Analysis
- max time kernel
91s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/07/2026, 01:05
Behavioral task
behavioral1
Sample
2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.0MB
- Sample260730-bfkhwaap9v
- SHA256 26b420556dcabdb45223bae0e6a9b05ec6367f80150aba058bbbe4e4bd3a5bbe
- MD5 eaa00886f4b894aa9f1534a03ff7b290
- SHA1 87517c43ea4de441a22913a35beadde974dc8380
- SHA512 cfe650f0e7e85b0b72921addaff91c543bd1ecb5f4ec711fd61bd3abe51abbc766cd12333ac76828526b10d8fecaadd798513ce8703f3eb659c2a9d63c8f99da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiT3avaiYcEJHZe0p4Ek4niOkl/A04szEP:A3k03kHRJGeW4SkZP4sz9MbE56rX
- TLSH T159A53A16F6B84B62D0ABC075C9D66A56FA323C451F2087DB0345BB283F377D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/5152-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245ef-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4108-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5152-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4108-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245f5-169.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00400000000202ab-590.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000218dd-1032.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000729-1650.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245ef-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x00070000000245f5-169.dat aspack_v212_v242 behavioral1/files/0x00400000000202ab-590.dat aspack_v212_v242 behavioral1/files/0x00030000000218dd-1032.dat aspack_v212_v242 behavioral1/files/0x0004000000000729-1650.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4108 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86921\javaws.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5152 2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4108 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_eaa00886f4b894aa9f1534a03ff7b290_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5152
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4108
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 26b420556dcabdb45223bae0e6a9b05ec6367f80150aba058bbbe4e4bd3a5bbe
- MD5 eaa00886f4b894aa9f1534a03ff7b290
- SHA1 87517c43ea4de441a22913a35beadde974dc8380
- SHA512 cfe650f0e7e85b0b72921addaff91c543bd1ecb5f4ec711fd61bd3abe51abbc766cd12333ac76828526b10d8fecaadd798513ce8703f3eb659c2a9d63c8f99da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiT3avaiYcEJHZe0p4Ek4niOkl/A04szEP:A3k03kHRJGeW4SkZP4sz9MbE56rX
- TLSH T159A53A16F6B84B62D0ABC075C9D66A56FA323C451F2087DB0345BB283F377D19A39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.6MB
- SHA256 961007ddb8328df1f4f09d522d5b400dba7e060c36dc3e51bbd17f8d83b2bdb7
- MD5 80649dcf35d0d844c61876e265d0a677
- SHA1 696335ecb4e7c57734860718c0bd840c5f499d6d
- SHA512 c7f6b2a77d4a54750ef703e5e66c6cabb984fe00be3ab95b63d428a7551cd534971077cb79e6e2b7e3c66d968ef8c3585ad9d6baad79219d7f934fec27609677
- SSDEEP 49152:A3k03kHRJGeW4SkZP4sz9MbE56rvUidGl:A3k03kHRcfkZcBrvdGl
- TLSH T161C55B16F6B84766D0ABC074C9D69A56FA323C460F3087DB0344AB283F377D59A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.6MB
- SHA256 1ff66babcbf82329f1733cf684e95013c07230160cc3b4c228e557e82c7d0b45
- MD5 cbdfa18daf60f3af3e9d359062cc9da7
- SHA1 c684fd4460947d48b6cbc39a47038f661131a40c
- SHA512 1d17d7871adfc179d5faecfe8672a4bacf9d59b84b3a9ee2bdf3a36001a4be5a4183dfe7b9899cbf5f2c2708be01c3610c41b5a8d8e489078198f1120e6e5f5b
- SSDEEP 49152:A3k03kHRJGeW4SkZP4sz9MbE56rTPji0Aj:A3k03kHRcfkZcBrLjo
- TLSH T15DC53A16F6B84762D077C075C9D6A65AFA323C451F308BCB0345AB283E377D59A3A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.2MB
- SHA256 df6cf9b8f403122dc6b33c5a81c1c34b791385f8c685351edc4a5304ac170fc7
- MD5 b3195dc3f41fcce192cd5ce3c4d7f130
- SHA1 477018e9266c43f04380f18a1176fb745ad627b9
- SHA512 7f51dd13c618105212c852e95db6e0dac2d69b0744ff07cc439cfe77cc358a840b599e68cdf6f25babf30ad031abaa8f121d88bad7df51709e88bcd654947b20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiT3avaiYcEJHZe0p4Ek4niOkl/A04szEM:A3k03kHRJGeW4SkZP4sz9MbE56rU
- TLSH T113B51816E6A84762D0AF8075CA965A55FA333C455FA087CB0384FB3C2F336D19A79327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$
- Size 2.3MB
- SHA256 20ee7c818bcc09e612d7d4bbbbbb613a4b97f66f78aab2714aa15da38809a0e5
- MD5 16197ee17802ceeb88a8caa1f77c7815
- SHA1 04fd22d536821fa194ba825b3bfaf40055a7db3b
- SHA512 9c9b38879f4a7924ff2a83cc1b08d07724f6a7dfa8b527e631705922ecae3bd6ee3bd556698b2cca3caf8820d3274c3e6a447a6b6a1a66c1e77186d7143fa49a
- SSDEEP 49152:A3k03kHRJGeW4SkZP4sz9MbE56r+C17IwZ:A3k03kHRcfkZcBrT7IwZ
- TLSH T18FB53A16F6B84B62D0ABC075C9D65A56FA323C451F2087CB0345BB283F337D19A3976A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.1MB
- SHA256 ba672bed6532f15318697955fbd103c67cd24a6516e1f3323f57611aa87ba2c8
- MD5 388a19ecab07692de506c174fcd4239a
- SHA1 48c61cc4bbf299dc8b976d1c7bf4a1783a32fe31
- SHA512 97482fa9f4d8fff62dfebb87e347bf265d2898d656e37ebe8282289a42d0ae861d09276ace59069c08af2d5a24d6b7f4dd5a3254205041a1143c4ae6f4f0baec
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiT3avaiYcEJHZe0p4Ek4niOkl/A04szEs:A3k03kHRJGeW4SkZP4sz9MbE56r0
- TLSH T1C6A53B16F6B84B62D0ABC075C9D66A56FA323C451F2087DB0345BB283F337D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH