Analysis
- max time kernel
102s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 02:45
Behavioral task
behavioral1
Sample
2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 3.2MB
- Sample260814-c8r9vsbl4s
- SHA256 4608f81a5e2850e425e105d4f829af6ce8233675f5888dbd0855df7c4c23396d
- MD5 f611448b2ba1bd0a576684fbefcfdeac
- SHA1 80dcc3c0eef988c139f1a3a183e1524f6faaceb1
- SHA512 c0dda75df5575eeb06b706cdf6a720aedd6576c32b359c25e242e813deaec914e1c73c57c14c0add3dcbb241031c39c7291340a8cb014436870516e5e418ffb9
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Aj:A3k03kCrtfkZc+fkZcRjo
- TLSH T117F52A16F5788722D07BC0B9C6D6AA9AF93338451F708ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral2/memory/4356-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5d4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4356-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/824-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-424.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-426.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019929-450.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5db-457.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000199ac-575.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0037000000019b0e-1031.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019cca-1292.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b000000006545-2034.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5d4-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-424.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-426.dat aspack_v212_v242 behavioral2/files/0x0003000000019929-450.dat aspack_v212_v242 behavioral2/files/0x000c00000001c5db-457.dat aspack_v212_v242 behavioral2/files/0x00030000000199ac-575.dat aspack_v212_v242 behavioral2/files/0x0037000000019b0e-1031.dat aspack_v212_v242 behavioral2/files/0x0004000000019cca-1292.dat aspack_v212_v242 behavioral2/files/0x000b000000006545-2034.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 824 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 25 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4356 2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 824 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f611448b2ba1bd0a576684fbefcfdeac_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4356
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 3.2MB
- SHA256 4608f81a5e2850e425e105d4f829af6ce8233675f5888dbd0855df7c4c23396d
- MD5 f611448b2ba1bd0a576684fbefcfdeac
- SHA1 80dcc3c0eef988c139f1a3a183e1524f6faaceb1
- SHA512 c0dda75df5575eeb06b706cdf6a720aedd6576c32b359c25e242e813deaec914e1c73c57c14c0add3dcbb241031c39c7291340a8cb014436870516e5e418ffb9
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Aj:A3k03kCrtfkZc+fkZcRjo
- TLSH T117F52A16F5788722D07BC0B9C6D6AA9AF93338451F708ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 3.7MB
- SHA256 551eaea1baaeb134f36ab93ac81c78637d9472e46ab5c60a37a91aea9794d870
- MD5 675822521695f1b8bcbfc045ca1f193e
- SHA1 24573dbd329dbc4f4e308326c35d5eb22c3d29a5
- SHA512 ddb6b6e96c6b07716ff625be3f690defb7e5d2ddf479dda705c72fcfe8889dc3be47be94ce6e8f608280689c3d6a9cbd12ae26d120fec1bd00bc77c44f1b0262
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0AjKPji0Aj:A3k03kCrtfkZc+fkZcRjo0jo
- TLSH T1CD062A16F5788722D07BC0B9C6D6AA9AF93338455B308ACB0285D73C2F277D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 3.2MB
- SHA256 bce3cfea0d3b460eb880712afe664715286fee6e0d93057febb809061b5c60a1
- MD5 47342e91a05e9d8dbeecc9c88dca9971
- SHA1 3639c45c44313fc7c468f30fa5a77e2b933eb220
- SHA512 90f63011e9fcd776e205d1c6444599d0dad3a28a52e0a004136b429243eeb66d96110f84d4188dcd01c74880dfea3066a25deff127e0c3abcb3e8340c1f0d73d
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Aj5:A3k03kCrtfkZc+fkZcRjot
- TLSH T17CF52A16F5788722D07BC0B9C6D6AA9AF93338451F708ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe$
- Size 3.2MB
- SHA256 c6258f81edb611e410092c5e9181ceefd7f17c2f608ee7eaa692a4aa7aa8fa21
- MD5 ff5bf34b469b331770e97bf57f3bb460
- SHA1 b71770a575082b6e8b07ac6f481dfcf7bc185eb1
- SHA512 f63905a71ea88da8019d73e1c634eb781adb203b6f72f503aada63f3f2a7c4b178511bf088d4baff78897a93069959ca4ce78ff70efe13da366aab14eb66d986
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Ajk:A3k03kCrtfkZc+fkZcRjoA
- TLSH T1F0F52A16F5788722D07BC0B9C6D6AA9AF93338451F708ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 3.4MB
- SHA256 c5854409c665d6eaf399ff2c5a1fc335dd0373b0122c27d18a39fd8d0e4b528e
- MD5 e426f59dde91223186865c1611db6e92
- SHA1 3a4057dedcce898ee5d3931f3c399bf914905c24
- SHA512 c49348550bb16edcd905d25a178a93fa9888e0fe08575c7cd1309d24ba5def0f528fb9b4ad950b181f93d7fc07e9c7e601d648462032fc80f0aec496d52ab4de
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Aj2C17IwZ:A3k03kCrtfkZc+fkZcRjov7IwZ
- TLSH T15CF53A16F5788722D0BBC0B9C6D6AA5AFA3338451F7086CB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\unpack200.exe
- Size 3.2MB
- SHA256 ebf0563bc712bc4b79f55d2c63e018b7eef587590bef043f3b14343f2f10bab3
- MD5 2685f80178f1353d5cc90820894ed9ca
- SHA1 31150b209dccd55cf65fdd4c2f86b3aadb9aa500
- SHA512 dddd4ea3766ceecc22919a899f54dc2d25215dd3f8918fb6f403f23ea73681834c9ded0093096c89eb3333662bf3b1442819ac7a104a7d5fc5458d2372e3e31d
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0AjJ:A3k03kCrtfkZc+fkZcRjol
- TLSH T1A2F52A16F5788722D07BC0B9C6D6AA9AF93338451F708ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 3.2MB
- SHA256 6df1ce573236c1741f350805bbc56aa0931d5411bb736c1b8db1a6d367293a33
- MD5 2f843108e5d7d9dc911a6c03f6248d1f
- SHA1 6c0086bb39a896ccb0b0adfda41760c6a6554413
- SHA512 66a2d16c324501f9cc8132a51a653e8cd6bc06f43d35a2890ae180d8fabe6e16d27d8372ee083ea47f31e830293f3f0d7fb488564744874eb4ab5b5fad8e9d8f
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Aj0:A3k03kCrtfkZc+fkZcRjoA
- TLSH T1C0F52A16F5788722D07BC0B9C6D6AA9AF93338451F708ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 3.3MB
- SHA256 04c8683a7fc03f170ca20b598b22cebcb099c3a3be274c66cc1cac62f52df63a
- MD5 2c893f978af09f20af80c27339c738b7
- SHA1 b6cd30b80172dbee48011a4b659887dc457fadf9
- SHA512 27a31d1cfd55fe0170b2524d58fab690423bfcc0ac1da296e68a7fa479355ca46738bab26cc11c3e9b1c04b3b848b42e7d2e353ba579078a1873bfc645b0c193
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Aj7:A3k03kCrtfkZc+fkZcRjoX
- TLSH T150F52A16F5788722D07BC0B9C6D6AA9AF93338451F708ACB0285D73C2F276D58636736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\uninstall\helper.exe$
- Size 3.3MB
- SHA256 11494fedc1ce64e52d9753625714c17912173aa213feb9ea8cd3252bf9d99c00
- MD5 36dbfaaaaa24c467454585be299f3971
- SHA1 bc86e2dadca579dbdbcc1ac6fee4c6f36a44fa79
- SHA512 738f045ff8896393d3840598fea65444d60d64da0c968577e3227ee6f96382df1b38e1ba1caa14b5028417cc32adf4f66ca08a4ba51a24b1b00d46169bda7cf1
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Ajq:A3k03kCrtfkZc+fkZcRjo2
- TLSH T1E1F51916F5788722D0BBC0B9C6D6AA59F9333C451B708ACB0285E73C2F376D58636726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{d87ae0f4-64a6-4b94-859a-530b9c313c27}\windowsdesktop-runtime-6.0.27-win-x64.exe$
- Size 3.8MB
- SHA256 c101b0a8264eb82938c306992390825370b1772688458781539d97162cc730a6
- MD5 683b5112c9505caeebf2ff04592b5825
- SHA1 a50ed0ac4e56be38bcee77ba54e95b141c8c4dfc
- SHA512 c734f2e9e58d0c2351b2369b36e04c333647d5611f7b636209f47ca5e9da2e19851edb47d1813746f0d03841fed57fc45cdc97849a21d0982ba59ed6ed649885
- SSDEEP 49152:A3k03kB56rZeW4SkZP4sz9MbmeW4SkZP4sz9MbBPji0Ajg5BjBbTpi75Zr62:A3k03kCrtfkZc+fkZcRjoc/j9TM5L
- TLSH T172063A16F5788722D0BBC0B9C6D6A659FA3338451B708ACB0385DB3C2F276D58676336
- MD5 SHA1 SHA512 SSDEEP TLSH