Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 16:21
Behavioral task
behavioral1
Sample
2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260809-ttpc4avsat
- SHA256 cd65456d18bcfe246cf269a95d055b01f61220f3385c8e456224f11945b81e55
- MD5 9347ec8be83352f8c059f5d52d6fd463
- SHA1 93ca04729d156a4a248befbf4f9b4d06029a6b5d
- SHA512 5a9c41c0d8044a1c6d5df71c6bf5f99820ffe8bfb649f0ce0b59db61dd977d60d0fd277569445e6667c3b3b253e90345bcd9013c3a6552724d78f8f7a4e919cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHao3mnXoZ643mnXoZ6i6cMJlCUQ01:A3k03kHRJc3k03kHRJh
- TLSH T12B85AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/3940-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024328-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3852-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3940-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3852-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000214f9-697.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021905-1114.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00150000000202bb-1526.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001ebed-1936.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024328-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x00020000000214f9-697.dat aspack_v212_v242 behavioral1/files/0x0003000000021905-1114.dat aspack_v212_v242 behavioral1/files/0x00150000000202bb-1526.dat aspack_v212_v242 behavioral1/files/0x000400000001ebed-1936.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3852 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3940 2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3852 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_9347ec8be83352f8c059f5d52d6fd463_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3940
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 cd65456d18bcfe246cf269a95d055b01f61220f3385c8e456224f11945b81e55
- MD5 9347ec8be83352f8c059f5d52d6fd463
- SHA1 93ca04729d156a4a248befbf4f9b4d06029a6b5d
- SHA512 5a9c41c0d8044a1c6d5df71c6bf5f99820ffe8bfb649f0ce0b59db61dd977d60d0fd277569445e6667c3b3b253e90345bcd9013c3a6552724d78f8f7a4e919cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHao3mnXoZ643mnXoZ6i6cMJlCUQ01:A3k03kHRJc3k03kHRJh
- TLSH T12B85AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.2MB
- SHA256 fcd32acf205fe578dbd6806b78ac09a55def98ff5e0dc1544beadf02edcebe4f
- MD5 c2acc07c9f33b0e2e8e1721e050468b3
- SHA1 46a6f9c8c49449dbf363449d74a63324198e5f6d
- SHA512 e2bd4c194943ea443af648c214c956b40233e99b1195e329426955d2b7e0021da9a421925e02098e941de340b86538c94912cdc84809290e71e9878ae2618cb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHao3mnXoZ643mnXoZ6i6cMJlCUQ0C:A3k03kHRJc3k03kHRJRTd9CHKyao
- TLSH T1F9B59E13E7D400E8E12BC2749AA68622EA757C561B70D7CF235882152F73BD06F3EB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
- Size 1.9MB
- SHA256 4ebd7491d6eb53a20051a373c1b73a92440f5b53f7739626d52eae75cb181f2c
- MD5 c79b673ece4b3c0e6c8a168a3073676c
- SHA1 013773ea059190901583c7efb0c4710ec9edd876
- SHA512 54b20c527104273ed75ca9be8535ea8095f0d34a638d73ce73ad073cc360dc76fe32728eac4c138548d4373b78d012ff15b2efff6ebe5ed8cf2bc4bcfb95a820
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHao3mnXoZ643mnXoZ6i6cMJlCUQ0w:A3k03kHRJc3k03kHRJrI
- TLSH T11695AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 be285d83f5243dfeeea87672990ab85e44f102717664638ad5fdc5de469b565b
- MD5 e0dbb92437ff22b348fb2b06f45d95de
- SHA1 c2e1b339b9d91b77eb30684ffed7e8a066596baa
- SHA512 3d561307997531871a7e631e303890d0dcfa8983e9846c723ed341f8ac2476265e1d212dd0200b05bc4eadd84d93fc5e7c17598a8dacdec4721a1ee7806c51bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHao3mnXoZ643mnXoZ6i6cMJlCUQ0t:A3k03kHRJc3k03kHRJ9Pji0Aj
- TLSH T16EB59D17FAA401B5D026C174CAD69A66FA717846173097CF2358C6293F63BD0AB3E3B4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 1.8MB
- SHA256 fe322bf1aa18ce5023afbb284088f553bad40e1ba40943e94d077f299748861e
- MD5 85c49789f8142fba6bae93a816a787eb
- SHA1 c47f0a63bd38ed43a6510d6fb46d1acdb492f1c7
- SHA512 4bcce4ad8e177754cf51f1c45d61e7d6eb865a1a10806a561e3a0ab161741ff89f1ec9f7707cbfd025f6c4b5a111f5f5d0e10140cc364310663e50b787933df9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHao3mnXoZ643mnXoZ6i6cMJlCUQ0f:A3k03kHRJc3k03kHRJj
- TLSH T1AE95AE13EB9504E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$
- Size 2.0MB
- SHA256 fe249ed900373e777238331f1a4ee90d4ca090742313ad25e26ac362de6c9a03
- MD5 8c5764f58950df0942422518576ff7a7
- SHA1 a7a9a6015a63e81da5b0e7badac82f2babaf6df8
- SHA512 3403596835a998f5cb355d78bab17f5cdb835f852d6304c24b291d0ab6365b72ada928967de9927e6726e596dbc9c3a6bc6f11bf0325902135f9f08380ae7bda
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccapHao3mnXoZ643mnXoZ6i6cMJlCUQ07:A3k03kHRJc3k03kHRJIE
- TLSH T14195AE13E7D500E9D24AC1705EA58662EB757E562B60D3EF2358C3052F62BD07F3A3A8
- MD5 SHA1 SHA512 SSDEEP TLSH