Analysis
- max time kernel
104s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/09/2026, 16:11
Behavioral task
behavioral1
Sample
2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 4.1MB
- Sample260922-tm918ats5p
- SHA256 357d5d602e737fc79b0f23bb9fa39b2563015e3323d4c2107d25ec5aef8a2121
- MD5 f9efbf2cbaba42c6697715800390e648
- SHA1 a0c149e5776472a87f7529ea34681dee3644e1ae
- SHA512 ce51f4c6bcc87597a8fb669f185caedafcb9a71658c73c7551b1c73106756132af11bed84873996093ec6749a2a6821dcc383b73abbdf76caf712ef87c2924ad
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbkqJtb2IdqJtb2IsBqJtb2IUpYq:A3k03kHR+RcfkZckcfX6
- TLSH T11F161915F6788362D07BC0B9C6D2AA9AFA33344157708ACB12C5D73C2F276D5897A732
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 8 IoCs
resource yara_rule behavioral2/memory/2352-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c534-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b293-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2352-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1136-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb48-218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001997c-570.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c88-1272.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c534-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b293-11.dat aspack_v212_v242 behavioral2/files/0x000200000001bb48-218.dat aspack_v212_v242 behavioral2/files/0x000300000001997c-570.dat aspack_v212_v242 behavioral2/files/0x0003000000019c88-1272.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1136 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2352 2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1136 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-22_f9efbf2cbaba42c6697715800390e648_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2352
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 4.1MB
- SHA256 357d5d602e737fc79b0f23bb9fa39b2563015e3323d4c2107d25ec5aef8a2121
- MD5 f9efbf2cbaba42c6697715800390e648
- SHA1 a0c149e5776472a87f7529ea34681dee3644e1ae
- SHA512 ce51f4c6bcc87597a8fb669f185caedafcb9a71658c73c7551b1c73106756132af11bed84873996093ec6749a2a6821dcc383b73abbdf76caf712ef87c2924ad
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbkqJtb2IdqJtb2IsBqJtb2IUpYq:A3k03kHR+RcfkZckcfX6
- TLSH T11F161915F6788362D07BC0B9C6D2AA9AFA33344157708ACB12C5D73C2F276D5897A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 4.7MB
- SHA256 0b44c5572355aa6cc9a38a3c7d1e85b099c85c11918c3b74f0fb0e664dc8682f
- MD5 0aff2db1d00055992494c605a8bbc7e0
- SHA1 80cccc002c06c081928acd391fac3479c7e882b7
- SHA512 638970a880db811d16d594ff32bcc3d9b6fd9b31eb8fc7c4415fb991583142c60e869890934b485f071f2373505947af2756d0734b6c8b8c8e0c90bb5b5f373d
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbkqJtb2IdqJtb2IsBqJtb2IUpYqjPji0Aj:A3k03kHR+RcfkZckcfX6Gjo
- TLSH T1DA361915F6788361D07BC0B9C6D2AA9AFA33344257708ACB02C5D77C2F276D5897A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 4.2MB
- SHA256 100d4c5b095a07b8e931a549f8c465c12550eaf8243102e5f6318d41b09116c3
- MD5 62db8e33ddcea2b47ed028c40e2ed087
- SHA1 f55c3784c1e907a1f1dac3a51d9eaa40396e6968
- SHA512 70de3c289d920548b9d5868c940804ef62099cf489344fd4f136462152b1a7fdb38637fac492476b17ee2b172e126b3f27c99e2ca3469c19ca661832b8860330
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbkqJtb2IdqJtb2IsBqJtb2IUpYq2:A3k03kHR+RcfkZckcfX6X
- TLSH T119161915F6788362D07BC0B9C6D2AA9AFA33344157708ACB12C5D73C2F276D5897A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe
- Size 4.2MB
- SHA256 fca0a7464eae8703ef7951f04cf76bda8fd78e55f257f4893b278eba5921c24a
- MD5 c0669fdecbd9542fc88805a874d6ded1
- SHA1 a317461573889c4f323c971907c1f93856b9e3dd
- SHA512 9dab1d3e5fc1394a0f4d11ad9c53a3553560370cbc0e0cb71c892cf83d4824e00abf4551b9e4c5d7fd8396af5e66240aa54a077c5b9af5cc0f592e0119aac31a
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbkqJtb2IdqJtb2IsBqJtb2IUpYqT:A3k03kHR+RcfkZckcfX66
- TLSH T1F1161915F6788362D07BC0B9C6D2AA9AFA33344157708ACB12C5D73C2F276D5897A732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 4.2MB
- SHA256 78d5810e5aaab1a8fccb34bff174bade4d53f6e61d4baff7863523088b8194dc
- MD5 692e81f25480cafbb977bd72838b03f7
- SHA1 3a1477906c8f8a770bf66d7002aded9eb3b61da4
- SHA512 4976bfed0233f9e160cd5af505640ad5965a76547b8f2fad591b361c6006f071d68da5905464fe784195bf06f0b892310c8002030f8fd06373b89a0e9feb6d9d
- SSDEEP 49152:A3k03kHRJARJaeW4SkZP4sz9MbkqJtb2IdqJtb2IsBqJtb2IUpYqt:A3k03kHR+RcfkZckcfX6Y
- TLSH T109260815F6788362D07BC079C6D2AA9AFA33384157708ACB02C5E73C2F376D59976722
- MD5 SHA1 SHA512 SSDEEP TLSH