Analysis
- max time kernel
107s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
02/06/2026, 17:14
Behavioral task
behavioral1
Sample
2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260602-vr3ndacw5m
- SHA256 5407cd0d1c6a606edf869fbfb095590a8466a2da2c88d12b5540ff98eca543ff
- MD5 5e60f8ed543d5410bae9dc597be10210
- SHA1 1ee8de9dc8e372ea37778c4d3d3be87050bcc283
- SHA512 95fa19e9111fff16e764076d8c83422465229810ce976b72a8c068d6f422c9a2638ed5ad51f08f7379fc4721e61e8c346941be294b41aa367f1303ba5310c9cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCaICjYTqMi8CtBd2QHCHmTBW5kDw:A3k03kHRJP56r2qJtb2Ij56r
- TLSH T11B853A16F6A84FA5D06FC178C5929666EA333C415F3087CB1344AE293F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2736-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b551-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a408-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2736-57-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4684-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028e17-1258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00060000000259ac-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00150000000279e5-1527.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002625c-2065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0018000000000675-2133.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b551-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a408-11.dat aspack_v212_v242 behavioral2/files/0x0003000000028e17-1258.dat aspack_v212_v242 behavioral2/files/0x00060000000259ac-1372.dat aspack_v212_v242 behavioral2/files/0x00150000000279e5-1527.dat aspack_v212_v242 behavioral2/files/0x000200000002625c-2065.dat aspack_v212_v242 behavioral2/files/0x0018000000000675-2133.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4684 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2736 2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4684 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-02_5e60f8ed543d5410bae9dc597be10210_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2736
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4684
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 5407cd0d1c6a606edf869fbfb095590a8466a2da2c88d12b5540ff98eca543ff
- MD5 5e60f8ed543d5410bae9dc597be10210
- SHA1 1ee8de9dc8e372ea37778c4d3d3be87050bcc283
- SHA512 95fa19e9111fff16e764076d8c83422465229810ce976b72a8c068d6f422c9a2638ed5ad51f08f7379fc4721e61e8c346941be294b41aa367f1303ba5310c9cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCaICjYTqMi8CtBd2QHCHmTBW5kDw:A3k03kHRJP56r2qJtb2Ij56r
- TLSH T11B853A16F6A84FA5D06FC178C5929666EA333C415F3087CB1344AE293F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.4MB
- SHA256 411c40eadc2e931ea28060bd28a793ec93bfb78bca1fc9e7652b65a89d5d0c3f
- MD5 2a7a4ac926d74672a6f41f6ce21e31b3
- SHA1 cc93e640386c23793489daef4f548c5b676c14f3
- SHA512 acf7029a2d2ec80bc2221ea17f175b09daf3d725e006ead688e9d5f43fa311c22e94949c620d2916aabbdd5c62fad06117700dee0c0407ce9050b2f84953b176
- SSDEEP 49152:A3k03kHRJP56r2qJtb2Ij56rIVk0QGTvntQb:A3k03kHRir2Jr5Haib
- TLSH T105C55B16A2A84BA5D06FC178C6929556FA733C421F3097CB0395DE293F77AD09A3E313
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.2MB
- SHA256 093226c5637d5c0c01f963ff657ea8def89bf1501292d3d98828ed6a635d483d
- MD5 866aa7a9c77a636bff68536da7c89c59
- SHA1 07925f952174f0b9f55fee6317aad2889b1eda8f
- SHA512 59aa44a0db29eef2c4cab3ad00accc36c5fd4e47452bd93019e4ce6f783c985d11507f1ad38a36f09416d941d8439dc29bedac6901fc9282d924373fe8649d98
- SSDEEP 49152:A3k03kHRJP56r2qJtb2Ij56r5Td9CHKyao:A3k03kHRir2JrpCqo
- TLSH T19CB53916B2A84BA5D07FC174C9A25656EA733C415F308BCF1354AE293F336D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 a80cff559d1f0fe7772b059a82bb6e9ceca9df1185163c21426aba8a98940d4c
- MD5 7dfd56cd24ed4b27d40a15a40ce25deb
- SHA1 47dfaa5a3b84483855df9e7139366dd6c91e4281
- SHA512 43dd27e74bec39263f29b5eee369e63c7ecab5b1a3197be2d41dd21bf6cfb55a2fb2961765697391cfb3ebe5a25d1f56449e811145c92aa59b6a393bc86f8c6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCaICjYTqMi8CtBd2QHCHmTBW5kD:A3k03kHRJP56r2qJtb2Ij56r1Pji0Aj
- TLSH T185B53A16F6684B65D06FC079C5D2969AEA733C425F3087CB0345AE283F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe
- Size 1.8MB
- SHA256 a1503fed5de9eddaaef34e61d5cf6d95421218e56e3f08e720dabbdcc4db04b4
- MD5 8d2fe85d5b61597540d6da96bc9aa8f3
- SHA1 f72c16460a4cf19f836bb3cefb7a55b7f23961e0
- SHA512 4863fe9ce17c0b60326cb777caf13a52bda25dc427475fbac617569244cb31c26dee2e8d25e3b1a9fb70badc78fa215359ccb7b256d20f6c048783a1437551f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCaICjYTqMi8CtBd2QHCHmTBW5kDc:A3k03kHRJP56r2qJtb2Ij56rP
- TLSH T1E6952916E6A84FA5D06FC174C9929656EA333C415F208BDB1344BF293F376D09A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\python.exe
- Size 2.0MB
- SHA256 d16b04fd18f433cf8ab7500d2389daa46b11f64172482047f8c37914a28ad4f2
- MD5 d6d0e3623d1898a7907ddb8a06929599
- SHA1 116783a44aa831f83a677138bc5cf0dd85b4a663
- SHA512 6b5f9265849a4bd03dee88b9419f0ddc10a567d905c37874adf7cd7e8dc11dd563650491b43fe8071d036bb60fd7704ba3dc81dcab91be43dcde9fb36f2dae9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCaICjYTqMi8CtBd2QHCHmTBW5kDB:A3k03kHRJP56r2qJtb2Ij56rli2WH3
- TLSH T139A54B22B6A84F65D06FC174C5D29666EA333C425F3087CB1344AE293F776D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 1.7MB
- SHA256 d50fed86bdbaa6f192c182e3eb5582a4994314589372d91951d37b1843a0765b
- MD5 890f6325fe5c4d9189b7deab329d2078
- SHA1 dfdfc20a963b1b1ebac2e6b4affd29e94e05650c
- SHA512 386a45337cef473eee6deb934e52e81a1e74bb3da42997883676745b1cf51ad81d70ef6d85a0db0f2294cbaeec1131e461f68d60f82a175e16eef8e057e37819
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlaTeD5Tvinrm5FaCaICjYTqMi8CtBd2QHCHmTBW5kD4:A3k03kHRJP56r2qJtb2Ij56r
- TLSH T1F0853A16F6A84FA5D06FC178C5929666EA333C415F3087CB1344AE293F376D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH