Analysis
- max time kernel
116s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
19/05/2026, 10:55
Behavioral task
behavioral1
Sample
2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 3.3MB
- Sample260519-m1dfvaev9q
- SHA256 d2bf835ffa6251bec3dae2476480c995ff5e76bfdb9b45d4c065105d052e060e
- MD5 1b46be5135a1019f3a72ba2dd6114769
- SHA1 02ba5048f685710fe2ca362e16f214de4d4f0817
- SHA512 eb4e98df4821ab8b744fef23812ea616947677741e8144331ada118057fba981bda0f8859b06b258929a63290fbe548ae6fcc3e26b7920c80aa3027912b99534
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2I:A3k03kHRir86Jr7fkZck
- TLSH T1B9F51A16F6788B62D07BC0B9C5D2A656FA333C415F308BCB0245DB2C3E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2112-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000002b5eb-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4448-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a322-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2112-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4448-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000029d47-1254.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001800000000f65f-1489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a8dc-1620.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a8dc-1871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0012000000000673-2069.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001f00000002b5eb-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a322-12.dat aspack_v212_v242 behavioral2/files/0x0004000000029d47-1254.dat aspack_v212_v242 behavioral2/files/0x001800000000f65f-1489.dat aspack_v212_v242 behavioral2/files/0x000200000002a8dc-1620.dat aspack_v212_v242 behavioral2/files/0x000300000002a8dc-1871.dat aspack_v212_v242 behavioral2/files/0x0012000000000673-2069.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4448 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_173093\javaws.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_21.21030.25003.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2112 2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 4448 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-19_1b46be5135a1019f3a72ba2dd6114769_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2112
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4448
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.3MB
- SHA256 d2bf835ffa6251bec3dae2476480c995ff5e76bfdb9b45d4c065105d052e060e
- MD5 1b46be5135a1019f3a72ba2dd6114769
- SHA1 02ba5048f685710fe2ca362e16f214de4d4f0817
- SHA512 eb4e98df4821ab8b744fef23812ea616947677741e8144331ada118057fba981bda0f8859b06b258929a63290fbe548ae6fcc3e26b7920c80aa3027912b99534
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2I:A3k03kHRir86Jr7fkZck
- TLSH T1B9F51A16F6788B62D07BC0B9C5D2A656FA333C415F308BCB0245DB2C3E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 3.4MB
- SHA256 14a32d266f2a821a4b5c2c0a4a4cff6b3f51ab63413d95565dfb88d197f13417
- MD5 f1df794ecf5e1c5142fd84f7dd468c37
- SHA1 8d081ddab23216faf4a69791a075bac8d7f93d2a
- SHA512 48411448a98cca124bc0bb9f7b485e90b02c394e8224ca9efe5d72952386cc62faa6c0cb6e9b3f8f50bac1a51fe6201009118785abe7ed5cf4fa9b0c650ea95b
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2I0W:A3k03kHRir86Jr7fkZckxW
- TLSH T145F52A16F6788B62D07BC0B9C5D2965AFA333C415F308BCB03459B2C3E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 3.4MB
- SHA256 676fc1fb72f6ff1ede1e3bc62a10e23672efaeab3cdd67b26c35a0fc48be7b24
- MD5 09549a0ed4df2a055eee0832de347ee6
- SHA1 210c416ee15ce13912a9ca3741ba4b404ce68ef1
- SHA512 e5e40607a9bf34ff5de294034f39574f8933407afe5c00b5a63ac5739875d824a9600134bceb29f387ce523b3c5bd982263ebde097e028ace709d283126ba22c
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2IcBPVAU:A3k03kHRir86Jr7fkZck7BPVl
- TLSH T1ADF52A16F6788B62D07BC079C5D2AA56FA333C415F308BCB03459B2C3E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$
- Size 3.4MB
- SHA256 21c9d0588d2f6c04363b106b3be06e6495593984be69ffd1a6ce8db9899e11bd
- MD5 2145f87abaaa4b963ed08694606a5f46
- SHA1 0fafcd5d2385b2b8dd66b0a3481c044c7d4c8eba
- SHA512 8a5ade5cca5034dd9400961ad6917830019a6c5c0f0b4aec5d0413a041ad8548115075917934f6c40ba22227c27e9ceea8565d3f09e88c4faf1febe0539b8578
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2Imw:A3k03kHRir86Jr7fkZckE
- TLSH T187F52A16F6788B62D07BC0B9C5D2A656FA333C415F308BCB0345DB283E276D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.8MB
- SHA256 c8ef0fd4dfc0f817a0a0c56debd80b238f10e9241958815972b0b6c3d44699b4
- MD5 e1a534da1c2cb1541fe3350016e856bc
- SHA1 931b580ee713f2a5e2e0a6e9fd79cd2758f6bae7
- SHA512 c18b67cd72c1ee16c1466ce3de406c4d0d5ccfa763c2307f1cfcd1a3327446533ea758075db10a3fa726abc8c0b93e72c834f6e3a6740e13fe07f3beed3fadd4
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2IQPji0Aj:A3k03kHRir86Jr7fkZckZjo
- TLSH T13D061A16F6788B62D077C0B9C5D2A69AFA3338415F308BCB0245DB6C3E276D59936732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 3.3MB
- SHA256 d368847a11b160e3d973bf4f30fffc20fe0c8f3ddf5e2535e595a194ca7de619
- MD5 cbb2d73c3c385812550af7db4d3b1c80
- SHA1 b7f276bde666497390eb10673be5b20ec2957d4b
- SHA512 4f8829966514684537cacf0c1090c3d27e141d0a32644f3e72be283cfd9f28158d38e1badc25873407c85345184c27ca2c9c5c3370f70d08acde4e2bb4253d5d
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2Ig:A3k03kHRir86Jr7fkZckr
- TLSH T18AF51A16F6788B62D07BC079C5D29A56FA333C414F308BCB0245EB293E376D5993A726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 3.5MB
- SHA256 134249a028aace8e0c8bff92d0d12f1d7c63cc310b18adc9b0dbae714fbc9e70
- MD5 618db5a48b4b528466144a9947b4b5fe
- SHA1 11f5c9a32d47453359ac623eb5955a12fa20b9a9
- SHA512 6e6ebe311dd22d3ae9e7e64a0fe8802c613ff25915849cc99db6dd015308a3d960520256229d90a4c36e4be3dd683446042361353b0862ea64daaeaa0598af25
- SSDEEP 49152:A3k03kHRJP56r8pYqJJIUd56rbeW4SkZP4sz9MbkqJtb2Iai2WH3:A3k03kHRir86Jr7fkZckJuX
- TLSH T1FE062A26F6788B62D07BC079C5D2A65AFA333C414F3087CB43459B2D3E276D5993A722
- MD5 SHA1 SHA512 SSDEEP TLSH