Analysis
- max time kernel
96s - max time network
133s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
01/08/2026, 14:13
Behavioral task
behavioral1
Sample
2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260801-rjsxesbf69
- SHA256 24793d76928dfa922b9eb708cf435705c7200fd60bf15c2ea3c22de37628ab6e
- MD5 2726340719b26f35db6c0ee150466b68
- SHA1 1bcbe9137697fe77987fa48d62675a108946a235
- SHA512 7037c7ba91de93fbbae6ae9f1be30df0b576718bb5ff6a4b18bd85b3f18b61f774442af9b306ff390ce0b7b28ae8b2d9e5bebeed2ade6df013836fbdf2a1c91b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5TvinrmC:A3k03kHRJ5pYq+56rX
- TLSH T18F755B16F6644BA5D06BC178C6D29666EA733C461F3087CF1354DE283F23BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 16 IoCs
resource yara_rule behavioral1/memory/5008-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024463-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1640-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5008-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1640-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002352d-165.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202fd-252.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ac-402.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a0000000212a3-403.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002153a-634.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021651-1284.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001e809-1385.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024488-1605.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00100000000006d1-2078.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a000000000731-2126.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024463-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x000200000002352d-165.dat aspack_v212_v242 behavioral1/files/0x00030000000202fd-252.dat aspack_v212_v242 behavioral1/files/0x00020000000212ac-402.dat aspack_v212_v242 behavioral1/files/0x000a0000000212a3-403.dat aspack_v212_v242 behavioral1/files/0x000200000002153a-634.dat aspack_v212_v242 behavioral1/files/0x0002000000021651-1284.dat aspack_v212_v242 behavioral1/files/0x001400000001e809-1385.dat aspack_v212_v242 behavioral1/files/0x0007000000024488-1605.dat aspack_v212_v242 behavioral1/files/0x00100000000006d1-2078.dat aspack_v212_v242 behavioral1/files/0x000a000000000731-2126.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1640 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5008 2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1640 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_2726340719b26f35db6c0ee150466b68_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5008
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1640
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 24793d76928dfa922b9eb708cf435705c7200fd60bf15c2ea3c22de37628ab6e
- MD5 2726340719b26f35db6c0ee150466b68
- SHA1 1bcbe9137697fe77987fa48d62675a108946a235
- SHA512 7037c7ba91de93fbbae6ae9f1be30df0b576718bb5ff6a4b18bd85b3f18b61f774442af9b306ff390ce0b7b28ae8b2d9e5bebeed2ade6df013836fbdf2a1c91b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5TvinrmC:A3k03kHRJ5pYq+56rX
- TLSH T18F755B16F6644BA5D06BC178C6D29666EA733C461F3087CF1354DE283F23BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.8MB
- SHA256 42c782636d7635a4cddce351c029beb2eabc0d01afe035f4914a6516d91e1856
- MD5 41c64f2b6b2edd04959782165f9fa093
- SHA1 5b8b2ab1f7750409af5955a4f28411a9197bc3d1
- SHA512 14e7b283d0d4431ab17e89f733c344f6764b97eed403168a46dca214a21096b67f365a3b9b1d898fcc6f137639cc297796082c207c330f9f25e15f2cc15727dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5Tvinrmc3UNUX:A3k03kHRJ5pYq+56rtUN+Eir
- TLSH T1D6954916EA684EE5D02BC17889D29656EA737C510F3087CB13549B2D3F377D0AE3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$
- Size 1.6MB
- SHA256 f263bb3733cc1d512dddcc23a7e4b1f65b0eb0a762be726eafbe8eaecdd77c17
- MD5 1ad773c9d35243779790ce12ceb2ab84
- SHA1 d65f6f9c6f5964af1c28b274159eab117dd17b89
- SHA512 fbf5132225b7595c6548fda7e92cc4c1b7b7587b97d575f10deaaa320229223eff3076d26e934e3412a1d4a930a12b9c30b94a2e05a37eea8ce3f87be603c14c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5Tvinrm+TjE:A3k03kHRJ5pYq+56rNw
- TLSH T17F856B16F6A44AA5D02BC178C5D29A66EB733C461F3097CF13549E283F237D09E3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 63f824a96e3c7e3db7e92e9d20c34eb1cdf50b07e1cb7029b8759621f8a1d54c
- MD5 6912acc2550adc5e08f6d5e21f98f40f
- SHA1 272c9a2078e0aba7211f71ab1a7607735f849415
- SHA512 9f2d6e16a82a26e497c036936ed17749f6845e173a0822b169b7d1453ae1c7091f16f78ae4a6fd5931e17fd313ddcafa08ebf60e461593feddedb6954acdabc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5TvinrmC0Le5b:A3k03kHRJ5pYq+56rTPji0Aj
- TLSH T12AA55A16F6644B75D07BC0B9C5D2969AEA723C421F3087CB1345DB283F27BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.7MB
- SHA256 72e5d25cc9e371c1a38c0458694e210352361793c7f8a252384724aecb81a560
- MD5 7a544eb9a3034d5117776737140f8507
- SHA1 c09a4ddc88baf1b3768f1d5d3d938e83626cef55
- SHA512 34d60dc8d94f687e140ce514725511706f1f021330813fb5f13d87765282b4ebd1a9280560724fac3669d2dcc4c168bbad24aaf2089778b233b8a2f3ea6b6d03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5TvinrmrD:A3k03kHRJ5pYq+56rU
- TLSH T1D8853916E6644AA5D02FC174C7929656FA333C464FA087CB13D4EA3D3F326D09AB9363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe$
- Size 1.8MB
- SHA256 96fbaa1e0cbe8f75cefc68a3641e7a5d1b28dc5019fe469cd1427c8325601e31
- MD5 43c1cf61fa4a63960e70efa2e3cd9bf4
- SHA1 5458ba935999b523d886afc31fa5fd98ee0fa22a
- SHA512 ae3331c4337865ffec0f2d133c3927074b7b646fda6ed851a4d50b669fcdb0ad6ba84668652a9837783441a792f3373eb4892cc3fd994ae3c64aa807b724f95d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5Tvinrm4TWaL7:A3k03kHRJ5pYq+56rrT1LljB
- TLSH T149957C16F6644AB5D06BC178C9D29A56EA733C460F3087CF1354AE293F337D09A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 1.6MB
- SHA256 06672f923876199156f3d53952d1928291157fafb2a8f126bd118d0d8c470ff1
- MD5 352c7d2b939e505568d065ae6d651880
- SHA1 0b51dcc923aa0c720b6f145ca47d06a624d8f41b
- SHA512 b5beb7a06b37e6663056ffe765db4b9f642c421673102056af8dbfcec3ca3b2fa9b4fc02fd58f2eea2ba5317bc68060bfe35f15df423360983012c36b7b8b38c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5Tvinrm7j:A3k03kHRJ5pYq+56rw
- TLSH T156756B16F6644BA5D06BC178C6D29666EA733C461F3087CF1354DE283F237D19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe$
- Size 1.6MB
- SHA256 97205ed9991c36a6a9be42655345a7c60c00bc361ca77ada52f524183e3a7611
- MD5 33705e7b428935740975587cce19581a
- SHA1 68d62e92ab704f17a28eb84fb9c01a98feaa7bef
- SHA512 7b765474572c5871b1f2fb3534bd5dfcae70e4a1595e57f3a65905251d86c90bf8ba554d0c5a5cf2eef3600d7e4153ee099a63cd1cedfb89240f880b06678a50
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5Tvinrmqu:A3k03kHRJ5pYq+56r+
- TLSH T175756B16F6644BA5D06BC178C6D29666EA733C461F3087CF1354DE283F23BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe$
- Size 1.6MB
- SHA256 27034dbf067b35b73e553601c731e8a3a2d8a01306fad4b426228d612187ee91
- MD5 cb0d5d9e50a997f55fb8c3024bc8be3e
- SHA1 c96cbaa9f19ec599b6408cb8cf739481b0257425
- SHA512 ed78f0c7cc375c64627f33affe7768087d62601cc22824ab5142d571ed86b68bbd41387bd4e9dc6af146d2e0309c2e3070e4c39275f79d413681ced578646972
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5TvinrmzY:A3k03kHRJ5pYq+56rj
- TLSH T14D756B16F6644BA5D06BC178C6D29666EA733C461F3087CF1354DE283F23BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 1.6MB
- SHA256 051dc7f64f749a6a6c3039998eb0c14e6c5a79d402f006daa05e358f330485af
- MD5 d54a5a8e90cd28eb435573f906243c04
- SHA1 56bb657710074771e70aa6736362add409212e1c
- SHA512 d61de7fafeeba019f8ccf2b3e8e3e5baecca1752635fb3e9f375515269447ab2fb99381e5f233a66a7f6b508c540dbeea8045bb2d222bb6085b9650c14f7ab89
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5TvinrmgF:A3k03kHRJ5pYq+56r9
- TLSH T15D754A16E6A44BA5D06BC174C9D69656EA333C420F208BDF1354BF293F337D0AA39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.8MB
- SHA256 f8e934233d10e4ca0ea9b62b736628eed46b77fb43509db98bf1dcb504e975d7
- MD5 7b7e7f7654944bbe199e16a5528dadec
- SHA1 24c5adcbe80da8e7c82df1876159b2c14899b8e3
- SHA512 338f76e5f786173b9d034839940b2a7719987848df7d001160227f8c577662bb0679d0fa521e36d9db137ca5e85168af79eaa489a281f4633922b8fce39c0525
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5TvinrmQV+PAm:A3k03kHRJ5pYq+56rPi2WH3
- TLSH T182856C12F6A44AB5D06BC174C9D69666EA333C424F3087CF1354AE293F637D19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$
- Size 1.5MB
- SHA256 8ef4a647b271880b00761fc864a66fd495c8296f5dd674670293369b18059833
- MD5 eb1c09405443ce43d4f04f5c64f98f45
- SHA1 6f13a63c3523e8e350fa185fa1ca460978a4ce9f
- SHA512 ed92193ca35f21d74e1e3664bca1721857eec9dba947ae5694e0024600e00e53c94f0fc1f822e2109ce261c4f7ffbf79dcdbc20615fe251735f085d657eca75f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEB2Ki5jcAkSYqyEoD5TvinrmhBl:A3k03kHRJ5pYq+56r
- TLSH T151755B16F6644BA5D06BC178C6D29666EA733C461F3087CF1354DE283F23BD19A3A362
- MD5 SHA1 SHA512 SSDEEP TLSH