Analysis
- max time kernel
107s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 15:44
Behavioral task
behavioral1
Sample
2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260809-s6nrnatwcv
- SHA256 0c670f3f9b7e94b631e3afd7cd7944a6738ad70763a59f277889566794697514
- MD5 f15875bdfcd4d1da19277d114a62605f
- SHA1 908d97f654951b0e4ca7f665edbe55bb85195174
- SHA512 0f912d474773bed244dcf198fd8cb6ad29fafb85e5a85779bf9b46fb5b64ae3ecbc68a729742b3578e2c3ca77562b2f8eb91eb686b51566c62298ba3dfadc72a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55E87hv5jcAkSYqyEomD5TvinrmVD5TvinrmC:A3k03kHRJgpYqr56ru56rX
- TLSH T15B754916F6684FA5D06FC178C9929666EA733C454F3087CB1354AE293F336D09A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/6052-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c568-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6052-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2468-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ba83-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001aa84-848.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c96-1289.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00190000000187f4-1502.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a00-1501.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c568-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c2-11.dat aspack_v212_v242 behavioral2/files/0x000300000001ba83-252.dat aspack_v212_v242 behavioral2/files/0x000300000001aa84-848.dat aspack_v212_v242 behavioral2/files/0x0003000000019c96-1289.dat aspack_v212_v242 behavioral2/files/0x00190000000187f4-1502.dat aspack_v212_v242 behavioral2/files/0x0004000000018a00-1501.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2468 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6052 2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2468 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_f15875bdfcd4d1da19277d114a62605f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6052
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2468
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 0c670f3f9b7e94b631e3afd7cd7944a6738ad70763a59f277889566794697514
- MD5 f15875bdfcd4d1da19277d114a62605f
- SHA1 908d97f654951b0e4ca7f665edbe55bb85195174
- SHA512 0f912d474773bed244dcf198fd8cb6ad29fafb85e5a85779bf9b46fb5b64ae3ecbc68a729742b3578e2c3ca77562b2f8eb91eb686b51566c62298ba3dfadc72a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55E87hv5jcAkSYqyEomD5TvinrmVD5TvinrmC:A3k03kHRJgpYqr56ru56rX
- TLSH T15B754916F6684FA5D06FC178C9929666EA733C454F3087CB1354AE293F336D09A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe
- Size 2.0MB
- SHA256 b287ee3f65daa1ee6a2515ec161c1df1c71670fc23c76cc7ba0fff827014681d
- MD5 93f8096c3b44b24b652b76df9734184e
- SHA1 4d4d9c1543c5bd6e7d6291fedbcadf17e006ae7b
- SHA512 c8c25a2dc3326b15ac674c0edebd1e0997dc3c67305df7a0d7c0c2fc1c6c3c71f53d3147972930e10cf4f1ba42c72f9f19fe925f263458c2cd178cd207a0d250
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55E87hv5jcAkSYqyEomD5TvinrmVD5TvinrmKiTP:A3k03kHRJgpYqr56ru56rWTAGOme2
- TLSH T12EA55B12B6944F75E06FC175CAA69666EA733C514F3087CF1384AE293F326D09A39723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$
- Size 2.0MB
- SHA256 f45aebc54395aca93d28651027081b07d042821abc06e1b558d8b149dab54621
- MD5 55450e59ea32b19eff950adfa33a62b2
- SHA1 82a2cb049b7d6abbb718568b39727e04c89ff2df
- SHA512 31ec4a38260a3118ea1e9d768c51bb3d4dba24fd900b6424827db4743b55e254bf3bc4265579e92a3358e69e72c6c8415ceba4661eb3c25f3cae4a00692e54d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55E87hv5jcAkSYqyEomD5TvinrmVD5TvinrmSKh0:A3k03kHRJgpYqr56ru56rDK0DZT88fG2
- TLSH T1A3A55A12F6544FB5D06FC174CA92966AEA733C414F2087CB1394AE293F336D19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 72abe2b1ace4ce2b2e658cb1bd5e4aa172fe1970c920c67853e167ca9080ed43
- MD5 7e3084d6282e874b67e3065d150c07d5
- SHA1 284d5de46a7b290188f3b543e4c2c49d6bdc9af2
- SHA512 7dfaf55d25ec895714c0eeec55927020ea9fbfd77293e767f5c481c15e274ec88f6acfe439024c5dcd8c80a7ea44c1b75931fefac846e03b4c1df86809f75374
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55E87hv5jcAkSYqyEomD5TvinrmVD5TvinrmC0Lu:A3k03kHRJgpYqr56ru56rTPji0Aj
- TLSH T1ECA53916F6644F65D06FC079C5D2969AEA733C424F3087CB1385AE283F276D19A3A723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 1.6MB
- SHA256 4ad5d3c9a9c4b01ee6a9c7983a246c8d48de88d0e01cc7c41851b3c1b0d2c9be
- MD5 b7172d669f85f02eafb7915c6e23b6b6
- SHA1 e47dbdeff448140d9ed8f00e33037432d204d5c3
- SHA512 c650b933a15e9deee07acc9c0ddee31634ba5ce56063f21c69e5a0d75a70affd1f86b49303b1c677a2486adb97d95cff77ce8fc8a970af6f71128f3935e97222
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55E87hv5jcAkSYqyEomD5TvinrmVD5Tvinrml6:A3k03kHRJgpYqr56ru56r7
- TLSH T137754916F6684FA5D06FC178C5929666EA733C464F2087CB1354AE293F337D09A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$
- Size 1.7MB
- SHA256 102c4eade7da4215cbe1ff05bfe70dffe27895c915d5c451d9b77dab16249892
- MD5 a7e09281281f3d30bc05a4117ae31ae8
- SHA1 598548329559ddaaf04ece62a36f8eef7aaf489e
- SHA512 ff18d0f59e669f5d406c9f97e3f739edc8a063d88a530a783a67cd8fea93a0308764d30c240744a7c63212a16d1b37bd925eddbcf81298bc746d7a671a51f7f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55E87hv5jcAkSYqyEomD5TvinrmVD5TvinrmgF:A3k03kHRJgpYqr56ru56r9
- TLSH T198853916E6984FA5D06FC174C9929666EA333C410F209BDB1354BF293F336D0AA39763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msoev.exe
- Size 1.7MB
- SHA256 5a1e1c3a235170e65549941a21db4858320882c20efae49a8e5aa147eb815901
- MD5 9d9b443f8fd618673e1af3c7b296390f
- SHA1 844ed3c5ddf8154f2350819ce47969c80ee82898
- SHA512 3f13aba02849527a080b59e8aea98a75734f593bbb789d82c856840d27194326d07f058386d29fcb673fce404c5a2fc9a20a86cbb70dae5ac2124450d689c5ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCN55E87hv5jcAkSYqyEomD5TvinrmVD5TvinrmZnlR:A3k03kHRJgpYqr56ru56rC
- TLSH T148854A16F6684FA5D02FC178C5929666EA337C454F2087CB1354AE293F337E0AA39763
- MD5 SHA1 SHA512 SSDEEP TLSH