Analysis
- max time kernel
106s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/05/2026, 16:10
Behavioral task
behavioral1
Sample
2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.2MB
- Sample260525-tmlnmads4k
- SHA256 4682be374eb636718e50cf4679b7010e192e1dbb1e83de4668c107c7ea158781
- MD5 7aa4f951ff56898d4987047004d0c953
- SHA1 df6467cec2a535e28952c662e711b9cac166faaa
- SHA512 e7d810509d8f075ee7f2b9e02afb300d4e694c2edb9a9fd0c7dc48e44a3d34d13b6d173b4fe676a6bba5406a8464bccaa06fcae04575b8d14cc3af93e7184a21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgG:A3k03kHRJi56r
- TLSH T1A9557B03E6950FA5D64F813099964622EA777D421F2097EF1368BF253F327C0AA39397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/624-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024340-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1968-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-13.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/624-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1968-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-451.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021a98-840.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021634-1301.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023272-1394.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0009000000024371-1650.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000231c1-1675.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024340-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-13.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-451.dat aspack_v212_v242 behavioral1/files/0x0002000000021a98-840.dat aspack_v212_v242 behavioral1/files/0x0003000000021634-1301.dat aspack_v212_v242 behavioral1/files/0x0003000000023272-1394.dat aspack_v212_v242 behavioral1/files/0x0009000000024371-1650.dat aspack_v212_v242 behavioral1/files/0x00060000000231c1-1675.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1968 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 624 2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1968 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-25_7aa4f951ff56898d4987047004d0c953_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:624
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.2MB
- SHA256 4682be374eb636718e50cf4679b7010e192e1dbb1e83de4668c107c7ea158781
- MD5 7aa4f951ff56898d4987047004d0c953
- SHA1 df6467cec2a535e28952c662e711b9cac166faaa
- SHA512 e7d810509d8f075ee7f2b9e02afb300d4e694c2edb9a9fd0c7dc48e44a3d34d13b6d173b4fe676a6bba5406a8464bccaa06fcae04575b8d14cc3af93e7184a21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgG:A3k03kHRJi56r
- TLSH T1A9557B03E6950FA5D64F813099964622EA777D421F2097EF1368BF253F327C0AA39397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$
- Size 1.5MB
- SHA256 3a05108827dddd1892beb3ebd005ebf01fbc4d2d971ffa323d00e7482ad338b3
- MD5 de15446e88972859ba29b796b65bd786
- SHA1 eb3355b97ee428733ecd140bcc5f423246d79175
- SHA512 79a4308c713ddf01d55edc261bba2a8b3600b6548d0cc0d04dcc4f751b0a10b185397b445ba2c9787b12b806096e205a14e7f675e7b8cdb9354fe2b16de6ed3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGF3UNUpEisI:A3k03kHRJi56rKUN+Eir
- TLSH T155755B16AA980EE5D51F81348D968751F673BC510F2187CB2364BB2E3F337D06E3A266
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.7MB
- SHA256 a5c15e53781a39472cacc134443f8192b063d5e5eaf5c41f31279857f5b88e9f
- MD5 f4ad59be0d701ad15cfcb3727a3d9868
- SHA1 d990bc97ee421f3e2cb923b3adc020ccae0be624
- SHA512 21c5b51a95c449f0c74b893393f64d10753c8ec9c2f0a75b7d6c6dcd80d876cb5cfe865784f0cccc08b7f7f9e10440dbf8267c75f0b90fc719a8b570a5141a9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGbUr2d29dBrtb:A3k03kHRJi56rOUidGl
- TLSH T1AC857C02E6980AE5D15F8134CA964662EA777C520F2097DF1364BF293F32BD06F3A356
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.3MB
- SHA256 5b7dbe87154fa6ef4a081d3bbb0c58749ee1a50e02eb13b5e979f1e36ed5c0e5
- MD5 acfc7b219bd215afad4c889b54b1af2e
- SHA1 b87032b708e2cc2ce0e5decf9a3377a51887240f
- SHA512 efd93864a0298e57e88c0bc6d3af0766ae6307892fd261b039cbe2f925343429e727c8fca9756f42e301aa02f3f32f96f73b329444ee5785f60a4bd45b1b2aba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGhTjE:A3k03kHRJi56rgw
- TLSH T1F3656A03E6940EE5D24F813499964A22EB377D521F2097EF1368BF253F327C0AE39656
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.8MB
- SHA256 11c2380382fad0d58f0f0c96b47e95830af98715707cdac5ff4535c1082f8a69
- MD5 72f8cff5ed08219a6e1254741713e490
- SHA1 ef9f50a1ac7d315e08bd86c8bb93ee8bcf3b08a3
- SHA512 73ab154ecb247b2678a9b74a08aed84f768bfe43aa77f837ad42df3169746d80973ccfcdb8611d995fda9667dbe2ea2910a313453bc8d2b3d6c8bfdf1dd1f272
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGP0Le5ji0hmxe:A3k03kHRJi56riPji0Aj
- TLSH T118855B16E6A40BA5D06BC074C9D69656EA733C421F3087DB1354BF283F337D1AA3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 1.3MB
- SHA256 8adc7a37e22a6f9f3c517e127e44ce38d3733a1819e8906d56de841e2c5b6974
- MD5 0b77e496f0591a1420e3c4e1d796a414
- SHA1 5a0cb81ae9a35e1a5c8e271e12005576961c27c9
- SHA512 accffe853b89f820a682a5c772ec7ae1f271089996e3a0f8dbc2000c5ff135c8e3fb8088c1008b34b857556259e5ddb742f189c83b1b855b7f90cc325c62bea7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGkL:A3k03kHRJi56r/
- TLSH T103557B03E6950FA5D64F813099964622EA777D421F2097EF1368BF253F327C0AA39397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$
- Size 1.6MB
- SHA256 fd6867c45b84f517f12b589641738947a0b070cd826a6989ab3cfb50d7239668
- MD5 86de4fc1c4d2b1eac485a9b75e0da234
- SHA1 c602de697467678ab2b35ad29ee7c048b15f46c5
- SHA512 9c549671e0e4657dea1daa55703a0d925bb45f10d8afe9977dc28c71a4b2db2e6f609b7a10447f22d1c4e51f0c9a66cff9e229329273933f77a973fd2c8e7992
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGLZuqZM9RfkX:A3k03kHRJi56rkZkk
- TLSH T197856B06E6940AE5D24F813499A68672F673BC851F2097DB1364FF2A3F337906E39352
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.3MB
- SHA256 b218e0fa6e41bfbb0dc3aa191efd10454095338a0fd58b681e67cb63734a1d52
- MD5 6cd5438e2afe2837c60958dc213ac9c0
- SHA1 3f3d36af2d49307c1870ce1f9e5dfa0950d0c428
- SHA512 35f6e5162ac0615f5f133c43e976e169b2edcf0f68e5e0bcfe549fd4b1cbd061b08b6c79fed1448642a56e56d4e01a90fc2c66c6da2ee12a2debaa0e3e9544ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8GSW4K2DzaT5D5TvinrmgGLF:A3k03kHRJi56ry
- TLSH T1FA555A02E6950FA5D64F8130DD9A4622EA377D920F2097EF1368BF253F327C07A39656
- MD5 SHA1 SHA512 SSDEEP TLSH