Analysis
- max time kernel
103s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/08/2026, 05:10
Behavioral task
behavioral1
Sample
2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.5MB
- Sample260806-ftpf7stdrh
- SHA256 01ba3c97fe7b20a65ec7124b7f7efb38a7fe336f839a9a69d2e81df9b0d6817e
- MD5 c50d4fbf659654f016a0c1b1cc0e3b77
- SHA1 2328fc014ade7f2781541b456bba66e9dd8d4ae1
- SHA512 a33da30b3638de0d1e2249d43fbc872aa2be4870a66a3ce3c3005883938c4744794d21acecd3c59993172b1072746de39489fea6c6d8d14e325bd5d4838f0f86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrM:A3k03kHRJSPji0Aj
- TLSH T156658C17F6A402B5D027C1B9C9D6966AFA7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 15 IoCs
resource yara_rule behavioral2/memory/1420-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c54d-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1420-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2200-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-312.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-311.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199b2-572.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000019cf4-1025.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001a0c4-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cca-1278.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000187f0-2018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00070000000171e6-2020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d000000000140-2135.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c56f-2133.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c54d-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-312.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-311.dat aspack_v212_v242 behavioral2/files/0x00030000000199b2-572.dat aspack_v212_v242 behavioral2/files/0x000e000000019cf4-1025.dat aspack_v212_v242 behavioral2/files/0x000600000001a0c4-1053.dat aspack_v212_v242 behavioral2/files/0x0003000000019cca-1278.dat aspack_v212_v242 behavioral2/files/0x00030000000187f0-2018.dat aspack_v212_v242 behavioral2/files/0x00070000000171e6-2020.dat aspack_v212_v242 behavioral2/files/0x000d000000000140-2135.dat aspack_v212_v242 behavioral2/files/0x000c00000001c56f-2133.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2200 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1420 2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2200 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_c50d4fbf659654f016a0c1b1cc0e3b77_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1420
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.5MB
- SHA256 01ba3c97fe7b20a65ec7124b7f7efb38a7fe336f839a9a69d2e81df9b0d6817e
- MD5 c50d4fbf659654f016a0c1b1cc0e3b77
- SHA1 2328fc014ade7f2781541b456bba66e9dd8d4ae1
- SHA512 a33da30b3638de0d1e2249d43fbc872aa2be4870a66a3ce3c3005883938c4744794d21acecd3c59993172b1072746de39489fea6c6d8d14e325bd5d4838f0f86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrM:A3k03kHRJSPji0Aj
- TLSH T156658C17F6A402B5D027C1B9C9D6966AFA7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.0MB
- SHA256 d84474ee8a58e6f516d391a45245d7e5d4182334a0a1de57fa9eed0dcac54b69
- MD5 36ea37d917d01140390b93e9fcf7595b
- SHA1 77e0d0f531c3d95b3c5f3687f2fc68fa949c9a49
- SHA512 cedf6a10bc123ca72e1dd7cede2f0314b3b68955060d13308fc72b4d019f7ddd43fa97d0ef9e347dd7854fa666a59bf8bbabcd376b7c982c1a153a02d272c1da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrMD0Le5ji0hmM:A3k03kHRJSPji0AjKPji0Aj
- TLSH T1BEA57C16F6B44375D033C0B9C5D2A69AEE7134821B3086CB1399C7283F67BE59A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 1.5MB
- SHA256 6f02d2bd7f89efc195996257ef0ddf55b7e40ba059fc7e817c12b9a36ab6a489
- MD5 56b6f85f8fce6a3f69e2709219875491
- SHA1 a6a0b417316c22e9b516d9cc1ebe967d71e608da
- SHA512 03cec629a2695f0a6d3a19e5d619122f7106a1d96e1a4e9926ec164392674f09c7b8b6e5c85fb93cbaacaddba9215244b9911d2ba10dc5b44fae4650638eec34
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrM7T:A3k03kHRJSPji0Aj0
- TLSH T16D758C17F6A402B5D027C1B9C9D6965AEE7138821B3086CF1359C7283F63BD1AB3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe$
- Size 1.5MB
- SHA256 0659078d5908930eb3fa96750761bbc9216129feb0ce80669ad4484b88f1543b
- MD5 6ce5dc151462eb267e709bf9c3a7184c
- SHA1 ab28788a3172e0664505a8be527d815c6d820eb2
- SHA512 a02e9486dc69acd23e4aaf8ac25dbc03633c9351b59f15f34c662c594853e8d771e0218d569a192111cb4395c308845fc5704a7b040989fe1a0afbfc3ab59fa3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrMkw:A3k03kHRJSPji0AjM
- TLSH T1F9757C17F6A402B5D027C1B9C9D6965AEE7138821B3086CF1359C7283F63BD1AB3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 1.5MB
- SHA256 061053be3e86e6f3a6b880f6fdc43cb02fc3fe76e56beb2d220045a850dce535
- MD5 a6d158cd6f1ad20db226e0d101bd143e
- SHA1 2039a154f80f0aa822469990c3d564def087eaf7
- SHA512 abe09730bb6c6e9f610eb0c88c5f8d7a9bdb3d1624e536b9ba330e22b7631c973970ca26f69950cd70095f785a4d0f0d114ae47b40c5be41414ff260e8df3d00
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrMwQ:A3k03kHRJSPji0Aj0
- TLSH T1FE757C17F6A402B5D027C1B9C9D6965AEE7138821B3086CF1359C7283F63BD1AB3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 1.5MB
- SHA256 2c4f29f9e4e55db353d9f6ef7c6aaa562d49db52b83ce53250dd3a1656820fc0
- MD5 ad5c64e03ee5bc8320e6e9abe3d70573
- SHA1 6afa18420a2377587ed55c542c5769e631bc439a
- SHA512 95d3b94e8a020d55b20052d6bb2b32c852c79b858cfb4a75cfb63b695805a246aa6a61d339cfb3de95c136b7ccff83542865050a028038c81a64a6b53a0eda5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrMPF:A3k03kHRJSPji0Ajq
- TLSH T13D756B17F6A402B5D066C074C9D6965AEA713D821B308ADF1358F7282F73BD1AB3A770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.5MB
- SHA256 154e7e214a47cfee9e1f5797869b9c94d906c281b421bc2f34111f9ebb2ba3bc
- MD5 c5533351f7522ad9e308910640a8f449
- SHA1 f67781cab52d213dc61763f249fdc3e1339b86fe
- SHA512 89be0659cce786fcd00c9c55a5c09eb6f39fdb66410eabea6fada4dcf3cc0fd80dd884244e5dfee8b5f75929b154a7dde103ff748bd7f0e9238682282787efcb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrMuwE:A3k03kHRJSPji0Aj7
- TLSH T11C757C17F6A402B5D027C1B8C6D6966AFE7138821B3086CF1359C7282F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$
- Size 1.7MB
- SHA256 b54e0f24b9a1232306935829f58ca7ed405fd5e5ad36180bb38f3482650d6a7a
- MD5 f089813c5a941c13ed669cc8e089be51
- SHA1 755d4539060dc6fd4796bf1636d91cce3c86500b
- SHA512 3ef8261dd0823b2805df3992a961d0e62ba4c729d6702c6fb60962d6127eb242a439104ae2a86280018d520065d5eaa7b869f6ce3af06c74d3231e7f4a5fdafd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrM5WolMk:A3k03kHRJSPji0AjcN
- TLSH T13E854916FA6402B5D026C07485D2965EEA313846D7338ECB13549EEDBFE3BD19A3A370
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe
- Size 1.9MB
- SHA256 e1ab3c3e04485a6454e3f2bce161bfe9eb35ca6b0b8d21f410d0ab5118dde247
- MD5 65e2061aa5f70e5d68b77447244a0bbe
- SHA1 fc4871b4d658d3042bfc727be75b91de1cd6d999
- SHA512 013f3742a3141cd5a57a8929b3048a1df9576e84c343d59eb72dca03a7a1fdca447fbce5194ddc1f26d37d2b2fb52e1d510ffca2148d4d33a5b6e48350a13634
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrMTBOkUhMXcBc:A3k03kHRJSPji0Aj0Uasqc
- TLSH T1DC95AE23F6A40276D062C1B5D9D29666FE7134461B3086CB5398CB2C3F67BD1AB3B361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{61087a79-ac85-455c-934d-1fa22cc64f36}\vcredist_x86.exe$
- Size 2.1MB
- SHA256 ce864936803ac2338c610eff38733376093bf8107569f60acd81b4a242e8a893
- MD5 94b0cbce0e8396991c05adf17963bbfe
- SHA1 d8b4c0fc0f93c7b38f3647bd90e751078ff1c837
- SHA512 d79d469b16da85967bd9c318dd72972747de413ba786c1346465271845f09667a39c3cd4fbbf6de4894428104b77f399f301e0646bc9040eff1e4bcbfc282b0c
- SSDEEP 49152:A3k03kHRJSPji0AjhgZ2HbbZt+jqpQ0CMO:A3k03kHRujotgZ2Hb9t+2xO
- TLSH T193A5AD23F6A00271E072C1B6D9E59626FE3575451730CACB93C8DA283F67AD19B3B361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
- Size 1.5MB
- SHA256 dd67dd168ef15ffd03a82dd4343f9d9ef021173da69f9fee10d6057345a59f53
- MD5 f099dc6c1e2e1604eeb8930d40aac225
- SHA1 f5ab4bfa50898cb99a049b2320c8a57ac95fbc4b
- SHA512 7cd0e689a3f1944573463a7a0ae5e04285fc4235d1d23232145abad51c3f61f8a0bcbad272ad70f00c7b2f179e735bdd6ab2462a2bd549d43dfd4f5d387847ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrMt:A3k03kHRJSPji0Ajq
- TLSH T188757C17FAA402B5D067C1B8C5E6965BEE7138821B3086CF1359C7282F63BD19B3A375
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$
- Size 2.1MB
- SHA256 0313d7d6190a23def8ff254f090169cf94abdc200aaf11e1e6991a9e83cf2611
- MD5 bc5b1b0bea959d3a6b5e60f70429a101
- SHA1 1b4b3a43fd98f12b385d3f11e574a3f9cfe9a000
- SHA512 b74418b2f0e30d378bd0926eaf316bc07cf40ae1c451b3d7177a5aa5fc0d552330a4f7c741fdfb30652971270e0c16453b87c4722c7e1dc9de0eb5c23da1d06e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiKCpJyYGa0Le5ji0hmxNrMzDi7GCsRyaN:A3k03kHRJSPji0Ajw/VLU98PZUeX
- TLSH T141A5BF17FAA402B5D027C0B9C5D6969AEE7138421B3086CF5399C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH