Analysis
- max time kernel
98s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 01:39
Behavioral task
behavioral1
Sample
2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260718-b2x14ab16m
- SHA256 e8dd533058e24e1b606127189713234eb66cf784fa39dda2e7fb738e24b72017
- MD5 e8281f9c75dee3711cc7beb5505e3278
- SHA1 d960e7968c4b1f315a0497ec12fadedb1e880446
- SHA512 5914c361b13f66f735bcf75d7d2a2749a66ad96b5749b958e36b631b12d383962e994a6f09349b5d97acc64aa87723bfbdf732d829fdfeaea04e9824d518db7a
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGbjoFZe0p4Ek4niOkl/A04szE87JKTvm:x7iw2zeW4SkZP4sz9Mb
- TLSH T10B853B16F6BC8722E0B3D075C5E6974AFA7274461B3086CF0259C72C1E27BE1A939739
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/4120-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c560-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4120-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2596-34-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-412.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0038000000019af0-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000019ec6-1126.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019caa-1211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00080000000064b2-1816.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c560-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-412.dat aspack_v212_v242 behavioral2/files/0x0038000000019af0-1018.dat aspack_v212_v242 behavioral2/files/0x000e000000019ec6-1126.dat aspack_v212_v242 behavioral2/files/0x0004000000019caa-1211.dat aspack_v212_v242 behavioral2/files/0x00080000000064b2-1816.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2596 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe - Drops file in Windows directory 36 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4120 2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2596 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e8281f9c75dee3711cc7beb5505e3278_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4120
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2596
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 e8dd533058e24e1b606127189713234eb66cf784fa39dda2e7fb738e24b72017
- MD5 e8281f9c75dee3711cc7beb5505e3278
- SHA1 d960e7968c4b1f315a0497ec12fadedb1e880446
- SHA512 5914c361b13f66f735bcf75d7d2a2749a66ad96b5749b958e36b631b12d383962e994a6f09349b5d97acc64aa87723bfbdf732d829fdfeaea04e9824d518db7a
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGbjoFZe0p4Ek4niOkl/A04szE87JKTvm:x7iw2zeW4SkZP4sz9Mb
- TLSH T10B853B16F6BC8722E0B3D075C5E6974AFA7274461B3086CF0259C72C1E27BE1A939739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 239d1a9f36195b0a3db6fdbc34cf78fb03176912178be786902b37d441dedeba
- MD5 7d49d74c60390bd245432917433f009f
- SHA1 9c84e8dcae4205a034b5646ce3607949927a8cee
- SHA512 bd4210012151a4172b72f5e1e667cc06f101d88650a931c21328badfcd9986b82d2d231d533347856d58293bf42bfe1c077a1399711fd4f721ea2612139fcb23
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGbjoFZe0p4Ek4niOkl/A04szE87JKTvmy0Le5ji0v:x7iw2zeW4SkZP4sz9MbBPji0Aj
- TLSH T1E3B53A16F6B88722D0B3D075C5E6A64AFE7234461B3086CF0259C72C2F27BE59A39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 1.8MB
- SHA256 13379c5805b04e0ea5672b5dd56b6282f14e8290146b4ef7b4dd89c33e811fed
- MD5 a30f494df1306d4a6a0e04ec5c2ae531
- SHA1 8b49aae3df6fea939111df9176be695922f96821
- SHA512 7bdd78398544819ec4fe07f3eebdabad160e44a82214ccde33fea0c892cda2671938b24615f594e990dab82146f7cafb63ce64360ebb2e40cca17de4ebfa057f
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGbjoFZe0p4Ek4niOkl/A04szE87JKTvm5I:x7iw2zeW4SkZP4sz9MbT
- TLSH T199953B16F6BC8722E0B3D075C5E6964AFA7274461B3086CF0259C72C1F27BE1A939739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.8MB
- SHA256 22d3e2af862785d86769f263b9205f88ba4ad32216cccbf52ba91f0105ca069e
- MD5 3ecc290fea4401c7536c89690bf10929
- SHA1 561968a6ce92c248009fe1e83dd8c9e014a41fd7
- SHA512 2f45b57202f4175c16521852b187722451a0b36e683b0b864386bab23bc47d5b5960652e0233349b76ae48df2a7ba0074e541b217ab0feb42cba32a55b47eee5
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGbjoFZe0p4Ek4niOkl/A04szE87JKTvm7wE:x7iw2zeW4SkZP4sz9Mbu
- TLSH T1AB954B16F6BC8722E0B3D075C5E6A64AFE7274461B3086CF0259C72C1E27BE19939739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$
- Size 1.8MB
- SHA256 20c8e474cd9d9898450ce7d31d7978dd67d92444c355d31cc6954fb6a0823605
- MD5 11cece846847d5b5ec0490b50a6d6391
- SHA1 9db11fed8c8803577dd4d044eeed378a7a92aa62
- SHA512 e40f917c11e2f491ce2a6fb26b28d21596146fe632661469890e8596dcf46624e5dd8b2d048d5ef6b77d528ea7ae2593851658a6ea5270c6c2ed5835d30d2231
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGbjoFZe0p4Ek4niOkl/A04szE87JKTvmwB7:x7iw2zeW4SkZP4sz9Mbf
- TLSH T1A7953B16F6BC8722E0B3D075C5E6A74AFA7274461B3086CF0259C72C1E27BE19939739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.9MB
- SHA256 34e300082087c9f48e8f7c1420eaae66cc416045251aaee0a384c6a327a53ffb
- MD5 83243e31b10354c4094492654c9a38ad
- SHA1 33a928a2d7558388d18738c4fd0501550ead7910
- SHA512 7b7b71e4a83cd01715821459f3a90de3df5ca286a739e461ee45876e41eea10c40a02fe15f9053685d267500f7afbae1c2c39045697788b5d37fc55859072d09
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGbjoFZe0p4Ek4niOkl/A04szE87JKTvmwF:x7iw2zeW4SkZP4sz9Mbj
- TLSH T105952916F6BC4722E0B39075C9E69649FA327C451B3086CF0259E72C1E37BE1A939739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.2MB
- SHA256 316b143f61cf48349c082fcb51bbaa806790350f8e1e24e51b7efbc9e812d8b6
- MD5 770e6f7b63b0463a10d505f1c4e6b5e6
- SHA1 b208141f35731c50d42247114c4b49ead5b1c5c5
- SHA512 8c09f123b712c514d1153fe3e57fe5991ee0566fe06917d96f966487d26b15486e4ef749fa680867ac88e6bd111072fd96d1bbf85c970dcab14a4b4e1b539088
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKplpGbjoFZe0p4Ek4niOkl/A04szE87JKTvmZ3npi63iC:x7iw2zeW4SkZP4sz9MbgXpiMh
- TLSH T12CB54B16B6FC8222E0B39175C9F69655FA7278415B30C6CF1258872C1E33BE1EA39736
- MD5 SHA1 SHA512 SSDEEP TLSH