Analysis
- max time kernel
95s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/08/2026, 17:17
Behavioral task
behavioral1
Sample
2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 900KB
- Sample260831-vtxj5sdp21
- SHA256 57ff6696495cf7bbb1de8f11b49bd998e107f8b4083d4dbca75e775c598599d3
- MD5 8e48ac090353c1cdbb7a66d1bf12d950
- SHA1 62edba40207c3a58717535a199a5f4d54e3ad49c
- SHA512 234753809eb862d66f3a8394764df7a2f52f87e2327a2803df3f1756bdb95679c0faeeacbd04e5d84c4ea68d6ab1fdc812e39cc2ddf720ee054d14eaddf2023c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+E:A3k03kHRJARJ6
- TLSH T131159C13F79800E8D15AC2789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 27 IoCs
resource yara_rule behavioral1/memory/4344-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c0000000242d0-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b88-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4344-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000022b94-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4764-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021605-60.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212dd-507.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212e9-592.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f0-617.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f1-636.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x003e0000000202a5-721.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f3-740.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fd-784.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fe-791.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021304-823.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021309-854.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002130a-873.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021317-886.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000219ad-991.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002208f-1046.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002259c-1200.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022599-1285.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202b7-1491.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001ecf6-1931.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000006d1-1988.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000001da2d-2158.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000c0000000242d0-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b88-11.dat aspack_v212_v242 behavioral1/files/0x0005000000022b94-40.dat aspack_v212_v242 behavioral1/files/0x0002000000021605-60.dat aspack_v212_v242 behavioral1/files/0x00020000000212dd-507.dat aspack_v212_v242 behavioral1/files/0x00020000000212e9-592.dat aspack_v212_v242 behavioral1/files/0x00020000000212f0-617.dat aspack_v212_v242 behavioral1/files/0x00020000000212f1-636.dat aspack_v212_v242 behavioral1/files/0x003e0000000202a5-721.dat aspack_v212_v242 behavioral1/files/0x00020000000212f3-740.dat aspack_v212_v242 behavioral1/files/0x00020000000212fd-784.dat aspack_v212_v242 behavioral1/files/0x00020000000212fe-791.dat aspack_v212_v242 behavioral1/files/0x0002000000021304-823.dat aspack_v212_v242 behavioral1/files/0x0002000000021309-854.dat aspack_v212_v242 behavioral1/files/0x000200000002130a-873.dat aspack_v212_v242 behavioral1/files/0x0002000000021317-886.dat aspack_v212_v242 behavioral1/files/0x00020000000219ad-991.dat aspack_v212_v242 behavioral1/files/0x000300000002208f-1046.dat aspack_v212_v242 behavioral1/files/0x000400000002259c-1200.dat aspack_v212_v242 behavioral1/files/0x0002000000022599-1285.dat aspack_v212_v242 behavioral1/files/0x00070000000202b7-1491.dat aspack_v212_v242 behavioral1/files/0x000500000001ecf6-1931.dat aspack_v212_v242 behavioral1/files/0x00060000000006d1-1988.dat aspack_v212_v242 behavioral1/files/0x000700000001da2d-2158.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4764 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4344 2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4764 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-31_8e48ac090353c1cdbb7a66d1bf12d950_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4344
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4764
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 900KB
- SHA256 57ff6696495cf7bbb1de8f11b49bd998e107f8b4083d4dbca75e775c598599d3
- MD5 8e48ac090353c1cdbb7a66d1bf12d950
- SHA1 62edba40207c3a58717535a199a5f4d54e3ad49c
- SHA512 234753809eb862d66f3a8394764df7a2f52f87e2327a2803df3f1756bdb95679c0faeeacbd04e5d84c4ea68d6ab1fdc812e39cc2ddf720ee054d14eaddf2023c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+E:A3k03kHRJARJ6
- TLSH T131159C13F79800E8D15AC2789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 953KB
- SHA256 57db7dcac0398923c691e4d3ba355a34866826c24dcf3e0ed93a17003253c090
- MD5 7b2d45b7163b65a0cff101c7b1d633a7
- SHA1 9069066834b42e925b92aea28483ab911e037842
- SHA512 2b959fc63304ed0665621def73025b4b98af0a92de17ac243164d6a0ffb194958cd2a7520803b2f0dffa84a5b4e10fcba98ec04bebcc1e59ecc455ed814f620c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+6fj:A3k03kHRJARJSj
- TLSH T18B259D13F79900E9D14AC1789AA69A23EB75BC121B30A7CF1354C6162F72BD0AF3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe
- Size 1021KB
- SHA256 b6c06c91a80883b141fe181812f3ed7015d5a67028704f876b9076e7cc0f732b
- MD5 a7ffbcd4680e75713b37cf6358afb945
- SHA1 8bfe0d782b1cd882f54ca4e4d1c05361d8bf0325
- SHA512 7f1bc47ae3a0eff3b1f6a700c639af232e905a0a30760917ed835317f1e11075bc4e6d798cb296707071daa3a4b3f0bd9e452a804c0fa8a618c43aa20d36613e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+qGen:A3k03kHRJARJXI
- TLSH T106259E13F79800E8D15AC2788A959A22FB76BC621730A7DF1354C6162F63BD0AF3E754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 829a1294a47172735855c54ab487050bd0ea3a531323d79235aff9dc4451ea8a
- MD5 982f89e4bc01d792091415e4671bf210
- SHA1 1ef9c0dd15d9fac72cd2a98b524a93f66f87ae85
- SHA512 fe05f9f75519f693f2fd84ade74ab39b0eca016ecd68a135ad19ebcca414ac16cf8a76a7eef640bf8069a78a9ac33f5a86860186c3b0f6f48c2e6de80a9673a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+P0Le5ji0hmxNrM:A3k03kHRJARJ5Pji0Aj
- TLSH T143657C17F6A802B5D067C179C5D29A5AFA72384217309BCF1394C7292F67BE19F3A321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 915KB
- SHA256 e1fce005877332d498bb50bf03a49aad8fbdc785fc89b3c6d59a71cd59ebc236
- MD5 9f4a3e0642755911881a6000673bdee9
- SHA1 8b7df60432f347ffab68ef6cab2559cb94b7b5b3
- SHA512 0663410baa7b84aadead63cd87510a7a13431c38d1eea9d02ade0e3d2be380b7b4341f8718a8c26059c6707bf6ab9e67711d148c0998e551250afedd077306e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Ra:A3k03kHRJARJ
- TLSH T133158C13F79800E8D15AC2789AA69A23EB75BC161730A7CF1354D6162F63BD0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 948KB
- SHA256 dd5a502d1321de29128bdb91d54cc048bdb443ab36c21a7f62ed93765ce96db6
- MD5 263c544c8c332b5b366b568947f44f42
- SHA1 9291c9dfe9c8c7fa0fd51859d5c6668301a829f8
- SHA512 4bf699b82e037303b91306788950af2d9acb8dbd37083eccb6e217f314fe15a264b438d9355309791ea17da60abc73c54d5795227a47059afcffd8284d2fa905
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+yb:A3k03kHRJARJob
- TLSH T134259D03F79800E8D15AC2389AA69A23EB75BC561730A7CF1354D6162F63BD0AF3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe
- Size 924KB
- SHA256 51eff7a166b6ac7f36a36dcf106277d46e74752aa97f73be2934f0a346f8e63b
- MD5 b35cd5669748fd98a192635d4825f288
- SHA1 296a5334583afeaf8c1808910939725e055cc666
- SHA512 a52bbc58b1f056e80c7964c935d59a065f91006622bf5c9abfdf1ad7b05af27962eba49e798fad9728c9627f0b85cae0318c0980321ea4fc860cd4e03d704fe0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+5j:A3k03kHRJARJT
- TLSH T1F8159D13F79800E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe
- Size 924KB
- SHA256 e090e57b8ef3809473cdb31e8a5e11ad4c45078cc5a88bc7d2bb236fde2d4179
- MD5 cae6456ff74c6582a73721867ab22408
- SHA1 a4b102867941bc63166f7b833cb34495a1fe4418
- SHA512 615ab2b4731d7a124aaea50803ccb5fbef4bc356c9ba0b7703fc3f36350455fb023ff8d528713e05311f3f0c5c85f336e1bca776cb49a115096ca2024a6e8ba3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+vD:A3k03kHRJARJp
- TLSH T19D159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe
- Size 924KB
- SHA256 55b6dd26ada8d6bf14cc771d47051a7825a7535b5926691f6479612d0bbdc9d7
- MD5 c5141843b4c4b87bf2d42bf7b2ec954e
- SHA1 425ee2f24190baf0297bd174e10b0d858f582617
- SHA512 b7fab5329f32dc81d2e292320db3451c3a4c99dc0ce6ce9ee67b5d83e4196e7e3ddd363e040f7dbfb01b1abf266f9c46c76e4dd86230b194c3514d7919d0a5e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+3d:A3k03kHRJARJT
- TLSH T17A159D13F79900E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe
- Size 924KB
- SHA256 9062c13d8c87cb13871ef3f9b65f53ac48f4d4f44075dbeaf988000e99f8485c
- MD5 24652989e4301d2b2bae7442e0bf8fcf
- SHA1 baa5352e89234acf70cdefea1f9107e7223e0505
- SHA512 1ccc9301e9c05d0bff61be4352519cbadb23a95e39fd531967ccf6e58ba2bb58afa709248829bf4637e9f4735da6bb2a3779b633ffb14b6f57ae09ed7189410c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+XM:A3k03kHRJARJ6
- TLSH T15B159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe
- Size 924KB
- SHA256 94ea1cd2632d4a55ffc629a34fc8221e47f15e99ab41bd7402b90170accc3185
- MD5 7f8f9780fa70dc08198b327bd84b1f6d
- SHA1 b951c1225bb791e2f86f43ad9eceeb26179a87de
- SHA512 f31c9843f0950b4fc6f67f248d91875224d193a8507335a13d53ea84ac45e9146f6e5a2e6856b62165df5cf2749b9898963b36be51e70101c7a2b28d96adca87
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+EW:A3k03kHRJARJd
- TLSH T14F159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe
- Size 924KB
- SHA256 b5c51636537c40dc237a731d246f82fa64f40cc1a3f9ce0721fb3c62b9fccac9
- MD5 1e963de3529fcb7731ab883b10789d8a
- SHA1 e2aebb6edcf2f960ff80abd4e947b3c42e7d8e77
- SHA512 1cd2bbe7dcf72e4d96a230dd5ebd72fd06123e49ac9e6ad52b6673c420de466a7a48c095fe96631367adbd488e6ab43ee1d819da6237cd9966b6b32440529abf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+L93:A3k03kHRJARJr
- TLSH T17A159D13F79900E8D14AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe
- Size 924KB
- SHA256 0f29ebf160dff111592a8a9fb743c59ba9b5c2737ba804dfc3474b7ffa593485
- MD5 1bcc0f90a857d04adfb399c15b7546ef
- SHA1 b59d1dd46fce7cf81c1573a330bef1bf33cc309e
- SHA512 fe0129d7fa2317e7ae8b0ebe0c40a0e6db78a5aeaa1eb128e4b6f8a3bedeccbf47337e55e2487ac6ea361dfbb907924b718c32fa7d0e010870706fee2f70f28f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Z/:A3k03kHRJARJ3
- TLSH T17B159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe
- Size 924KB
- SHA256 1742c48e7c3d15ebf406dacbd5764db9f987b7a54fe62409a4f7cd2b73a9da71
- MD5 ea2b0d149a44eef198d3948b041b5a73
- SHA1 cd611e2ca8fdaeaa1f7bf621cb9c4babe15cee6f
- SHA512 de7735206028aef78d98f25efb99df152a9eb640453a4e97f27f378765bdcc548aa668c082c6da7586b2942924a2cb8237a218d3e926de09d444733fcce57ca9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+fa:A3k03kHRJARJY
- TLSH T18F159D13F79800E8D15AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe
- Size 924KB
- SHA256 fac9305836a0388ea6677535f4c54c800acda9dc10acfbc27c1a769b0b1fd737
- MD5 6db06bd519c7edeed473ce229ce928f7
- SHA1 a6558f79eb7e2e2962ddb29973577569cd9a993b
- SHA512 ed733982f9907cb6cc27f2b530ef4bc4ad7bb0b02f0aaf6f2bf250a5c43443e2a3987b488f0bce54ed950db20c3f5ae27db121d83a5a9b41b6af1bc4d4f82aa3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+zj:A3k03kHRJARJR
- TLSH T163159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 924KB
- SHA256 f60f2a58070f5ba7e5b50e72416be974ac71498a7ac5df023102bd56b168e3c5
- MD5 20cac9385e65cde854bbb5b420096fe4
- SHA1 aeddfb85bffbb9ec5534449a6466beb859b2f4ff
- SHA512 0128bf6e0dccbe981ba81540932eea331cdb22272c6951abc7e19ece2782177c2dc98df47322ef7a3b75a9b128b6da12a449934f3719bc293be1dc565e76afea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+EQ:A3k03kHRJARJJ
- TLSH T19B159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe
- Size 924KB
- SHA256 0418f250daf61383cd34f0db47b467fa9a97f7dc062d1eafa5019e4cee3250de
- MD5 213d08689dc1ed932d3f121179dc6102
- SHA1 dbee5db11810a162e4e6b90ecee3dbbddffbb4c3
- SHA512 6b20d1b9dc551fb359e0df46b084cb4c46c8e267a6a36e3aebc8aec07dd77c36955777908166cdab2952ce90cd633e1c3c1a23a2162c49cdcccdfb73431ab269
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Li:A3k03kHRJARJ4
- TLSH T149159D13F79900E8D14AC2789A969A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 924KB
- SHA256 d6dc0943cbd7467aad3f3d98b593199c0310f565fd4e320fdb28a16e740ea28e
- MD5 ca97b4b9a40ca81aeb9a6b796ca62a37
- SHA1 147906cc5b532e8693d6928653a56315a4a3e077
- SHA512 bbcc1c35d52a44022d9ef91aad3d7c58ee1f04101bb0ecd3e9d44325cff26f691d26d94082b0e46879a236c4d67c52086fba712bbcdca183f434f552bbe25840
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+L9:A3k03kHRJARJX
- TLSH T10A159D13F79800E8D15AC1789AA69A23EB757C561730A7CF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 934KB
- SHA256 6efe04dfcc97fe23ea3b2087def43728e6249e628ef12c0de87e223528f6445d
- MD5 e73bf755df8c89f18339a639d9fb2afc
- SHA1 0d5f1d93d2189542078f09fec97a64257a1100e2
- SHA512 a4c034f8aa9d49f286c3f0654512b0cd297c322f48fe84faee4462307f5a20757df0e58670f3f0e9b897adc27af968b8ab835fc9233d2e0d2c9f0c8ea1574fd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+O1:A3k03kHRJARJ01
- TLSH T193159C13F79800E8D15AC1788AA69A23EB76BC561730A7CF1354D6162F63BD0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 944KB
- SHA256 21d0d3c65d81401ecd5fde3545e917afb0bf86b91f03952ce2c2edabacf7f4e0
- MD5 b4586394bd05f77e7bcad79e7289a9bd
- SHA1 cae692e28898e6d78deaef7c534b27556f7badaa
- SHA512 f80e9c3f3a188d82fa89f67228615e1c3f63636c778d963b7a56be8785a0425b4be83499cda1b045d8d93352a28e7c290c38296fb11dbed1350756ceca103c9b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+SwE:A3k03kHRJARJ2
- TLSH T1F3258C13F79800E9D14AC1788AA69A23FB75BC561720A7CF1358D6162F63BD0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe
- Size 956KB
- SHA256 45c135f7b97a15172ee1003b59fa8cc3da78518e5f0b6f178ef1f5b46172ee55
- MD5 81aafc004ae41b238a8c7c654e41d5fa
- SHA1 ae1ffddaec55f5464e05781b21e56240f8cc6d15
- SHA512 c109ec53a6de71ebba5b4aaabc8c6bac0888820b0c2d3844048fa64ea754853e8e4f427022bc4a768d876569296d82e300fb0f57983946671aabe839b8f696b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+B2+:A3k03kHRJARJy+
- TLSH T175259D13F79800E9D11AC2788A969A23FB767C561720A7CF1354D6262F63BD0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 962KB
- SHA256 7978e328a9f1dd6a7c01293860d008e64a45253329094f6b6acd6fd521138f86
- MD5 fe77b38f1bdb5900fc56e3b81f05a55e
- SHA1 2926422677f1a1608a3bd5ec5e0d92ef905c8ea6
- SHA512 11fc6d1b91bbd84a229b81e10601fe8b9237ed18d49bcf9925af0fa0071d5abd983ae735ef6ff7ddad8d3b78fc265b308be7e015bd6e93690ae8e5a873bb486a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+E:A3k03kHRJARJC
- TLSH T145256B13E69800E8D10A913496999A22EB35FC1A172097CF177CDE252F66BF07F3D768
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.3MB
- SHA256 798b600b19a9ea30fa769c048fcc096893f86982ad8e3292f7ca71a91b317e54
- MD5 2a90f03fb83ca384a4edb99dcf0cbf78
- SHA1 294b4088b1a16488600dd770036fffd0cafdb803
- SHA512 a63846b7243bb8783457a60f580e92dc61c0f4bc85bab58cab11ef89ce32820189a496c07954f6b3a85a09e13a8e09aaf866f576c809834d95a12fc13e936fe4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+K3npi63iC:A3k03kHRJARJYXpiMh
- TLSH T1AD555B03B7E800B4E1B786349AB59622EB76BC615F30D3CF239456191F71AD0EE39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe
- Size 945KB
- SHA256 43a5b8465a9159ba01734372e7782225a9877c7612d511f4cfc83c30205243cc
- MD5 7c1eac37e3305b92f0ef8db575f91733
- SHA1 c7dd93059a43f3b42d40321edb5b7af9fca3944a
- SHA512 8887784e3363342a3e04c61141905c250959270fd8ed5d7e6189ae6194fa8f76c9ccdbe0d1cf9044e1dec577d4e0de575c696b66a6bbfc4cc7d03b9415b11485
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFhs+Q:A3k03kHRJARJS
- TLSH T137258C17FB9800E9D15AC2788AE69A23FB757C521720A7CF1354C6162F63BD0AF3A354
- MD5 SHA1 SHA512 SSDEEP TLSH