Analysis
- max time kernel
110s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
08/06/2026, 13:59
Behavioral task
behavioral1
Sample
2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260608-rad2xaew3p
- SHA256 facb0b793a87bdb1e96a54369a6d6170812cb283d82e75a241391d91401dff75
- MD5 e891e5ebd1e6d5bb1d6330e165774799
- SHA1 88200cca1a129caf94e4b7818a04029d2f3209b7
- SHA512 e30eb0b5a10c2b9e04f5e62854d9710fdaab5538cbecc3ef9783c7a1263ee3a1272a985dde882353131f9815b8c9370dfc179035d8c780900ed5f6fd085b99b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8BkoP0Le5ji0hmxNrM:A3k03kHRJARJsPji0Aj
- TLSH T19A657C17F6A802B5D067C1B8C6D29A5AFA713842173097CF1394C7292F67BE19F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/6036-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b586-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3276-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002a411-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6036-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3276-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000028ea0-1250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000027a85-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002800000001a60c-1645.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000025e75-2105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x003a000000000476-2198.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b586-5.dat aspack_v212_v242 behavioral2/files/0x000200000002a411-12.dat aspack_v212_v242 behavioral2/files/0x0003000000028ea0-1250.dat aspack_v212_v242 behavioral2/files/0x0008000000027a85-1376.dat aspack_v212_v242 behavioral2/files/0x002800000001a60c-1645.dat aspack_v212_v242 behavioral2/files/0x0003000000025e75-2105.dat aspack_v212_v242 behavioral2/files/0x003a000000000476-2198.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3276 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.143.57\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6036 2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3276 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-08_e891e5ebd1e6d5bb1d6330e165774799_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6036
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3276
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 facb0b793a87bdb1e96a54369a6d6170812cb283d82e75a241391d91401dff75
- MD5 e891e5ebd1e6d5bb1d6330e165774799
- SHA1 88200cca1a129caf94e4b7818a04029d2f3209b7
- SHA512 e30eb0b5a10c2b9e04f5e62854d9710fdaab5538cbecc3ef9783c7a1263ee3a1272a985dde882353131f9815b8c9370dfc179035d8c780900ed5f6fd085b99b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8BkoP0Le5ji0hmxNrM:A3k03kHRJARJsPji0Aj
- TLSH T19A657C17F6A802B5D067C1B8C6D29A5AFA713842173097CF1394C7292F67BE19F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 2.1MB
- SHA256 3f512b16d7a2cdb393525777aae40ed17d9233e24b3c14b8631fdbdfa07d5ca9
- MD5 3dd1bfb268408b1d08c5aa04efb0666f
- SHA1 6a777ad362b82f1b46f806178b7623047f2e2928
- SHA512 09fb5325602834de41b26b336603d251b707aeac33717fbebcf3a732578f991b691c48fad9acfd031af8268dfc7270dced7e938aa1b54976c18f2fb592a50012
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8BkoP0Le5ji0hmxNrMqVkGDvQGs94iGWt:A3k03kHRJARJsPji0AjPVk0QGTvntQb
- TLSH T135A57C17E6A803E4D07AC179C6979A57FA713846133197CB03A5C6292F67BE19F3E320
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.9MB
- SHA256 ca67fcf5a174ff7d477403e9b5d2221454475de47b1904b120af2baf7d022e40
- MD5 0a6535229eebba149dc6cc63be754c0b
- SHA1 0a0bc19025cf4cc4f694e467ddf394a1027639b8
- SHA512 32238ce35d5a3bf9a8fb0b1b97b37558ec4b102551a6cc03c9a4135456b365769bab9b3f81f79df90dc3023eb6e2a6ea985508980dd535b01ccd1e5ab4f6e71b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8BkoP0Le5ji0hmxNrMfUr2d29dBrtpDiI:A3k03kHRJARJsPji0Aj2UidGl
- TLSH T12A958C17F7A842B5D067C178CAD29656EA7238460B3097CF0394C7292F27BE59F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 92619f7b5ffb6e274ac254329198737bef1b3ffdf8b8c9047d3b8187723a62f7
- MD5 e0934204b7daf24f905bd4cc122040da
- SHA1 45b52326bac83a10bd862ef84e4fbd56c2cb6730
- SHA512 8cacd2f9660f4967d7d66342b839598ade04f5c6674f8fdfc65797f6bb6230febc7254e687acb4e22cf86c9cb5b29c69fc8903510633ac6eb70ff346cba1a53e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8BkoP0Le5ji0hmxNrMD0Le5ji0hmxNrM:A3k03kHRJARJsPji0AjKPji0Aj
- TLSH T1B0955C16F6B84375D073C0B9C5D2A69AEA71348217308ACB0395C76C3F67BE59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe
- Size 1.5MB
- SHA256 d3ccae053d4af7353ad275e314e1a05d218ff2e2771a52b7a3e3a34d803f9936
- MD5 ca53b1c0eef476b77fe5757353fc3389
- SHA1 0c4d9ad060b77f5eaa2847e1f50fcbe42855ec80
- SHA512 f42c4b9869a8e85e111b594ed3ab9af1424a54909c3982d4a6f4fd7826d6c933369cee844cab2c9292595eaeb055a7db5f39170e451ac1022a17ff10e53d90c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8BkoP0Le5ji0hmxNrMPF:A3k03kHRJARJsPji0Ajq
- TLSH T114756C17F6A402B5D067C078C9D69A56FA313C8207309ADF1354F7292F73BE5AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\python3.exe$
- Size 1.7MB
- SHA256 9c981233641ac8267fb7a1e50ad4ae5a3d5435e57c7a3739acbb02008227af55
- MD5 3d2aa1460e2fa04188c321fb80070a9c
- SHA1 47d38564a87081a85cbd2e6ba406aeb546c5ed7b
- SHA512 bf0a54293e47d7f3d5049771fa86a0b4c15e53b91ee781f9ab8dfe33842ea26e6cec80cdc5016db5e568528b68a2b332f5b97b0a5d0f4ef3c7e54428fa3b2d26
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8BkoP0Le5ji0hmxNrMfV+PAk2hMH3:A3k03kHRJARJsPji0AjYi2WH3
- TLSH T1CB858D23F6A802B5D067C179C9E6966AFB313842073086CF1354D72D2F67BE19E3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 1.4MB
- SHA256 3f2aef7c35a5f940c8324a29a099d7f523565a6913d69eb35ba5ce52f0ae54d9
- MD5 4899dfc7f3d53f4f30c4133a75fec245
- SHA1 74c77fa5f1d173bc162e4b50a9aa11b2e34ca376
- SHA512 45fce585c15d162a02c6bdfa70afd1d851048d073e9f1d304a8599140797c79933d2c16cfb375b7135240961a2746d7696e58394ba53092bf07f5b08ba4effe9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBFD8BkoP0Le5ji0hmxNrM/lt:A3k03kHRJARJsPji0Aj
- TLSH T1C2657C17F6A802B5D067C1B8C6D29A5AFA713842173097CF1394C7292F67BE19F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH