Analysis
- max time kernel
105s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 19:03
Behavioral task
behavioral1
Sample
2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.5MB
- Sample260802-xqcfxaee35
- SHA256 29db1c54c778f43a722dfc7065dc3820ed0a22f54ead506af18bc07733be812c
- MD5 35de2cd356b2685205422840625e7b48
- SHA1 88f05981ae7459a4b20ef93d761c9a4a8ffecf4f
- SHA512 31248c44de7122f932c5dd401a4837330a40016a0be3e0cd84205d80e6fabe5d7bb20ff977ff3810b262aaacb3113803e37b249d20e2ed7ed1df15b7ad42f9b5
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9Mbj:A3k03kc/vtGfkZcj
- TLSH T105C53A16F6B88332D0B3C075C9D6AB59FA723C810B308ADB1349B72C6E376D59636725
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral2/memory/6052-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4f8-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6052-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4460-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-355.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997d-528.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019975-530.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a0a8-1032.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019def-1264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d0000000188b8-1419.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4f8-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-355.dat aspack_v212_v242 behavioral2/files/0x000300000001997d-528.dat aspack_v212_v242 behavioral2/files/0x0003000000019975-530.dat aspack_v212_v242 behavioral2/files/0x000300000001a0a8-1032.dat aspack_v212_v242 behavioral2/files/0x0003000000019def-1264.dat aspack_v212_v242 behavioral2/files/0x000d0000000188b8-1419.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4460 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6052 2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4460 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_35de2cd356b2685205422840625e7b48_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6052
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.5MB
- SHA256 29db1c54c778f43a722dfc7065dc3820ed0a22f54ead506af18bc07733be812c
- MD5 35de2cd356b2685205422840625e7b48
- SHA1 88f05981ae7459a4b20ef93d761c9a4a8ffecf4f
- SHA512 31248c44de7122f932c5dd401a4837330a40016a0be3e0cd84205d80e6fabe5d7bb20ff977ff3810b262aaacb3113803e37b249d20e2ed7ed1df15b7ad42f9b5
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9Mbj:A3k03kc/vtGfkZcj
- TLSH T105C53A16F6B88332D0B3C075C9D6AB59FA723C810B308ADB1349B72C6E376D59636725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$
- Size 2.8MB
- SHA256 46221ea28d61fc340a7e6522d94ce0516056edd2533f8dbf4739ef4e98d2f648
- MD5 716b34e4f9e77fb1b056939bc00467ad
- SHA1 b6788f7321631f334d72722b384a9b1d4a7cb364
- SHA512 2cb0a414924a750c7e65001bf3abad186df34db20299f09250834085cf79b6fd8e5f65f97ed5cc620408d11d24213f3562fa9f79b66bce79f8ecbfc8148f28df
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9MbQeS3:A3k03kc/vtGfkZcpI
- TLSH T1DAD54B16F6B88732E0B3C079C9D6AB59FA723C410B308ADB1345B72C6E336D59636725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.0MB
- SHA256 04354de5bbaaee111542251153d115042dadf09a5a9ec9faad88dc4822821bc0
- MD5 3e9c20318fdc39e2d2e93cfaea768f43
- SHA1 bc84e6fbc518bb9adf75ddb5e1ad2b89e3ad4422
- SHA512 5fbdc57f6fa7c162d1088acc25aa1da889f6555b5ecd63eba4f1ad688e6222433f540317b6a68eb81b862f2b4258977f4f9dcd082fcad68d5e543f24a9d146e1
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9MbfPji0Aj:A3k03kc/vtGfkZcXjo
- TLSH T171E52A16F6B88332D0B3C075C9D6AA99FA713C810B308ADB1349B72C6E376D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 2.5MB
- SHA256 330b44d247718718b1f38681d1c756435f1f45c40075d0979cc9f852f4e7c643
- MD5 e1f2a33346e78bfa603190f893c8ae2b
- SHA1 fcd4c75f93fabb6537a17b77fe39bcd3d23ad64b
- SHA512 ce76a8b26bf956ed48b0ed10a9774a654f8075db41eaf5f9d3d6de5ee2dc892275e8924b8e1e7d3cf31b1fdc0adc4ad8e6189e956260ec390d04c3109427f4c5
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9Mb8:A3k03kc/vtGfkZc8
- TLSH T1FBC53A16F6B88332D0B3C075C9D6AA59FA723C810B308ADB1349B72C6E376D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 2.5MB
- SHA256 fa68208e84907117a918c23695b3ce037bf07c6b95e3545524f9ec8195615691
- MD5 df10c2ffc76fc48ae49be3a1a592179c
- SHA1 1876a5eb23a30910d3a1ff52a26c47fd7b98c46f
- SHA512 285bd38ce24e1b1f0cd187cb8079223fdf77eeeaf391764ed702952c62d77d37bfb129cebfef7589ef8ae5af332b7a406cad6716e951dbbb51c5f3c35fa6551a
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9Mb9:A3k03kc/vtGfkZc9
- TLSH T132C53A16F6B88332D0B3C075C9D6AA59FA723C810B308ADB1349B72C6E376D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$
- Size 2.5MB
- SHA256 f946e8abb1ea91d95d29be1708a256f01c61e454b27e4f9374fcba44aac1fdde
- MD5 6304dd18d9026a800059b653e314dc95
- SHA1 5e076f2e6d26cae1656fe5c577f404698b4e8d86
- SHA512 9ea45ab6c67e841825a57fa95cdc952e3eb210f12a130562d42f06225326c37a39c5c5e6eef6a0d0756b6233e3a66be4c1d9300736ac2d04b4832df65e841b42
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9Mbb:A3k03kc/vtGfkZcb
- TLSH T1FDC53A16F6B88332D0B3C075C9D6AA59FA723C810B308ADB1349B72C6E376D59636735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 2.5MB
- SHA256 72ac20e5ae3388a975cebb822f7221c24aa161bd20f9587530d4a26b7b1461ad
- MD5 97244adbc728f724e50d4bbe1768b06e
- SHA1 0b24eaa408c8513a6599347d70b6adf1f29ea206
- SHA512 670c29bfd4933454ff811acd5f9c5ba3913419fb252083d5955397148cec81914eb8ef6e0a1a9bd4654f8b79e677651a6f89ccd089152a94141a72fb72aa9d65
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9MbI:A3k03kc/vtGfkZcI
- TLSH T196C53B16F6B88332D0B3C075C9D6AA95FA723C810B308ADB1349F72C6E376D59636725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.6MB
- SHA256 d46e36b6c33f7fd63d14efe017b505422fa5dbd3d1589a74472ff6149f00bf5d
- MD5 2eee120e356e307ef185398749b60d2d
- SHA1 93e9ea01d09a69c8685ce76b6eacb7791aebf3da
- SHA512 d7e48305e67376109cffff7d582ec58b232c87d3169a0f1c769d446e879912fb7e61ecef35f81a8ae40ef1dbddbca4fbc5333c84de54617aa067229d40ae693c
- SSDEEP 49152:A3k03kD4U2v+uqJtb2IHeW4SkZP4sz9Mbh:A3k03kc/vtGfkZch
- TLSH T1BFC52916F6B88332D0B3C075CDD6AA95FA723C810B308ADB1349B72C6E376D59636725
- MD5 SHA1 SHA512 SSDEEP TLSH