Analysis
- max time kernel
110s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
01/06/2026, 04:24
Behavioral task
behavioral1
Sample
2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260601-e1mqhsct2x
- SHA256 915a243f9b4ef38b68ed827702de1f855526a81f3f3afecd5073cf1c76010f37
- MD5 8c54b2fd12214fe7f3f594a8103eebd4
- SHA1 8611da30e11571ac85932da4a2cbd0584b9f95fe
- SHA512 5ccc311940d7b8c30b992686c1e5c3b84babd705e95b62a380f58677d3d83eb6d42da7c4afa0332f286465ba9b4e6b57a2223c35acabd57dcc7096da063abfe4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJs:A3k03kHRJP56r+3k03kHRJP56r
- TLSH T1CA955A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/2904-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b592-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a408-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2904-51-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3756-64-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x008f000000027281-1025.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b0000000259ac-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001a602-1529.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0016000000000478-1895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000000675-2091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b5b6-2215.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b592-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a408-11.dat aspack_v212_v242 behavioral2/files/0x008f000000027281-1025.dat aspack_v212_v242 behavioral2/files/0x000b0000000259ac-1373.dat aspack_v212_v242 behavioral2/files/0x001f00000001a602-1529.dat aspack_v212_v242 behavioral2/files/0x0016000000000478-1895.dat aspack_v212_v242 behavioral2/files/0x0013000000000675-2091.dat aspack_v212_v242 behavioral2/files/0x001900000002b5b6-2215.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3756 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_176265\javaws.exe$ 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2904 2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3756 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-01_8c54b2fd12214fe7f3f594a8103eebd4_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2904
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3756
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 915a243f9b4ef38b68ed827702de1f855526a81f3f3afecd5073cf1c76010f37
- MD5 8c54b2fd12214fe7f3f594a8103eebd4
- SHA1 8611da30e11571ac85932da4a2cbd0584b9f95fe
- SHA512 5ccc311940d7b8c30b992686c1e5c3b84babd705e95b62a380f58677d3d83eb6d42da7c4afa0332f286465ba9b4e6b57a2223c35acabd57dcc7096da063abfe4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJs:A3k03kHRJP56r+3k03kHRJP56r
- TLSH T1CA955A07A6980FE8D11F81749A968A62E7737C111F2097CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.6MB
- SHA256 7deb956268ddf534fb11a2f190dc7896144d1b61f68b750c02bd8555e3b63a93
- MD5 564bdb8a495c35114b4448034fedcadb
- SHA1 ac8583764dcc012ec6cfa99f95078a95c5c7fd88
- SHA512 e8cebf361f4a41a9be6cb3d887f7a174ea7e5fda6954961f85259cefcaea56e22984af87070ea9e1b96002931a2a67ca2168b3a8a6b2b59c31c52f6f741be696
- SSDEEP 49152:A3k03kHRJP56r+3k03kHRJP56riVk0QGTvntQb:A3k03kHRir+3k03kHRirfHaib
- TLSH T10AC56B17A6980BE8D06FC17886968522F6737C161F2197CF03649E163F73AD0AE3E356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.4MB
- SHA256 e8518caf01f1fef605ae526daa6d7f4a62c72fa6add72e21b6d109afb1c523e2
- MD5 79a68d208aeea80d2f5ac49cd06bebea
- SHA1 765908205ca6085d902ccb010b7aa95c489a04b5
- SHA512 ab428b59d6c285d8dae500c79058d2de9cce7b193064903cebfe520078f0641d3b1e87d1c6ad0914925da0d503b52a5659cbd78c49b2bc93179b5144934cce7b
- SSDEEP 49152:A3k03kHRJP56r+3k03kHRJP56rPTd9CHKyao:A3k03kHRir+3k03kHRirLCqo
- TLSH T15AB56B13A7980EE8E16FC1748AA64522EA737C551F2097CF1354AE153F32BD0AE39B53
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe
- Size 2.4MB
- SHA256 fc2572242ab6d75eb5d42e8e832c7c6550b7aabe29944267bf73fefe6eb1af44
- MD5 37e9ccb4a751873e701d2f80c50f4b5f
- SHA1 a31a61f69f152f9da87b45b8c90ad16dae5409e0
- SHA512 ca06ddf85134017ed457e1f68bcfaf8da0bdae8cf24b098262a82a48c7c9e2cb21ba9cd7504cec58bde7e252a2b186c325d05fba0222f4d07507b34ded07ded3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJB:A3k03kHRJP56r+3k03kHRJP56r3UidGl
- TLSH T11CC55B03A6980FE8D15F81748A968662EA737C550F2097DF1354AE253F32BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 d77415c8f79a150cf721eaca7faa413132c9154fd536c58b3147de279a2ca828
- MD5 25ba31f24d380e95cb5f205d2f84d3c0
- SHA1 f3403f51a8535f2f70dd6871247570c25e5b3e6f
- SHA512 02481d02edda240bb3e0f5bf6854b55f7e059bfba4a83cbc890aff666f598beea9a6744fd91f63e8e6bb85fec87c784217b3e37f727626772213bf13fc7ec6e7
- SSDEEP 49152:A3k03kHRJP56r+3k03kHRJP56rbPji0Aj:A3k03kHRir+3k03kHRirjjo
- TLSH T16DC55A17E6A40BA4D02FC178C5969666EA733C411F3097CB1354AE293F77BD09A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.9MB
- SHA256 6dbffa79074ce9490bbc57115af191c4627b764ea3ea5735856ccd45f97cab3b
- MD5 d4a9115b2392041919b0c310cfa3d032
- SHA1 39a1bfd6df5f9777318de328e985d28d496eb9b3
- SHA512 78349fb6ef99b1c2bf6b985a78b22413eccc44c14131354f20bc49397e2af6fa7d89e6b47ae1d8c6e0bad5d237354025d2853936553c07f1b72043beb3e1a7b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJN:A3k03kHRJP56r+3k03kHRJP56rM
- TLSH T156956A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python.exe$
- Size 2.1MB
- SHA256 4fb0407543a12aac460361fb05c2e215ba12488f14257bdd191dcec7201e0aed
- MD5 105f5cccd2b5064b942fc81b3cd603f8
- SHA1 33c5c4c47f986bb8c5179363bdb5441bf33cf232
- SHA512 01f1bb252a7d640fdd7f8cd9506683581d74948506641efd042bb04a07669e258b36f7738f2e7b805abbc753b70a27e543c9e6aac8dda64684a19b6337e7e48f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJd:A3k03kHRJP56r+3k03kHRJP56r3i2WH3
- TLSH T1AAA57C13A6980FB9D11F81749AA58666E7777C110F2093CF1354AE1A3F72BD0AE3A353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
- Size 1.9MB
- SHA256 e2fec7914bc7b6279203b445b21997a142589dba8ebd012b5489d7ed7872e084
- MD5 9e6584ead488d9a66ab2a5de4b62dad1
- SHA1 ba6fc9ed8fb36ac045c5539d59719f4268577054
- SHA512 54cbeeba809b92fa8d6ee2101e0819aec8dd39784dc6db9fd70f55b8af6505ae622c16e12ccdd25d28e57a27519d21221143263ac5f5307f8ad6aa4623010e77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCZYaRaC3mnXoZ643mnXoZ6i6cMJU:A3k03kHRJP56r+3k03kHRJP56r
- TLSH T149956A07A6980FE8D11F81749A968A62E7737C121F2097CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH