Analysis
- max time kernel
102s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
04/06/2026, 11:48
Behavioral task
behavioral1
Sample
2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 789KB
- Sample260604-nyk9caew7k
- SHA256 c846581273181b2a1479b5f61b724d1929ea3fa3a85b3524ac17bbcbfb248a84
- MD5 96e1a4b7c788f93867cc8e9fedf40ba2
- SHA1 29c0f763ee25523f0f148955c153d899b6bc3e9b
- SHA512 37fb3ce021ae8d23f48c8de0dea66aae8ac31b78e198dddf2b15ac516e9895276e6d697d790f1bd577469db4e27b17e64a3dd54ded3d15bde972e32d75e5e601
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE:A3k03kB56r
- TLSH T12E055903E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 60 IoCs
resource yara_rule behavioral2/memory/3624-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001a00000002b690-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a2a8-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000002a2b2-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028d2e-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3624-72-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2588-73-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002897d-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002897e-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028984-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028985-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028986-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002897f-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028989-280.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002898a-311.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002898b-342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002898c-373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002898d-398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002898e-429.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002898f-454.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028991-468.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028992-487.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028993-489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028994-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028995-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028996-510.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028997-517.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028998-518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028999-519.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002899a-532.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002899b-539.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002899d-570.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002899e-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002899f-614.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289a0-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289a1-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289a2-630.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289a3-638.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289a4-651.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000002ab62-652.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000289a5-659.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289a6-660.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289a9-661.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289ac-662.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000289ad-675.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028c09-754.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029915-817.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029913-824.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000295df-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000295de-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000028dd7-967.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000002952b-1034.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000295dd-1042.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029ca0-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029cf8-1239.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029cb8-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0002000000029cb2-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000027ad4-1504.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00080000000279b1-1535.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000279c4-1554.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001a00000002b690-5.dat aspack_v212_v242 behavioral2/files/0x000300000002a2a8-11.dat aspack_v212_v242 behavioral2/files/0x000300000002a2b2-39.dat aspack_v212_v242 behavioral2/files/0x0002000000028d2e-58.dat aspack_v212_v242 behavioral2/files/0x000200000002897d-202.dat aspack_v212_v242 behavioral2/files/0x000200000002897e-209.dat aspack_v212_v242 behavioral2/files/0x0002000000028984-246.dat aspack_v212_v242 behavioral2/files/0x0002000000028985-259.dat aspack_v212_v242 behavioral2/files/0x0002000000028986-260.dat aspack_v212_v242 behavioral2/files/0x000200000002897f-267.dat aspack_v212_v242 behavioral2/files/0x0002000000028989-280.dat aspack_v212_v242 behavioral2/files/0x000200000002898a-311.dat aspack_v212_v242 behavioral2/files/0x000200000002898b-342.dat aspack_v212_v242 behavioral2/files/0x000200000002898c-373.dat aspack_v212_v242 behavioral2/files/0x000200000002898d-398.dat aspack_v212_v242 behavioral2/files/0x000200000002898e-429.dat aspack_v212_v242 behavioral2/files/0x000200000002898f-454.dat aspack_v212_v242 behavioral2/files/0x0002000000028991-468.dat aspack_v212_v242 behavioral2/files/0x0002000000028992-487.dat aspack_v212_v242 behavioral2/files/0x0002000000028993-489.dat aspack_v212_v242 behavioral2/files/0x0002000000028994-496.dat aspack_v212_v242 behavioral2/files/0x0002000000028995-509.dat aspack_v212_v242 behavioral2/files/0x0002000000028996-510.dat aspack_v212_v242 behavioral2/files/0x0002000000028997-517.dat aspack_v212_v242 behavioral2/files/0x0002000000028998-518.dat aspack_v212_v242 behavioral2/files/0x0002000000028999-519.dat aspack_v212_v242 behavioral2/files/0x000200000002899a-532.dat aspack_v212_v242 behavioral2/files/0x000200000002899b-539.dat aspack_v212_v242 behavioral2/files/0x000200000002899d-570.dat aspack_v212_v242 behavioral2/files/0x000200000002899e-601.dat aspack_v212_v242 behavioral2/files/0x000200000002899f-614.dat aspack_v212_v242 behavioral2/files/0x00020000000289a0-621.dat aspack_v212_v242 behavioral2/files/0x00020000000289a1-628.dat aspack_v212_v242 behavioral2/files/0x00020000000289a2-630.dat aspack_v212_v242 behavioral2/files/0x00020000000289a3-638.dat aspack_v212_v242 behavioral2/files/0x00020000000289a4-651.dat aspack_v212_v242 behavioral2/files/0x000400000002ab62-652.dat aspack_v212_v242 behavioral2/files/0x00030000000289a5-659.dat aspack_v212_v242 behavioral2/files/0x00020000000289a6-660.dat aspack_v212_v242 behavioral2/files/0x00020000000289a9-661.dat aspack_v212_v242 behavioral2/files/0x00020000000289ac-662.dat aspack_v212_v242 behavioral2/files/0x00020000000289ad-675.dat aspack_v212_v242 behavioral2/files/0x0002000000028c09-754.dat aspack_v212_v242 behavioral2/files/0x0002000000029915-817.dat aspack_v212_v242 behavioral2/files/0x0002000000029913-824.dat aspack_v212_v242 behavioral2/files/0x00020000000295df-891.dat aspack_v212_v242 behavioral2/files/0x00020000000295de-922.dat aspack_v212_v242 behavioral2/files/0x0002000000028dd7-967.dat aspack_v212_v242 behavioral2/files/0x000200000002952b-1034.dat aspack_v212_v242 behavioral2/files/0x00030000000295dd-1042.dat aspack_v212_v242 behavioral2/files/0x0002000000029ca0-1074.dat aspack_v212_v242 behavioral2/files/0x0002000000029cf8-1239.dat aspack_v212_v242 behavioral2/files/0x0002000000029cb8-1324.dat aspack_v212_v242 behavioral2/files/0x0002000000029cb2-1376.dat aspack_v212_v242 behavioral2/files/0x0005000000027ad4-1504.dat aspack_v212_v242 behavioral2/files/0x00080000000279b1-1535.dat aspack_v212_v242 behavioral2/files/0x00020000000279c4-1554.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2588 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GamingApp_2105.900.24.0_x64__8wekyb3d8bbwe\XboxStub.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3624 2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2588 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-04_96e1a4b7c788f93867cc8e9fedf40ba2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3624
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2588
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 789KB
- SHA256 c846581273181b2a1479b5f61b724d1929ea3fa3a85b3524ac17bbcbfb248a84
- MD5 96e1a4b7c788f93867cc8e9fedf40ba2
- SHA1 29c0f763ee25523f0f148955c153d899b6bc3e9b
- SHA512 37fb3ce021ae8d23f48c8de0dea66aae8ac31b78e198dddf2b15ac516e9895276e6d697d790f1bd577469db4e27b17e64a3dd54ded3d15bde972e32d75e5e601
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE:A3k03kB56r
- TLSH T12E055903E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 924KB
- SHA256 434fe678534f7a53779880de3983a233601a2f68886345291c6623261af150a4
- MD5 a207a83347932819b5c2e2ddb0ed9120
- SHA1 cc47c83f5c1bb06c7b3b02d5b8042d062fba50d2
- SHA512 44cb3ba33c4ca046754a726fa3b380bb575891f92ef20e56a27b52fd09f9b0ae939add58fea2f29e536d75fe932ba629ef2c4cab5a8abb33cbdf87c3057fd343
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEoqU:A3k03kB56rS
- TLSH T1B2157B13B7840FA4D14F81749AA95972EAB37C214F2053DF6314AE253F36AD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 880KB
- SHA256 072530473a31cb7f32d449638c6fa0fbc75505bd702b2558af26bc9819b78965
- MD5 e9ce08d46acd3e0e92748b308e9b9cdb
- SHA1 9ac3b6b447bd11a896c923715b06e77a55ba670a
- SHA512 2cce0711506a5596baf47e8406b83b5942097ce3d242df83cdbbd27dc69e5e9aa82af886c44a551852ed95dea0c6cdce1170e388f34b3685fee1f289d6738bb5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEf:A3k03kB56rZ
- TLSH T1C6157A03E7840FA4C11F81349AA59A72E677BC111F2097DF2354AE193F72AD0AA3E757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 873KB
- SHA256 6e034db8489378c577d8e2ef0f7cd9de44a32d6646efb23789066192b33c343c
- MD5 8ddd5b0d1b98bb5a6beeb4312725dccf
- SHA1 f31748a7c62e5468ad68612d5c8ad3bf4fb1a827
- SHA512 b5508281932cdf875c44025b210fa9bf596768caa783c325da39d9e789b45bda166bd46317680b864062dbe5335e0e0718b52fbae319b3d4d715d23dc03424ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEe72:A3k03kB56rc72
- TLSH T1A3156A13E6840FA4D14F81749AA68672EA777C111F2097CF2354AE253F72BD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 dab94595e7862375eb76f141c779cc2bd228403256556d1a226787e63f453ac1
- MD5 c8a021e176a5d895f384e7fd2166c5eb
- SHA1 754a37cddba50779359cacf0f68e7ced55a5d45d
- SHA512 98e8778cde85fc57e347fa0e4dce0727f533f829de370355b79c7dd64f59e4475741bfce3d624c0927fbf5da30d4b26ca16e620b8c885567d384e732bcd47379
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEP0Le5ji0hmxNrM:A3k03kB56r5Pji0Aj
- TLSH T1E9554A16F6A44BA5D06FC078C5D29666EA733C411F3097CB0354EE283F67AD19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 803KB
- SHA256 76a78e837b40c6f244635063d988e2327b20465da19f29b0724ccb62be911d91
- MD5 40ed0296af18d0d35a9032a1059b3f6e
- SHA1 199f87f8d34620aadfd67b3d77794f6da3ccb003
- SHA512 741bce7e8cd109d7b9f2db16c33a0bf209068243eee62210ede2612dfa16b288be6bfa9de81f067a5277cc81e5b8b20273cf9dbef4f7365d0919f35cd54bcfe5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEERa:A3k03kB56r
- TLSH T1FB056A07E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 836KB
- SHA256 61d440a3a78eebea06b26ba5c2ece4f64a35aa88a7bf62be845396a109f08ad3
- MD5 6f8c26dad37daf74663125911ae2e747
- SHA1 c82f4761c53aaffe5f7a0b0298ee2f7cf6e34ff0
- SHA512 f8e7d385dedc5af8e979682932f84e52238e4947e7a9ef98bd9b971eba9d9da24b6382dbf47c89e9e60957786f7f4b277b194f61d3cc405332748bff970ebb7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEyb:A3k03kB56rob
- TLSH T129056A03E6880FA4D11F81749AA58A62EA777C011F2097DF1354BE253F72BD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 812KB
- SHA256 6c7a9c1171b45fbe86dc74614431ef99cb8dfb6af6db04589c93774cc97135d7
- MD5 bd93cdf3eca4677aa3a109a0ccc93c62
- SHA1 21011f9571be5b5c0820e5566dce4470dc4b216b
- SHA512 ee521d37482472fc4bdfca646e3474a979ce5ae3990f3b7cff5771f96a0c9528db401baf12597b44445953f37f9269109059a8621b6272ae4c21c0eb7dbb54a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEpZ:A3k03kB56rN
- TLSH T105056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 812KB
- SHA256 2fa9d4fa7df18ea4116395cff6bcd0f018f4c6832a2e6f24bbf657695db8d648
- MD5 56126f6f99b4607cbd9528d9e5dc5c8f
- SHA1 7c96bfafc2b432998ea203b0ca31ae35902c2f20
- SHA512 d9a2dab57ea56b4c4ca31798b7051f113e74e36fd0842d21308031633df0a357fbf6f94de15a486af9912f0e81a85ac2c028a234f12735a5fcf6f7e0d6c35544
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEC1:A3k03kB56rq
- TLSH T17F056A03E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 812KB
- SHA256 c884908280af5dbb08af0b21038569e5128eff5a7521758069671f9f8e6d3216
- MD5 f25494a77251573d82ca2bab1a435d2a
- SHA1 7feac93228c79fa42df37118144c8ede2f2278a1
- SHA512 50bfcc463ecd3cc98569e67848a06676b07da378b92706064060289781c055d22c9a8bedadf2a0dcfc84d40e44b26d25c073c4ce243a4a71a8de26aac9a8641c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEo6:A3k03kB56rF
- TLSH T1B0056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 812KB
- SHA256 9e2c99ef38a4c03bc7806c9625a1c88f736c790b656f0db28936aba53564e977
- MD5 47b51fad98c1072671b43ccdf141a134
- SHA1 89e62113ae8206c25db9aca3f3f072799f46f4c5
- SHA512 e34ece35833e728631ada436e00705d8679b7df677912689a3e7f0f08db92d2b6b047a9b6c9625cc8824e199f1b719336243743738929f6cd17f464d48b1e36b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE8o:A3k03kB56rJ
- TLSH T19A056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 812KB
- SHA256 9cfc1fe70e62933ba492700bb2fe49732cddb9d9a41d8750b1918c49d5919916
- MD5 3ac0a994233036e43d482520ca459324
- SHA1 673be7520bd18ae48a819944a4a30cdf69e8cddb
- SHA512 8b62cd82987255cc65d4bc012439a78e456eadcf596b600270dbc6e0af34f7ce72cc0041c861845064f92e5b2f766d1a446130493fb3d08e30c102a58eb4142b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEcu:A3k03kB56rr
- TLSH T14D056A07E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 950KB
- SHA256 38ec4483a1db7cb9dc99bca1e0e04d9c61398867d50f13859a4f5a650124f261
- MD5 2d76fb9f1d50f29a4eb145fef1478dc2
- SHA1 1f42a9912e9124a997d9c8d71424ce3941c87d61
- SHA512 dd851e833d6665f9e36a0cd140d6752034372e07e607017cbf4d08bdc1ddb7f3f757690637780e96d611d078b685a9ee68912570531d893a609daafa11ca91b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEwzy8:A3k03kB56ruT
- TLSH T19F256A07A6950FE8D11F81749AA64A22E7737C121F2097DF1354AE253F32AD0AE3E753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 812KB
- SHA256 ceffeae10ff1f2bb4798420281775a5ea13304fe2e60ad50c2bd8062f4b4d383
- MD5 900078fc9f8ba1abb3ba380040554f04
- SHA1 0d4e34ec7b5d75ba6adc06d1076984d70d197ffb
- SHA512 ff6f913acb57e8136c9f5f9d5edce012d1eaa64ac225fc47b062b547fd762b89a7958db31208a901c71c9ed116a4990a9941d80558dee8658fd238553a010995
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEg9:A3k03kB56rK
- TLSH T149056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 812KB
- SHA256 385ba21a95c0f4bf43ac65cdf9a34b89b0820a39ee4eff5cf611f465dda0df80
- MD5 85e059552d249a695082fcbc4aa5279b
- SHA1 aa2612cff5abd09e3cc856bf2e973bf50f4b80ac
- SHA512 213c1ae8a979f64aab428554c5984d73d53e47fb1c10c2e543eb14781d945ff194e422ddb2da24f31682aad88654d6f1e07666bc0860345ed88e8be2ad24d842
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEoc:A3k03kB56rn
- TLSH T1C5055A07E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 812KB
- SHA256 b798c8db61be067323357a78d5010947c9b8e144d04be50c6413618c2c726719
- MD5 765909dd8416af24e8f0ec6f9424c9f9
- SHA1 55f450c46b4eba2bc5f1934cd52e68b566a23ec2
- SHA512 ddd125bb6be58f27a3623fa2b13c915a710b2a140575df5b3dfbb66fd2047f8bc1707e474beabaa95c2a854516e516097981e2ddaf61436554c93dc3ba439b86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEBp:A3k03kB56r9
- TLSH T12C056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 812KB
- SHA256 702fe334d74893b7a054948f523f50c5630c66c5d45c1c13709cdaf4022a9654
- MD5 b09b56f02d71930b12b1de844c4a85bf
- SHA1 20cee706f1489546a426b4347791ea04eca0eb53
- SHA512 2eec6a4ca691fa39dde1227bd711a2a413178a5140b1529640ec23c8f17dbbb442e2814d5a11d320cc7ce2f8d1d6b3fff2dd89a269a867e8750a1cb996afc853
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEWN:A3k03kB56rG
- TLSH T1E6056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 812KB
- SHA256 a3ec1319a752044599713b93583078199bd86e680cb2fcd3833fee9d3f78ff87
- MD5 31eb59dc6fd7a35d53bdb8efc2b41362
- SHA1 cb734efcbe047e10c3a897e7b92348cf5c3d6b3a
- SHA512 4d5e4f934bb318a4070d74ca54fd5b7631a6408d11dd349e8483610c6128b4c1dc955b0b22435318dd393cc172e6525461fe3e0f5314fd41e16e64e512bcb1b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEaF:A3k03kB56rk
- TLSH T1AD055A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 812KB
- SHA256 40eb894c6808893fee938d7cb775a20a7f5717e1bb36291117d98dd34f05afc2
- MD5 563c292087ecdb7c9a5bf650c82cd18f
- SHA1 37910f5c73151cef1f1ea74f393811a872cb3a5a
- SHA512 e80918740e41b28b280f51ff71241e6db48def55e40e3b499e3b91d7170b40940ecbed0a99398d59d3cbf7cf07963779af56637e4ee24d65803dd5a0b01912a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEvC:A3k03kB56rQ
- TLSH T172055A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 812KB
- SHA256 f41653afbb5a2f148b693acce3e0fd49b2e21b33cab08dce50ff644287c87370
- MD5 bae9f9565b539eca0ba699caaf589111
- SHA1 548202f784abef63da3b33bbc2beaa60fc82ca7a
- SHA512 8459552b32e6b5d0c28d79d8c1cd5d93950c6d73aa5fa4419b509fb520a7faf027adba9fea070afb31bc3c669d4bde5b7b7f5c7bb6a3490991abc4d19674814f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEQw:A3k03kB56rt
- TLSH T1E7056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 812KB
- SHA256 77a12b684bcda89e222cc91c83f6893249710069dd1d77bf3a521b9a645d6df8
- MD5 3fa91e550a5a06e08cdc32a9ea9d5bd9
- SHA1 e696c19ec64c4e00f5ce4a9060397ff0eab00df4
- SHA512 b0ccf8ac0431698ad6442f3a62550694b196182440c46d95be9e965d544b33718ae5b6f33f8d267175de17217fdd9efd04b8ac4408efa7741050c3c8e1de34e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEvT:A3k03kB56rh
- TLSH T137056A07E6840FA4D11F81749A968A72EA737C111F20A7DF1354BE253F72AD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 812KB
- SHA256 7568b1faa854719a5f396bb8368ecb434f7114fb09a44bc8c0562c31c88b3ac8
- MD5 3ea88bdb88a7f772cc1d9d7d20ab042a
- SHA1 5d74cec571a74cd8c8c0e70631066e0854eef4cc
- SHA512 56558814d524082337aaa0b36fa8df4f8ca7834483fc559d0fc8f4ac5005745ac2808cf7917c5c0dfa79f8f05245994586daa5f5009806a4e3ce2f7d8b8306c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEpu:A3k03kB56rW
- TLSH T113056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 812KB
- SHA256 fcda5dc5b3ce2474014698ce1cc67416bddbe7eae314ca64e59abcc64ecf873d
- MD5 7a15f602a934de788661186a97fbad14
- SHA1 f7ffd1f845892f62035f9104794774fa8bb0cd1e
- SHA512 b1ffc24edf0532be1ac7d825989388275332db1a45470f19a86c4b02bdf9adbd06d796951a15fd6619a8a4aa82a35ae4cac70d3fb9385cf7806b0324cd0b405b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEhb:A3k03kB56rn
- TLSH T12F055A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 812KB
- SHA256 d8c30a97e0c80eb9d8fc38416da232af47ddc7134701456f889fbb7505dc1a84
- MD5 7e47f63d4e06fd8bf73460ab29e7b1ee
- SHA1 cce77f5e2a06409d31d6ef1254c14b61ccbb5306
- SHA512 31f3316267235b002f4d8bc2e53d68d1aed1732aab176a4760971f4a19b9a861bf99910ed3212a37f75d7d30bfe24fdfc5f39ade8b3fc0b91ff6d956e12270be
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEpf:A3k03kB56rP
- TLSH T1F1055A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 812KB
- SHA256 2e4bef9d1865d454ec4d5c1eddc7a55b1e2985bd71e31e8427aebc841fab940a
- MD5 1fa82a98c1791a53c6160172a7486c02
- SHA1 b9f8c9c37c91d10032316334e559d8e6bf5ed586
- SHA512 fcd17680dfd6fee85d6154418d4e0d5e030b4e31f4970f876488929295663027271b06c4d79804066579b49aa18f01d46c6dcf4f6493b826c2afd7fdf396cabd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEESK:A3k03kB56rv
- TLSH T156056A07E6840FA4D10F81749A968A72EA737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 812KB
- SHA256 ec3bbb2031eab3e2ade3238b9dec50169d9209e0da3d8aab53930bd22c44c00b
- MD5 c82a482961d33cdf063dd048a6ba9629
- SHA1 494a3d3923e55da3b359fd31fa4d456be57cb45a
- SHA512 810ec3aa8e14ea8fd99aba2962bd7aaf313565d9597a7ac0a0d1f8b0f1bbf83baf90e707f124d84961b4afde74b4e306ecd9179fe9b09190dbaec20c038889b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE3k:A3k03kB56r6
- TLSH T19B056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 812KB
- SHA256 6dced960409d3049d7709a01bf3452c4c7f4c4c7c1a338cb60846bbf0731408b
- MD5 0530677947f01f69a625eb88434a5808
- SHA1 626bda0eed1ce6399c39d4c4d01f27295b1ebf7e
- SHA512 dce79328ae22226e02a3102bd3d35d35b2b24ebdd25d69953f6cd9688f2e718755818e44bf5c868ad31db8977ed7fae8004a65dc1acb97307e51c809ab0ebe63
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEA0:A3k03kB56rP
- TLSH T125056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 812KB
- SHA256 729382e1a8824dda53db4f0ba910d91b095ca6387ff513e241bd7d4342a129c8
- MD5 35b9af112d028b15601e516be12d5040
- SHA1 6627d1ef9aa2015d849661e5f06482a535667587
- SHA512 9351e0764bd939bc88b5f836be6da0954ce68ba4d4e9f7caf1b89abfc2fd2d9f77e766a34b21cd84f188fdc5d5df08d436d675f7666ea71f983b7a4ed7497b42
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEbg:A3k03kB56rS
- TLSH T1D8056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 812KB
- SHA256 641d1858f94827908c3c25ff910a7ea2f55399cf0de549ff0dc16528d7699b9a
- MD5 f6e2c777266f04fc3acdfb1ea71d51dc
- SHA1 2858ea6f68f4986c765110c36b65e12b955bff1e
- SHA512 522767d27ae898cf5ad732d865f188df1c6a25d7627f2d4f9d38bae6ac98942f2dfee438a7869df5d485d78a360177c31835e276908eb1a64e353aee4e0c6536
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEWr:A3k03kB56rc
- TLSH T1D5056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 812KB
- SHA256 465a3fe9d8a6a90281e4c27a1a137a3b1f28d3174283106c8fa264c68689b4ea
- MD5 d86a8eccd31fdc3ba725e79d4cce76c3
- SHA1 63293c768e82a6c3ab7b0ad488400b2a758b82e8
- SHA512 be59ca8e985a4c68421d025ab13e91662dfcc5eb85a048f90b36316f1cee57e449cfa47b46088b258018150cd3e64713203509f63bca8882bae4ee20729f31b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE8n:A3k03kB56rm
- TLSH T1AB056A03E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 812KB
- SHA256 1897af47092b57e17bf3388d5f91e966d8eb5f01dc6811db2123f1e5094d59d9
- MD5 a5b5823badc803172203a8ca6a4a1d19
- SHA1 8958dd3cfe2b677c6830d060c0acd013ada04064
- SHA512 dd2934e30e94aae0268a0fd91e8e8714ba6888e90b02fb515d222b8b1b0c52b50741a6b84c9eb3364c216e147b0d81c6da88e187a0cbec2b3eac6fe5b9eb2241
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE6x:A3k03kB56r8
- TLSH T1E2056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 812KB
- SHA256 96de546d1963dd9f4643611bdd9c64169fafd1701f7c360c045eeaa5067182d5
- MD5 5904567b2600f19029b0d6fbe2dbd64f
- SHA1 dd89b9c672db551917a54cf5d7baafb95b20b948
- SHA512 159758b23e5b65188b8f81b58103f3141c46bc8b1aa573d7be5551ee8b8c248ecb0591d14243c08bdfe812a784bcaa6b7bbeecfb4561e5dcbada830369a7155a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE8A:A3k03kB56rH
- TLSH T1AB056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 812KB
- SHA256 2120ae5db7b4484cf00580710bce0de6e0dcad93662a8717fde67fcb36e3e008
- MD5 3bbe52d8213c9b806e57d89fcc1da88c
- SHA1 5bb7f82d39723b7c8bece2244c8abf266a055d67
- SHA512 ce1dc9fcc6c5ca67bff830fba4d158c8e61fc077732d58c4fdf8636e22e364825cbb2fe66ea2bdb2a3ab47d54fa6eedf329a0b9b13f571db657281a8ef8724a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEl9Q:A3k03kB56rq
- TLSH T1D7055A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 812KB
- SHA256 33749e9d6a6a4bdcf42aef04fe719c156fee54f40cafe64e1c6b9ea5ace8a79b
- MD5 6c119935eaa1417f5bd3ed8332394803
- SHA1 56adb67096b31130838a03a218d441325716e98a
- SHA512 9cda9e72a96055b96cc039642240c4166bac04f263fd8c0af261d52e19b5336c8f0070ce0c297fbe1d4ee4f6d8ad48774966d08be972c6b1f54fbd01680bad60
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEQ4:A3k03kB56rp
- TLSH T1CB056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 812KB
- SHA256 d0944570ff5ee8da5410eef1b0ff87d42987795013b2fe5e598dd104cfdc6e26
- MD5 8ed623b987144af38901eadaa4e357a6
- SHA1 e7b7d7331272093aba4f5bde743ae42ebb1ff080
- SHA512 bcb25fac11b24b143d676a849d8b8e63bbabcab609f5787b4c1529187215a119aa4b6d4047fcd700bad88abc552dc71d1b59f20b609c0129b78d26afa8b2af1d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEETu:A3k03kB56r0
- TLSH T1F8056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 812KB
- SHA256 fca02eaeabc0750968ad7a446b5622b857f620b01ada48a495be3b7168b90626
- MD5 a6e26d13aa8d65bee003065ce07f7da6
- SHA1 77a48346531b3f5e14ded5e5d8d9df08609ee307
- SHA512 52bf1783de1c665b1bd8651b05aecb4b5dc672ecef922475eb6ab292d77dc9d18fb0b984b7486934705c01a52c24b155ab0fb1def5203889a4c1266d0d8c79c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEOj:A3k03kB56rW
- TLSH T11F056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 812KB
- SHA256 441b89148cfa4a2d0ba26f322370421cf4118e130ed2a29f88229e525d1c724b
- MD5 d6b94deba4d00ebf5b96e296046b818e
- SHA1 900da43a3bbb070edc9cb9d3a808f28c86bb183e
- SHA512 d233365ca5231010cc8baa007e4ca828a346bbb1528a07c0b82eae86c6d667944caf88d06ac8a9ab8e087f02ec8b07ce54a6380400e651da0587349c0d3c6483
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE7g:A3k03kB56r6
- TLSH T171056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 812KB
- SHA256 81972574876c42c7284a080ca3ef655a1ef79b5eaca212e2c8fa8e526d7bbbed
- MD5 765afd0415248bd1d55b82eb2bee4d69
- SHA1 3c498ca42f9b9dd53eaabc98b55e3e5a70e22254
- SHA512 96af76632ca6a17033ef634f4f05921626f059c998945c262ccee421fd2a57f8c5952a80ed0a3108f13ff754a76c48a6b3ed2ddc82ab8d368ed640a105226e74
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEmI:A3k03kB56r7
- TLSH T154056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 812KB
- SHA256 9eb78cda395756cf63d8f60a9a620ba9c992b53c7b8d0b4a85e5359113993ef0
- MD5 780c6226f1b7cb94b3943ad49a76d2c6
- SHA1 687ed1687e249850b9f73ed917e972ae0c388a89
- SHA512 530cf284e7bb569e7f8d94aac0c4981438501ed9a6215eb8dee30223e9d3c4bb4649ccf352c14dfcce8d60adb4d04805ce5a905c4c9343ab36c96b2e0ea432aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEUo:A3k03kB56rF
- TLSH T1C5056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 812KB
- SHA256 fead5eb36ae7618c8c78e1ac3a6295004614c33c582a38162e22ff1be5d2cdd3
- MD5 ddae942687fc42662791cac441df1672
- SHA1 03298e42db6e39f76f69c0afd32a0da79872a354
- SHA512 354e86723be6fa61b8493e8474710bb0b9a28633a4eca0aa5897ec7b00ccfd622cdd70ba40f607f83f003f21b5c2120b3a2e6b314cc1f7afc45f06c870af0df1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE3+:A3k03kB56rA
- TLSH T149056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 812KB
- SHA256 0a7f783f1996157fabaf3407ba9d4139821ce59b851eebc25bd94cbd2b44c863
- MD5 4f97a858e8d4806c8e64b93c9cce4743
- SHA1 4dedb1e7c09787aecd1b6eb80dd51edcc59c481d
- SHA512 e8b35e313dc2380b180b39e83aba63ae27e1687d30af0a6bb4671d0c6cbb9f8c71ced1e625392ebd161e33065a44158ad26407ca2500b56fe85b85136413916a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEENQ:A3k03kB56rQ
- TLSH T1E6055A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 812KB
- SHA256 a89ec0d825d129f08f07793eb431bf532e651db43d680f743e7417f527c85958
- MD5 b15ed45f39f0072e06b9f14b8d35bd6c
- SHA1 34a55570ccbc8bd94f33613196e3695fa65eb6e2
- SHA512 e40509eb517f881540e1b65d27ab92a6848b3d34892db9e6ff18acf15d395219b2c9371d2c355115cc8537f5cdd81331ba1c03b876827d3602c183855a13e173
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEECX:A3k03kB56rg
- TLSH T1AC056A03E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 812KB
- SHA256 d88cc903f975a1ae974bbcbcdb6a1e988764e62d047708b2408f576f3ff92fd9
- MD5 7243d4e2f452695ebe7d94d50d27dc07
- SHA1 96b4a96dbb75ef277cae5d828afb578f6ee1ff50
- SHA512 9212d667c7a0740ec3f0dc464bead24346c166ac6472ca5490d07a15063cbffbd56b3e2ea2dcd28ce897f8e9c4878f990067c068c2f9c69188f39240be628243
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEkL:A3k03kB56rC
- TLSH T1AF056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 812KB
- SHA256 e7852e9d21c6dcde0514db5a6ea21f757ee107bc839250ed92f97d5037d9993e
- MD5 03f9f2a97c7439abffd9d12cd4dc9a7a
- SHA1 1b2c73538205f2d2f37879e54722d8c5b7696097
- SHA512 1997ccb31831433f646876964a330c35c5826531094d1b7bf07bbae60ea5f9b9bb8627d659a6800dc1d5f430c847112260eb6d49fe759e4648c6a2a01d6b48c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEAM:A3k03kB56rP
- TLSH T1F0056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 812KB
- SHA256 54c88ac6572ffbf7c97b76e4284a2f31fc96390c2c466299053cb3885d0eb2ef
- MD5 eb14fdde5ab418a8609c939dfa8a02fa
- SHA1 b0bae52282d00e62d62d1e1bc38b23eec73090c2
- SHA512 8a48637bbd9ea0cd16d4f1f8c24cd60f254c3009f61339e2961cc988b6ee1930a10ef93faafea8d1892ef3f102ddabc1abd8ebd897f0339ff35b073e83536aa1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEhh:A3k03kB56rB
- TLSH T1AB056A07E6840FA4D10F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 812KB
- SHA256 0bf531a0f7dc3097d3e5ecfa7280b72c8a48eada79e761ff0c069ea8721daed9
- MD5 61009ee2f33486d92e7854b6cb094d10
- SHA1 18cc0b3975c59f23e287a720b4d3872c48679fda
- SHA512 fcf71efc5fdb37eae30a795175e92f24fa1988fd2cfaf7b0f20cf915a93ca7485177b035de39077fcf0c2f5422015697883cf7f32bb5c188dc4a806d6c1abd49
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEhv:A3k03kB56rv
- TLSH T1DF056A03E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe
- Size 810KB
- SHA256 9c918bdd4be8d4e627593285147e8a5c532b225734cbe128f99a2b275f1fed7d
- MD5 b2b9914234a51c27caf5d29dec64a4c8
- SHA1 98e6a9105739c2275a8029912aeb3b8c59a95968
- SHA512 7f898fbbe5944ce332fa7645783627a10446389d23e980ed2003c5ffb0689928fb8303afefa293c710a8f47c44a37a61bb50ad1575980361df1c14553c6a4481
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEy:A3k03kB56r
- TLSH T13A055A07E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe
- Size 810KB
- SHA256 67f512e94d160f47bd24227c0d9232a9e437d1323f03a7ca150d2481d25af05a
- MD5 67a333a81c99a6615eb3fc9f3723b3ce
- SHA1 4222dfe18af0ebb1faadd3be0afc139e926bb0ad
- SHA512 9ca0e18602516c20568dd226ee71202544a80102bdcef9414d3ceb015a33ee57616c2a0cc1f3577619330b09c67d5afbebd5e437fbd006b580e48031fff7cbdc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEej:A3k03kB56ri
- TLSH T135055A07E6840FA4D11F81749AA68A72E6737C111F20A7DF1354BE253F72AD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE
- Size 970KB
- SHA256 98d4114fbf302ee164388a51cb8c4974a9005402df7c092d2f2eed352b6e0867
- MD5 e54d808b4a0a099c361c10d0a51bc577
- SHA1 ab42f0be51f4849b37def4fbecbf9716f01a00c2
- SHA512 5173e7d8fdc464e800296575f869ead4b2be2adb7293b86b84e5c5c2bab02f71093dcb9a8d0b1a00e7345e6e2bfaa0b97d673819cf6f5c0f20cd03b2c49e4893
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEE+3t7C8GebG:A3k03kB56ry7Cf
- TLSH T14E256C13A6580FA5C11F82748BA58962EA777C010F109BCF1394FE693F76B906B3E257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 822KB
- SHA256 8829a8edabfdb32adb977d3d3e9cc8c43aa12ce35675166b13e7b95ae7e8461a
- MD5 a6fd4dde4a96680fd68b99ab860f599d
- SHA1 5ee760ecdf25822a10ce5dc611b649a38e03f225
- SHA512 2c288a76bfc12570f4c04c160a7291894260566834de35be71fd811639aa9266b0aa88655060ad769c5697aa4db64f42d184c7c534cbab5ab7c2c899f0810365
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEO1:A3k03kB56r01
- TLSH T1E1055A07E6840FA4D11F81749AA58A72EA737C111F20A7DF1354BE253F72AD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 865KB
- SHA256 87c1a1623fff713a5b6ec880cf40a89b938aeff5937bd9dac491f7612b88c5ac
- MD5 cc5f93f50d2877883dd855b556104f40
- SHA1 ced98efcd9686e1015dad0bf793e7dccd80c13a9
- SHA512 53bf2485ada23211e582f6f99b52b6705183584f4ba882845a581b943dd26dda1dc7226d92f906fc85e76c091077209c098303f98f9b3a5dc03c6e3aa52a3770
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEAkUl:A3k03kB56rq
- TLSH T1B7155A07A6840FE8D14F81749A958A72E6737C111F20A7DF1358BE253F32BD0AB3A657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 833KB
- SHA256 bf987bee27aeff6079f3a1d438147db43b2b343bf056bb5f5332824cd34ec142
- MD5 efc46bd285ff722c8e0c2fc08a0a1b5a
- SHA1 ad0c9bcfe5a870f17899fa9abd1a17c81b1af093
- SHA512 4dbb9a08bba0d3b4d837ee8ad5fad006be59277821f069a5ab7399f0746edf1bdf86bb6a1a232bf4d5e7acc4c1e3124cdf786cb75261e515156ee279e69cd6ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEESwE:A3k03kB56r2
- TLSH T1ED055A07E6840FA4D10F81749AA68A72EA737C111F2097DF1354BE253F72BD0AA3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
- Size 845KB
- SHA256 f2a5ff3f81207b70f8aea0ad3fe74591a6f2e1d04740d761147e7ca283d87b6b
- MD5 f16edebeef166e56d1ecf96de802cd9f
- SHA1 1d9ef03855c5678f767ff92809cf7319a3366f77
- SHA512 81cc2c2179e5af5ce4b8286aefb5138ff2935d89603c4f05cc5bd5f6a8da1136c79885e15555e77137a89c6a74e0a7c1d68627f0dd5c07ffdc1cfd56de0eb35f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEknlR:A3k03kB56rg
- TLSH T107055A03A6840FA4D10F81749A958562E673BC191F2097DF1368BE253F72BE0BB3E657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
- Size 845KB
- SHA256 1e5c93ec25d314e4db16ca2775bf441e679f10d9124e0e84a0f8559217eddf98
- MD5 174eeced7748c8af87f34555028cc42a
- SHA1 1a77243f235fa9eb72c6ca84de5a36219dd33915
- SHA512 185ae1ff827f08f552271069b329286a03fc6dcd00d73bcbd22d78567213cb3cf5355f7cfd71c8442d8c983614d0bf881f42c7bd142779f5787e29b8c54d58e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEjglV:A3k03kB56rK
- TLSH T142055A03A6840FA4D10F81749A958662E673BC091F2097DF1768AE153F72BF0BB3E657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
- Size 844KB
- SHA256 5cdc1de8c89948afadf01b222eb791d6b491d8dd97170a373aae010102161297
- MD5 3d61509a3b37e3ac3f66429599c23272
- SHA1 e609a4cd0f2949ad6f22259f682a4329f460b363
- SHA512 6fc76e8a0eadcda6552677a076689cf9fb4bcc4d1eeb8d33e0207f23bc651fecd8520f36283bffe115eaefb4e6853b51d6db49de2adb9d974ed4f382523cf590
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEB2+:A3k03kB56ry+
- TLSH T16A056A07E6840FA4D11FC1749A958A72EA737C021F20A7DF1354BE253F72AD0AA3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 850KB
- SHA256 7679078f49e81e3e5cb5272880f60178b6ec2774249db2d588a952b543ea0785
- MD5 bb3d39391a7a18631a689af736f6ec42
- SHA1 99bb624371159dc51b856f48475a2572e402d2cd
- SHA512 d68cd97866eb088976a0021b63dfa7682bae3374ace46c497d823749eac295d92861157291c93f140306577c4beba6d982ae9b5e835a52fa62be4a8183dbc5d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEEE:A3k03kB56rC
- TLSH T187052813E6840FA4C10F917496998662E633BC091F2057DB177CAE253F36BB07A3D66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 868KB
- SHA256 187c5a5a97a5b72176de70a9ffd7a463a995258ac658995d613e870c6914ab1d
- MD5 6212dc10af8011776d00d748407d6167
- SHA1 66fffd3eaa5ede20be587df116d9b8f327afa871
- SHA512 cdaad3f6096637d99fc8ed7dddd08fb2b442379df66cb4a2245d48471d38b453cde5119e1196830387c1351dcf3681a50107483198316f2deae4e221d132826c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEELF:A3k03kB56rL
- TLSH T128155B03E6850FA4C64F81349E968662E6377D510F209BEF1354BF253F32AD0BA3A657
- MD5 SHA1 SHA512 SSDEEP TLSH