8433e7959e0d2d2ed0c3576598816
- SHA1 db334384861e2837e9012d802492ca58f6a31462
- SHA512 7f7d9c91222d3639c107f9ac0d424753251e998d0ec1128a5b64a437b998d56add3bceeb1b41b767e86d884d757033de8f45a44a1ca08d5864eb19840abc3f23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbcEiKfgp3N+tCn50ChWdArKtYTqMiJ:A3k03kHRJb8tDZqrK0qJtb2Ix
- TLSH T1EAA56B16E7A442E5E067C178C6E69676FA7278421B3097CB1349C32D2F337E19E3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.6MB
- SHA256 df8edbc1cd0fe57d54ad8d0986494d69f208ed12eabd14864e4bc363e406753a
- MD5 dc64c3f615471454dc8fa028de93c36b
- SHA1 6d2c3abb3c2a20f22fe9af7e6b20181691672490
- SHA512 ecc212a34b97ec5805cee162942ae9f7eb65f3463b1bd1a78cba414e3f2fac5064b5aeef789ffe0c329ee717dcf592cbad8506abed5921aefd111f2f6836fedc
- SSDEEP 49152:A3k03kHRJb8tDZqrK0qJtb2I78tDZqrKV:A3k03kHR9rum
- TLSH T126D56B56EBA442E5D067C174C6E6C6B6FA7278420B3097CB4355D32E2F336E19E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH