Analysis
- max time kernel
117s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 14:19
Behavioral task
behavioral1
Sample
2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe
- Size 2.7MB
- Sample260604-rmx1jsg17p
- SHA256 ace8e3b2505437192211fb268029cc6ca60e7e640a41c4d0b6afa7e772fd1bdb
- MD5 5ec666806db7d1cbae9ff463113b0899
- SHA1 7d15aa8a59d996c7a9f692612b9d1d5f95fede68
- SHA512 b17a0405df11b5121e5622ae9b62cc981bb1138cb580905e67362feabaef120e0425627f9ff43c3498cfb3c915778528f672827dd10b6e20682006baebdd194a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGKciNcZvYTqMi8CtBd2QHCHmTBW5U:A3k03kHRJbqJtb2IQ8tDZqrKtii
- TLSH T1CCD54B83EBA58EB1F05A8034C9928679E6727D450BE286DB124EFB1D5F333D459F9320
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/548-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b48f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4660-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a213-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/548-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4660-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028de6-1027.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a0e-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00080000000279b5-1492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d0000000279b5-1537.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000000476-1884.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000026201-2109.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b48f-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a213-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028de6-1027.dat aspack_v212_v242 behavioral2/files/0x0008000000027a0e-1380.dat aspack_v212_v242 behavioral2/files/0x00080000000279b5-1492.dat aspack_v212_v242 behavioral2/files/0x000d0000000279b5-1537.dat aspack_v212_v242 behavioral2/files/0x0008000000000476-1884.dat aspack_v212_v242 behavioral2/files/0x0002000000026201-2109.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4660 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_2.2106.2807.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 548 2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe 4660 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_5ec666806db7d1cbae9ff463113b0899_amadey_cobalt-strike_elex_hijackloader_stealc_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:548
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 ace8e3b2505437192211fb268029cc6ca60e7e640a41c4d0b6afa7e772fd1bdb
- MD5 5ec666806db7d1cbae9ff463113b0899
- SHA1 7d15aa8a59d996c7a9f692612b9d1d5f95fede68
- SHA512 b17a0405df11b5121e5622ae9b62cc981bb1138cb580905e67362feabaef120e0425627f9ff43c3498cfb3c915778528f672827dd10b6e20682006baebdd194a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGKciNcZvYTqMi8CtBd2QHCHmTBW5U:A3k03kHRJbqJtb2IQ8tDZqrKtii
- TLSH T1CCD54B83EBA58EB1F05A8034C9928679E6727D450BE286DB124EFB1D5F333D459F9320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 3.4MB
- SHA256 6427296c49f55f57f423ab14764dca7fc3697ec8eb40a05f01dccbea1b919546
- MD5 fe6d2d85e002ed8df2b1f5993c87077f
- SHA1 082e1e570a3192ec0be251827d4bef5a3422ba11
- SHA512 ee6c4142bd984fb34ece0c730aaa978d99fefb7bf5f4538b0d6d5af2b00f5705c3f526a849ae7364459a8d0f01845419c306dd1f9ad798cee88235cb9adebaec
- SSDEEP 49152:A3k03kHRJbqJtb2IQ8tDZqrKtinVk0QGTvntQb:A3k03kHRZz8iOHaib
- TLSH T1E4F55B52E7A54EF5F06AC034C992863AFA727D4507E286CB025EFB1A1F336D45AF9310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$
- Size 2.8MB
- SHA256 92031319d1adb03357d22f981e241d6dd619f8dcbff9a9079b92be52778845e8
- MD5 bc53e2b480906a48ff27ab97370b1b5a
- SHA1 1c71c122fec2c6fb24c57ebf3baac0c1fa9b643b
- SHA512 85972ec266f9537c51b5c115d710701a5f40ab1b33ff3069acca1d961944a1c6d358342779505e8cd706722a06f3695b2b3264dddfa283d59d4f6c119067037e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGKciNcZvYTqMi8CtBd2QHCHmTBW5f:A3k03kHRJbqJtb2IQ8tDZqrKtimW
- TLSH T14AD55B83EBA58EB1F05A8034C9928679E6727D550BE286DB124EFB191F333D45DF9320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 3.1MB
- SHA256 9d0c60615d67cd2be29d38c14eb820663aaad4a3ef1360dfcae69082036256d8
- MD5 5ce912ce197a1ef32df93e468b31bf23
- SHA1 0cb23cc817a36f8542d0e27aaaf51ea711e839d4
- SHA512 cdd4b17243df79f7f30d68ea39988621bd714c23a946805bdf504eff7c64418d17a4ae94d433096ef78dc5c3e5a665d38144b8d2229231b6458c42bffec8c6f2
- SSDEEP 49152:A3k03kHRJbqJtb2IQ8tDZqrKtiwTd9CHKyao:A3k03kHRZz8i2Cqo
- TLSH T1FCE55C82E7A54EB1F06AC034C9928639E6727D590BE28ACB124DFB1D1F337D459F9720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{7A70D36B-67CD-4626-BFCD-AFE8ADEDC3E0}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 2.8MB
- SHA256 bc5ebdda201c42a50a4e6eee31ad2d651612b5139478880c8df29f82788d28b4
- MD5 3871ccb6015c9652d3248a2118bef6bb
- SHA1 e6bf356762a88d8072097bd8d05e99dd334dcf53
- SHA512 7e9708ac2d4ffaa40222d25ab33132eed6352b1ba8a6fc45c4afb80475a675c24ea84db3ac1302c5dddbc37294ceafefbbb8eaba0518271aab9176dbcff2ca0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGKciNcZvYTqMi8CtBd2QHCHmTBW52:A3k03kHRJbqJtb2IQ8tDZqrKtiGBPVAU
- TLSH T17DD55C83EBA58EB1F05A8034C9928679E6327D550BE286DB124EFB1D5F333D459F9320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.2MB
- SHA256 639ce82cce8ed3b34ba83c3b57eda45d08fc4be819025ce31ebc02517aab1ba4
- MD5 bd9e07d9c2d2387fc9f9cfbf49e722ab
- SHA1 806dad6f666aa1f57ea1726177524470a038c470
- SHA512 1cd62d89c682f96a605476a997c3151aef9f9204267ac91a8bf4203e14b500f0a5e56f925fbfbda2e548b3fde5130cdbce6eddd2fedfd58d9c357c8ed3edae83
- SSDEEP 49152:A3k03kHRJbqJtb2IQ8tDZqrKtiiPji0Aj:A3k03kHRZz8iojo
- TLSH T1B6F54B52E7648EB1F06AC074C9929679E9323D450BF286CB124EFB2D2F336D559F9320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.2MB
- SHA256 da11783352ecc342e342381658d7b5d68e6b05cb21ffe30adf62a21c4f2bc124
- MD5 5aa5cc9669e382da821e81ca2e262cb2
- SHA1 56b491938f06927b10f161728a880ca24ff92081
- SHA512 4fea53bbf6c1d74a863f9161c307358e04788ef7a1ebb18b527bc2e9b98fa3e059429a4f23ac5df249ef61072fb8b6cf1f10d417b6a2fa28fdd242f9cffceb9d
- SSDEEP 49152:A3k03kHRJbqJtb2IQ8tDZqrKti+8tDZqrKV:A3k03kHRZz8i+m
- TLSH T1FDF55C82EBA58EF1F05A8034C9968679F6727D450BE286CB124DFB1E1F332945DF9720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python3.exe$
- Size 2.9MB
- SHA256 c7803e1ca4265e52f8574a35d265037923840f42e703bfcf9c8d1cf1e5d9a43b
- MD5 0353658afd78e3dad872a3680aff1f09
- SHA1 74774b6b6e2defe1a7f278405636d97d7e5fa64f
- SHA512 a8456a1dac78c19ce36bcb76113e692a78538fe868c3eadee495f4bc3884c6dda31b2f1bb5be48913423161a0e2cd091ae57647c1f8cda1bff55d0bc470fc48f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRaiGKciNcZvYTqMi8CtBd2QHCHmTBW5Z:A3k03kHRJbqJtb2IQ8tDZqrKtiwi2WH3
- TLSH T124E56C52EBA58EB1F05A8034C9968279E6327D450BE386DB124EFB1E1F333D459F9321
- MD5 SHA1 SHA512 SSDEEP TLSH