Analysis
- max time kernel
94s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
21/07/2026, 03:48
Behavioral task
behavioral1
Sample
2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.7MB
- Sample260721-ecs8dsfv2z
- SHA256 a141fc17a978f917f825ba5002dcf4e7b6761743cbf3fcdba8c35d02d05f9733
- MD5 d8cdb7737b430fd18aba8cafea84ccee
- SHA1 45d790e4f098442869e1a1c68ccb1e15a06b08fe
- SHA512 93ae3c1a216aca1a6d9f86089bc30992c75e1a11874ac5931ec93b177e2eae19df8fc7ac2da09d1098b4393455fd8100da789e06c0978560624a102c52aca8cc
- SSDEEP 49152:A3k03kD4U2v+WeW4SkZP4sz9MbE56r+qJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9J:A3k03kc/vVfkZcBr+WfkZcNfkZcRjo
- TLSH T102361A16F6788733D0B3C0B9C5D6AA9AFA7234455B308ACB0345D72C2E276D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/4448-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245aa-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6a5-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4448-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3804-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002361d-132.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021fa5-792.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022144-816.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001500000002031c-1533.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001e0c1-2106.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245aa-6.dat aspack_v212_v242 behavioral1/files/0x000300000001e6a5-11.dat aspack_v212_v242 behavioral1/files/0x000200000002361d-132.dat aspack_v212_v242 behavioral1/files/0x0002000000021fa5-792.dat aspack_v212_v242 behavioral1/files/0x0003000000022144-816.dat aspack_v212_v242 behavioral1/files/0x001500000002031c-1533.dat aspack_v212_v242 behavioral1/files/0x000400000001e0c1-2106.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3804 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_86218\javaws.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E3C293D9-92A2-430F-A573-2511CDB7A4F8}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4448 2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3804 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-21_d8cdb7737b430fd18aba8cafea84ccee_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4448
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3804
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.7MB
- SHA256 a141fc17a978f917f825ba5002dcf4e7b6761743cbf3fcdba8c35d02d05f9733
- MD5 d8cdb7737b430fd18aba8cafea84ccee
- SHA1 45d790e4f098442869e1a1c68ccb1e15a06b08fe
- SHA512 93ae3c1a216aca1a6d9f86089bc30992c75e1a11874ac5931ec93b177e2eae19df8fc7ac2da09d1098b4393455fd8100da789e06c0978560624a102c52aca8cc
- SSDEEP 49152:A3k03kD4U2v+WeW4SkZP4sz9MbE56r+qJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9J:A3k03kc/vVfkZcBr+WfkZcNfkZcRjo
- TLSH T102361A16F6788733D0B3C0B9C5D6AA9AFA7234455B308ACB0345D72C2E276D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 5.2MB
- SHA256 73154ed335d255dc8d0df8808693080c4432a431362cbff492361d02e42c7eb4
- MD5 5d38be44b29192b6765b9b7577856abb
- SHA1 51f5c13730f2a67752fc11d6c68a84728e08aaf4
- SHA512 1554a6169c34dfc5dd6c77e9a6f9c76e0bf75d70e575653444849fa1642ff32f2938d153eeb8d8c066f61e4d959413a3bd748ee83ef78f3840eddaeb724527fa
- SSDEEP 98304:A3k03kc/vVfkZcBr+WfkZcNfkZcRjoKCqo:A3k03kc/pP1+APpPVofqo
- TLSH T110462B16F6788732D0B3C0B9C5D6AA9AFA7234455B308ACB0345D72C2E277D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 5.3MB
- SHA256 c5c8c86cff052ebed69dc611dee3951ad72f770a649e8c72ad2fe51cf884e0d7
- MD5 2ae9c33e75bf904bfe7f315c818785a7
- SHA1 418cca679ab031895b04f75b12770484eef16266
- SHA512 a17b977be4478875d47f500fb869eaf4c658ecf2968f26b8cf7e8bd9e0f7f3821a6a4d2dc79cfbef9e40c3548e625ff86a14d70e1bd99b4cc002cfbf7e9c2e3d
- SSDEEP 98304:A3k03kc/vVfkZcBr+WfkZcNfkZcRjo0jo:A3k03kc/pP1+APpPVo+o
- TLSH T1B2462A16F6788732D0B3C0B9C5D6AA9AFA7234455B308ACB0345D72C2E277D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$
- Size 4.9MB
- SHA256 f864647842ecf85e4c32003d52188367c3953367c64d591d8a6b8bfa4271c0b8
- MD5 f053b0b1d3ad65f8bab938d4909e3925
- SHA1 0b696c3382d0e705461724422322ffbbf3789c44
- SHA512 aad6ffbf925e153caafb8546d0d86c5d5fe905f712a7d85aa9ec5df1427fe5ac1508844d894f184501fc4ae700977ebc56c219edb7ecfb92d1f17fb55663fab4
- SSDEEP 49152:A3k03kD4U2v+WeW4SkZP4sz9MbE56r+qJtb2IpeW4SkZP4sz9Mb5eW4SkZP4sz9p:A3k03kc/vVfkZcBr+WfkZcNfkZcRjoT
- TLSH T1A0362A16F6788732D0B7C0B9C6D6AA99FA3334455B308ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE
- Size 5.2MB
- SHA256 4e2ba34e700f6f4c1238b44933029ef8fa47165de3ffaeaeec9b25d779f459a0
- MD5 8da939053316e1420eda966d369584d4
- SHA1 6f4a83adf40910981ebd3aacc7acf38b6ab9f9e1
- SHA512 b486551adb17df9427def43f34a3574e06a0dd906a5121270a82fb2f0e264bfaeb44c7154ba5d434d90dd07cc05f4fe214974e532f209906d04c37a1a8a3edf4
- SSDEEP 98304:A3k03kc/vVfkZcBr+WfkZcNfkZcRjoW0QA:A3k03kc/pP1+APpPVo4A
- TLSH T18D463B16F6788776D073C0B9C5D6AAA9FA7238450F30CACB0249D72C2E37AD58536736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe
- Size 5.0MB
- SHA256 bf8c7a038510f4d05c27e2a34a101449a0b6365819a76669d2e7ffccedb8f68d
- MD5 08ec4c94fe8f59317c74c7be68a88092
- SHA1 48f3a13ccb50eb2bf57b97dd519ca25994d32426
- SHA512 72fbbef8370ea2372c9c8f5a1d6c543b29e6477ec9082bddd23918df006091a5e64b8047d48092ca04ba6bd5150d76502affe36efe8a739ffb718545ad3e67d3
- SSDEEP 98304:A3k03kc/vVfkZcBr+WfkZcNfkZcRjocTQ:A3k03kc/pP1+APpPVocTQ
- TLSH T17B362A16F6788733D0B3C0B9C5D6AA9AFA7234455B308ACB0345D72C2E276D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 5.0MB
- SHA256 e67c0f0e0012cbf6725e2178facaf0ab39c596cae7fdfe15ed6b45ba9febb1fb
- MD5 2a17b1ea6f8059cff5cef120afe3004a
- SHA1 adc6e6f722f60813fa6400d35cd7608157128012
- SHA512 4c5935f1ad3b6a753b98f6d8b91b4148b7f189b1856a26408024d7a1c52b3eb812df7a79623a9d7d531f7d3e251eb38c5e5de0f39fb7790eacdb9e5b0a02eaea
- SSDEEP 98304:A3k03kc/vVfkZcBr+WfkZcNfkZcRjoMuX:A3k03kc/pP1+APpPVoMA
- TLSH T1F5361A16F6788733D0B3C0B9C5D6AA9AFA7234455B308ACB0345D72C2E276D6C636736
- MD5 SHA1 SHA512 SSDEEP TLSH