Analysis
- max time kernel
91s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 17:26
Behavioral task
behavioral1
Sample
2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260810-vz6d8sdr21
- SHA256 8f322ff08d409c6aa14f3259a28564b63ab6b370bcdfdc2424313b17573ed7e3
- MD5 4f9d68063a0a97deaeacb96b3e663d45
- SHA1 e0f80e499e41f3a724890cafbf1d7872e8da5eff
- SHA512 604d35f3a8bfe0c8f4b10f1523072cc34d6a0d9d4947b7aacbcc7a7b81485498518cd68899c8e37c9c4a3aec26207d202ba88f96c5f396a8771c4ffb6682aec2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyE:A3k03kHRJi56rFpYq
- TLSH T1F9655A16F6644BA5D06BC178C6D29666EA733C450F3097CB1344EE293F23BD19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 12 IoCs
resource yara_rule behavioral1/memory/4060-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000024390-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/728-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4060-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/728-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b5-301.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-299.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c8-410.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c9-409.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021886-764.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000231ef-1651.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000b000000024390-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x00020000000212b5-301.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-299.dat aspack_v212_v242 behavioral1/files/0x00020000000212c8-410.dat aspack_v212_v242 behavioral1/files/0x00020000000212c9-409.dat aspack_v212_v242 behavioral1/files/0x0003000000021886-764.dat aspack_v212_v242 behavioral1/files/0x00050000000231ef-1651.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 728 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4060 2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 728 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_4f9d68063a0a97deaeacb96b3e663d45_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4060
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:728
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 8f322ff08d409c6aa14f3259a28564b63ab6b370bcdfdc2424313b17573ed7e3
- MD5 4f9d68063a0a97deaeacb96b3e663d45
- SHA1 e0f80e499e41f3a724890cafbf1d7872e8da5eff
- SHA512 604d35f3a8bfe0c8f4b10f1523072cc34d6a0d9d4947b7aacbcc7a7b81485498518cd68899c8e37c9c4a3aec26207d202ba88f96c5f396a8771c4ffb6682aec2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyE:A3k03kHRJi56rFpYq
- TLSH T1F9655A16F6644BA5D06BC178C6D29666EA733C450F3097CB1344EE293F23BD19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.9MB
- SHA256 07648c4aa3749a3f19dd3bff95d74650ab1854e3a2e4d46939fbc940d733611d
- MD5 ddd92442b7030c8a1ac58e1a58804931
- SHA1 db83c9c4c961280949af07a8551ab8dc4228daab
- SHA512 3ed9793bf359ec5a0fd6caf26264b3d2329cbfa94482f98fa3d88719b48c1b4e0bb71d90e3f1f7b75d19c39a1cdfe54c91184d9af185b1127c8a8aefb728b726
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyEfUr2d29dBrtpDiI:A3k03kHRJi56rFpYq/UidGl
- TLSH T190956C12F6A44BA5D06BC174CA929656EA733C450F3097CF0394DA293F37BD19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 4a7a734a873a363042f3c07e5ecef85a69246fd943fb52210b101cf52ef56dab
- MD5 bf2a612c2ff781ee94e1f823de7e0035
- SHA1 a2d07d83bfff28975b7e50b30ab0bbcf79cea30a
- SHA512 d2f5793b4adaf6289ca80a4cccdc45b9166dbba95498401cc10f88b2694c3867ab065dacf8e6fbe604fc82c7c2a3ecd892a0376dac7f5ef07ab6fab7076a2a49
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyED0Le5ji0hmxNrM:A3k03kHRJi56rFpYqjPji0Aj
- TLSH T182954A16F6644B75D07BC0B9C5D2969AEA723C411F3087CB1385DB283F27BD19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 1.4MB
- SHA256 ed9bd9d7998a6a392dcb91fe34971b290a1469f8ae9c5a51c63a87741212730e
- MD5 cdb0a74083dbde95c3314b99f5a4905b
- SHA1 0328cab0894bec35da375ea70eaa20c881eb59dd
- SHA512 343fea19d13798cee5f91738372a7067fd6727365b95133739a8bc27d9199226623fcfe10364e45fbd97185907c2d380119fa6062510480df55293261f5999af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyEbC:A3k03kHRJi56rFpYq2
- TLSH T1B4655B16F6644BA5D06BC178C6D29666EA733C450F3097CB1344EE293F23BD19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$
- Size 1.4MB
- SHA256 3d28eb26ee88100be3c9fc72d426a1bd3d5c61b820306e3a6749d156ef2b27eb
- MD5 4db7a1183699db009c5c273a05001d69
- SHA1 570ad6e6d0dda1c7c91703ec4e64128c1c8c68b7
- SHA512 db272c0460adb1d9d6c2975cd3a0e5b1452b6455713c8ccb27f69bfc79a3d01e8d260d510a8a1ca81687e865bcec3d6f1614438c61db7c750acc554070c61cc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyEeF:A3k03kHRJi56rFpYqi
- TLSH T139655B16F6644BA5D06BC178C6D29666EA733C450F3097CB1344EE293F23BD19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 1.4MB
- SHA256 f7861912f5b6338128e88da064295c1d73fb26b5fb7ec63d009b206eaa149673
- MD5 6748e186c10b581a170e85b95f5f1741
- SHA1 16b2a303f54c47aaa00adb55b40ea65f96eff9dd
- SHA512 01c9ae1af6cf8fe6fb3acf05b904a86357663a9fc1a1be71dbf43b7fa6abf5d771a7fc32454b70d14f5e62a1109f998cdb9dab3d42e3828484746fa1ac9ab328
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyECj:A3k03kHRJi56rFpYqA
- TLSH T187655B16F6644BA5D06BC178C6D29666EA733C450F3097CB1344EE293F23BD19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe$
- Size 1.4MB
- SHA256 4d155b26ee7af33b228470cb7afc6e1a2ad5c3f6a6b2072962137349294cf30c
- MD5 b4b7f22b2ad60adbc6ee58fc93fc72d5
- SHA1 7588101da07de5ee42a5a5ff5e0c6b9f30b62287
- SHA512 35a6294e3748b807c88faa6145b80441d8c92f04efe30edd50e7794f441a52cb375641d6568addfb5d58185a86d9ba52cc2d2abbe4cc498814caf8f6f7bb8883
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyEM4:A3k03kHRJi56rFpYq7
- TLSH T122655B16F6644BA5D06BC178C6D29666EA733C450F3097CB1344EE293F23BD19A3A363
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Integration\Integrator.exe
- Size 1.9MB
- SHA256 2d49da159db66d044430f21534d3beb30a213e9d5d9d443027e58b41e7c17c80
- MD5 75d69602c5a4d077642f92a77ddfe692
- SHA1 4b49b322227d6d1f3d5be6bfc71b94627f35be05
- SHA512 5cb0b86ac16f49c228320f2672b39a94f4fe54b58bd9289cb49ff7a78e9e413a435d15290d79b7c1bf243469b4b81742fb883fd5df106eaac84df1a6ddafe8c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415v7r5jcAkSYqyEzUOlZ7q/c9:A3k03kHRJi56rFpYqTUOlk09
- TLSH T139955B16F6684AE5C06FC178C6D29656EA733C410F3097CB5358DA293F237D19E3AB22
- MD5 SHA1 SHA512 SSDEEP TLSH