Analysis
- max time kernel
92s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 00:57
Behavioral task
behavioral1
Sample
2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260720-ba19fads9w
- SHA256 61b3ff15878eab584b1c1a13fb62f2b6d983f3a7bd4412b0fe48c642b55e9ea7
- MD5 97838ae0d77232a8d0261e0cb9cfba0c
- SHA1 5582d5a8663273f114621ef53591ac238ff9c7e2
- SHA512 e78594a23b31fff5dcf5c7013de6325fb6f4480d4f9e33c917443b988c3eb00b9357ed3c0787ec880ec90ff716158d4f72da8d288b699da385f4a658c4948ecc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrM:A3k03kHRJARJVPji0Aj
- TLSH T1E6657C17F6A802B5D067C179C5D29A5AEA72384207309BCF0394D7292F67BE19F3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/1844-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245b6-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3808-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1844-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3808-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202af-277.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00220000000202c2-519.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021f82-1019.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002170f-1021.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021673-1293.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000020395-1569.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000723-1987.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245b6-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x00030000000202af-277.dat aspack_v212_v242 behavioral1/files/0x00220000000202c2-519.dat aspack_v212_v242 behavioral1/files/0x0002000000021f82-1019.dat aspack_v212_v242 behavioral1/files/0x000200000002170f-1021.dat aspack_v212_v242 behavioral1/files/0x0003000000021673-1293.dat aspack_v212_v242 behavioral1/files/0x0005000000020395-1569.dat aspack_v212_v242 behavioral1/files/0x0004000000000723-1987.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3808 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1844 2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3808 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-19_97838ae0d77232a8d0261e0cb9cfba0c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1844
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 61b3ff15878eab584b1c1a13fb62f2b6d983f3a7bd4412b0fe48c642b55e9ea7
- MD5 97838ae0d77232a8d0261e0cb9cfba0c
- SHA1 5582d5a8663273f114621ef53591ac238ff9c7e2
- SHA512 e78594a23b31fff5dcf5c7013de6325fb6f4480d4f9e33c917443b988c3eb00b9357ed3c0787ec880ec90ff716158d4f72da8d288b699da385f4a658c4948ecc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrM:A3k03kHRJARJVPji0Aj
- TLSH T1E6657C17F6A802B5D067C179C5D29A5AEA72384207309BCF0394D7292F67BE19F3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
- Size 1.9MB
- SHA256 5a0e6f2bb7f75f98f5b9e13df36f97e19fd17b8531fcf28f5f203e9c11dcb6d5
- MD5 649e31983fffb6e3a7090a5e59cdf18e
- SHA1 fba78ed63d83ebc174cd6a7403fd9cb0a2acd217
- SHA512 d44db45df81d5fe31f4bfd3e8b47ffcf8841ffac36079beb91ff5e9f9d9b98d47019b623d091043d967b1794a47bf186606538f448b8f5719b01063b66c1053a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrMe86n9kAJ9w:A3k03kHRJARJVPji0Aj1T9t2
- TLSH T174957D17F7A842B5D067C178CAD29656EA7138820B3096CF0394D7692F37BE59F3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 05dc5de10a86a64db1d42e1b838acd281d59c1e5aeb9297948599223241906f6
- MD5 23acb066e97ab8f14286b96ca97bc4f0
- SHA1 0e5c954d1d41e94f9ea9f992006066c4cf8f94e3
- SHA512 1c6b2c0cc14cc367f0d67a9458e18cfe6431b57a2f4c86251fc213aca903d1ae31af8ae006e8e1eda38984a5c81c21aa47786365a09ff89bee7e170aa6e219c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrMD0Le5ji0hJ:A3k03kHRJARJVPji0AjKPji0Aj
- TLSH T123956B16F6B84375D073C0B9C5D2A69AEA72344217308ACB0395C76C3F67BE59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 1.5MB
- SHA256 6befc6bff76e1ec3390f2b32adb35c2e3b5a43513ef574354bb6ec46659a80e4
- MD5 a07967f9ae9d3deaff76971530fcd02f
- SHA1 51cce0cb25ef3fadbd6343afed803f81d853f1e0
- SHA512 1f26f03682057ff8fb8b4527e8b229f4f93d8c2e67f4bef52685d1e24c78647dfed12f96c039ed03363ed8559c1cb9ed14ab2c76b3f947c83c0cc0b2bc2139fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrM8c:A3k03kHRJARJVPji0Aje
- TLSH T174657C17F6A802B5D067C179C5D29A5AEA72384207309BCF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$
- Size 1.5MB
- SHA256 7a36da083d644ede87ffe9a9e9e14c6b77013dd6d973c8df4f9a6d8011762947
- MD5 d8dd7e4ee76c497b467cbdfba9d2dd03
- SHA1 e3e2184c2f1d7354eb3f41c7e89892f3223cbdb1
- SHA512 d204459132c5679c67ec5a9d7841259ebdf7f5850165ea46b0b7ae087adb1dbdd773f7a7209ef7120db08a81e976155d8b1b789b9f7516a7e5af3a94134eefd4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrM7D:A3k03kHRJARJVPji0AjE
- TLSH T10C657C17F6A802B5D067C179C5D29A5AEA72384207309BCF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe
- Size 1.5MB
- SHA256 9592a83ff66c1d63336e50e381077ddc17aecae1bbb9780bea5c4e7de61940ce
- MD5 67f1fa2d1734d13d44a4d35bcc6697e3
- SHA1 1d79859cfbf5389b1c64bcac8fd1710636bb6559
- SHA512 ca7c0dfd911226d37394e178dcb07ecbe01e80c586aa72da3b175188926fad68b001a8773a802a09696919155f45011e6ad537495ef32991bba41c7010fa7187
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrMPF:A3k03kHRJARJVPji0Ajq
- TLSH T1D5756C17F6A402B5D167C078C9D69A56FA313C810B309ADF0354F7292F37BE5AA3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 1.5MB
- SHA256 2656025bb7f3c6b9047291e8698fe2ac560785fc27fd62eb31c8d253d9571b4d
- MD5 432f328868885f8839c02d2d94ebfb6c
- SHA1 6c8bb8e55a0d03b86777eaa7f058336201dbaa6c
- SHA512 5f016176d36b861f0ccdf0859465e6917d54e38b3f6d7243d088b0fa552e72f2c22e7b637df6f96d8a71399c4022f2600b23e8b20955e505d60a5049fd1153a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrMuwE:A3k03kHRJARJVPji0Aj7
- TLSH T17A657C17F6A802B5D067C178C5E2AA5AFA71384217309BCF0354D7292F67BE19F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$
- Size 2.0MB
- SHA256 bff13b43f20d93bec6fa976fd4602872cb104575fb271b8ff293f96dc6604a43
- MD5 4008ca658a40da0e825a51a9d2056fea
- SHA1 a1e2221fcb1e6dca23a11f725037df236d36fdf1
- SHA512 05a5ee2af8bdf99911b16d61bd518dfd11a4c1d3b667bdcad2b33654c7303d7f930b6e8e5770b16064d7af5aba0c8f9302e6482497fab9268a6a8a7f8b560a3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrMR3N+tCn50V:A3k03kHRJARJVPji0AjW8tDZqrKV
- TLSH T196A56A16F7A842F5D067C178C6A69676FA7278410B3097CB0394D72E2F376E19E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.9MB
- SHA256 96069143d4f18be6936295dcf8a1c31ff62aa8986659ed793c7759c5f2413ebb
- MD5 9637f31e2cd7a89d96bfc66f12acfe84
- SHA1 4d6effd5980ea001c2b6eadfa1971c3b0b42f65d
- SHA512 ec5736b7dc50e5f5a6cb0d4ad8160ffbb7e825869931bd189a51a786f862e77711361c78076d2e3679cf45c9fa3d8a545d342e688160fdf9f313ca991137699f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEaRaRaEvC0Le5ji0hmxNrMu3npi63iC:A3k03kHRJARJVPji0AjRXpiMh
- TLSH T1C7955B12F7E84275E0B3C274CAB69656EA727C514B30C6CF1394961D2F72AD0DA3A732
- MD5 SHA1 SHA512 SSDEEP TLSH