Analysis
- max time kernel
114s - max time network
97s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 11:52
Behavioral task
behavioral1
Sample
2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260602-n1xp6act2z
- SHA256 8bb98da811aecb655210f9e14d08a9d34ce632c88109f2e268a08874738c1882
- MD5 3c365ae245322f23f93ac16896a70725
- SHA1 06aeaf03b7626a6fcaae2abf34781e9c3a2e4a84
- SHA512 fe679a70855667001ff56fab09cded072dd96ba0a7a90be5e02958d04d50f46a7e4b3035297b102a18c90ce1da896f94d3ab9cf75bc55b74f6edc073b0effde9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaEyovwNqmYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNw:A3k03kHRJJqJtb2IQPji0Aj
- TLSH T17D954B26F6A44375D073C0B9C5D2A69AFE3234425B308ACB1385D72C2F67BD59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral2/memory/2984-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002a00000002b29a-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1852-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a341-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2984-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1852-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028ddf-1288.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027ab9-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001a60a-1534.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001900000002b37f-1775.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002d000000000476-2074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025aba-2097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0033000000000476-2155.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x002a00000002b29a-6.dat aspack_v212_v242 behavioral2/files/0x000300000002a341-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028ddf-1288.dat aspack_v212_v242 behavioral2/files/0x0008000000027ab9-1379.dat aspack_v212_v242 behavioral2/files/0x001f00000001a60a-1534.dat aspack_v212_v242 behavioral2/files/0x001900000002b37f-1775.dat aspack_v212_v242 behavioral2/files/0x002d000000000476-2074.dat aspack_v212_v242 behavioral2/files/0x0003000000025aba-2097.dat aspack_v212_v242 behavioral2/files/0x0033000000000476-2155.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1852 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_x64__8wekyb3d8bbwe\StickyNotesStub.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Maps.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_12008.1001.1.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\PAD.Console.Host.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2984 2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1852 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_3c365ae245322f23f93ac16896a70725_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2984
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1852
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 8bb98da811aecb655210f9e14d08a9d34ce632c88109f2e268a08874738c1882
- MD5 3c365ae245322f23f93ac16896a70725
- SHA1 06aeaf03b7626a6fcaae2abf34781e9c3a2e4a84
- SHA512 fe679a70855667001ff56fab09cded072dd96ba0a7a90be5e02958d04d50f46a7e4b3035297b102a18c90ce1da896f94d3ab9cf75bc55b74f6edc073b0effde9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaEyovwNqmYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNw:A3k03kHRJJqJtb2IQPji0Aj
- TLSH T17D954B26F6A44375D073C0B9C5D2A69AFE3234425B308ACB1385D72C2F67BD59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.6MB
- SHA256 244da49f17fe19a0ba6319ec8a406c0bff8933a2c3a49df50305485e048b2a25
- MD5 c5a02c292bafd1271ca8c176be9d3904
- SHA1 1508f4f8219bcf9459ecf59dd44a3255574ad182
- SHA512 7a296be988dbfa20f4d4d8961c4dd0a5fb2fbd9c4de80f5e6ac429b5a14695464d9569a5ddfc9166728388368df4a80f6d4aca90e0666cc37d38ebe63b4a4b49
- SSDEEP 49152:A3k03kHRJJqJtb2IQPji0AjPVk0QGTvntQb:A3k03kHRvZjoCHaib
- TLSH T12AC56C26F6B843A5D077C179C6D3965BFA31384217309ACB0395C7292F67BE19A3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.3MB
- SHA256 d4ef292d3d02ed7d0d6f3166c65f3d316b6c1e13c04470439ae6f44b6fe75f4a
- MD5 0de931d9bfc9ed5a662690bce2d39a14
- SHA1 f504eab68fe2709cd540594ff35d5158292f2e4d
- SHA512 d234d0476e4d7871b06b3d3017aa08ae0ee1215ec3bfccc8ab30bf87db4904b2c3772b4387e505baa810fd0ea47b0223f9603c0f3918e773e7a4d3451c6368e7
- SSDEEP 49152:A3k03kHRJJqJtb2IQPji0AjoTd9CHKyao:A3k03kHRvZjoKCqo
- TLSH T10BB55C16F6A44375E073C179C9E2965AEA7238421B30CACF1385D7292F37BD19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe
- Size 2.0MB
- SHA256 6a15dac6736650d6ff71a40c05853117fbd6a25b3971d22406ae4aeea7070ba3
- MD5 2c6e64860390dd802a86321dc05a22ff
- SHA1 4ab86f66ba0e3830b1045ade1c45e8a5e64fa5a2
- SHA512 a7b2a33073d7f4e5277c481fd707b88923fc479d8b5611a2d166022f58dbbea6f183239300957412493a7451e569031b9b9602083e2a72a79978371854a3187e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaEyovwNqmYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNV:A3k03kHRJJqJtb2IQPji0Ajow
- TLSH T10B955B26F6A44375D073C0B9C5D2A69AFE3234425B308ACB1385D72C2F67BD59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 b314f90c5e7717b137abf091cfd2419b748f3aa535ebb017d826c1e8144fafc2
- MD5 af6bdcda66c1b84f6bf3ac0788260e9d
- SHA1 750373a6d7c4782421c036bf0d4856428ed63130
- SHA512 f3dcc81a7fc97ded95f3539281a9e95c47cae758a497493be48d05aa386b89b0bb71dda195158ad33bf7ba24fcd1837f9c04c61c8fce37029476d77c1796b8d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaEyovwNqmYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNe:A3k03kHRJJqJtb2IQPji0AjKPji0Aj
- TLSH T1C6B54B16F6744375D073C0B9C5D2A69AEE7134821B308ACB1385D76C2F67BE68A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.9MB
- SHA256 d85eb4d59703293ea8852d0a3e14e56662904515b44779a327623d92c90ca11f
- MD5 d35968600a1a29bf1377ffcddb9a4b7e
- SHA1 ede8e3b19bdf3a899266b398acfa5e1d30f2787e
- SHA512 a68d52cbfcd1c32ee09f434b4567bcb81de6ef694b4a12e620a2ee9c620f5842945a2394657385777da7fa2d6e5321117b461e1713d2e97a260ea67fc21d8767
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaEyovwNqmYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNq:A3k03kHRJJqJtb2IQPji0Ajq
- TLSH T1F2953A16F6A44375D073C079C9D2A69AEA313C821B308ADB1385F7282F777D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe$
- Size 2.1MB
- SHA256 f77257c9c4000b8ab2a554621610bdacc9c77afc1eae3d3abf0c4d62bf755f58
- MD5 e292cecc694e40900d898f30ba608731
- SHA1 9da797e254d7e3b0be1d751626417c031877fa1c
- SHA512 33cf2ea1fa8b469a9d110b5edb4a9a62993e40fde169fea3f8c29618f2dcc6088a194dd3f21e01d6a78ca0287ae5604aaf8608e879f26955798107e592ae3b4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaEyovwNqmYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNI:A3k03kHRJJqJtb2IQPji0Ajvi2WH3
- TLSH T14EA56C26F6B84375D073C079C5D2A6AAFA3134425B3086CB1385D72D2F67BE19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe
- Size 2.1MB
- SHA256 31f0aceb963b1ecc7bab545048a7376ba0a5ca6e240e17ab7e154099923b4f26
- MD5 f8ab6e0bf3a82737413bd22abaa5c55c
- SHA1 a5d5509f1469a514611c2c3f522223a388084550
- SHA512 86387e3cc7e37c5fb5c7c7669ab260bf4c23a511d207bc8111edc65a36f52544aff54b46c4fc8a24b136e5f42dc87b3f187a7e6a2c41f86b9b4b5aea4cfb2356
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaEyovwNqmYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxND:A3k03kHRJJqJtb2IQPji0AjYi2WH3
- TLSH T158A56C26F6B84375D073C079C5D2A6AAFA3134425B3086CB1385D72D2F67BE19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$
- Size 1.9MB
- SHA256 9a62721dfea65746f2cd34848fc6d6014b0fcfd3e8d8ef245759e6e8a25a8968
- MD5 1a3a6cef000a7dfa10f2d8623c243d76
- SHA1 1e9da64c338a73fafbc4b95bacc1e0eb96fe905e
- SHA512 ad48603910430ad0e049cd2edf131dc4fd09f6e41130597f1eb8b4accbe679b03d4bc70370f86020f05f8be7fe4a094ca2d423f144034fe71a1c54192a8d744e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaEyovwNqmYTqMi8CtBd2QHCHmTBW5X0Le5ji0hmxNq:A3k03kHRJJqJtb2IQPji0Ajq
- TLSH T126954B26F6A44375D073C0B9C5D2A69AFE3234425B308ACB1385D72C2F67BD59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH