Analysis
- max time kernel
97s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
19/07/2026, 16:42
Behavioral task
behavioral1
Sample
2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.4MB
- Sample260719-t7vr2ahv4x
- SHA256 ae09edc059b1a6f39786fa392518333202d118d42ebbaa987ec2fa8098426bac
- MD5 a9e737210544fd4ae30c6a08e5a9a8df
- SHA1 501935db366e369d307b480ceedd7d1d2de6ec82
- SHA512 2109bc0b78222fce086ad6da973fbb1b22fc1345b2b51731b8fe4e1ca39c4c3f4d736a6c46a0ec4ca20aaeacfe31b40c90e2b815d9ea1364b4bed0a2babfc6cb
- SSDEEP 49152:A3k03kHRJARJNeW4SkZP4sz9Mb0eW4SkZP4sz9MbE56rTPji0Aj:A3k03kHR+R7fkZcgfkZcBrLjo
- TLSH T108F51A16F5788722D0B7C0B9C5D6AA5AFA323C451F308ACB0345E7282E377D59A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/4312-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c511-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4312-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5100-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d000000019cc8-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000900000001ac32-1224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000000137-2093.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c511-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x000d000000019cc8-1018.dat aspack_v212_v242 behavioral2/files/0x000900000001ac32-1224.dat aspack_v212_v242 behavioral2/files/0x0008000000000137-2093.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5100 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$$ 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4312 2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5100 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_a9e737210544fd4ae30c6a08e5a9a8df_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4312
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5100
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.4MB
- SHA256 ae09edc059b1a6f39786fa392518333202d118d42ebbaa987ec2fa8098426bac
- MD5 a9e737210544fd4ae30c6a08e5a9a8df
- SHA1 501935db366e369d307b480ceedd7d1d2de6ec82
- SHA512 2109bc0b78222fce086ad6da973fbb1b22fc1345b2b51731b8fe4e1ca39c4c3f4d736a6c46a0ec4ca20aaeacfe31b40c90e2b815d9ea1364b4bed0a2babfc6cb
- SSDEEP 49152:A3k03kHRJARJNeW4SkZP4sz9Mb0eW4SkZP4sz9MbE56rTPji0Aj:A3k03kHR+R7fkZcgfkZcBrLjo
- TLSH T108F51A16F5788722D0B7C0B9C5D6AA5AFA323C451F308ACB0345E7282E377D59A36736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.9MB
- SHA256 3bb40ba2ec797bc2437c8394088913ed229fb1aa239126d933b3a08266dce017
- MD5 5c37f501f6df333cd1877ac981bcf2f8
- SHA1 4f9912cda31daea2a9fbe31dc29db5ece95de1a1
- SHA512 d50da8008e662b96ba14a9630d3460955669d0e8893877c7f602dba717048e242f225c394d75270b73d95fe699c2facd53b4e901c4ce7b211116bec167ffe1ba
- SSDEEP 49152:A3k03kHRJARJNeW4SkZP4sz9Mb0eW4SkZP4sz9MbE56rTPji0AjKPji0Aj:A3k03kHR+R7fkZcgfkZcBrLjo0jo
- TLSH T1C9162B16F5788722D0B7C0B9C5D6AA9AFA3238451F308ACB0345E72C2E377D59A36735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.5MB
- SHA256 b934e098223053e33064f5fa2b418376eb3b35b1939f1f6ac2844fcc41d404bd
- MD5 a2af1c3c2eb6b19ebcd2e54e8b7c1d26
- SHA1 393cd881f160a996af9c94c51e64722d235e10b9
- SHA512 7afceba13c3e099ce9b7fb0b1aa3ccb4fe8e1bd9a87b971e22107ea2f38b8589b5993bcf296db4a8dc9fe808542e6e5b191cea9c01e7714da2ab0f8ddb8af632
- SSDEEP 49152:A3k03kHRJARJNeW4SkZP4sz9Mb0eW4SkZP4sz9MbE56rTPji0Aj7:A3k03kHR+R7fkZcgfkZcBrLjoX
- TLSH T16FF51A16F6788722D0B7C0B9C5D6AA5AFA323C451F308ACB0345E7282E377D59A35736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 3.5MB
- SHA256 0efadddd7333bae4d7da02ec8122894b52a52f5ec782b9d64ae68cdd3970ec77
- MD5 97e6da93c04b1ccb9e56d2c9bc481b88
- SHA1 fce237ab67c1d2082f510873ed30744ab3a030d9
- SHA512 fdaf7bfecaa4d905b85b474230926f304855d057170807f76253ebd1f2545f26d169f06a6202752dcd4b6372363bba8ee442a74784a294301ca2fbf1271a4610
- SSDEEP 49152:A3k03kHRJARJNeW4SkZP4sz9Mb0eW4SkZP4sz9MbE56rTPji0Ajq:A3k03kHR+R7fkZcgfkZcBrLjo2
- TLSH T15F061916F5B88722D0B7C0B9C9D6AA5AFA323C451F308ACB0345B7282E377D59A35735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 3.4MB
- SHA256 d15689a0327ec70f579e0795549b0c7c3dfd638feef576ae7beb3f9fa91a6390
- MD5 0c8c72577b73ab699aba4bdd22d0da1e
- SHA1 626d7c80b8d704e6c0f4e4c73d0bb143e33a9705
- SHA512 74947000e3e3e0977c144fb9f4cf67ef91bda6de2828f6cc4b8432d9fd3bc84ee268c5f3e7cce083353ee9c3c7c170a1e6c1a86b9cd277138a0eb5f844376c47
- SSDEEP 49152:A3k03kHRJARJNeW4SkZP4sz9Mb0eW4SkZP4sz9MbE56rTPji0Aj:A3k03kHR+R7fkZcgfkZcBrLjo
- TLSH T112F52A16F5788722D0B7C0B9C5D6AA5AFA323C451F308ACB0345E7282E377D59A36736
- MD5 SHA1 SHA512 SSDEEP TLSH