Analysis
- max time kernel
110s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
06/06/2026, 13:45
Behavioral task
behavioral1
Sample
2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.1MB
- Sample260606-q2lemaf18x
- SHA256 593c8752a6388cd004ffa97ed94db86a7a46af30c9712520496ce080e387052a
- MD5 fb8c538ca45de9e133c263496910f8d6
- SHA1 caac4f2f6f9bbf104c18dc48a22653eca3e02bd4
- SHA512 2f19b29d05c3c351d4c7a7d0156511efaf237e6e803ba63fbb2fb512a57ac5b3f4cd9b1de1cf36c2bc724adab2acfeccfd99bee8c0c2390a081f573b91b9451d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsy0HdfnC/L1ZuU:A3k03kHRJ
- TLSH T17B458D03E7D400E4D65681349D958A22EB75BD921B209BEF1368B7162F32BD0BF3DB64
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/808-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001b00000002b4c8-7.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3028-13-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028dd6-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/808-83-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3028-84-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000028eb4-1265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027ac5-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0012000000000478-1882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000000673-2091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000000673-2132.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001b00000002b4c8-7.dat aspack_v212_v242 behavioral2/files/0x0002000000028dd6-59.dat aspack_v212_v242 behavioral2/files/0x0005000000028eb4-1265.dat aspack_v212_v242 behavioral2/files/0x0008000000027ac5-1386.dat aspack_v212_v242 behavioral2/files/0x0012000000000478-1882.dat aspack_v212_v242 behavioral2/files/0x0013000000000673-2091.dat aspack_v212_v242 behavioral2/files/0x0015000000000673-2132.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3028 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingNews_1.0.6.0_x64__8wekyb3d8bbwe\NewsStub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe$ 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2020.503.58.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 808 2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3028 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-06_fb8c538ca45de9e133c263496910f8d6_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:808
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe$
- Size 1.1MB
- SHA256 593c8752a6388cd004ffa97ed94db86a7a46af30c9712520496ce080e387052a
- MD5 fb8c538ca45de9e133c263496910f8d6
- SHA1 caac4f2f6f9bbf104c18dc48a22653eca3e02bd4
- SHA512 2f19b29d05c3c351d4c7a7d0156511efaf237e6e803ba63fbb2fb512a57ac5b3f4cd9b1de1cf36c2bc724adab2acfeccfd99bee8c0c2390a081f573b91b9451d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsy0HdfnC/L1ZuU:A3k03kHRJ
- TLSH T17B458D03E7D400E4D65681349D958A22EB75BD921B209BEF1368B7162F32BD0BF3DB64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 1.9MB
- SHA256 98931750b74e61a4e99d479e015a35ac08ed2c0fe12e27aa95d58e0ac8a3bcdb
- MD5 41323b537a613708f17adf5e3a8818f4
- SHA1 d212498845f92182da54517cd837278109f45c64
- SHA512 4f30094d4bbafee62d4d9e2bb4aa0e4cbb7aeb02c049881e9839af90af5f2326bdf42371cdb0bd45c81a57a0bf2ca8cd08354689374e7e8320e9fd5cdd3278e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsy0HdfnC/L1ZuU+VkGDvQGs94iGWWdTxTU:A3k03kHRJ9Vk0QGTvntQb
- TLSH T162956C1692E802E4E5AAC278CA568513FA717C5613319BDF0364F61A1F73BE0AF3E714
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{3C9C959A-F248-4B60-A580-F846F36C0A80}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.2MB
- SHA256 64345eca0a880b053c8a31adf653b36480ae62f7ebfe3849c416e37c7484afd0
- MD5 3aa1e544a766e19f418e6c4ded5db29c
- SHA1 52c2abff950fe52d8b9d80facba987660bbdf32c
- SHA512 d8d9d1eb4797220dacdcb6bf9bf034f5ea92953ba0f293337a894721f07c9543316b294cfa6b03093a06935096aa1af6cb1120d80dac4c3187928feb9987d79a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsy0HdfnC/L1ZuUlbBPzBAU:A3k03kHRJwBPVAU
- TLSH T1D2559E03E7D400E4D65681349DA58A22EB75BD921B209BEF2354B72A1F327D0BF3DB64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 1.2MB
- SHA256 28dc5d31f3cd95def5e6a1d701016430eec6c7bf108c10c61be986c519ade0ef
- MD5 139f5e12e0c868983762721c1eebf0a2
- SHA1 23e3d0c071af236dcb8bf2e7475f2499959dc8a0
- SHA512 e36b184d3345721208c41a0aadc4d9b2bc8f5ea53235eab2850048225192be83ff07ec004672d78c839dea10c5feaa83f674294cd4d8f422b243a4e5d29c65f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsy0HdfnC/L1ZuUyb:A3k03kHRJtb
- TLSH T1B3459D03E7D400E4D6568134DDA58A22EB75BD921B209BEF1368B7162F327D0BF39B64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 1.2MB
- SHA256 3c283a03552b2c304057926bf12405b65f55d39129ad44136b8fbe6e41553bd0
- MD5 9c59f40fcb5b562f54259a66b10d26ef
- SHA1 ebb32458a552851a9a9be04e11b67e74b1f91a43
- SHA512 1fda4088d9294e96e8dced23f303d982ec4f3ddd4da8eaf140ef217bd2f2debafd68acfdff99c98c80309df6deca2e9cbb8d47db555daaad033e488b48eedc2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsy0HdfnC/L1ZuULF:A3k03kHRJM
- TLSH T1E8458D03E6D500E5D6968134DD998A12FA35BD920B209BFF1368B7252F327D0BF39B64
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe$
- Size 1.4MB
- SHA256 e3cdef05e0d5ffd5e48d567ac28b846f51e2fa8869491e011ea0b82d67ce273b
- MD5 c595a5362e75e9f39aec0fb429c3e9a4
- SHA1 a8eabaae3188d1da16c671f439a6909b4f7100e2
- SHA512 e2ad360f3436281ef8e8d8808bbe8e605e6c2854ab7f4e10ddd740b161944f5ec8958042cd56c0f54338c25e9339a1c3795910eb9c56ea32a15b46179c8cfada
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsy0HdfnC/L1ZuULV+PAk2hMH3:A3k03kHRJ+i2WH3
- TLSH T16C659D13E7D400F5D16781349DE98622EB35BD920B219BEF1354B71A2F327D0AE3AB61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$
- Size 1.2MB
- SHA256 73c720e62198e084cb527d0312d044382f11703523d7ae54440fb80c10698e8d
- MD5 5e2465fa1b5c69279d385dc7024ffbf1
- SHA1 4b6eb36d483d867093628b86023469f45c480f76
- SHA512 5ffeb526c0a689b60257779379c41636346048f8361bf391778a7843255e44206f6356676f2361ddb640f4fa1ea8e9c20522745383c7d3d31cc42d317d949745
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsy0HdfnC/L1ZuUzV:A3k03kHRJMV
- TLSH T108558C03E7D400E4E66681349DA58A22EB35BD921B209BEF335CB7151F327D0AF39B65
- MD5 SHA1 SHA512 SSDEEP TLSH