Analysis
- max time kernel
114s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 12:40
Behavioral task
behavioral1
Sample
2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 971KB
- Sample260707-pwcd4ah161
- SHA256 71bbef9a38c6899fb82b9bdc7a177c44ad723aa20d6f5dfe4d505ad8c0f6668a
- MD5 fb1215943ca2923db77a8847a3e9940a
- SHA1 74480729280dfcf3f7dedd1ff81a4a589ed85d49
- SHA512 e9795bbeb284d12db027fdc70722d7dab61181d710b5f8fa26f59ce871fe7a7e362bb5d70cba546ab6b52f8c7ad1b1d0ede7e387f93f921ab2fb189354b5ed42
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTuC:A3k03kB56rj
- TLSH T16B257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/1348-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001200000001c470-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b302-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1348-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3320-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-326.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00060000000198eb-364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019ba2-647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00680000000198e8-1039.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001ad00-1230.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001200000001c470-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b302-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-326.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-328.dat aspack_v212_v242 behavioral2/files/0x00060000000198eb-364.dat aspack_v212_v242 behavioral2/files/0x0003000000019ba2-647.dat aspack_v212_v242 behavioral2/files/0x00680000000198e8-1039.dat aspack_v212_v242 behavioral2/files/0x000200000001ad00-1230.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3320 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1348 2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3320 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_fb1215943ca2923db77a8847a3e9940a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1348
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3320
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 971KB
- SHA256 71bbef9a38c6899fb82b9bdc7a177c44ad723aa20d6f5dfe4d505ad8c0f6668a
- MD5 fb1215943ca2923db77a8847a3e9940a
- SHA1 74480729280dfcf3f7dedd1ff81a4a589ed85d49
- SHA512 e9795bbeb284d12db027fdc70722d7dab61181d710b5f8fa26f59ce871fe7a7e362bb5d70cba546ab6b52f8c7ad1b1d0ede7e387f93f921ab2fb189354b5ed42
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTuC:A3k03kB56rj
- TLSH T16B257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 7ffb522c4fdadeb9683a0952b67b89c85539ec99893f067d8da3699209ebe880
- MD5 3fcb2a7e88e733bba55e5b638ccbeeb3
- SHA1 4da5b35113c91f881a53f01d743d73320cd83870
- SHA512 383ff86b1ab1ac0d9428dcda5ad84cf7643489a84f1f71bcf887c815e42d1a8228e47ccbb326ff8be78ef17815ddae61dffe121431aa5326da546c524a3c847e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTuC0Le5ji0hmxNrM:A3k03kB56rfPji0Aj
- TLSH T150756B16F6A44BA5D02FC074C5D2966AEA733C425F3087CB1354DE283F63BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 995KB
- SHA256 62d863ea4df56ff50a9d6636564e1531881ea056ea95a255df839fda0a508d5c
- MD5 99da35c925e4ac2770bbcab6319e8014
- SHA1 cb72fed70d8c5648c6fb10865d75b4866acf3863
- SHA512 42b465d228d3b7cc4ae7108334f08f24b848336980f0948ff191223d3d2b690b051f01fe4eab86bbeace80b9b4a01df4ee4f7e0a424437343418c01a1d59c1ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTuMb:A3k03kB56rV
- TLSH T1BF258B03E6940FA5D10F81709A954662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$
- Size 995KB
- SHA256 c87ddb8b09e18681a3b74579008a223cb6b506ab82f9a6549ec312eb149e853d
- MD5 d8c89f6910d902aef8568510fa390352
- SHA1 14718989775085d37525462e5cfc602c7446dd6a
- SHA512 5d6eedef711617f5fde1379c730b583097f0d68b848e2674485534bcd7a89bab2ed273cdc112dfb39b416db6afcd330a19565bbf9f2df2f8fc95d71c6aaf5eeb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTuSu:A3k03kB56r8
- TLSH T1C0258B03E6940FA5D10F81709A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 995KB
- SHA256 6aeb002e293e78e11f5a0fd61cc9f71fd46ac368f3d56562efc665b244dfa80b
- MD5 2d0abe8613fa3bfe6d0e48f8a2f71581
- SHA1 3ea98959ed41fadb93597c369782221437b821bd
- SHA512 a3905be755271ead87ed104b4390fc05db072d547a462bd04f2d9c0dcd08caecf2e962361ffb07e2c8a6a0f279a9d3bb1c76133159df3f51e3b7083e2e0da24c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTusg:A3k03kB56r8
- TLSH T1A7258B03E6940FA5D10F81709A954662EA777C425F6093DF2358AE153F72BC06B3E3AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
- Size 995KB
- SHA256 fc17223de931b4ca3fec16c00ffde46cc1de3bd42d013c442d9b048a93b2f9af
- MD5 3cb949229b07166f4494028ebf910d3a
- SHA1 b8b2df211b75a148fcb5869db4bf93053ddee87e
- SHA512 fbe168c1066aa8ec1480f536fcf69a4f820bc7725e38216d5367d7bcd05999a968e209fb5253acfbbca870656ac17f9fa8d1567ade405226f3da3f172794bcdc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTucY:A3k03kB56rQ
- TLSH T16F258B03E6940FA5D10F81709A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1015KB
- SHA256 7de0f0a0183047d399282fbee75fe181b6ad92d98a1c4bfb4990d91a8bc26b2e
- MD5 03690e1150e8a4d28f660d8373edae65
- SHA1 bb7bbadae6317243f7d9ee3bf3603f4103b41d07
- SHA512 6315e0e937bd5bbbbc4b339c22090e6a3298a525b79f0d90aff96f3e8aa3a271e0f712a6e21c8c1ca957d9aba8c8c6b987362cd89d6e09b55b36c12b55443553
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTuLwE:A3k03kB56rI
- TLSH T1F7257B03E6940FA5D10F81709A958662EA777C425F6093DF2358EE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe
- Size 1.4MB
- SHA256 9f8f609e17975ac4219b14017ae07ca71981bb30da7a30b491320fc6da4b8de4
- MD5 f9f00b48c291f3af831998f3cd035ec9
- SHA1 a55f53fe8ad2a62837d0ff3c1a248d737df93195
- SHA512 178064325cc7472e1a0432c6a61e0009b5b8ce9929559dc23b18c0407f16303b7f8537a0543509281bbfda2c0129634f6d389f2ad70daf92bb0d2082b0088b07
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPRmxTu4i6:A3k03kB56rdi6
- TLSH T174652983AB469EB5F00E84309591423D96737E2D1FD347CB235E7E067B357882AF825A
- MD5 SHA1 SHA512 SSDEEP TLSH