Analysis
- max time kernel
105s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/07/2026, 18:48
Behavioral task
behavioral1
Sample
2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.6MB
- Sample260714-xf2m2sd15x
- SHA256 dd8eaf116ce04c30fbda92b0c9511dc1868853bd4d66a644b902fe5354d61754
- MD5 878f09d7aaa33054e55e07e66f11dc47
- SHA1 667f947bb839670366f94cbc313ccb26bb3931d1
- SHA512 7d2d94488e75069ba242dcfd1c29a59b511466fcd717db7bb75291f78706af93001e2b9e3b05f143629156e3d6ab3f1e7b276b51ee4081a0b410076b9a228eb5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrEFYTqMi8CtBd2QHCHmTBW5bYTqMi8Cp:A3k03kB56rEqJtb2IdqJtb2IPPji0Aj
- TLSH T1EDC53A16F6A48761D077C079C9D2969AEA323C825F308ACB1345EB283F377D5953A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/3316-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001200000001c4dc-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4080-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3316-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-352.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0bc-1026.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001200000001c4dc-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-354.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-352.dat aspack_v212_v242 behavioral2/files/0x000300000001a0bc-1026.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4080 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{4F64B9FE-D791-490C-9F74-D185F13EE27D}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3316 2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4080 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-14_878f09d7aaa33054e55e07e66f11dc47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3316
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.6MB
- SHA256 dd8eaf116ce04c30fbda92b0c9511dc1868853bd4d66a644b902fe5354d61754
- MD5 878f09d7aaa33054e55e07e66f11dc47
- SHA1 667f947bb839670366f94cbc313ccb26bb3931d1
- SHA512 7d2d94488e75069ba242dcfd1c29a59b511466fcd717db7bb75291f78706af93001e2b9e3b05f143629156e3d6ab3f1e7b276b51ee4081a0b410076b9a228eb5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrEFYTqMi8CtBd2QHCHmTBW5bYTqMi8Cp:A3k03kB56rEqJtb2IdqJtb2IPPji0Aj
- TLSH T1EDC53A16F6A48761D077C079C9D2969AEA323C825F308ACB1345EB283F377D5953A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.1MB
- SHA256 813a13e17a70f7afc535187d6559d8edcf7e74f3367d9f33c620c3d9b3ce7fe7
- MD5 f4a699b250503f696a2ed621cc10e7c5
- SHA1 f5efd7b681c5dd269023f8061637bcc9fc7e1eb9
- SHA512 76fae4d6517a2d99fcf91dfabbaf074a07f691deab48cee97b0fe09775dcfe20cda0fbc1d26c71f82c270a501d05199933f836c7bbafb492ab96425c9367ba27
- SSDEEP 49152:A3k03kB56rEqJtb2IdqJtb2IPPji0AjKPji0Aj:A3k03kCrEcojo0jo
- TLSH T10CE52A16F6A48761D077C0B9C5D2969AEA323C825F308ACB0245EB6C3F377D5953A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 2.6MB
- SHA256 7fd44d24cf5243ed0c2e2b30467520ae0bfa9ea3e30eeb1777d9fe03773c37f5
- MD5 da4ed514e31753cf0ed49f7a73b1b784
- SHA1 fbee02c8b35342e9d7f543d6b4149a5271140fe0
- SHA512 55bb245b403a6d0fa5bd7f82f18897281a7917d12ef9f563e8505e530f31c4d0606b89007de6d13895ee2b42481f06f4ffffaf65066dbe5261b38cd6da8c39dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrEFYTqMi8CtBd2QHCHmTBW5bYTqMi8Cm:A3k03kB56rEqJtb2IdqJtb2IPPji0Aj3
- TLSH T147C53A16F6A48761D077C079C9D2969AEA323C825F308ACB1345EB283F377D5953A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe$
- Size 2.6MB
- SHA256 1b5126b80fae3d7635d1d12adb3f2145964c4b89d47015c212405605fa5745e4
- MD5 8babbe1cb456f6af4791e8920a3479f5
- SHA1 ab75b73400be8039c594dec38ac9ee6574ac2272
- SHA512 50abfcd41258935d25fe007c462c34c1d1fe66f8d92e11b4db7af91744b4b96f1425f70bfd5e1425da430fa59cebe3a0aab9869476879373930687128a68dc06
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrEFYTqMi8CtBd2QHCHmTBW5bYTqMi8CD:A3k03kB56rEqJtb2IdqJtb2IPPji0Aju
- TLSH T177C53A16F6A48761D077C079C9D2969AEA323C825F308ACB1345EB283F377D5953A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.6MB
- SHA256 61da420e8e0d4a618e445598a73749bceb8e544052061c35ee4a04fa253f6f03
- MD5 0f783f74c1d62beede01a71a00fe0504
- SHA1 15b8189ba46647f2e86c72c3ee0b01de2847680a
- SHA512 5f846dc7b7bf11d764b3d53726f64bf522550d185f57f29128f23a2f347bc374702404b4cbc4c21df774d1094d0769fe4734aede6b923b3579746052d92af39d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyrEFYTqMi8CtBd2QHCHmTBW5bYTqMi8Ci:A3k03kB56rEqJtb2IdqJtb2IPPji0Aj7
- TLSH T154C53A16F6A48761D077C079C9D2969AEA323C825F308ACB1345EB283F377D5953A732
- MD5 SHA1 SHA512 SSDEEP TLSH