Analysis
- max time kernel
97s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 16:25
Behavioral task
behavioral1
Sample
2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe
- Size 1012KB
- Sample260813-txc48stflc
- SHA256 d78db617a601c7e44762a396f5c280f7f26b211fcd2df168864ba577dd08f7f7
- MD5 ddcda4c2732790aa36fedeee7c3c86e5
- SHA1 2a364e7d05e5e287fac592b9a561df0b55b167ba
- SHA512 944a930594c8a02c52a83927c46d5d95a781ea78642c81a1fdfc9cda8ff8a4405278105eb0afd26738d45fc4e4dd5bedf7d5235ac1383e175b2e3d172db3bf7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV2+:A3k03kHRJ2+
- TLSH T1DF25AE13EA9504E9D10AC1749AD58A33FB75BD561B6093DF6328C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 11 IoCs
resource yara_rule behavioral1/memory/4572-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245c3-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e69b-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4572-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4052-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126c-364.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x003b00000001f2b6-469.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002195e-1011.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a000000021638-1013.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000002023a-1380.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000245e4-1599.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000245c3-5.dat aspack_v212_v242 behavioral1/files/0x000300000001e69b-11.dat aspack_v212_v242 behavioral1/files/0x000200000002126c-364.dat aspack_v212_v242 behavioral1/files/0x003b00000001f2b6-469.dat aspack_v212_v242 behavioral1/files/0x000300000002195e-1011.dat aspack_v212_v242 behavioral1/files/0x000a000000021638-1013.dat aspack_v212_v242 behavioral1/files/0x000a00000002023a-1380.dat aspack_v212_v242 behavioral1/files/0x00070000000245e4-1599.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4052 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe$ 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{51A7B87B-57A4-493D-87A7-45DD03C49092}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4572 2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe 4052 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-13_ddcda4c2732790aa36fedeee7c3c86e5_amadey_cobalt-strike_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4572
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 1012KB
- SHA256 d78db617a601c7e44762a396f5c280f7f26b211fcd2df168864ba577dd08f7f7
- MD5 ddcda4c2732790aa36fedeee7c3c86e5
- SHA1 2a364e7d05e5e287fac592b9a561df0b55b167ba
- SHA512 944a930594c8a02c52a83927c46d5d95a781ea78642c81a1fdfc9cda8ff8a4405278105eb0afd26738d45fc4e4dd5bedf7d5235ac1383e175b2e3d172db3bf7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV2+:A3k03kHRJ2+
- TLSH T1DF25AE13EA9504E9D10AC1749AD58A33FB75BD561B6093DF6328C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.3MB
- SHA256 e3c33b3657a945d83b7482953d22fd0bf2a7c3fa94a1a62f8bacf1290d92017c
- MD5 ba1ec59101160a48f3cfa2e12ef1a56b
- SHA1 1105165b5007ef2a2d3f73a3f07034b9ef2004b1
- SHA512 c4b6397d93c3a16d3b68af9f93f32326ef0e0793625057d3d9acca37f3d45900c8f81ebb9d75ecb3b4402df6358ed90666ed3242bfdfd68493fed4d51c0aa8c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV2W3UNUpEisI:A3k03kHRJ2QUN+Eir
- TLSH T141558D17EB9808E5D11A817859D68716FB72BC520B61D7CF2364832E2F337D46E3A3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe
- Size 1.1MB
- SHA256 99b1a5ee0e2ba339e9d765ec3961554d5192d7ca221d74e9182542efd3771ea6
- MD5 f1130063bc77ddc9773b6a79758ab3a8
- SHA1 d0ff0cd08796f7ed476b5ee13149810d02cd36af
- SHA512 cfa2e636cdbe407b473076265c272fec19386592cf7ec6b3c9b91bfe7d51953a0e867b8d0c336fec7d37c87b404361f9280b66a1daedfe6b5b0908fc48f4b44e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV2wTjE:A3k03kHRJ2Gw
- TLSH T14A35AE13EB9504E9E10AC17496D58A22FB75BC56176093DF2368C2152F63BC0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 1cab4355a343c3f10aebf674e7284249dc1889b2235524955b989db454ef88aa
- MD5 7cd9014ddda958a68502aa68c1043046
- SHA1 e2ab48462d5f3330a8687cdebe64e551010d42e0
- SHA512 a0073486c2bf42fbb0057f47026d5548cd25cb39f5a2554b03af4863b0a4d52817c9ddb3964d0d28e237fb2c2181b463d540ca60ae7ecb9dabad9eaf3c01c991
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV2w0Le5ji0hmxNrM:A3k03kHRJ2wPji0Aj
- TLSH T1C8758C17F6A402B5D027C1B8C6D6966AEE7138861B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 1.0MB
- SHA256 84700c0f81bc4ad16d1317895f96d4d7335599d06f92c22355d22850ad62c5aa
- MD5 e37c62374ac27bb8170dec1e3fe80d76
- SHA1 b2e95bc35a961ad927e40470eaafea1b035b4d4d
- SHA512 25e57792f1ba715229b9459f0d7acb6c0318d41895f36097a089ca5f05111d0cadfc616c8607ce57dabb67c376aeeaaa9a8ed1d48e94b2547fa16aa8bc24b39a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV25n:A3k03kHRJ2F
- TLSH T18B35AE13EA9504E9D10AC17496D58A33FB75BD562B6093DF6328C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$
- Size 1.3MB
- SHA256 1c9133033f18464690e793210281b1badfddfc475056b04feeba405ef5330a46
- MD5 a24149ba867b9a41b16c40fe16dea590
- SHA1 4414ab6e1d77a3bb8b08ba683c79c7d4af25db6d
- SHA512 f999ade5092783c69e6b27d492e5c0425aef4c7f4cb2cf849cc57f76505f66fc459968463bfe634caecbcf0f953345e8c29bbd60d345ed1ec3c2155ee981248a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV2WZM9zFVSOu:A3k03kHRJ2WZM9zfa
- TLSH T1D655BE13E79404F9E40AC1349AD58A22EB75BC561B60C3DF236892162F737D06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE
- Size 1.0MB
- SHA256 c3484ec8fa1e9ecda5a42b7636322c656cde17d6504a6990375a1114ccb325b2
- MD5 0bbd60c9777a1fbae7bbafe6b8072a44
- SHA1 2526717dd7871193237f31efa880d3e831a48af8
- SHA512 b3578fd9dab42e17e044cabf66f6c269e4f90006964c8ca7d7372a83df5412f5a5535cf35e2e8eb2bc5c60f95af7a5118bed6d1ad4030d60380acc9d44a939b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV2hwE:A3k03kHRJ21
- TLSH T12A35AE13EB9504E9D10AC17496D59A33FA75BD561B6093DF2328C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$
- Size 1.6MB
- SHA256 9162750a2a172a2c55bbc90fd4537f10dd41a5f2cc78c8fa9c9bbcace7b28b10
- MD5 c7b827a1540ca145c21a9273c17c3aeb
- SHA1 0cff2f95307d7385b25f1813f25ed1f17e4e63ee
- SHA512 26d1d18ae2f1e1c583019f6ce07cdaa710e99936fd52c750b1523cee7e7a8753d162b63c70a037f7a97f9c4aa6a8ad1378840fc2a8401f60d57f8ee303f2db47
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsciKImWfVV2w3N+tCn50ChWdArKV:A3k03kHRJ2w8tDZqrKV
- TLSH T12F758D47EBA405E5E116817496A6C672FBB6B8421B2093CF5354C22E2F337E06F3E764
- MD5 SHA1 SHA512 SSDEEP TLSH