Analysis
- max time kernel
92s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 08:52
Behavioral task
behavioral1
Sample
2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe
- Size 2.0MB
- Sample260810-ks87favenf
- SHA256 04df9449c7fb1ac4335ad0d24dbc595e8037676b31d26da37d1f76f68ece69fa
- MD5 0b822fb50f2e85949eb51d9008baf45c
- SHA1 8e2af064df96387f63522d35444f659f21821934
- SHA512 0b3ed71eab8e4bd3fa2c7d0d1ae7474cd0cdd3b70930c25d715a38d5bb6a588b269fa44513242e49c9ced641a41fb28a036f556ab1d6bcf1ed4445ac229c9158
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ+zyuLaEZIgZAYTqMi8CtBd2QHCHmTBW5X0Le5jiS:A3k03kHRJ3DqJtb2IQPji0Aj
- TLSH T19BA55B16F6A44375D073C0B9C5D2AA9AFA7234421B308ACB1385D76C2F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/2412-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000242e5-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4924-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2412-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4924-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023454-323.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021285-325.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002600000001e91e-1256.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00150000000202bb-1529.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e502-2073.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000242e5-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0003000000023454-323.dat aspack_v212_v242 behavioral1/files/0x0002000000021285-325.dat aspack_v212_v242 behavioral1/files/0x002600000001e91e-1256.dat aspack_v212_v242 behavioral1/files/0x00150000000202bb-1529.dat aspack_v212_v242 behavioral1/files/0x000200000001e502-2073.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4924 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2412 2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe 4924 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_0b822fb50f2e85949eb51d9008baf45c_amadey_cobalt-strike_elex_hijackloader_icedid_njrat_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2412
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 2.0MB
- SHA256 04df9449c7fb1ac4335ad0d24dbc595e8037676b31d26da37d1f76f68ece69fa
- MD5 0b822fb50f2e85949eb51d9008baf45c
- SHA1 8e2af064df96387f63522d35444f659f21821934
- SHA512 0b3ed71eab8e4bd3fa2c7d0d1ae7474cd0cdd3b70930c25d715a38d5bb6a588b269fa44513242e49c9ced641a41fb28a036f556ab1d6bcf1ed4445ac229c9158
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ+zyuLaEZIgZAYTqMi8CtBd2QHCHmTBW5X0Le5jiS:A3k03kHRJ3DqJtb2IQPji0Aj
- TLSH T19BA55B16F6A44375D073C0B9C5D2AA9AFA7234421B308ACB1385D76C2F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 2.5MB
- SHA256 33065e0e872c5393c9216fe132580b79331a29ffe3aa7153a6fc8438c881db0f
- MD5 eff833ea3bac5fdcf65d975408f1a8ea
- SHA1 4881caf7e3c8cef278f5a6b4a9c9cc4dc81bbf7f
- SHA512 474d9d40bdf9ece8c0052aa122a05ff51c615d56259316738b8a79883e426403ea086316cd5a1894bf80b6dde88fef8b178e644295bb6538fe829d38738eacb2
- SSDEEP 49152:A3k03kHRJ3DqJtb2IQPji0AjoTd9CHKyao:A3k03kHRNDZjoKCqo
- TLSH T1BDC56C16F6A442B5E073C179C9E29656EA7238421B30CACF1385D72D2F377D19A3AB31
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 2.5MB
- SHA256 0f23d7aa7e5940374227f04d261983b67fd648a64b856067ede1f1b8fea511f1
- MD5 aed21282b48b8864aceacc2c073a719c
- SHA1 8649ec1a561e52104b8db54e3f6f7de0f2838136
- SHA512 e97f3f61c4cb70fd4a87c0fa1c235dbd8ca7220d46557da20e245d13164940c5935dce30db470c96341533779eaf338116e3de1c04f10cee3ff857a54cfe02b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ+zyuLaEZIgZAYTqMi8CtBd2QHCHmTBW5X0Le5jiI:A3k03kHRJ3DqJtb2IQPji0AjKPji0Aj
- TLSH T1E6C54B16F6B44375D073C0B9C5D2A69AEA7234421B308ACB1385D76C2F277E6DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 2.0MB
- SHA256 ec2adf6ae1b7b99ef0b57ab074c082290178fbf331eafab5d949da1607b5c911
- MD5 2020497b6bf539d3deba452655368150
- SHA1 458a6bd3153d641d1f87f24ca94b76135d82ebc4
- SHA512 071f21ff7242fa0be3acf14fef11fa11edc2e1f971dfe17b4fc10cd91ae1945b6d7bf37b52e4dfb906d50cb7491486735c0f50df45196c788ea633e416c91c92
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ+zyuLaEZIgZAYTqMi8CtBd2QHCHmTBW5X0Le5jiE:A3k03kHRJ3DqJtb2IQPji0Ajq
- TLSH T1C5A55B16F6A44375D073C0B9C5D2AA9AFA7234425B308ACB1385D72C2F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$
- Size 2.0MB
- SHA256 b0548d24e45db3bf9dbc53a65a2a877ea5e68d8467019dccc18486af081d5046
- MD5 fbf657f8906c3da0b7b8ca91dd50301e
- SHA1 13fb5589b5a93609a190f9bceb5bc67c62cfe412
- SHA512 f70f214757c1b657b3f4aecb3ed054af25c55f953826802e9d5c07144ef4d77d2bf90ffeca84a97d507fe7c3204ced751b794f0cb30bc9dcfd343d1fe87d55b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ+zyuLaEZIgZAYTqMi8CtBd2QHCHmTBW5X0Le5jil:A3k03kHRJ3DqJtb2IQPji0Ajj
- TLSH T156A55B16F6A44375D073C0B9C5D2AA9AFA7234425B308ACB1385D72C2F27BD5DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$
- Size 2.1MB
- SHA256 830ba092e00053b820dd9c323a63643dbc06080c1f857b088fdcee33c5d96d9d
- MD5 562d611a7f7cc9832ce0e45574827e9f
- SHA1 7f6b89bb8238e7613b6fca3a79709e624a53b6ce
- SHA512 e8459a2ad6576a6dff96a7c5373c6c58ea28171eee88401e3ae051c3f21671d2bc3d4c06e06c492e2119068a612a86be703c68429576072f244b20612a0e1645
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ+zyuLaEZIgZAYTqMi8CtBd2QHCHmTBW5X0Le5jiE:A3k03kHRJ3DqJtb2IQPji0Ajq
- TLSH T13BA54B16F6A44375D073C079C9D2AA5AFA313C821B308ADB1385E7292F377D59A3A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 2.3MB
- SHA256 8174885621a28eac0672d2366d4b79010c86d75aaa5960f23c5b9b30cadbe2cc
- MD5 7e9bc641105cbcc52d8255703c1fd9ac
- SHA1 9070166f7404ec083555dfdac097568974a725b3
- SHA512 d7784554266967a5c4035c9f7781d9f2fed65c014a637bc7b57170d8bd1f64d0a596c93c096f9ee426e6d6a3c77183e4c93cd896f0f9e270593a0d9cd75e02db
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCZ+zyuLaEZIgZAYTqMi8CtBd2QHCHmTBW5X0Le5ji5:A3k03kHRJ3DqJtb2IQPji0AjYi2WH3
- TLSH T16FB56C26F6A44375D073C079C9D2A65AFA3234425B308ACB1385D72D2F67BE1DA3A731
- MD5 SHA1 SHA512 SSDEEP TLSH