Analysis
- max time kernel
118s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/05/2026, 15:57
Behavioral task
behavioral1
Sample
2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260524-teaamaat3q
- SHA256 94be5421f86a65cb9448216e8ffc8d063d545901bd8a608f092e740a36ef7b97
- MD5 4f6e0c0e2b2d919cd8563cfb96358994
- SHA1 4857731fbca9f316053df8fe57d84871c68b21e6
- SHA512 1ae6f1ea21f67affb439470352545c898d3ed395c654b2da4dc92efbf8fb22348602ce56e438d312495b5efcb3656fe9368c42e7aaa76906467be883250ca360
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0ya:A3k03kHRFfkZcBrO1lkNa
- TLSH T1E9B53A12F6B84B66E0B7C174C9E6A656FA323C465F3086CF13449B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/1028-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b533-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1232-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a411-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1028-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1232-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028ea0-1246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002a8e4-1646.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000002a874-1818.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002b000000000476-2062.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002e000000000476-2118.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b533-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a411-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028ea0-1246.dat aspack_v212_v242 behavioral2/files/0x000400000002a8e4-1646.dat aspack_v212_v242 behavioral2/files/0x000500000002a874-1818.dat aspack_v212_v242 behavioral2/files/0x002b000000000476-2062.dat aspack_v212_v242 behavioral2/files/0x002e000000000476-2118.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1232 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_321.14700.0.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1028 2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 1232 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-24_4f6e0c0e2b2d919cd8563cfb96358994_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1028
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1232
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 94be5421f86a65cb9448216e8ffc8d063d545901bd8a608f092e740a36ef7b97
- MD5 4f6e0c0e2b2d919cd8563cfb96358994
- SHA1 4857731fbca9f316053df8fe57d84871c68b21e6
- SHA512 1ae6f1ea21f67affb439470352545c898d3ed395c654b2da4dc92efbf8fb22348602ce56e438d312495b5efcb3656fe9368c42e7aaa76906467be883250ca360
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0ya:A3k03kHRFfkZcBrO1lkNa
- TLSH T1E9B53A12F6B84B66E0B7C174C9E6A656FA323C465F3086CF13449B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 2.8MB
- SHA256 1ca8f484cea2c10971eaad652f2d977e89447796b75e24edb3d2405685c1aa1f
- MD5 312f73dd8dce8955699d05d5a457c088
- SHA1 40e6c25ff60a7f5ac336e2d064830914540dd7c7
- SHA512 3ebb93de0a692a9ae19510da92ef3ba2f1c93d69a09da6196e10cef6c40181111fc6f57fa901f80595ef703fff5f25fc5dedb663b71e15eba39aa93f5af0d56c
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yWUidGl:A3k03kHRFfkZcBrO1lkNydGl
- TLSH T1CAD54A12B6B84766E0B7C174C9A69656FA323C461F3086CF03549B2D2F33BD19A39727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateSetup.exe
- Size 2.4MB
- SHA256 989cf525203b41c1b82d6e8f74aa537e9e4f0809a15f44f4323d938154c38d04
- MD5 e8ec3dc979871f064403f6e6e0b1cff1
- SHA1 a39c4b3db0c3857a6fccffd5ea7c28b73ccff00f
- SHA512 8200407c368e8f88f82acc9e5407b7d77f673f17abc6114ab54e65bea291c198a89d73af3b891eb4d46522d69261be1e6a50db1106c6a5a6ddc31800af9543e9
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yMfFXu:A3k03kHRFfkZcBrO1lkNMfFe
- TLSH T18CC53A12F6B84B66E0B7C174C9E6A656FA323C525F3086CF13449B1C2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 8c8c6939ce603e43f81fef6cfaaa7f55233f9bb3a14a36926bb288788decbacd
- MD5 7f0c690aa058087ddd22d870624cca8e
- SHA1 ddbc6244956818da5285e6ef4d7c95c3de32bec8
- SHA512 8f17d51febd35b9fb0534d000f11b407d52022f923b0af146012c4a1d6805557ebe1fb4a0fb3d16350882d799fbb5c30ab8a3d78e5b8cfa751f72b18cb9a2876
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yqPji0Aj:A3k03kHRFfkZcBrO1lkNgjo
- TLSH T11CD53B16F6B84722E0B7C175C9E6A65AF9323C425F3086CF03459B2C2E27BD19A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$
- Size 2.4MB
- SHA256 6a4f7d72bb5e97956bc7cf6d27d5541cdb0505eb490980c6a0fe31d52ca975bb
- MD5 987cc419a6201c1ae398b743d55ee957
- SHA1 ca061130eead6dc187b1dac158901cdf5cd79400
- SHA512 e1cae997c2325eba8f37654eab7cac8563f909eec2931fee50142a4a7e417675440deeaecc853d22b0f1b69f630ba1bfaeb0152a053371d3cad42f0bf8a040d2
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0yK:A3k03kHRFfkZcBrO1lkNK
- TLSH T144B52A12F6B84762E0B7C174C9A6A656F9323C521F3086DF1344AB2D2E33BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 2.5MB
- SHA256 9909e6acea444fb2420f7c168c924817455746c9f394f0bc5d3e1f8ef289aefa
- MD5 9848a742d9edc384461b90f598e707ed
- SHA1 adbf764f92dd47b92137636acd207a1f62906ed6
- SHA512 2b72f7069b972add9c95a5e8c132b4003d529e71dcc93cc9e6f7ee84a3f5919600d927d906223c15f9caeba24635e0a4da16225f73321a62cc7942f84d05e7b2
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0y4i2WH3:A3k03kHRFfkZcBrO1lkN4uX
- TLSH T1BEC54B12B6B84736E0B7C175C9E6A65AFA323C425F3086CF13449B1D2E23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$
- Size 2.4MB
- SHA256 6bd3196a60187bed1a98e5cfb244a6f4b2a61c544f9765799843220b03ec78f3
- MD5 da45d367a2711c85efe80b65fcc0d9bb
- SHA1 6a3e29f1a6d0edaf871e16ab542fc47fb459fe37
- SHA512 d6acb8bfca1e962300abaa708c4ab8d3650d505103d91c484f873c6c8bd191c920adeea95424678b1377dd310e8a64ea499587f575c832de2c6b9efa24e9a64f
- SSDEEP 49152:A3k03kHRJneW4SkZP4sz9MbE56rO1lkWu0y2V:A3k03kHRFfkZcBrO1lkNo
- TLSH T1B9B53A12F6B84766E0B7C174C9E6A656FA323C525F3086CF13489A1C2F23BD19A35727
- MD5 SHA1 SHA512 SSDEEP TLSH