Analysis
- max time kernel
94s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 14:21
Behavioral task
behavioral1
Sample
2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.4MB
- Sample260803-rn3mes1hpc
- SHA256 806f4ed97545bf48d652c5fedaa1a97e06fe014510ffc7be3c57f3c6cb940b56
- MD5 8cd83c4a7833aec673124acfb9fd184f
- SHA1 970ba9f0fc6728a4978d3b600c6fbaacc6493903
- SHA512 af75f8b326f029d6038d3ebf3052f38b4bcf63da28878c974c52401ab198f5c8d455abec3f2eaa259ee9df7afc78642e0ce73c67f5b8d737513768a286dbc58d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRags62+55jcAkSYqyE:A3k03kHRJSpYq
- TLSH T1FB658D17F6A445B5D023C1B9CAD29A66EE7138461B3097CF1358C3282F63BD1AB3A375
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/1756-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243ce-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5004-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1756-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/5004-65-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021511-655.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x005300000001f2fd-656.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000216a2-1267.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00150000000202e1-1529.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021461-1880.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243ce-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021511-655.dat aspack_v212_v242 behavioral1/files/0x005300000001f2fd-656.dat aspack_v212_v242 behavioral1/files/0x00020000000216a2-1267.dat aspack_v212_v242 behavioral1/files/0x00150000000202e1-1529.dat aspack_v212_v242 behavioral1/files/0x0003000000021461-1880.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5004 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\WinStore.App.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1756 2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 5004 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8cd83c4a7833aec673124acfb9fd184f_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1756
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5004
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.4MB
- SHA256 806f4ed97545bf48d652c5fedaa1a97e06fe014510ffc7be3c57f3c6cb940b56
- MD5 8cd83c4a7833aec673124acfb9fd184f
- SHA1 970ba9f0fc6728a4978d3b600c6fbaacc6493903
- SHA512 af75f8b326f029d6038d3ebf3052f38b4bcf63da28878c974c52401ab198f5c8d455abec3f2eaa259ee9df7afc78642e0ce73c67f5b8d737513768a286dbc58d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRags62+55jcAkSYqyE:A3k03kHRJSpYq
- TLSH T1FB658D17F6A445B5D023C1B9CAD29A66EE7138461B3097CF1358C3282F63BD1AB3A375
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.9MB
- SHA256 dea7d83d0ea3840fe65a2b51853265604f0e2f19856b8cd53e1137d080394776
- MD5 1661cf0a151b37ef9b672887e002e0eb
- SHA1 d827659cfc43424087f2e71f4c3563fc54028b56
- SHA512 48c5e51c7440716dc56960cbac301ef06b96ee60e5b4461663caeee7596877e1da87bbb8160b97724140c418938efc1addaff31584e3c0521b29cde89217847a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRags62+55jcAkSYqyEX3Td9CHKy7z:A3k03kHRJSpYqHTd9CHKyao
- TLSH T100957C12F7A405B5E073C175C9E29656EA7238461B30CBCF1398D6292F33BD19A3AB71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{74A5E9DB-42A6-4629-9DA9-DE27556EBF1E}\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1.5MB
- SHA256 c7ddf27ddeb15d16c3fb29fd2b2cde2912226190e1540a3339f94e1714c17ead
- MD5 6c885548294cab71b845d0a28297c2c5
- SHA1 08470cf84ed859020322b043781111dfa25102c7
- SHA512 d4a3636946cc003cd46a005baad55b30d9a4aa4097b9c62b70881938270e4ef81b5b58901d870a9195eada924c8b9ed6cb2846d27454c1d3f3e0125bd5987b07
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRags62+55jcAkSYqyEZbBPzBAU:A3k03kHRJSpYqtBPVAU
- TLSH T12E759D17F6A445B5D063C178CAD29A66EE7138461B3097CF2358C3282F23BD1AB3A775
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.9MB
- SHA256 ac5712dc88ba58a79a824b45940fbf2221a6016511a3448748bca57e232de3c6
- MD5 97e52ea9339c946a1a0e4762c5b7c9f0
- SHA1 28784675f9e979771e14722db16858f365e14696
- SHA512 6a16bb72e6a9dae13acd478d2880febdeef9a3d2f35406d6194bcfa5784bf6e7fc29937a2556bea8cb5061c6170c715bbbdec8bfe6a06a95563b0286c9f3ea91
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRags62+55jcAkSYqyED0Le5ji0hmM:A3k03kHRJSpYqjPji0Aj
- TLSH T13F957C16F6744275D073C0B9C5D2A69AFE7134861B308ACF1389C7282F67BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 1.4MB
- SHA256 70abb1548b8a7a75226c4f73cc7a5c188eec8bcdd6f09ca45de1e5e45119fb2c
- MD5 dabf9b1999b268a9a96f8b02aa9d5a8b
- SHA1 097273f4bf99033d5a29c92dd088779eaae04f8f
- SHA512 ac8cf7f862f08306ac2db3421f6d064c6c15515f191f539b92c9dbedf9d2c268bdd5eff5862767c5b6fe309f67171456e024e0f1ad4b62f54dedbdcae252061a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRags62+55jcAkSYqyEsQ:A3k03kHRJSpYqj
- TLSH T1EC658D17F6A445B5D023C1B9CAD29A66EE713846173097CF2358C3282F63BD1AB3A375
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe$
- Size 1.4MB
- SHA256 c31d4dd8fd4a009a61841e6c8177c9eccf5e2101bd5907dcdb97c8195fcbdcac
- MD5 415aa8c814a29196219feb7e656f1817
- SHA1 39ea5ff6bd0d511ac182cc3cae17a81a0dcd2a35
- SHA512 4c26ab24f2a1dcf89bce9e679ebe0cd9f715ff3d0cae9330c87779116ed0d2c35f5a0b6b64476e61824c17cdd3679a32ba13c1ca0817090ac28904bbf434e91f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRags62+55jcAkSYqyExt:A3k03kHRJSpYqT
- TLSH T127658D17F6A445B5D023C1B9CAD29A66EE713846173097CF2358C3282F63BD1AB3A375
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$
- Size 1.5MB
- SHA256 b3be0f22371bb0a3cc7d30d2a258a66695166b8aea079e6422d587ef0d66516c
- MD5 5e3a8f32976327fbb17439b4b6fb1ee6
- SHA1 b3a1d349853abae1b13c149c28ae3f17157cdd11
- SHA512 3c4875bab370cf0f0849a15fcaaf242542a9c328652b3861cc5820169e23da1690b6cafcc2fae0c2f6247a9c85f73520f353a88ca38fc87ba2558bc8f22385ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciAbRags62+55jcAkSYqyEPF:A3k03kHRJSpYqt
- TLSH T10B757C13F6A405B5D063C174CAD69A66EA313C861B308ADF1358F7282F337D1AA3A775
- MD5 SHA1 SHA512 SSDEEP TLSH