Analysis
- max time kernel
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 16:31
Behavioral task
behavioral1
Sample
2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1.0MB
- Sample260807-t1g8csstev
- SHA256 fb6455790742d92a0824c2b6d6571d03e76022af047fef71418e764b70e5eb4c
- MD5 158aa82fa2d1bdcfdbecb9ac559ddb08
- SHA1 5137e4be80ae38b8a7ec3c91c8758f9459f09883
- SHA512 1f62c89defb52b8dedd015424e086cc2413986deec589912ffbc35cbdaa6c9bb2a07ed6238e37d094f8278c101e74e83c64db47121e412ee140c800b698bbbd0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFpF:A3k03kB56rn
- TLSH T18C355A03E6950FA5D64F81309E954662EA377D821F2097EF2358BF253F327C06A39297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 9 IoCs
resource yara_rule behavioral2/memory/3012-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c586-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3012-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1536-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000019cac-1026.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c0000000066a8-1877.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c586-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-348.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-346.dat aspack_v212_v242 behavioral2/files/0x000e000000019cac-1026.dat aspack_v212_v242 behavioral2/files/0x000c0000000066a8-1877.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1536 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 1536 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_158aa82fa2d1bdcfdbecb9ac559ddb08_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3012
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1536
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1.0MB
- SHA256 fb6455790742d92a0824c2b6d6571d03e76022af047fef71418e764b70e5eb4c
- MD5 158aa82fa2d1bdcfdbecb9ac559ddb08
- SHA1 5137e4be80ae38b8a7ec3c91c8758f9459f09883
- SHA512 1f62c89defb52b8dedd015424e086cc2413986deec589912ffbc35cbdaa6c9bb2a07ed6238e37d094f8278c101e74e83c64db47121e412ee140c800b698bbbd0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFpF:A3k03kB56rn
- TLSH T18C355A03E6950FA5D64F81309E954662EA377D821F2097EF2358BF253F327C06A39297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{E03D5D6C-388E-4B12-B85B-347D19A529BC}\MicrosoftEdge_X64_139.0.3405.125.exe$
- Size 1.1MB
- SHA256 0fd0d5b42094346433564dee8f1be4843d633213091ca61678f589950572b527
- MD5 a5fed82fd7c1d061809e244babcc9450
- SHA1 8c307933ef4b960f892a1f6e35791d8b2ac4608a
- SHA512 577941fc60e1cfa13f9a12469d6bc5d36bda247a51fc14ae771fe795211ca20df6676601cb98a65bd1a552f65be60fb519b6b816173cd6c2a71506c3313941c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFp/bBPzBAU:A3k03kB56rtBPVAU
- TLSH T156457B03E6950FA5D54F80309D958662EA37BD421F2097EF2358BF253F327C0AA3A657
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.6MB
- SHA256 434e0407ab5ea5d78e941477648e0d48e8c4a2991d896c6ea0dfc4a097f691b7
- MD5 4d5d0d8b77ed14a517ebf4ea501e3f25
- SHA1 6e5d80c2eb4b0dd31adec953ea348182d1a9d490
- SHA512 1d6da0fe0a58f2a60be58aa5971a00f1f0f5a88e1495c2429d14e86a49cfde1fc98b77e8c3ab3d003072c594beeb63c7f2d598f25831bffa741d523c06f1a25f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFpB0Le5ji0hmxNrM:A3k03kB56rjPji0Aj
- TLSH T179754A16E6A44B65D06BC074C9D69666EA333C821F3087DB1354BF283F337D1A63A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 1.0MB
- SHA256 838095a6c5a4d33320fb923a8b49619ceec4c8b17fa21b6b2548cec35a40c25e
- MD5 4bbb0ad976d0acd03bdfa7aa0f9c218d
- SHA1 55a8f847977a5ff37d75b904069186e8ac891726
- SHA512 409b42e56f90c62a3473ee98a1e481f59247a0570c795d459c18ebfa1ec512ecfc8755b3030286bc3194e0b212fdcebbe14a4c97506f801ada5b9cc225500051
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFp60:A3k03kB56rh
- TLSH T160355A03E6950FA5D64F81309E954662EA377D821F2097EF2358BF253F327C06A39297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$
- Size 1.0MB
- SHA256 93f43bf4aaf21a85a4b4caecfd46d24751b63b42d35e9127cd65c9f6831fc3f0
- MD5 9a4fff1b626258ba92c5d32824241e26
- SHA1 22d69d4cb6b55d8250f39dfb13fafa4b32fbd9ba
- SHA512 4a5ba00d9d586db5a90f74f3f04f4d2739dee7e1d2a878eccf6b3bd80d55e79bf0d8e6da6f90f790dd5e96e1e658e66f69227363e6d48f4ec35ebf807b582cc6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFplk:A3k03kB56rI
- TLSH T128355A03E6950FA5D64F81309E954662EA377D821F2097EF2358BF253F327C06A39297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$
- Size 1.1MB
- SHA256 ade5223b8dc5dfd57df68bf056223858ea9da6261d3466b28887d2ff60ba96b3
- MD5 2e813875f6928f6eee3f5a3df131bb84
- SHA1 e8bbbc53094527491ba6772e94bede6df4e8423b
- SHA512 7af830150c073cf8f812be6a45ad1606eb487c75a0cd678e28e0d138f964c8f174e45890240aa6a7ea3ce8569cc1c9b5b91ac351719ba3543e457129293489ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQzmFpcwE:A3k03kB56rk
- TLSH T158356A02E6950FA5D64F81309E968662EA377D821F2097EF1358BF253F327C07A39257
- MD5 SHA1 SHA512 SSDEEP TLSH