Analysis
- max time kernel
94s - max time network
100s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 16:00
Behavioral task
behavioral1
Sample
2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260809-tf394abc36
- SHA256 bfdc69cd9853e389c96085cc8f99b9c3f38cc14826d8e9cff6020ace016114db
- MD5 c562490ff2c2878af41a19aca17da300
- SHA1 e01f0b505bef91f060890547d5bab8f4aa74f8a5
- SHA512 452b83879954a03e141912425a7d589fa30285666c02b1dc4912ab52046f5c28681ea096973c425ede67ebacd24c4c13ba6f3320170564a627163fad2706a3e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrM:A3k03kHRJPpYqjPji0Aj
- TLSH T1FA957C16F6744275D073C0B9C5D2A69AFE7134861B308ACF1389C7282F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/2824-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024661-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3504-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6d8-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2824-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3504-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000235da-151.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002125a-370.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001e000000021300-755.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0015000000020281-1530.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00080000000006cf-1952.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b0000000006cf-1977.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024661-5.dat aspack_v212_v242 behavioral1/files/0x000300000001e6d8-12.dat aspack_v212_v242 behavioral1/files/0x00020000000235da-151.dat aspack_v212_v242 behavioral1/files/0x000300000002125a-370.dat aspack_v212_v242 behavioral1/files/0x001e000000021300-755.dat aspack_v212_v242 behavioral1/files/0x0015000000020281-1530.dat aspack_v212_v242 behavioral1/files/0x00080000000006cf-1952.dat aspack_v212_v242 behavioral1/files/0x000b0000000006cf-1977.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3504 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2824 2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3504 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_c562490ff2c2878af41a19aca17da300_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2824
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3504
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 bfdc69cd9853e389c96085cc8f99b9c3f38cc14826d8e9cff6020ace016114db
- MD5 c562490ff2c2878af41a19aca17da300
- SHA1 e01f0b505bef91f060890547d5bab8f4aa74f8a5
- SHA512 452b83879954a03e141912425a7d589fa30285666c02b1dc4912ab52046f5c28681ea096973c425ede67ebacd24c4c13ba6f3320170564a627163fad2706a3e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrM:A3k03kHRJPpYqjPji0Aj
- TLSH T1FA957C16F6744275D073C0B9C5D2A69AFE7134861B308ACF1389C7282F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.3MB
- SHA256 c821fb5cc39afb46820b17690ae6e8068866c72621f7345d53a0c15cfd39f6ae
- MD5 43f10578940ecb274b71bc0f7e4e75fb
- SHA1 caa1298a5fa93d5af2d456c8bb0adb7e2f2807b3
- SHA512 21de7b0d15b81f4a0ad3bf26aa75ca4493237d1e6205e4843da8424a0a25076a3c050ce9fa9b8e8a24eca42f2edd10c2d66a3d508140f2db6c395c562148af4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrMX3TQ:A3k03kHRJPpYqjPji0AjoTd9CHKyao
- TLSH T1E6B57D16F7A442B5E073C179C9E29656EE7238461B30CACF1395D7282F23BD19A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$
- Size 2.0MB
- SHA256 4d8ea3eaa67629fb236d4b32e99901368518e22cf246990ac2cd38a5a22347d5
- MD5 5b37568e543359d3f63ae954dd04bf07
- SHA1 4bc76d055d94565a5aa4d534ef388e0cb7fb8cf2
- SHA512 215e64d9966263a298dc5e20fe79526f3aebea7e40dca8a24dd16a45622a9eeeafea9b2973d4a4ebbbff653c680f4c4c5439d16f512bc83e5912bb10faace7a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrMeGen:A3k03kHRJPpYqjPji0AjMI
- TLSH T138A56C16F6B442B5D073C0B9C5D2A69AFE71344617308ACF1389C7282F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 110bc73dc9d191c10a8b1334b234b0e5990d9e6a6d4f5596d969041eac69247e
- MD5 f565e1b5dfb90642a46320f18b0d3688
- SHA1 00b12973feadfdaff8d4286b3ea9e1ec1bce3e93
- SHA512 5fc6fa939431b1042d9fff1254d5998d53dfd881848d2383df4cc0688bedb8589f9c812450fa2372588947c607454551c4576301ba867fe7be833c33b8da25d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrMD0Lu:A3k03kHRJPpYqjPji0AjKPji0Aj
- TLSH T1DFC55B16F6744375D073C0B9C5D2A69AEE7134821B308ACB1385C7782F67BE69A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
- Size 2.0MB
- SHA256 81dacb8bd15989876d5d36cbd4ed748779b84a6b0f76c176fccf57c1f7029b37
- MD5 001256248a3daeb0277f7cef9a82fbb9
- SHA1 b8c9698575693b0068ac81e2691dfb591cab538c
- SHA512 78f61879ffbecea1407e572272d384a00117861eb0fa9fd0d31a7fbb2d9150ea1854fc0292b7232da21ef75a1b480d7808107d7ffa03fa7b00bf6462fb8235ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrMYD:A3k03kHRJPpYqjPji0AjX
- TLSH T137A55A16F66442B5D06BC0B9C7D2965AFA33344217B086CB13C5D63C2F23BD19ABA763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 1.9MB
- SHA256 277bfc64b25516e600420eed9589b91122b2cc38279b300830615cc6bbe0dbae
- MD5 04bd115e331391d8079db9b8d95d36f1
- SHA1 19f02d717092df1a4b4b13cf216298467f5bbcaa
- SHA512 55705a1b2921f35036f3e43cab10d50e331b6797008e6ecfd38d69d001179901772eafc9c5b7435f2d90c20071b1448bf86ddd82c858abb4fc970de47f0abc1d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrMYn:A3k03kHRJPpYqjPji0Ajb
- TLSH T101957C16F6B44275D073C0B9C5D2A69AFE7134861B3086CF1389C7282F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$
- Size 2.4MB
- SHA256 fe047acc78010557c0148168ba3a0463178df7622041daf320a763cae9fee7e6
- MD5 e88bb917b7d7b51c52e1befb0bf6e852
- SHA1 2b73924b8d0004eb965e636301b101867d688ee1
- SHA512 30175aa103a15141ce72172ddb3d6c5fe859c3f0dde5940f2d5a43e3c0eeefbbb52727e0dff2ab89749a2e8bc2a3d19194a4ec846051dbf514d1fec17aacce4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrMzUO/:A3k03kHRJPpYqjPji0AjqUOlk09
- TLSH T1CDB57C26FA7446B5D077C1B9C6D2965AEA7138420B30D7CB5359C3282F23BD19E3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 2.3MB
- SHA256 e2892213fceeb8faeb1d89cd9de71920bf7d55e040c0f7f388dab36a85a33e27
- MD5 c3882f53e94a35c344b6a8df76357de5
- SHA1 66bcf47829a95bd74ef2295466c6780a091c5ef8
- SHA512 27af5a0cff0c208bd31024ec0d4f055e898701e87331b1eb8bbfe516a8b1d41104be115ab9f920836cbbe8d886d8eebbc438581eb0dfe540bf75f0a494482588
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI7E2v5jcAkSYqyED0Le5ji0hmxNrMu3n5:A3k03kHRJPpYqjPji0AjRXpiMh
- TLSH T17BB55C12F7A44275E073C175CAE2965AEA7238525B30C6CF1385862C2F73BD1DA3A772
- MD5 SHA1 SHA512 SSDEEP TLSH