Analysis
- max time kernel
84s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/08/2026, 16:23
Behavioral task
behavioral1
Sample
2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.6MB
- Sample260818-tv14aaab67
- SHA256 39bdacd3f6c21c8f35c263008a79f7d28abb45e40803a44fe6b7522ddd91d340
- MD5 f913d764d9d7a6ab4dd257ac241ef1af
- SHA1 6149cb02762160e9dd906e98f4264ab07e552431
- SHA512 76013986b170e8daaa22ed4b820fbe2d41ed291ebdbf9c006ccbdbdf5e236e10424dce1ece3b39da6a2a9879d57cbd40cc1be1da1776982ecd10b444dd428cfe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrM:A3k03kHRJARJXi56rTPji0Aj
- TLSH T1FF755A16F6A84BA5D06FC178C5D29656EA733C421F3087CB03549E293F67BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 13 IoCs
resource yara_rule behavioral1/memory/4620-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024401-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2028-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4620-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2028-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023442-131.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-438.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021299-437.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000214bb-675.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021669-1270.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6e8-1542.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002325b-2086.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024401-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000023442-131.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-438.dat aspack_v212_v242 behavioral1/files/0x0002000000021299-437.dat aspack_v212_v242 behavioral1/files/0x00020000000214bb-675.dat aspack_v212_v242 behavioral1/files/0x0002000000021669-1270.dat aspack_v212_v242 behavioral1/files/0x000300000001e6e8-1542.dat aspack_v212_v242 behavioral1/files/0x000200000002325b-2086.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2028 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4620 2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 2028 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-18_f913d764d9d7a6ab4dd257ac241ef1af_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4620
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2028
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.6MB
- SHA256 39bdacd3f6c21c8f35c263008a79f7d28abb45e40803a44fe6b7522ddd91d340
- MD5 f913d764d9d7a6ab4dd257ac241ef1af
- SHA1 6149cb02762160e9dd906e98f4264ab07e552431
- SHA512 76013986b170e8daaa22ed4b820fbe2d41ed291ebdbf9c006ccbdbdf5e236e10424dce1ece3b39da6a2a9879d57cbd40cc1be1da1776982ecd10b444dd428cfe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrM:A3k03kHRJARJXi56rTPji0Aj
- TLSH T1FF755A16F6A84BA5D06FC178C5D29656EA733C421F3087CB03549E293F67BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 2.0MB
- SHA256 5defed954e2dce9e512eda540956adbf9688a7faceac35128c7593a082db551f
- MD5 60c2e783969f6ccd5bedbd3ee2d78b92
- SHA1 7d3e623fd4f0761a2a71a186511105570c120196
- SHA512 17c9585d25f945edf5483f67bfc43355e596fc8f2786e1f683154fac7a5b73a48845936e40fd0effe4183858e1d7ef7ad06f6913c7335bc67ca0100c88941ac8
- SSDEEP 49152:A3k03kHRJARJXi56rTPji0AjoTd9CHKyao:A3k03kHR+RF/rLjoKCqo
- TLSH T16BA55C16F6A40BA5D07BC178C9A29656EA733C451F309BCF03949A293F337D19E39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.1MB
- SHA256 12b7e5a080b69584fc5c95c3348fd7f4fb5ff18548bf25a6e06530167a01b964
- MD5 1095a5beb4a5d12bfc62943627494a2a
- SHA1 102725c1afab2f7a774abf0c7ff413d3ac8ccd83
- SHA512 98f518be52d030fe481edcd49b22d0fd7cf4c83ba3e52018bbed6457f5e1c8a67ddec7eed92a7a066ba419e5e6641d5c9bac887fd0bb55837a702334307eb845
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrMD0Le5jiS:A3k03kHRJARJXi56rTPji0AjKPji0Aj
- TLSH T10EA55B16F6684775D07BC079C5D2965AEA723C421F3087CB0385DB283F67BE19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 1.7MB
- SHA256 a8a6bdd3eb364098aea7c1fd269d728b5af8e6f783580765f049bfc81a7f2d27
- MD5 0246033951e28a01d88f5d3b009fa17b
- SHA1 395d3aa0a8cd8f417bda6baf4e081a032c7542b3
- SHA512 940665ef0ceb276ba9c2633819582bcbf7d39053dcccd297c0192e6cc8431dd7cc3261fd7099abc7f11b180a50999961e2db80adb2cda4d0976845eb9dceec01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrMYD:A3k03kHRJARJXi56rTPji0AjX
- TLSH T10E851716E66447A5D06FC178C7929656FA333C410FA087CB03D4EA3D3F266D19ABA723
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 1.6MB
- SHA256 82b61dfc9be277fa2af9b0e63da84afe0afe13bce2f2eb56077aa867f634c942
- MD5 a51b2471fc1500aa82e1b039e4a5b83d
- SHA1 c7baa5fdfe618d2b13a406d80eb1d50c489dd3ba
- SHA512 bd157ac3f518648ca83db8c90b04828b6173b3007fddac48f45816efca22ec02d86467344848d17ff66bf1190499ce1c29bb9aa54e821e76706c709e085e9c0e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrMZQ:A3k03kHRJARJXi56rTPji0AjJ
- TLSH T159755A16F6A84BA5D06FC178C5D29656EA733C421F3087CB03549E293F67BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe$
- Size 1.6MB
- SHA256 edd166b2391a9a3c9137ca08ac41333d3e7942c686a965e26a37e3b82449dca9
- MD5 78b4a2f7c2a9b6a6b3610caa7bfa4620
- SHA1 c14104eb543b63769e11aaf68af6228a5903b779
- SHA512 a3fcc76d95fdbcceefe2abf91c3180cc1fed08aea5b196011af72de5f28b31eb6fb620c4205fd73e45a60cb003a349acfbcb5b00f0e4a3facf7da38fa008afc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrMj+:A3k03kHRJARJXi56rTPji0Aj5
- TLSH T1F8755A16F6A84BA5D06BC178C5D29656EA733C421F3087CB0354DE293F67BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe$
- Size 1.6MB
- SHA256 33e746da972b6c3c8b9bcbeca3ecc522b040d4477c9855a46bb3492163788042
- MD5 b071e9d0cd72a48448459e36f61b70af
- SHA1 89a3840372a72c9e5caa3ac8f8f156454b40f27c
- SHA512 299a263bd84eea2e461a9a82bc0ed653affab63bf157eebf28e795ee690d3e00671630dac5d93efa52a8ded41a5d07e493d5301d2aaa24c1e4d4ad2dd34ca3ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrMl9O:A3k03kHRJARJXi56rTPji0Aj9
- TLSH T1FC755A16F6A84BA5D06FC178C5D29656EA733C421F3087CB03549E293F67BD19E3A322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$
- Size 1.7MB
- SHA256 0bd3bfc68ab248995d28afdf95d7e0a5bba3c16d76efbd8c539dbd2cc93e99e1
- MD5 6a85d4d24589f15eb765c035ff9e373b
- SHA1 2a3cd141673a48dbe3efb48a884a1a5c334092d3
- SHA512 f636e4862ce6d09eb2d723031e685d8dbdce751832724305df8fde188fb629f3d29b07b36f4166cef8fb71a0ba357758bade1e63c033cc230284719053c42ed5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrMPF:A3k03kHRJARJXi56rTPji0Ajq
- TLSH T1FC854B16F6A84BA5D06BC178C9969656EA333C410F3087DB0354BF293F377D19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe
- Size 1.8MB
- SHA256 fe8973538a7bb8234ea67de999c1ba32a0949977f9243410dafa67a4beef017d
- MD5 0aa87f0985eab1aa089bd4ecde533fa6
- SHA1 890f942b94c70f541ac0e560c99705fb85a8a048
- SHA512 11882f28186c5b588137a2d190f3b3c8c446a00d7661e2bcaebbef13397c75efd4b24bc61cff6a92a12a5d243da5a2a367cbd2dca630b95b3288864c1cf47280
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9P0D5TvinrmC0Le5ji0hmxNrMfV+PAk24:A3k03kHRJARJXi56rTPji0AjYi2WH3
- TLSH T1DD955B12F6A84BB5D06BC178C5D6966AEA333C410F3087CB13549E293F677D19E3A722
- MD5 SHA1 SHA512 SSDEEP TLSH