Analysis
- max time kernel
114s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 05:39
Behavioral task
behavioral1
Sample
2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 1.8MB
- Sample260728-gcfcmszvat
- SHA256 88446b95d598ce90849bf952d8e28d97ebbefc2c4c4da8231a20c788a9bc7cdd
- MD5 8932731f96fde27a8c682b615781a717
- SHA1 82bba8413dfd8d82a7e96385b3c5172337ec2d88
- SHA512 8ff4ff79c56e194126f659f05aa4029e16616d1edcda9ec7bd7fea193c977398443978501dd99d59f75641c7893a936ed4b238f127566cc410e4a9bcd546d24b
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyAnosfZe0p4Ek4niOkl/A04szE87JKTvm:A3kMPezeW4SkZP4sz9Mb
- TLSH T14A854A16F6B84377D0B3C0B9C5D66A5AFB7234465B308ACB034983282F277D19A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2004-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c585-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2004-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4512-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-428.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-425.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0fd-1027.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f0000000187fc-1529.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b95f-1549.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c585-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-428.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-425.dat aspack_v212_v242 behavioral2/files/0x000300000001a0fd-1027.dat aspack_v212_v242 behavioral2/files/0x001f0000000187fc-1529.dat aspack_v212_v242 behavioral2/files/0x000200000001b95f-1549.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4512 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2004 2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4512 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_8932731f96fde27a8c682b615781a717_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2004
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4512
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 88446b95d598ce90849bf952d8e28d97ebbefc2c4c4da8231a20c788a9bc7cdd
- MD5 8932731f96fde27a8c682b615781a717
- SHA1 82bba8413dfd8d82a7e96385b3c5172337ec2d88
- SHA512 8ff4ff79c56e194126f659f05aa4029e16616d1edcda9ec7bd7fea193c977398443978501dd99d59f75641c7893a936ed4b238f127566cc410e4a9bcd546d24b
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyAnosfZe0p4Ek4niOkl/A04szE87JKTvm:A3kMPezeW4SkZP4sz9Mb
- TLSH T14A854A16F6B84377D0B3C0B9C5D66A5AFB7234465B308ACB034983282F277D19A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.1MB
- SHA256 51f209e91d90a4c1433939d5753703361a59f80ac34832f8502f1e958fb3f693
- MD5 30028fd80015ef41b3dc519683edc9a6
- SHA1 82387ee158f42261013bd14f50918ed5e7cf81ff
- SHA512 b4290cb4b231216d5ded143ac5576bf08d509a0e67c007cb40db9d765eb26f0b9616b3e3dbaf59769ea123654dc5012a4e841fdb7d30fed7f3b5c4f7fb48e8c4
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyAnosfZe0p4Ek4niOkl/A04szE87JKTvmvTWaQ:A3kMPezeW4SkZP4sz9Mb6T1Llje
- TLSH T12DA55B16F6B843B2D0B3C079C5D66A5AFB72384607308ACF035993292F277D19A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 2.3MB
- SHA256 99497a68bebf4d977655665ace37cf1d5fb68a646f27316bc8287367cfb39a82
- MD5 0a3773f321b1d2f5794cf87026593ac1
- SHA1 f27d0051db04b8c63e1eb83da7c01be0fdcb00ae
- SHA512 15b11400d1a4c6a057a10b667c752dd296654f0feaead69e65c7f577de89e450ff3b16965231e3f809e5a33255d787bafb1fd88d3eb7b035972de0f0be6c254c
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyAnosfZe0p4Ek4niOkl/A04szE87JKTvmd86nE:A3kMPezeW4SkZP4sz9MbIT9t2
- TLSH T1F7B55B16F6B843A6E0B7C079C9D66A56FB7234461B308ACF035483292F277D19E3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 906d06e0216e72b2ff46a959e659d4f3bf07caabf28eb26589d89333f24c69fa
- MD5 ead981457782b2246179048b12c4b634
- SHA1 1dff3d4e3fd7b36904f5785fa334fb3233708130
- SHA512 2f65da2b71f82550d5e919574291319326bd92eeb92c5c8600a7468f77c73d3dd7cf557dd7a3b46eb977197546e23e85d3cdc90cf383aa1f718121583e14b9bc
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyAnosfZe0p4Ek4niOkl/A04szE87JKTvmy0Lel:A3kMPezeW4SkZP4sz9MbBPji0Aj
- TLSH T1A2B54B16F6B84372D073C0B9C5D6AA9AFA7234465B308ACB0345C72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 1.8MB
- SHA256 cea3ea42cff047ae2ce9921b8ad9c267af64ecbd3632c223c7b844a56cb647c8
- MD5 fa80c2db95986b8a1cbba640355ed478
- SHA1 40b75f1fff0798549dde39563693a8d2495dc1b5
- SHA512 e15a5b548f71c15d076b36fba41f9a870aa388e28115eaca16fc5e2f1d5ee854247e7d2ea3f3ebd23d68d648f18f70f7d810087cd544c51d6ce2324080fa30c6
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyAnosfZe0p4Ek4niOkl/A04szE87JKTvmA+:A3kMPezeW4SkZP4sz9MbI
- TLSH T187954A16F6B84377E0B3C079C5D66A5AFB7234465B308ACB034983282F277D19A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe$
- Size 1.8MB
- SHA256 0c0e8fa31a324f58cac1010e837630b383097c048a93d73721f7b16d494d6c7c
- MD5 52df29d6c76adc72e3e8f80a32926aef
- SHA1 df5e1aa7032f8dafb188d04d093d60a2bd52eaf4
- SHA512 fdd6d6a9df64d9f7108af0a6ab1753331db6772fcb83b174916920ead14b9800ba7fbe8a4ecf40791f05f734d607a078cfc3f4e437310e3ef3c23b4cbec30970
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyAnosfZe0p4Ek4niOkl/A04szE87JKTvmbo:A3kMPezeW4SkZP4sz9Mbt
- TLSH T170954A16F6B84377E0B3C079C5D66A5AFB7234465B308ACB034983282F277D19A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.8MB
- SHA256 48c275fdb94ca6be19ed2cc0d8a36cdce2982f9c877b1b51ec9cf4f368119fa8
- MD5 6343aa102fb0d19636fa4564d63a993d
- SHA1 127b421342c5cae51180efa1d5a1dd5fbb6339a3
- SHA512 ccc0496e1aa63fc0ae240dddf745974063e5b1ddcff915690972e43b8dbaff30601d967ecea54c27f9d15b9ae7dfc91f122d4219b4c35e5f75c0ca84ca4b62b9
- SSDEEP 24576:A3mnXoZjzyaEFo3+aWiauhzyZzyAnosfZe0p4Ek4niOkl/A04szE87JKTvm7wE:A3kMPezeW4SkZP4sz9Mbu
- TLSH T161954A16F6B84377E0B3C079C5D66A5AFB3234565B308ACB034983282F277D19A3A775
- MD5 SHA1 SHA512 SSDEEP TLSH