Analysis
- max time kernel
65s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
12/08/2026, 10:51
Behavioral task
behavioral1
Sample
2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 2.3MB
- Sample260812-mx45dssvb1
- SHA256 36d91693a7d5d92a958d21047f21579ff95641a278f1a64ab0ec598c65ccd8c7
- MD5 9fe5cdb46b418d18c7af09af08a8ec7f
- SHA1 31c466f6e26d44df34d26b66443c3502fc4a46e6
- SHA512 e38e35d9f6181b8ff4d4c029da1655bfc6b64ac1c056d5230bc2ab6b0fec04d2dc1e7d5b2f7f72329be7314589d67348ab95c38e21593151f9896bd76456de22
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCZlFPZe0p4Ek4niOkl/A04szE872:A3k03kHRJreW4SkZP4sz9MbBPji0Aj
- TLSH T11CB53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 14 IoCs
resource yara_rule behavioral1/memory/3048-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002459e-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2144-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3048-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2144-53-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021235-379.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021237-376.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b9-552.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bb-551.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000214e6-627.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a3-1274.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e48e-2073.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000000701-2101.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002459e-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021235-379.dat aspack_v212_v242 behavioral1/files/0x0002000000021237-376.dat aspack_v212_v242 behavioral1/files/0x00020000000212b9-552.dat aspack_v212_v242 behavioral1/files/0x00020000000212bb-551.dat aspack_v212_v242 behavioral1/files/0x00020000000214e6-627.dat aspack_v212_v242 behavioral1/files/0x00020000000216a3-1274.dat aspack_v212_v242 behavioral1/files/0x000200000001e48e-2073.dat aspack_v212_v242 behavioral1/files/0x0003000000000701-2101.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2144 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3048 2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2144 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_9fe5cdb46b418d18c7af09af08a8ec7f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3048
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2144
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.3MB
- SHA256 36d91693a7d5d92a958d21047f21579ff95641a278f1a64ab0ec598c65ccd8c7
- MD5 9fe5cdb46b418d18c7af09af08a8ec7f
- SHA1 31c466f6e26d44df34d26b66443c3502fc4a46e6
- SHA512 e38e35d9f6181b8ff4d4c029da1655bfc6b64ac1c056d5230bc2ab6b0fec04d2dc1e7d5b2f7f72329be7314589d67348ab95c38e21593151f9896bd76456de22
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCZlFPZe0p4Ek4niOkl/A04szE872:A3k03kHRJreW4SkZP4sz9MbBPji0Aj
- TLSH T11CB53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.8MB
- SHA256 1d9cf5d1da405852b48daff669dc93e24548546d37dc9b920e2f61f6aa78b412
- MD5 8794a46daa0612c59efaac693a9dae48
- SHA1 23c6cf42cd87afd44f1066ff59d1ca4ccb1c5170
- SHA512 5cd4b3e48008a55a6e6901c147aef8dd36a9976e76db0530dd3a3a468513f4c54f794ceb4039a39925f36ebccf4bc56be3d3617e88b62e4e951acad68bb62b81
- SSDEEP 49152:A3k03kHRJreW4SkZP4sz9MbBPji0AjKPji0Aj:A3k03kHRdfkZcRjo0jo
- TLSH T1DDD53A16F6788372D073C0B9C5D6AA9AFA72344617308ACB0345D72C2F277D69A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 2.3MB
- SHA256 2b629387279c96bb23c516817b4c6a73fc76815e4cfc2c1d3cf46161659a21a8
- MD5 e9043a51f47d2e0875ec519b14c7063d
- SHA1 21f58b350b9f998ce79b99e1440a654a7392435e
- SHA512 75900b44d598a7759e458818f2a7055a3472b7c795567cc47f39db6912eaad8aded637cea3727696fa786ddc741a442ef2bb096574dcb2aa523b207f548a1de3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCZlFPZe0p4Ek4niOkl/A04szE87c:A3k03kHRJreW4SkZP4sz9MbBPji0AjW
- TLSH T149B53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$
- Size 2.3MB
- SHA256 0d6e7dfc765ea037e1f59373dee4312b52fff2300847de9f3fc1cf2cc2dbb463
- MD5 873b5cbe878357256c2c5d232e655de6
- SHA1 1761722dd9158d8797ec32c0360a5e84088a73ff
- SHA512 87fd496c882d2c62b1a53603e5a037b7d605d0d1a944006061ae8ec0e880a85fe3f099419f9ddc86396716069d79764870eda5f80d945780bd3741ed17cfc178
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCZlFPZe0p4Ek4niOkl/A04szE87D:A3k03kHRJreW4SkZP4sz9MbBPji0AjJ
- TLSH T1E0B53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 2.3MB
- SHA256 410d5e55aa8b3806fd88f79969618a6e5aaa5bbce91965f880a8d06fdc7677a7
- MD5 3f47c05629cbb6a00aac8a2a66c79ed3
- SHA1 d8dc6ed80b615ddb2766b6834725ad62dd866f56
- SHA512 0b392dd0f453069db9138daa2c599f33886c40c89e8b0932c2e0ca600d9c1d4cd17b005e3597b9fce737096dbbbd564f8fb14d44ec4ffd85ed91cea72665f580
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCZlFPZe0p4Ek4niOkl/A04szE87g:A3k03kHRJreW4SkZP4sz9MbBPji0AjS
- TLSH T134B53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$
- Size 2.3MB
- SHA256 65a70f492b0503cd84a6b5951ca1e335089cb49ce4e9227c272dffa99b80d089
- MD5 6f8dd2470f651ee75fbd12f61d01a729
- SHA1 197b2c663ba6530501d834b723ee8b962e010695
- SHA512 9f21e674e57a10183ca11f14d5bd4207bce602117402a20886eda63ee58de0d6ecc8f96ac4ada0a89851cc4d6d494a4db9e1a32205d8c6a435f3d680d3054a94
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCZlFPZe0p4Ek4niOkl/A04szE87E:A3k03kHRJreW4SkZP4sz9MbBPji0Aj6
- TLSH T1A8B53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 2.3MB
- SHA256 0fb363d1adaa8c34c38f51fb0f11e271bb3b1eefab02bb73d0c27c093da36800
- MD5 e7dc699ee17ddf4e809a07e0b48732ed
- SHA1 392d1eff8a01fdfbbe3ae1211131255c4e4d9a1f
- SHA512 3594d9d0c25fc897d43cae84353859ebc8afacaf65099686354a2320df61693c2675d273a3e9d790bb4ccaafcbaac473a1abeb77b079b231cfcc6c5fc62b56ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCZlFPZe0p4Ek4niOkl/A04szE874:A3k03kHRJreW4SkZP4sz9MbBPji0AjK
- TLSH T194B53A16F6788372D073C0B9C5D6AA9AFA32344657308ACB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 2.4MB
- SHA256 97b6105abd022c62b8a689c1de0cdd2fbdfb0e817107c9e8aef75672a0f63217
- MD5 663b9eaa685cce7acc2237e98f1f6f7d
- SHA1 77c06255ff7b624f1acbc969cd71d7983afc304a
- SHA512 501d3c766db4fcc8415264968cedb2c8f7a1e8b8c9608d3c1714ab8cd8cdf302eb6e482311a31936f1fce99436a17863b81e153e987d483134de74a57a61acdc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaaCZlFPZe0p4Ek4niOkl/A04szE87Y:A3k03kHRJreW4SkZP4sz9MbBPji0Ajq
- TLSH T148B53B16F6B84362D0B3C0B9C9D6AA5AFA313C4617308ADB0345E7282F377D5963A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe
- Size 2.5MB
- SHA256 67d959883a7b57cbae12809a8add70e88482adf32779435f57593325ce61be10
- MD5 7e588f9f48c2465e79a695276e2c38b3
- SHA1 d6dd0ef3c93c2132584923f13f5d9c16679c3274
- SHA512 7fd3d163b4bee217045170a11073600a05ae9ccdc6d45f8b1c9649dd406598593c38b225e7ab65347ed263a187fade22838dda83a53a81b15475630149badf6f
- SSDEEP 49152:A3k03kHRJreW4SkZP4sz9MbBPji0AjYi2WH3:A3k03kHRdfkZcRjoMuX
- TLSH T153C54B26F6B84372D073C0B9C5D6AA9AFA3134465B3086CB0349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
- Size 2.4MB
- SHA256 003cb19a6a63aef5d7904ea3039105a55b86276942a89c0f08d645885b470634
- MD5 73b7888bc5b936efd92cc1ab469c8833
- SHA1 40543aebd94b7bfae0f53a2adf34527263ee71a8
- SHA512 3c6f2ca5f27cb1cdf4ac32f769577626e5dccf88df8f124b5ec730c364026027147feca0361b027689546982b9c8ce2d486058fe10648864133a2bb96a1e6931
- SSDEEP 49152:A3k03kHRJreW4SkZP4sz9MbBPji0Ajfxd:A3k03kHRdfkZcRjotd
- TLSH T146B54B16F6B84372D073C0B9C5D6AA9AFA32344617308ACB1349D72C2F277D59A3A735
- MD5 SHA1 SHA512 SSDEEP TLSH