Analysis
- max time kernel
112s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 15:59
Behavioral task
behavioral1
Sample
2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.3MB
- Sample260720-te919afv5j
- SHA256 3fb1618ff986bf975bcdbe1a1560e6ea191119a13a7f7957c9d684f620850af7
- MD5 50a013c8c35bcd3cc3cecc61db74fec8
- SHA1 496968a066df128a665fb87fc58e0fe7b00d7f72
- SHA512 6dbfcc0d7060a3c5dddf8867764949b0a41b59a3a69922892e85c712b362fa20dd0f04bf20cac17f5ffa65836b6ec58fb00987ed71716062e237b0ccbd9193b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPcMacF5jcAkSYqyE:A3k03kB56rUpYq
- TLSH T1CE555B16E6644FA5D02BC074C6D29666EA733C461F3097CB1354EE283F23BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/900-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b8b6-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000016bc9-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/900-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2908-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-456.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-457.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b000000019cbd-1028.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cc8-1259.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000400000001b8b6-5.dat aspack_v212_v242 behavioral2/files/0x0009000000016bc9-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-456.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-457.dat aspack_v212_v242 behavioral2/files/0x000b000000019cbd-1028.dat aspack_v212_v242 behavioral2/files/0x0003000000019cc8-1259.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2908 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 900 2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2908 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_50a013c8c35bcd3cc3cecc61db74fec8_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:900
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2908
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 3fb1618ff986bf975bcdbe1a1560e6ea191119a13a7f7957c9d684f620850af7
- MD5 50a013c8c35bcd3cc3cecc61db74fec8
- SHA1 496968a066df128a665fb87fc58e0fe7b00d7f72
- SHA512 6dbfcc0d7060a3c5dddf8867764949b0a41b59a3a69922892e85c712b362fa20dd0f04bf20cac17f5ffa65836b6ec58fb00987ed71716062e237b0ccbd9193b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPcMacF5jcAkSYqyE:A3k03kB56rUpYq
- TLSH T1CE555B16E6644FA5D02BC074C6D29666EA733C461F3097CB1354EE283F23BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 de9e49b30ebdbb291de5b06ad64ec72b6340e296291c2d501c27b0ee62f1bc61
- MD5 dce65657a9c5d2d11db5e2bbd05085ed
- SHA1 7db875df0740ab4ec1ec5646f57d7ad808170b61
- SHA512 16cd14503ea5a986b1c6e7c4aa9ff4ac230e13927843b3ef0370297102db13c895a969096708ca77a94b50ea821f38f040e96eeca6740138ce439921708bfb36
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPcMacF5jcAkSYqyED0Le5ji0hmxNw:A3k03kB56rUpYqjPji0Aj
- TLSH T1C1954A16F6644B75D02BC0B9C5D2969AEA723C421F3087CB1345DB283F27BD19A3A772
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 1.4MB
- SHA256 537d6ed9b613677199ea038d1ce133013670048ddc6965be0c8589c422a3a88e
- MD5 5af01c1d90ed8e24afe93f89a9d2eabb
- SHA1 2df97bf50aa192862206dac8d56b9d1d4dd62d37
- SHA512 1f0118b088828718a3d88b32c61b46361fa7f1559ce0c140c092c3356d5a87955cf7b02652244ecc39231f268601924659c4cd78efba75c9f0449742761e6495
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPcMacF5jcAkSYqyE0M:A3k03kB56rUpYq5
- TLSH T16D655B16E6644FA5D02BC074C6D29666EA733C461F3097CB1354EE283F23BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$
- Size 1.6MB
- SHA256 c20bb15a08caee78a495ca4e6a9de7395913785e9af81a65fd6fb1a819347688
- MD5 c4e803b17da87da9529c54057f8ae420
- SHA1 6f517ef022beae073b1ebd46c9cac2d69c13d1a9
- SHA512 46db7c4a96d95cbbff99109d3d9a264bff1b941533ddf35d4e94fc1e294800b015bbff1f66c83c0aca383a450398c2fda5e501d91ff3086899191afe9a00c87b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPcMacF5jcAkSYqyEVjCXF7IwZ:A3k03kB56rUpYqpC17IwZ
- TLSH T13A756C16E6644FA5D06BC178C9D29666EA733C451F3087CB1384DE283F23BD19A3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.4MB
- SHA256 0ea58c688693d06a959f18d1a9b33fa817ce9025c9708a6ef69a2b9ac7dd6051
- MD5 1b68b831993b1f503d5ea9281ab5cb65
- SHA1 c28b3cb405931cbfb7eeb84163bf14ca824b3b32
- SHA512 bb2ddf81b77dc23230aa607b1ee2cc4f09c7bb3a5d7ffdca2cb1cd810c6de8761a3df1093a76046152ffdf8eacc0b99d47e5c028d5e6a78d5e9397bb2356efc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPcMacF5jcAkSYqyEuwE:A3k03kB56rUpYqk
- TLSH T14C655B16E6644FA5D02BC074C6D29666EA733C461F3097CB1354EE283F23BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 1.4MB
- SHA256 48b15c737daa5da53838f1650456ba31493e8cd3e36191b60ed8917595f39461
- MD5 1ca9f9d17a05a1fdbbad3a82a99a4fa2
- SHA1 cce65f67000b83a00f058859d0b0a06503360f38
- SHA512 97697bf1334a9f30823594454ac91b978d675fd440d12fab224e0e1e0647b2c11cf972e02f56dd0b47c77a7bf53dea6ac385ca8c40f5dcc6e4c9be0072eea170
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPcMacF5jcAkSYqyEPF:A3k03kB56rUpYqt
- TLSH T174654A16E6A44BA5D06BC074C9D69666EA333C811F2087DB1354FF283F337D1AA39762
- MD5 SHA1 SHA512 SSDEEP TLSH