Analysis
- max time kernel
92s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
16/07/2026, 12:01
Behavioral task
behavioral1
Sample
2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260716-n67gjsgt21
- SHA256 c455d35e089b9eb2ff1b9c8c03e6f584908e86dba1b3a616055fb47bff679e84
- MD5 2bc05ff9410d14e648da945ebd87f420
- SHA1 accc07d72c902ca5ceb7bc7ba056651ac8735775
- SHA512 1140c6a638921b339ca8673aa391bb7d029c47a740214b39b274262c7e30ca145befe8bb1a7211f3ab7d1c4c0247dc254c107176edc73a19f506612b2d691ab7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBW5:A3k03kHRJQqJtb2I
- TLSH T13C756C16F6A442B5D067C079C5D2AA5AFE3238425B308ACF1349D7292F73BD1DA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/1636-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245a0-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4532-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1636-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4532-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245a4-143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202be-239.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235b6-241.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001da00-836.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00090000000202c1-1497.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000245ae-1633.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000735-2077.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245a0-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-12.dat aspack_v212_v242 behavioral1/files/0x00070000000245a4-143.dat aspack_v212_v242 behavioral1/files/0x00030000000202be-239.dat aspack_v212_v242 behavioral1/files/0x00020000000235b6-241.dat aspack_v212_v242 behavioral1/files/0x000400000001da00-836.dat aspack_v212_v242 behavioral1/files/0x00090000000202c1-1497.dat aspack_v212_v242 behavioral1/files/0x00080000000245ae-1633.dat aspack_v212_v242 behavioral1/files/0x0003000000000735-2077.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4532 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$ 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$ 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1636 2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4532 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-16_2bc05ff9410d14e648da945ebd87f420_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1636
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 c455d35e089b9eb2ff1b9c8c03e6f584908e86dba1b3a616055fb47bff679e84
- MD5 2bc05ff9410d14e648da945ebd87f420
- SHA1 accc07d72c902ca5ceb7bc7ba056651ac8735775
- SHA512 1140c6a638921b339ca8673aa391bb7d029c47a740214b39b274262c7e30ca145befe8bb1a7211f3ab7d1c4c0247dc254c107176edc73a19f506612b2d691ab7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBW5:A3k03kHRJQqJtb2I
- TLSH T13C756C16F6A442B5D067C079C5D2AA5AFE3238425B308ACF1349D7292F73BD1DA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
- Size 1.6MB
- SHA256 9c326df60e7ec8706fafdac79860c5f92166abf5c71bd57c66a9cdd533a5ef88
- MD5 396476be6bd31102d9863528f392e996
- SHA1 aa53c890114d542c5f61a7e5c4187ca38a51e479
- SHA512 77da969ae2ad449a5df7c2c82d7e26eeda6e99b29f84b81225922b4fdf7def4f0f29bfa2ef72c32f3b23536658bd05c8c4a9e82ea191f95ef341186d835bdd6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBW0:A3k03kHRJQqJtb2I0W
- TLSH T152757B17F6A442B5E067C179C5E29A5AFB3238421B308ACF1349D7292F237D1DE3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.6MB
- SHA256 a19a38f68abfcbcbc7b0d67c7c335b0f7c27b95f6b3bbe9615911c7d5d75675c
- MD5 2dc02c99de8b8f525dfb39e484b5a6ae
- SHA1 f7b8cf2d06364dbba7cb395bda41f4f5c3022345
- SHA512 1767704e2db631b3bda652b0776756eeaab3d6f086e1e43e0d96faa2ad60d3a3318499dd9ea6ca0bcfce3bc5eadce5ce19e78f38542993fc43994eb72a417c08
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBWs:A3k03kHRJQqJtb2Imw
- TLSH T14C756B17F6A842B5E067C178C5D29A56FB3238425B308ACF1349D7292F23BD1DE3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 ce4fa58de5b4229edfa4bcad9afb4674a1b81acf30753de196cb9dff943d5b31
- MD5 aa09b33bb2a87c40d5b6467e9b514008
- SHA1 72b70eaec254b1951b6486316e4875149b190c7b
- SHA512 cb7fbf68463c677ec1d1d1577bc0a18f9e11b03651e08d9bac2d43d8af525b6fec5e94bcca68a82ad9cecdd2d3590266c30b40bca48233f5d6307583bcd68c7c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBW9:A3k03kHRJQqJtb2IQPji0Aj
- TLSH T107A55B16F6A44375D073C0B9C5D2A69AFE3234425B308ACB1389D7282F67BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 1.6MB
- SHA256 bd8621d6d8a147daf926e498979f9ee6ec2610445f675069ba46e3fcfd94bd2b
- MD5 3e974b8512ff61d0218968b6cee9367e
- SHA1 54b2c20f5d206fe71e19c04e2da1ce62f6749939
- SHA512 7f9270cbeceba3323cbcf71372e21e2766ceca931e7812a919684ea0db0e0c3eb0e8ad1836ba3dd10815113be72eeb6c9b7869c5cd14a5499173cd353deba787
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBWq:A3k03kHRJQqJtb2It
- TLSH T157855A16E6A442A5D06EC079C7D29A56FA33384257F086CB13C5D63D2F337D19ABA323
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.6MB
- SHA256 1b1db4f6532ccaaaf0cbf556127a6ae6aa4f6fa670bf717fc56c7d5e98dcd1cc
- MD5 1f0fe4a15a932244a1873d290699df0a
- SHA1 ce65c4adf7639a54481f7a7b69ebe54ab5814f06
- SHA512 17cfb0d26ed33b6503d44c0a8335f7dcd429f319e1ae1dbdd0eb1f542d0ce12f1daf24a0ca0e6fa64a7c924bf5da00022adac7556d7ba7c3711fd5f4f0529af2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBWQ:A3k03kHRJQqJtb2ICs
- TLSH T1A5857B17F6A442B5E067C178C5E29A56FB3238425B308ACF1349D7292F23BD1DE3A761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 1.5MB
- SHA256 15def15783faebb338a55a3b3c856e6c186019350329b1c096a39b7a13339a1d
- MD5 b0e5e91c58122ad4ec0964b7c2f62877
- SHA1 98fe43aed1081b4a75e2166dbe4133f4c4d3900e
- SHA512 1f4df2fb3acd49c11f7c5f1aff7fc47cf25fab1707cbe6bde133fc32e579b2dcbd11f32e3bf8ace46bb7aa033b10d7281f0a99b7cef169259867dbdcaed04353
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBWB:A3k03kHRJQqJtb2IK
- TLSH T1C6756C16F6A442B5E067C179C5D29A5AFE3238425B30C6CF1349D7282F63BD1DA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\misc.exe
- Size 1.9MB
- SHA256 11d04cddcd7b9b0240ee011f808d0731b4d660f90c2d2b7cc4e57d1da048ac26
- MD5 47856ac377128a31c8e849bca23704b2
- SHA1 4ec04b4cb06b5c8b832c2666f5329df32ea61f4a
- SHA512 31cdffde20dd08c98093b4f0384aef1c0123cb0b98b0c87a179c3f4245772e7073acfb52b137a1398920031343e7f832e46ffaa34ddb9864af21cd215ec73326
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBW3:A3k03kHRJQqJtb2ImZkk
- TLSH T10C957C16F7A442B5D067C178C5E29A76FA7278461B3097CB1359C72D2F33BD0AA3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.7MB
- SHA256 841bc52028da07f527e3a3bbb6828e35a4c0fae4c8bf49904b88ced490f2e5c4
- MD5 2a3bf65cb47448850fde4dcdc4958a06
- SHA1 0e2525a58911c7fac591f990b0d5e3e2cffcb9a0
- SHA512 c31d492f0a5328db79a5948ff1b901205a3f041819e4e95845a9f77de663da8c110e63588dabdb104fa72ff74f2621214991432ce55d585222f56f40aa351bf5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaitLacYajYTqMi8CtBd2QHCHmTBWC:A3k03kHRJQqJtb2Iai2WH3
- TLSH T156858D22F6A442B5D077C075C9E6A66AFA3138425B3086CF1349D72D2F737D1DA3A362
- MD5 SHA1 SHA512 SSDEEP TLSH