Analysis
- max time kernel
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/09/2026, 09:50
Behavioral task
behavioral1
Sample
2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 969KB
- Sample260924-lt9d9ssdja
- SHA256 85c46ddda4c4ab9945f91ac90f689beba7be3e388de2e586a23996478b0ad38f
- MD5 44cf78f9d2319ad12310a4911d011ac6
- SHA1 485144f963431fe15610731ac091cb0197a0918f
- SHA512 19482369414325b699cb96c65b458a92904310c2da871351c896810bb4590d830935da1cea7a9b823ef57938a7fee057b5f7012ee591b5f464e95ab5d9b43774
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9hOIc0+:A3k03kHRJARJ
- TLSH T15D259E17F79900E8D14AC1789AA68A22EB757C56173093DF2358C6152F73BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/2384-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000f00000001c47f-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2384-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4752-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb63-206.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-243.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb63-406.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019eb6-775.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d000000019cc6-1031.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000f00000001c47f-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d0-11.dat aspack_v212_v242 behavioral2/files/0x000200000001bb63-206.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-243.dat aspack_v212_v242 behavioral2/files/0x000300000001bb63-406.dat aspack_v212_v242 behavioral2/files/0x0004000000019eb6-775.dat aspack_v212_v242 behavioral2/files/0x000d000000019cc6-1031.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4752 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_107750\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2384 2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4752 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-23_44cf78f9d2319ad12310a4911d011ac6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2384
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4752
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 969KB
- SHA256 85c46ddda4c4ab9945f91ac90f689beba7be3e388de2e586a23996478b0ad38f
- MD5 44cf78f9d2319ad12310a4911d011ac6
- SHA1 485144f963431fe15610731ac091cb0197a0918f
- SHA512 19482369414325b699cb96c65b458a92904310c2da871351c896810bb4590d830935da1cea7a9b823ef57938a7fee057b5f7012ee591b5f464e95ab5d9b43774
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9hOIc0+:A3k03kHRJARJ
- TLSH T15D259E17F79900E8D14AC1789AA68A22EB757C56173093DF2358C6152F73BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 de13573c8a09d03a98f71afae94b34906b64f44aa124b068bb2c3eb3869c7c21
- MD5 7b60a5ac2a5964edcaf98939e4432b0e
- SHA1 fd81eac1a80774a2e6eb4887632f7ba1d6fb47b4
- SHA512 f84c3bd628f06bc507f599f1112b51288302bf3d69a5c5f8bcb1df48e5aed1e3969042f58fe9267cfb25075d4e6b66733864d8f1f0852ac0938d1e5bd6a2049b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9hOIc0+P0Le5ji0hmxNrM:A3k03kHRJARJsPji0Aj
- TLSH T1C4757C17F6A802B5D067C1B8C9D29A5AEA713842173097CF1358C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 993KB
- SHA256 937db607521747afa595d204e63c0c4d1818789b702588265a59580e19a46131
- MD5 3804fefceae1dcbe2b1670fda2962994
- SHA1 057732e69b4d8e7ddf05fd3c04c827308285410b
- SHA512 ef91304e7dcde6c432c627a14fc65a67943a43d65d26dcfca961a43e1f9a685899418a71a76ca9128bfe871af093d07cf40c5976c9acb8abd63db6c9501f7653
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9hOIc0+C1:A3k03kHRJARJd
- TLSH T128259E13F79900E8D14AC1749AE68A22EB757C56177093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 993KB
- SHA256 99fecab3b75535ef134a4a3b8b239279445d14c87a16cadfa7b6f2de49f35e79
- MD5 92a01b0c96cadf685e612b395f6cbd33
- SHA1 c8f9e3e00517c42e6e18c3f677f950717fc7dc1d
- SHA512 6a0a28409767349c457f0810e084af7b770ed1fb32c8157b4b15b00c5ad94bd3aa430f8a713443769476b0fc45b51ac7a4fec598912f2d27f460fae467dcfde2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9hOIc0+8o:A3k03kHRJARJu
- TLSH T153259E13F79900E8D14AC1749AE68A22EB757C56177093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 993KB
- SHA256 d2b671025c1b64c7f020a38ac99e34623123392d746113f7ef00233050c37c5c
- MD5 87770ff6e3ed4378afe0c83d10e2b430
- SHA1 35adf7fcb51f2ea5cb49ec88bdb47f3f5ef13ac1
- SHA512 1df1794d37230b70d901169956373332047eda8e4d2ae9b57c0ef044b177f38b50c7ed05037707a66bc31a80fa665bde98bd1e1b3429b8164442d38b18b71128
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9hOIc0+Tu:A3k03kHRJARJf
- TLSH T13B259E13F79900E8D14AC1749AE68A22EB757C56177093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe
- Size 1.0MB
- SHA256 7b85d80e0a5f7ab00c6e2f0b19d9ca891eaa3656f12dc8a4937b4f7882788a1b
- MD5 d194ee4be05c21f256c86cbe90d3b261
- SHA1 ad7b55d7e39c55bb0e2e2845a40e4100c343f089
- SHA512 d2aef8541b47896f872d76e9be5dbb07a305ebf1f440dc7ec1cac6150680efafec21438f3f620911bf5cf0d1c5bc9f12388586b7137974fae392dc17d145496a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9hOIc0+6:A3k03kHRJARJr
- TLSH T1F8259E17F79900E8D14AC1789AA68A22FB757C56173193CF1358C2162F63BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1013KB
- SHA256 52561627536999dfe9e171659f5312e58a02df5727e1e41f8f99c322ca2225a1
- MD5 9612ccbbd927988ed24d2d78b8c65a8a
- SHA1 59b1d2c8db8c5bd370978d5ad1aae3b7acc2b2bf
- SHA512 35116bd11264dd87fb6d486c8fe879e94d4bfbd173c3bed3f20dea233cac7be0f23128ff7d6679b5473008928049ec108e8e8d6211ed3b2b919d2bdd70059e76
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoo9hOIc0+SwE:A3k03kHRJARJ5
- TLSH T1C925AD03F79900E9D14AC1749AA69A23FB757C56172093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH