Analysis
- max time kernel
106s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 22:53
Behavioral task
behavioral1
Sample
2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe
- Size 2.7MB
- Sample260710-2t2mesgt9x
- SHA256 d5330943d0ed643798d7cd6949f23dddeb638a7fca8fd7714cf95957122321c5
- MD5 2daa379794f8c9112ecef23ba5f777c7
- SHA1 7a393f83939496c880c8f8ee8ea17d8f36efbf97
- SHA512 a771f162d7a67871733f7471aca0bbb93870794a26ede2529a267ab0bdfbc6c85faa50e4b1aac77a1db3f04b02e2f7e79160343890e341ebf1d6208c853586aa
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56rX:A3k03kHRTr1fkZcnFrX
- TLSH T1B6D53A16F6788BA2D17BC078C9969655FA333C414F2087CB1358FB293E336D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral2/memory/5816-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b6f5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000016cbe-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5816-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4568-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000018992-271.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019980-520.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997d-523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b000000019ce0-1032.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cb3-1289.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000172dc-2004.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b6f5-5.dat aspack_v212_v242 behavioral2/files/0x0005000000016cbe-11.dat aspack_v212_v242 behavioral2/files/0x000c000000018992-271.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-270.dat aspack_v212_v242 behavioral2/files/0x0003000000019980-520.dat aspack_v212_v242 behavioral2/files/0x000300000001997d-523.dat aspack_v212_v242 behavioral2/files/0x000b000000019ce0-1032.dat aspack_v212_v242 behavioral2/files/0x0004000000019cb3-1289.dat aspack_v212_v242 behavioral2/files/0x00040000000172dc-2004.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4568 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5816 2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe 4568 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_2daa379794f8c9112ecef23ba5f777c7_amadey_cobalt-strike_elex_glassworm_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5816
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4568
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.7MB
- SHA256 d5330943d0ed643798d7cd6949f23dddeb638a7fca8fd7714cf95957122321c5
- MD5 2daa379794f8c9112ecef23ba5f777c7
- SHA1 7a393f83939496c880c8f8ee8ea17d8f36efbf97
- SHA512 a771f162d7a67871733f7471aca0bbb93870794a26ede2529a267ab0bdfbc6c85faa50e4b1aac77a1db3f04b02e2f7e79160343890e341ebf1d6208c853586aa
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56rX:A3k03kHRTr1fkZcnFrX
- TLSH T1B6D53A16F6788BA2D17BC078C9969655FA333C414F2087CB1358FB293E336D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.2MB
- SHA256 4be84277580c1cea16a612bac029ee1843c9b2ef7b415713bd7a3ee866a82caf
- MD5 7bf0499fa7e8514150cbeb31beb57647
- SHA1 286cc1bc1c19c5cbf18ef670bf11d01ce7f60a37
- SHA512 18cb49b73fbcf23b2cdca999c06e421e9ad2c399260551d0ef172eb4f5f842e2b019bc703b74dce04d91361827571edf33e4a0dcc5e81ab1d97ff2a2d93ed627
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56rTPji0Aj:A3k03kHRTr1fkZcnFrLjo
- TLSH T11BF52916F6788BA2D07BC079C5D69656FA333C410F308BCB1355AB283E376D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 2.7MB
- SHA256 8582e3128b873019257ddfcc09a98ce5e2f9f384ee58aed075ff046ba1b8a512
- MD5 4967c21b186c4d4ce2949029efd3497a
- SHA1 5f04698ddb0b9f468dd621379e320ce430145189
- SHA512 80eb969eb8b94c0074ffd4935d4199364c0d44499b81380fea14563aced5c4fc8201871120799a473f15f2f584a14b884fe47b5dcd6d0561efff1ab61be67312
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56rA:A3k03kHRTr1fkZcnFrA
- TLSH T1FDD53A16F6788BA2D17BC078C9D69655FA333C414F2087CB1358BB293E336D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$
- Size 3.2MB
- SHA256 109349c41078396e921fdcda2b214d7e87b9d03310f20aa37fc24c0e6d565443
- MD5 1553f970c605cb6414551d15a560fe10
- SHA1 dca95181a1d7034b39b1c7db2a25bf8bb5339cb6
- SHA512 9b094e47e7a5554017994a3b2b2b7d7372f147a94aaea1c5833cfaf5a48d6f070ffb8c7205d31b60353e56d521bfbe75fb2d289e826a7f66a6887a690f5162a2
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56r4Td9CHKya6:A3k03kHRTr1fkZcnFr+Cq6
- TLSH T179E54A16F6A84BA2D07BC174C9969655FA733C450F208BCF1354BB293E337D09A39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 2.7MB
- SHA256 f2e1a14c802d3b0842f109d51641c43f2d5e8e0863d6e9a6ac329aec77ee2e9e
- MD5 df5a5334bbd502395d3b816333f32ed6
- SHA1 28d6b8a5ba1850d35e40c9c55d12ab64a5d94a12
- SHA512 6dccfef91dae21d9ad42579a277a68f66b38fc1bba03e6a73017bc073ba3bbcab40e8cd62cc9da9e4199ac6b9aea8a9aa21dea52ae04f5ae8651ed91e0ed50af
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56r/:A3k03kHRTr1fkZcnFr/
- TLSH T176D53A16F6788BA2D17BC078C9D69655FA333C414F2087CB1358BB293E336D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$
- Size 2.9MB
- SHA256 f3587f7c3e17e866dc15af4ef542e1ad2bacbc8ac3d61009a511fa60ac77a0b0
- MD5 1eb04b2f494ba7541d75637fa4cc0d86
- SHA1 560d5b305a6e7acfb44613634bf60d32a9bb35f7
- SHA512 331ecd59dfe4b6a367b63b19e1a9db76db0ea42ebd6740c9548c725eb589e16ff7ffbbeda7b1a4597b1ac53dfbc0d07a288ec81e2df415a7b51e0378fbf0859d
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56rU:A3k03kHRTr1fkZcnFrU
- TLSH T103D53B16F6784BA2D07BC078C9969655FA733C414F208BCB1354BB293E337D19A39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 2.8MB
- SHA256 549a90332d2cb3c1a0af9fb888d4c7c06a930eeb0a5f8681f6a5c8c5f0f9d4fb
- MD5 f06c1cc2c49d4aba120d2d7350cf9b03
- SHA1 e8ba247678930cbd74dac85bb9547f4a18746e33
- SHA512 b965eef6ddd4710b2781e17bff98988015e0730fafa58cddfc797b133c081a6b10fae3dcd94c974e55ceba1a2bc93019ccf7f1056e768ab643ab8d2e050432f7
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56r9:A3k03kHRTr1fkZcnFr9
- TLSH T129D53B16F6B84BA2D1BBC074C9969655FA333C414F208BDB1354FB293E336D09A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.8MB
- SHA256 9bed96decf780ebbe1cb95658070230748d12ef7e4c9f738acd2ee47948af2da
- MD5 bbf44b01f85f80d832afd3439301abbf
- SHA1 9464c5877c30ed7acfb60db026ef34e5095b7827
- SHA512 24d7751c3a80220e93b5f1b0c63cc0ac112ff2e66cfd3cc95eec29df9d8546c1f59c6fd9d2a97746da17cf0ef1f4d1564c8ce6f371a1b4cbedb6f606813ed703
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56r0:A3k03kHRTr1fkZcnFr0
- TLSH T189D53A16F6788BA2D17BC078C9969655FA333C414F2087CB1358FB293E336D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe
- Size 3.3MB
- SHA256 eec8b30fed669c5058fcf5348943df17ecd456a274bd9caf023563b5d43f9a87
- MD5 4175c8bec924544fbaf6286c77c11398
- SHA1 b33c73d969e43cab1c036abbcd9a34d1cdd82259
- SHA512 32e4c195637b003f8dba3f2ed4caa825da6d1db35e12eec849ec3c86828e12299bf0b1900dc23b32a2f83b2f8f2a369d918534555c70c8204e9c83866da53345
- SSDEEP 49152:A3k03kHRJo56rheW4SkZP4sz9Mb9UOlk0I56raRjvQo0nGH1:A3k03kHRTr1fkZcnFraRjYFGH1
- TLSH T145F56C26F5684B62D1BB8075C9969655FA333C050F208BCB5394FF283E376D09A3A727
- MD5 SHA1 SHA512 SSDEEP TLSH