Analysis
- max time kernel
100s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 16:36
Behavioral task
behavioral1
Sample
2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260809-t37k2aak3w
- SHA256 31bf0af987473cfc456004f6cb0968e01690eeb70e7ded7238a208e3cfb90919
- MD5 72845b5cca46b5b3a1e13625eb8bce96
- SHA1 9590dabb20d06fa42495bae84f1e23d6ef05bf0e
- SHA512 b715fd1799157f61b02bbc1fdd0fbb0834bf43dbb16a64044f51d118e95a088ff67714af744827e6a783e0e1f142b5b31eeb975952a841a62b753768a2c90ef0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEx0e5jcAkSYqyE3YTqMi8CtBd2QH7:A3k03kHRJcpYqOqJtb2I
- TLSH T18E956C16F6644275D073C0B9C5D2AA9AFE3238425B308ACF1389D7282F277D5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/6128-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5e4-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000008f2c-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6128-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6044-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019929-454.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-456.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x005c000000019b0e-1291.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5e4-6.dat aspack_v212_v242 behavioral2/files/0x0003000000008f2c-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-270.dat aspack_v212_v242 behavioral2/files/0x0003000000019929-454.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-456.dat aspack_v212_v242 behavioral2/files/0x005c000000019b0e-1291.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6044 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe - Drops file in Windows directory 21 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6128 2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 6044 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_72845b5cca46b5b3a1e13625eb8bce96_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6128
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6044
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 31bf0af987473cfc456004f6cb0968e01690eeb70e7ded7238a208e3cfb90919
- MD5 72845b5cca46b5b3a1e13625eb8bce96
- SHA1 9590dabb20d06fa42495bae84f1e23d6ef05bf0e
- SHA512 b715fd1799157f61b02bbc1fdd0fbb0834bf43dbb16a64044f51d118e95a088ff67714af744827e6a783e0e1f142b5b31eeb975952a841a62b753768a2c90ef0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEx0e5jcAkSYqyE3YTqMi8CtBd2QH7:A3k03kHRJcpYqOqJtb2I
- TLSH T18E956C16F6644275D073C0B9C5D2AA9AFE3238425B308ACF1389D7282F277D5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 7846fe8dd5edb0e3b5dadec47fa1e58217b8102dc76c03d6f6c359e13fb4bb55
- MD5 23481eaa88cac3144c1de7c8edc1ebd3
- SHA1 f848d369c023c0992bf1822f9aa0c42de85c890b
- SHA512 64d9436da03c1215ac61ec1c077e1d79d38aabc3b3fe63e0b573e878491566494fad49b5ecff058e90616f2cda3ad37700c4e802a428d054114cd7229d714c9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEx0e5jcAkSYqyE3YTqMi8CtBd2QHn:A3k03kHRJcpYqOqJtb2IRPji0Aj
- TLSH T1A6C54B16F6748375D073C0B9C5D2A69AEE3234425B308ACB1389D7682F277D6DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 1.9MB
- SHA256 7d2e80cf70313eeb0d6419ae450f8dab57644ce3e823e1856f0e82d3311a93ed
- MD5 0481091340d4c83bb446daee9a466b5b
- SHA1 4b489f0db6b05d615a26f74659a2e1ae5e99b2f5
- SHA512 5f34d578652d870e6d7ee087e0940b7fa7557b9571ea70e0fb18c6f5816543cfeaf1cd78f082958c6b3e3ed06506c7e4f499af898e619c91a506e1fce315f27f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEx0e5jcAkSYqyE3YTqMi8CtBd2QHo:A3k03kHRJcpYqOqJtb2IC
- TLSH T15A956C16F6644675D073C0B9C5D2AA9AFE3238425B308ACF1389D7282F277D1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 1.9MB
- SHA256 3d778cb88044d2f7e0e711920b5e34f9bf100315d194c9cceff254c7e6dfa9ae
- MD5 b8ec895e2d995ca9047be3aa81bc824b
- SHA1 30a4c3d5dae70ea4692bb134522cd102d018585b
- SHA512 03502ec08a826ccd5752ffe3c0f9c26018d5e5f12823009642f23b38bb777410c1a4f1c09030ffa1e5cb97dea69d0264004655f63aba90fb69dd458434e17541
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEx0e5jcAkSYqyE3YTqMi8CtBd2QHw:A3k03kHRJcpYqOqJtb2I6
- TLSH T190956C16F6644675D073C0B9C5D2AA9AFE3238425B308ACF1389D7282F277D1DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$
- Size 2.1MB
- SHA256 c8932369b329efd97fe79900139860770664e52a4f7af0e8b9fa52794358ec8c
- MD5 ce21a029ba5d4295e51597f916b37820
- SHA1 2ef90068bb5bb8b7c3f4bf0bfe21d978c5c32d64
- SHA512 1389489b8d781f2739bd2360b7dbc476835a9ac84f274bc5257d77f2b2f764a1b88ca3183b50c9c43a9d22e5055309473ec15deb6a302e1816481d04ad25fc7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEx0e5jcAkSYqyE3YTqMi8CtBd2QHw:A3k03kHRJcpYqOqJtb2IvC17IwZ
- TLSH T1EEA57D26F6644275D073C0B9C5D2AA5AFE72384257308ACF1389D3282F27BD5DA3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 2.0MB
- SHA256 028d36b4cece875d9cb408bbb015389cf5511d43d9e879ba3cb04222143037b8
- MD5 9464f1dac4efe4678b2a4e4de68c296b
- SHA1 e702bd9881869adc897d5cd01655bbfae5eb0060
- SHA512 d2b527d76c8596662ae8e3cf2d77f51d57f190120c98c34561901f4cb516568f996abcc2ef30ff326e936c1f90595e52dfaf0fe5094113ef743a9918b3611e31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ2RojsqiZaiEx0e5jcAkSYqyE3YTqMi8CtBd2QH1:A3k03kHRJcpYqOqJtb2IT
- TLSH T16CA54B16F6A44275D073C079C9D2AA5AEE313C821B308ADB1349F7282F377D59A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH