Analysis
- max time kernel
96s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 13:21
Behavioral task
behavioral1
Sample
2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.8MB
- Sample260804-ql4w2a1fqa
- SHA256 40e1f2135d0c1191b29c63437f9bde8d2dc202848e3adf13413d3bf3cd67085f
- MD5 fdfbfc14b53141a6462ed139f922b30c
- SHA1 d900073e0092d1558b4828e74ba5bb9a2857b1ba
- SHA512 0a64c552f57f6cd3825b440078f5feddc2340f70c76212e41537ac3e67c4f98abe3358ed612717d92813a18ca74a8e0289d63233da4c6696aa7ad38510c69c98
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tv8:A3k03kB56rW3k03kB56rX
- TLSH T1B6957B13E6940FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 16 IoCs
resource yara_rule behavioral1/memory/4820-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000233ae-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5932-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4820-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5932-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000e000000021274-442.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212dd-491.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212e2-489.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002220c-1016.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000218dd-1017.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000703-1546.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001ecad-1926.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000723-1993.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0013000000000723-2090.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001b000000000723-2141.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00020000000233ae-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x000e000000021274-442.dat aspack_v212_v242 behavioral1/files/0x00020000000212dd-491.dat aspack_v212_v242 behavioral1/files/0x00020000000212e2-489.dat aspack_v212_v242 behavioral1/files/0x000200000002220c-1016.dat aspack_v212_v242 behavioral1/files/0x00020000000218dd-1017.dat aspack_v212_v242 behavioral1/files/0x0003000000000703-1546.dat aspack_v212_v242 behavioral1/files/0x000200000001ecad-1926.dat aspack_v212_v242 behavioral1/files/0x0004000000000723-1993.dat aspack_v212_v242 behavioral1/files/0x0013000000000723-2090.dat aspack_v212_v242 behavioral1/files/0x001b000000000723-2141.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5932 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4820 2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5932 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_fdfbfc14b53141a6462ed139f922b30c_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4820
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5932
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.8MB
- SHA256 40e1f2135d0c1191b29c63437f9bde8d2dc202848e3adf13413d3bf3cd67085f
- MD5 fdfbfc14b53141a6462ed139f922b30c
- SHA1 d900073e0092d1558b4828e74ba5bb9a2857b1ba
- SHA512 0a64c552f57f6cd3825b440078f5feddc2340f70c76212e41537ac3e67c4f98abe3358ed612717d92813a18ca74a8e0289d63233da4c6696aa7ad38510c69c98
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tv8:A3k03kB56rW3k03kB56rX
- TLSH T1B6957B13E6940FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 2.2MB
- SHA256 67e1160751cff877c3195e05264bc9b9741d65e0769500ee90840e7ebb052e58
- MD5 50bbb4593e2f6f58c4dc371958111383
- SHA1 c17792bb081abc3619c3d63fc9699f584ae1d149
- SHA512 c0b7a2490c02c76ef6685f31aafe961960cb4393ec5cc61c2fa3de072edf3f631bd9e81b6cdb1547c5f80c3054aff97703eafccf31197aa273e97e0ae8d90b63
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tvd:A3k03kB56rW3k03kB56rXTd9CHKyao
- TLSH T1C3B57C12E7940FE4E02FC1749AA54622EA737C561F2097CF1354AE153F32BD0AA39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
- Size 1.9MB
- SHA256 0ccd2b032004b2c71b2a8b606cfe06321a0ec3cc23302bd2ae75e1f5b88094e6
- MD5 170afcdd3a335309b4d971900eec8a67
- SHA1 740b9902d2f6671dbea6e3d00a1440617593d271
- SHA512 ed6fb25afe4c09c9f417effa953d056bb3ff5c023cc5de15cf9af384db8e51b78590ff87f2b02a0e5d146406405983145f9ee59ab4b247810a20d8cda7494f02
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tv/:A3k03kB56rW3k03kB56rJI
- TLSH T1B7957B03E6940FE8D10F81749A958662EA737C125F2097DF1358AE153F72BC0AB3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.3MB
- SHA256 d565389e54359241e39aa3ef7b774554dc57be2dabd622a2ba15d23f165d4812
- MD5 9c546117ff4a13ca08e6ea888c6da09b
- SHA1 5bae14c7a53e0e265b0e798ba72cce254c37287b
- SHA512 763508b77866b23b96a1395fc8ef5738eaa8f96f64ea3f86f55cfec9701f1aafd9e6cd50aeaf7a8f048de1240a3f0bffa5bde2fa365b9062c038a4471215f0b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5TvQ:A3k03kB56rW3k03kB56rTPji0Aj
- TLSH T11BB55B16E6940FA5D02FC174C5D69666EA733C421F3097CB1354AE283F72BD0AA3A367
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$
- Size 2.0MB
- SHA256 afaef50ab5736ef4457762799adf65c78edd83b35a57659a815bb881f9502c72
- MD5 cae19b7dfa3f9c25d64c14bc06db4c32
- SHA1 f1691029cfc3f6741916f5df3e6d641565009fe8
- SHA512 d42f1d854b21e291f198eebc3acda440ca5a526a1881e866f61f041fc336d7a1882cd584b7db6cbef83036065090acd75abd4cc19f4f56fb956ce671ff7295ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tvx:A3k03kB56rW3k03kB56rZC17IwZ
- TLSH T10AA57C13E6940FA5D11F81749A968662EA737C125F2093CF1358AE153F32BD06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 1.8MB
- SHA256 55997be96cff985c0a13d87baa63a7ead747bd06b518cdf82e649226021cfc07
- MD5 c8cdde5dfe039dae4cca0e5dc6b75bc6
- SHA1 8ca343efa335f1afa5b1a84f173188fa17a2aed6
- SHA512 557aeb9cc783f2c371a89d67f830ed3b217737ba7e3161ab8268e47f23dd76eef730fda55489ea31744d232f581fb6d1a9730fe362bbd7957fe965625d25d909
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tvx:A3k03kB56rW3k03kB56rU
- TLSH T169957B13E6940FA5D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$
- Size 1.9MB
- SHA256 9e3258809b5ea089592e59b4a1a02dc478c9cf325bc85232e4cbd6a5f406293a
- MD5 90cd91778808bc03c03b51418e79fa94
- SHA1 217cca370e0058feba6fba22d4ff2844f3f3d4e0
- SHA512 5a2de4ad3eb161854f4587c4a71a7056ca4f8409da513d35c36f6bcef0cd9784fe42003c61692944734871957970949da24312ca5434fa397c58999f14102b9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tv+:A3k03kB56rW3k03kB56rZ5
- TLSH T129957B03E6940FA4D11FC1749AA58622EA737C065F2097CF2358AE153F72BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 1.8MB
- SHA256 4fccbee992be86a06f9a6343638995ef888eb290ee4e0d967d62292fbe61cdb5
- MD5 2295fd2448f39665d776d5ca86a74ff6
- SHA1 86d61b715529d0f1eef5fb03fb12c5a383356042
- SHA512 d54c7e6fd7ffa2ef054950ce102995a8ee77d3c2cbddb6e440d159426d38fa9d793cf9fca642b852227c32a5854ef047f99cb576cb1bf08018ed6f9d262c1d0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tvh:A3k03kB56rW3k03kB56r0
- TLSH T189957B03E6940FA5D10F81749A958672EA777C425F2093DF2358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$
- Size 2.4MB
- SHA256 6c115d1a9c564542f166a978d766e2866d8bfb845b0e2309095e07f3496e6d6e
- MD5 67549f09697b7e7adf9198df3eed923d
- SHA1 aa3654d3c60673e7adf74f9fb937ed38f84744b9
- SHA512 db23925977492543fbdfc3568d327a4abd9d2a37c2cf4fafb5bd10b59970a994a46a8d8fb4bea0f43b491bc8222df8d9e803a1d5fc8eb8e6cf1a56a3a20a2f66
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tv1:A3k03kB56rW3k03kB56rB8tDZqrKV
- TLSH T178B55A07EA940FE5D11F817496A68672FA737C421F2093CB1354EE2A3F336906A3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.2MB
- SHA256 56a5497dab0b070356d5ae9aab762275a463b238c4bee60abdd9f0199db09ac6
- MD5 0c38b68cf72e04fde604f14dd6519aef
- SHA1 f71d36b8b2579ccecc9a9170cdde84c2c14c5b64
- SHA512 8974d84eb31b91cc64d787ee83b61353aad78ab11598898a4ff11c095e0cfb5e7a3b14fcb201cc2b072a3440c86f582b7f30609d645c56b5d7d8a66261531f30
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5TvJ:A3k03kB56rW3k03kB56reXpiMh
- TLSH T19FB56C03A7D40FA5E16F82309AA54662EA777C515F3093CF2354AE193F71BC0AA39763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 2.0MB
- SHA256 d06faf2c72e37ece1e81999554d063a07d3a10266469453780370396a0f1abaf
- MD5 6b38afd4e96535f149bc68037e415ee9
- SHA1 10399ed93f8a744ca85619b6701abdeee37c8ec2
- SHA512 893c97caaecdc9b2a464ab79b66f49e44d959be1b34a98fba972cdb8cc2e23f7482c12f48642b7cdc28f8245278b9fcce1670621c5639e06a732639ce33f6a60
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tvx:A3k03kB56rW3k03kB56rPi2WH3
- TLSH T12BA58C13E6940FA5D11F81349AA58672EA777C025F2093CF2354AE193F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$
- Size 1.9MB
- SHA256 4d38a92f4d748c758c62d8587a8b580545d640101d5726c7d7ab8d600916877d
- MD5 a21c7cf8f4785153c9ea94559e82983b
- SHA1 6353039563b7592e1f31b406f6899069053cabaa
- SHA512 f1923a1f4fcdc1e566a9c68baf888fe5932b20152260b63885b2d30435c05212494b401d0fbbab410ea74f2ba6dfed4b9805053bff6951067595501fa8fa2aa5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipk5tF3mnXoZ643mnXoZ6iLa5D5Tve:A3k03kB56rW3k03kB56rD
- TLSH T124957C13E7940FA5E11F81749AA58662EA737C021F2193DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH