Analysis
- max time kernel
104s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 12:28
Behavioral task
behavioral1
Sample
2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.3MB
- Sample260809-pnhadaxfqf
- SHA256 626818e1b37fad522d145fba9de7af7b003f0f824354a7b5a9729589bfbef5be
- MD5 b049c7f65b196745630891090a7a9f72
- SHA1 9b4406006cbff8ca5d2ea8e5bf103edc9a9a0038
- SHA512 a486b9f5c3f24a6a6d762c9dd87f7b47db6b993c1d014485619e2ec89027eea8574340b59e693f8011d7b10c9e1ba0577bdd6edb084a33a2400f37ac08faf741
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyE:A3k03kHRJ+pYq
- TLSH T1E5558C17F7A445B5D063C1B9CAD2AA66EE713846173097CF1358C3282F23BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 14 IoCs
resource yara_rule behavioral2/memory/3388-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c48a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3388-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3128-28-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4a3-299.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-302.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019965-490.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00190000000198f0-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a5dd-771.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019d6a-1031.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ab81-1025.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019caa-1293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00150000000188ba-1481.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c48a-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x000d00000001c4a3-299.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-302.dat aspack_v212_v242 behavioral2/files/0x0003000000019965-490.dat aspack_v212_v242 behavioral2/files/0x00190000000198f0-492.dat aspack_v212_v242 behavioral2/files/0x000300000001a5dd-771.dat aspack_v212_v242 behavioral2/files/0x0004000000019d6a-1031.dat aspack_v212_v242 behavioral2/files/0x000700000001ab81-1025.dat aspack_v212_v242 behavioral2/files/0x0004000000019caa-1293.dat aspack_v212_v242 behavioral2/files/0x00150000000188ba-1481.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3128 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3388 2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3128 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b049c7f65b196745630891090a7a9f72_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3388
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3128
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.3MB
- SHA256 626818e1b37fad522d145fba9de7af7b003f0f824354a7b5a9729589bfbef5be
- MD5 b049c7f65b196745630891090a7a9f72
- SHA1 9b4406006cbff8ca5d2ea8e5bf103edc9a9a0038
- SHA512 a486b9f5c3f24a6a6d762c9dd87f7b47db6b993c1d014485619e2ec89027eea8574340b59e693f8011d7b10c9e1ba0577bdd6edb084a33a2400f37ac08faf741
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyE:A3k03kHRJ+pYq
- TLSH T1E5558C17F7A445B5D063C1B9CAD2AA66EE713846173097CF1358C3282F23BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$
- Size 1.4MB
- SHA256 aa6eb20d57a95a59f1b8cb498a962dadf1c9ee674c03a870358b0686db78d745
- MD5 691703c7b9dfce1948d6538cd1284b5f
- SHA1 9e85122db3e76cab3e65c248900b794ef5238d6b
- SHA512 4419ec0cab0979c034d74e0c82695259f58be154cdbe3cd75784b70a5b75476e094442c20130ea5e53291d4644b60e29ca03142a886c3cc3218d90ae73fa0bed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyEOfj:A3k03kHRJ+pYq0j
- TLSH T137658D17F7A445B5D023C1B9CAD29A66EE7138461B3097CF1358C3282F63BD1AA3A375
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 3e57f382de412fc5ef8592ce7922b6a7554239c4edbc2971d65440fbb233e2cb
- MD5 296f48bee5fe61fbec627f0516021636
- SHA1 934324011351e198d53e309328a6cf5aa9ed301c
- SHA512 02562877a809f4645fdc9e212ac46b47532a3ce8aaff93f998f98c7f9f90cb8d73ba3a81b1ab33bce2fa4c6109d659325b1767fa6100a166cfb915187753256a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyED0Le5ji0hmxNrM:A3k03kHRJ+pYqjPji0Aj
- TLSH T1C5957C16F6744275D073C0B9C5D2A69AFE7134861B308ACB1389C7283F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 f93f4d1ca6a7698564ea792a323e04ae66d43253e1d67914864d3099adcdad6f
- MD5 ef3cdf7a424540dd8d85204d0e12dfdf
- SHA1 65f81d14f0329a14e03934b4215a39fd812d271e
- SHA512 c09eb5a88c029f4a1f266f92a091aad4f38563e32d4e306fa7b9129cae2a10649f8540632c30ac6566a38f0787cfa68349d48ef266f2bed09f260ab906436b39
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyEbC:A3k03kHRJ+pYq2
- TLSH T10E658D17F6A445B5D063C1B9CAD2AA66FE713846173097CF1358C3282F23BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
- Size 1.4MB
- SHA256 08cb95055ce71bbf58c185c8aa725e13e1f01a17b3709efafa36bd5ccac03986
- MD5 52c17a888284877d248b7f76980495de
- SHA1 70db50c89f0418e1680d26b6cd25ff5cf82e55b5
- SHA512 45b6dcec2568eb9d26808f078e9c80dcf4c5acc9ff136df8e8366c5c5090ad76d1f2e9d11c590da988c8af0a5eded08c61b7a2e173bc82807e3a3304e4e84e88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyEeF:A3k03kHRJ+pYqi
- TLSH T12F658D17F6A445B5D063C1B9CAD2AA66FE713846173097CF1358C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe
- Size 1.4MB
- SHA256 c5800b5c828bf9f4abaa0af02fc8de2753c785eb700b645aa6496da378388e51
- MD5 9fc04c39368a172369eec771d3e77f48
- SHA1 16b4d365b20059f2da0d2f3189d76988c471175c
- SHA512 c7725c120729928a68d32d2b57592743c0d992862d4664cf0d58651bd1e7df627e7fb8ab53d941d432d099cc795f5176d2ee949b686d9ab35a1f14d591086875
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyEMF:A3k03kHRJ+pYqE
- TLSH T132658D17F7A445B5D063C1B9CAD2AA66EE713846173097CF1358C3282F63BD1AA3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$
- Size 1.4MB
- SHA256 ab310829ae98596593d8eebfae8ba4569ed55ea14222c980478daae7e9365c2d
- MD5 dd94012ee800c6dbea2a35acb6d0a072
- SHA1 c4711243c7162e787c74709fce3668f882e66644
- SHA512 2329de351b29b1439b88db2b076f6126eb403c0f10f8ac748f8c13621e7249657d91aa34f1c8bf836965822126fd73cdacefde22aad728ab38615dfe25887d6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyEJI3A:A3k03kHRJ+pYqp5
- TLSH T13F657C13F7A445B5D063C179CAD29A66EE7138461B308BCF1358D2282F73BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
- Size 1.4MB
- SHA256 4221937a62c136067bed01d6336148ffa1f93d0ea8629e2cb9aec0e9458f4081
- MD5 ee7f99cb9d0ff47b31a6ef509ad7dcd1
- SHA1 6589404bccea1567e68605ada72c6557b4111405
- SHA512 87caf98372c4b87da31f9a438f99ddc3538274fce062439a9fecb206b31cb2d975f74660459bdbfc21a084f8deefeedf0414fd5a91d1b8125772ab5b3408e284
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyEm:A3k03kHRJ+pYqG
- TLSH T18F658C17F7A445B5D063C1B8CAD29A66EE7138461B3097CF1359C3282F23BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.9MB
- SHA256 4a541966ab273df9729b4317cbc8a814f7f57fb2efb14526a16ae709082593c4
- MD5 7760996c73a45ef9ea6569182af8e780
- SHA1 dd314565a9c0c193890f8e3d66029621f76e4186
- SHA512 578523a7a1e4322a6c538162231889dcd1e6ef7ee4a6e226c45f173ab9a6eb4fb6d48b9d4dcda9e53ebffeb292283f11ce8b853255cea01d33194288edbbfdf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyER3N+tCn50ChWdN:A3k03kHRJ+pYqx8tDZqrKV
- TLSH T12C956B16EBA446F5D063C178C6E696B6FA7278420B3097CB5354D32D2F237E19E3A720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE
- Size 1.4MB
- SHA256 08eb6ffd700ac928495a15af0673b15f0b7d3d8b59d6ead4dfce5203edfaf4c0
- MD5 8b02b75b3118b7ad9854c75fb13d475d
- SHA1 040ce5245da41f44dafa6875fd33fb190ed8ee1c
- SHA512 7d4e7fb917c427f888960c3fa089f004365f82ca7c1dea7c5520cb5ea7a5e89b887cf841dd7afe4d1424e4bafc129fd6bcaae412fb34d050cab7747f818e02f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyEuwE:A3k03kHRJ+pYqk
- TLSH T134658C17F7A445B5D063C1B8CAD2AA66EE713846173097CF1358C3282F63BD1AA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 1.4MB
- SHA256 83484b11b36b7bbecb4ad55ec2d9762ae933d419017a1497034d26d9ea666001
- MD5 5a4604d153f58fa6bd52176a684637bf
- SHA1 dd04abde84cc6350f84c0a9eff8c8b24af50f117
- SHA512 fbf4d5acbc23a6141c8fa2276721037baa4e00ebf3b48c23c8bcafbe78571c2d8dd54d4cf321b56c7f6b435f30543e030f2d904d22916d53f6b6d9ee27e76468
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRagye5jcAkSYqyEPF:A3k03kHRJ+pYqt
- TLSH T1EE657C13F6A405B5D063C174CAD69A66FA313C861B309ADF1358F7282F337D1AA3A761
- MD5 SHA1 SHA512 SSDEEP TLSH