Analysis
- max time kernel
86s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 18:46
Behavioral task
behavioral1
Sample
2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.0MB
- Sample260728-xeszhsbc42
- SHA256 400dd101055ae615dcbcddc3af0168b36b2910e0e42fc75db067cdbed8690a1b
- MD5 5dad444e4aef6afb4f5f0047861775fc
- SHA1 6e5336e31952d245b4ee591398f48eeb9f393313
- SHA512 65142327e961f571c7d99e896745bacb1c9b441ed02bae3b412b536edd86bc9c5b3233506b8ce0e760dc13559a145aaeae67d15c59bde4e6e3a6af14f2696115
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1Pi4F:A3k03kHRJT
- TLSH T1A735AE03E6D500E5D64A8130DED98A22FA35BD921B6097EF2368F7152F727C07B397A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral1/memory/548-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024521-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/456-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/548-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/456-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235a7-137.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f00000001690f-1873.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000739-2069.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000006d1-2134.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024521-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235a7-137.dat aspack_v212_v242 behavioral1/files/0x000f00000001690f-1873.dat aspack_v212_v242 behavioral1/files/0x0003000000000739-2069.dat aspack_v212_v242 behavioral1/files/0x00060000000006d1-2134.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 456 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 548 2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 456 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_5dad444e4aef6afb4f5f0047861775fc_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:548
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.0MB
- SHA256 400dd101055ae615dcbcddc3af0168b36b2910e0e42fc75db067cdbed8690a1b
- MD5 5dad444e4aef6afb4f5f0047861775fc
- SHA1 6e5336e31952d245b4ee591398f48eeb9f393313
- SHA512 65142327e961f571c7d99e896745bacb1c9b441ed02bae3b412b536edd86bc9c5b3233506b8ce0e760dc13559a145aaeae67d15c59bde4e6e3a6af14f2696115
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1Pi4F:A3k03kHRJT
- TLSH T1A735AE03E6D500E5D64A8130DED98A22FA35BD921B6097EF2368F7152F727C07B397A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.1MB
- SHA256 cb5a87bfe15da3f324e54a85e6860fabe41bda96c773fbcb7ac8adcde6ea66dc
- MD5 aedbe297828b411a3db506f11639b7da
- SHA1 e95cdad0f30d738346ffe4c085e60090d9bbf623
- SHA512 6f64eaba19b0c591064d6ca2135a07535d7c5c75fc3d8e0c7f378dd8454f047b38351ed7449f0846203d7d4e3d7bc9d854273d9a9b28068f04261714ce1ea1c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1Pi4/bBPzBAU:A3k03kHRJpBPVAU
- TLSH T10C45AF03E6D504E5D64681309DD98A22FA39BD921B6097EF2358F7152F327C0BF3A7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 ebf3cab9b3a8240e154c6b97c9470d73442bb0216e2fb8f2ed0f4ab0ed68fc0e
- MD5 afb62547cf48b5e920edc17a6c79a00d
- SHA1 43311030f75f8bb3c1a256f70a68d02bfd0669b6
- SHA512 36247514b2da2c68506f7ea311690e8f41e9dfd4582938db02e9c688c29046be572e864270cf8b57ac8c043b2d61e0d39a5a51dc4c7f0ad89d7f1cdb257b3a69
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1Pi4B0Le5ji0hmxNrM:A3k03kHRJPPji0Aj
- TLSH T166757B17F6A402B5D067C074C9D69A56EA713D821B308ADF1358F7282F73BD1AA3A770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 1.2MB
- SHA256 4a7b49c4e01230860955659a1e83a743d2882253f0a3a5f448c9e01b3dde70a1
- MD5 b40668add1ae8f760e5e37f64dc8b8b6
- SHA1 0d7d85ef7b9f790568df435b262b65967439d1ef
- SHA512 68ed12bafae386ad048717abc650d9b811b3cbe9a3e0e3b82f913daf6b784685a02ac21c14299341200a6505facb1f526535654106d12b319f4deacf3c2ffce8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1Pi4KD:A3k03kHRJY
- TLSH T1DA455A02D69400A5D64E8130DB994A22FA377D9217E096EF23D8F63D2F327C06AF9757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.3MB
- SHA256 869754112d5bb2b038cbd031b9d6343e13512c087a5b11f570d125a44f019a27
- MD5 6d93f4bd45c40d6edb84557af97383d9
- SHA1 86630ed5802c60e47b0d867456980881ed8bcc56
- SHA512 24057936243f41307a03942ae409459177b1048c22eff310642f8c2cc59f7839656e2fa5c49e4873eee589d290531908b0f4a59f3de0f12ab202bb0ff0a28391
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1Pi4xV+PAk2hMH3:A3k03kHRJLi2WH3
- TLSH T1CE55AF23E6D400B5D64781309DD98636EA34BD920B2196EF2358F71A2F727D0BF3A365
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$
- Size 1.3MB
- SHA256 4ad6877f008dd2dd1ba5c54a4f0bb37959c8583e865349b55523e9e1c19fd421
- MD5 9fca42ecf08e66c1ddb1b9a120c6c2e9
- SHA1 9305eaef12501145f7ca103d0ae1e7574d46f34b
- SHA512 e75e52a4a9fac267c5c9b46a17df1ed98dc6e98bd760bd077bfe79b82aaabe16d0fb240fe98e2d2eee569cad3d8a6846968d54f7d9429292b97b74fb6d6c8c9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GduEcl1Pi4HpJFCfb:A3k03kHRJLJwT
- TLSH T11555AE03E7D900A5E69A8130ADA54622EB35BD925721D7EF335CB3192F327C0BB39365
- MD5 SHA1 SHA512 SSDEEP TLSH