Analysis
- max time kernel
96s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/08/2026, 19:01
Behavioral task
behavioral1
Sample
2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.7MB
- Sample260805-xpjhtsem2v
- SHA256 aad81ae155b7f2ed250a302216eaad935e95f26e3336388d012b196f58754bd7
- MD5 28a97acb259952d02b094356999c4d65
- SHA1 448c66066ec3ac30d432265e80fd3bf2d2dfdb29
- SHA512 813826861b45254e07f158d9a8677b6f780923133aa8789a633dce1820126931c266ae093f84f472d76ce0ac2a0a5c0c0013fbdea67886219e8c1d298664569a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9EP6Ze0p4Ek4niOkl/A04szE87JN:A3k03kB56rSeW4SkZP4sz9Mb
- TLSH T165853A16F6784B62D07BC0B9C5D6AA5AFA333C455F3087CB03459B283F276D1963A326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/3644-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024507-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4460-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3644-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4460-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000001f2b8-119.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024513-644.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021452-645.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000216fc-748.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000225db-1193.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001600000002029e-1536.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024507-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x000700000001f2b8-119.dat aspack_v212_v242 behavioral1/files/0x0007000000024513-644.dat aspack_v212_v242 behavioral1/files/0x0002000000021452-645.dat aspack_v212_v242 behavioral1/files/0x00030000000216fc-748.dat aspack_v212_v242 behavioral1/files/0x00020000000225db-1193.dat aspack_v212_v242 behavioral1/files/0x001600000002029e-1536.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4460 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3644 2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4460 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_28a97acb259952d02b094356999c4d65_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3644
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4460
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.7MB
- SHA256 aad81ae155b7f2ed250a302216eaad935e95f26e3336388d012b196f58754bd7
- MD5 28a97acb259952d02b094356999c4d65
- SHA1 448c66066ec3ac30d432265e80fd3bf2d2dfdb29
- SHA512 813826861b45254e07f158d9a8677b6f780923133aa8789a633dce1820126931c266ae093f84f472d76ce0ac2a0a5c0c0013fbdea67886219e8c1d298664569a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9EP6Ze0p4Ek4niOkl/A04szE87JN:A3k03kB56rSeW4SkZP4sz9Mb
- TLSH T165853A16F6784B62D07BC0B9C5D6AA5AFA333C455F3087CB03459B283F276D1963A326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 2.2MB
- SHA256 001734235ed465263ec5ccb720b69c5ae3e0b6f527a74fc73252d053f0fad0a6
- MD5 e5c0eee66aa9bc2c7fad9ff88b44192f
- SHA1 b22ed22d4e857110243af4e7c287c02a96bdfd18
- SHA512 c0c6ee612a6401aa91eb1f810ee258240dbb8524b34e45d9928555978709493b1424c577aa2bf79db2efa49973f30e4c31d8cf7f791865e250410b2a2f1bd467
- SSDEEP 49152:A3k03kB56rSeW4SkZP4sz9MbVTd9CHKyao:A3k03kCrKfkZctCqo
- TLSH T103A53A16F6B84B62E07BC175C5D6AA56FA733C451F308BCB03449B283F236D19A39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.2MB
- SHA256 e800a150d02db961ed9ef300458c26fdbae18fed0f837d369f3811b7859e55ce
- MD5 d56e25f75b62d30a1f5d8561a90b72e5
- SHA1 232000c8b4c3a787ca82209024de886d0152df21
- SHA512 be4f908807c0e7e0030415b0138b7c7cdebe609d9806c882e9bb9b54a2e0aa2182dedfe71f14961431135ba4c1a45dbb55751e28a66436bee2c09c66f2be7c3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9EP6Ze0p4Ek4niOkl/A04szE87JM:A3k03kB56rSeW4SkZP4sz9MbBPji0Aj
- TLSH T1E2B52A16F6784722D077C0B9C5D6AA9AFA3238451F308BCB0345DB283F276D5963A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$
- Size 1.8MB
- SHA256 ebecb7d09f76ad1d85061a007a940591f33b6f03c78affc14eaa90f6cddcccd4
- MD5 6abe16570381563b4a26c0ebdf4f04ad
- SHA1 f9a496cd91b0a2e7da8c0aa4da10eabd1e962c6c
- SHA512 50a53dcf3999665332beb9d0d7c807d993e0e1fcdb86d1d0bc5d5e86c81286df49c816b9a6cb429fc560c322a0229a0efffb2282ac76d90679bcfeb5f669156d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9EP6Ze0p4Ek4niOkl/A04szE87JN:A3k03kB56rSeW4SkZP4sz9Mbq
- TLSH T19F951716E6684B62D06FC075C7966A56FA333C451FA087CB0284EB3C3F276D19A79327
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
- Size 1.7MB
- SHA256 83918e655a192c8c8c2cca78a3ed4b782b5bfa5178b4be658b30fe8c4c89282c
- MD5 1d716375ea0da1b6550f233f1ff25436
- SHA1 04b07355c7f12dff98c2d6fe24889b29a09d1008
- SHA512 f21364a0f598e907653a227e6f76ef549a960eae4c0efcf85aca59c945fc1ef2e634ae37e0e5a72198a78010e26d12814c8db490e558f01eb44fbedabea80daa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9EP6Ze0p4Ek4niOkl/A04szE87Jt:A3k03kB56rSeW4SkZP4sz9Mb+
- TLSH T15E853A16F6784B62D07BC0B9C5D6AA56FA333C455F3087CB03459B283F276D1963A32A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe$
- Size 1.8MB
- SHA256 9ddb3f1f6d1e2c048c9c6390ffd71fb44bc89956cd52b26f5c7481868baa63e5
- MD5 d3a5e690c651f486166f5f12849cb87a
- SHA1 e2493e6b657cca049efc988fdf7da7969d664bbe
- SHA512 0c1fb88e225b290ea3d914ad111a3f436c3f8d3e39af07e9ebbbf50a18f6236994a11802e0d52e21f3a367f67f725504bf9f6e024533c9b44a2bf084c303f8e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9EP6Ze0p4Ek4niOkl/A04szE87Jq:A3k03kB56rSeW4SkZP4sz9MbF
- TLSH T137952916F6B84B62D07BC079C5D6AA56FA333C461F308BCB03459B283F276D19639726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$
- Size 2.2MB
- SHA256 e5cdfd4d75465fb19427bb6fe4eb9b7b49bebc337b40dcc1e75d7d4a8212bf5a
- MD5 f80b852c0911ae6f03da686a4d7b3b93
- SHA1 f6cb1392a5783c9456f5d131f5758757fcbae776
- SHA512 2525467b9cdf1fd081c6d7e9867311d54390ddd45e7121db36549951b027f2df5f87f6751ea4655f2f3124f5430e78e6e98d7545070f569eb7f731c28558c2de
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9EP6Ze0p4Ek4niOkl/A04szE87J6:A3k03kB56rSeW4SkZP4sz9Mb9UOlk09
- TLSH T179B54B16F6788BA2D07BC078C5D69A55FA323C410F3087CB5359DB283F276D19A39B26
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
- Size 1.8MB
- SHA256 3390be2fc1b924cf14006da515fe4fef7ca27902daf65b97df5e330c884b7071
- MD5 e21a4af5870d2af74c8d131f6bb56f1d
- SHA1 872eb3d2021cbbd27d4b3568bd2d37e09858645c
- SHA512 5cc6ef4f2efa66ce0d22466cc0451cc5d6b5cbbd36d864cf11a8ce1a4ddb6e4dabf677cf61c1a9cf15f754c2578d192116c7a28fb0234a2f75c49356d686da00
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9EP6Ze0p4Ek4niOkl/A04szE87Jm:A3k03kB56rSeW4SkZP4sz9Mbq+
- TLSH T1CC853A16F6784B62D07BC0B9C5D6AA66FA333C461F3087CB03459B283E277D59639326
- MD5 SHA1 SHA512 SSDEEP TLSH