Analysis
- max time kernel
108s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 05:35
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.9MB
- Sample260730-gafwdscd72
- SHA256 9ffff38892680cbc492772f56945868e699c8b761adb7a1c31c6ce40d6af2693
- MD5 60a2095cb9753cb1ef5ee819e4c96b47
- SHA1 1ec9ba98b87ef84b49d9a9c99d4104b7caaecf28
- SHA512 0e83d04bca486e20bde8adde93828578cc2e1d559f747be61a5e9bed760c06c4b1cf3cf9f13e68c1cab7df1ddad4eeb64fd1c8f6d75c01ac461dce24b52663d9
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaiopr/sCv7rTiw24DtD+qBAaiopf:N7iw2G+q7iw2G+e
- TLSH T123954B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 10 IoCs
resource yara_rule behavioral2/memory/4928-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c524-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-359.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019fe4-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9b-1268.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4928-1509-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3668-1534-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066a5-1787.dat INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 3668 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{ECFE93F7-0E0D-49A5-A40C-A888E035F269}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe - Drops file in Windows directory 15 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4928 2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 3668 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_60a2095cb9753cb1ef5ee819e4c96b47_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4928
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3668
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.9MB
- SHA256 9ffff38892680cbc492772f56945868e699c8b761adb7a1c31c6ce40d6af2693
- MD5 60a2095cb9753cb1ef5ee819e4c96b47
- SHA1 1ec9ba98b87ef84b49d9a9c99d4104b7caaecf28
- SHA512 0e83d04bca486e20bde8adde93828578cc2e1d559f747be61a5e9bed760c06c4b1cf3cf9f13e68c1cab7df1ddad4eeb64fd1c8f6d75c01ac461dce24b52663d9
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaiopr/sCv7rTiw24DtD+qBAaiopf:N7iw2G+q7iw2G+e
- TLSH T123954B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$
- Size 2.0MB
- SHA256 feaa6dc5f046c377cc631ab60cb9de22031128e30f127237a49d75cfbb6dbaf3
- MD5 1249706a8ec0f32b0f3bf08051940292
- SHA1 5c62547ab2ad16d310a57ec5471685bfd96636c3
- SHA512 f92778122864cb4f0f7ec09686658f6dc791e47ff2f9b00a67b2118eb7e4e8984607f110500f6cd3281455f7e7e00b31f6ae3548c14a68b9909d1558f00ab642
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaiopr/sCv7rTiw24DtD+qBAaiopoGsrzBli:N7iw2G+q7iw2G+gsrVli
- TLSH T103A54C1777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.4MB
- SHA256 177ea50aeba2ff44e9370c649bb2f4a5e1de85cd4e5e7987a7d40d96a675f009
- MD5 259db54d8ac7827cb61aca885df22c59
- SHA1 937b041cdc5a2d2546ce0fd937077f6311edb7e7
- SHA512 9394b2e3401f6a4e8278dd96e6b5dd29b9ba72cf4a2a5a057f0c8f9b2eb0fa5a449fc3ea3e0a46ac0a276e5d8d2c75c526804a4b645ee8252239004cb6a64323
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaiopr/sCv7rTiw24DtD+qBAaiopL0Le5ji0hmxNrM:N7iw2G+q7iw2G+OPji0Aj
- TLSH T11DC55C27B7E84565E073913088F5965AE972B8451B30C6CF12A8CB3C1E73BF1AD39726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 1.9MB
- SHA256 8dbae51cdfb26edb68ed390f5dd435dc833da33afeb7ec490d21824c878a91a5
- MD5 0b7d8da9ce54d3896996ef4d369e4ded
- SHA1 d45e2d0357f204f3cbf9c385b0c80ccead7e4b95
- SHA512 accd4994848105522b7bab5d07ed8c69ad7127e6dbef07cd6f4cc005a2900a7950f2d2615bf17c52471bc77618ce122a689cfc01f09c6816aeb58081cf5df2cc
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaiopr/sCv7rTiw24DtD+qBAaiopwn:N7iw2G+q7iw2G+/
- TLSH T1FF954B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe$
- Size 1.9MB
- SHA256 c722995ca5243fbe85f030146f34c6c86ae6cb4003a4f7893019d020d44ad6a8
- MD5 1588365019671a7602ae4efcdf7dd26c
- SHA1 318e11728f5a0023a12a66a104ecf2f98ed63c13
- SHA512 d25c230f9d5e7fa76a4bc8b3c7d5ccb39cbe9022775b6a00110ca991d0a09af52505c369d8828371600f1956ec900dce63667e2c56967b3a1be34baf27fc3c4a
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaiopr/sCv7rTiw24DtD+qBAaiopSr:N7iw2G+q7iw2G+d
- TLSH T1E1954B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$
- Size 2.0MB
- SHA256 f0026c4acf3758291ba142b672a7b6def70e65bcfd3ad40143166aa3fa75f0e9
- MD5 d9498687a65da8802a4029ce1977bd9f
- SHA1 d56e51c86e5362ca1bac16f072fb568ffeb46c68
- SHA512 66a919c615aa3702373803cb047dd126eb913e8ee32daf16a8284a87bd776588ede1c3e00feb6609080c84388058fd60848fb0ef7230f839ab336e77fb557fa1
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaiopr/sCv7rTiw24DtD+qBAaiopHF:N7iw2G+q7iw2G+2
- TLSH T18D954B1377E84861E5A3613088F98656D976FC550B3086CF226CAB3D1E72BF17D3872A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$
- Size 2.5MB
- SHA256 3c4888a6d84fe6dcd1b6f07850cfadbe435e0120942928aaa2a38fc9e8d5cd75
- MD5 ea3dbd2ef37f44ba417342deeb86c10c
- SHA1 bf4eedf8e3f810fac075d69b4edf6f8f5deb6865
- SHA512 2954d88e5bb9923f3ebd939722aefdcab9decac65dd0dd746849f42121ead7a62bc787994a96d587c3dabef6bd751e480a92c04c1a4befb5a776aca03df4826a
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaiopr/sCv7rTiw24DtD+qBAaiopTMRIWmfvD09Zm757fP:N7iw2G+q7iw2G+RIWmKmd7DAS0S
- TLSH T156C56C1377E844A5E567513088B98626EA72FC551B3082CF5268DB2D1F33BF17E3872A
- MD5 SHA1 SHA512 SSDEEP TLSH