Analysis
- max time kernel
126s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 07:31
Behavioral task
behavioral1
Sample
2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 845KB
- Sample260629-jcm4lags2s
- SHA256 87fe24ae5c848677668d61ef8ac44569b4e06bacc9acff84888f31447de4062f
- MD5 4fa39d8724013d1675bd48100797f72c
- SHA1 981dd93028bad50b823dcdf9a2bebb4682038dff
- SHA512 1c0abb115917f8cc9a4c1fd3246bbbc47046d428707812164e32921b8214fd2cfde843b56568073dccd40b476aa4765cad79d2ba50e5ad308019dbddded1d546
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E:A3k03kB56r
- TLSH T193056A03E6850FA4D10F81749A968672EA737C121F2097DF1354AE253F72BD0AB3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 47 IoCs
resource yara_rule behavioral2/memory/2104-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001f00000001c4a3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2104-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5380-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c78-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018972-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a19-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4f-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983c-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a4c-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-300.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-313.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-365.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-514.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-575.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-618.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-643.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-716.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-760.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-804.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-812.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-843.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-971.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1027.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1072.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1109.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1122.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019d42-1237.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019d3c-1361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019d3e-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b1-1865.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001f00000001c4a3-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e4-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c78-59.dat aspack_v212_v242 behavioral2/files/0x0004000000018972-202.dat aspack_v212_v242 behavioral2/files/0x0004000000018a19-209.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4f-228.dat aspack_v212_v242 behavioral2/files/0x000400000001983c-230.dat aspack_v212_v242 behavioral2/files/0x0004000000018a4c-262.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-281.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-300.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-313.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-332.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-345.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-365.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-378.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-398.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-489.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-514.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-575.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-618.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-643.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-716.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-747.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-760.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-804.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-812.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-843.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-874.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-913.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-926.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-945.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-971.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1027.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1072.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1109.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1122.dat aspack_v212_v242 behavioral2/files/0x0003000000019d42-1237.dat aspack_v212_v242 behavioral2/files/0x0004000000019d3c-1361.dat aspack_v212_v242 behavioral2/files/0x0004000000019d3e-1393.dat aspack_v212_v242 behavioral2/files/0x00020000000066b1-1865.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5380 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2104 2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5380 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-27_4fa39d8724013d1675bd48100797f72c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2104
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5380
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 845KB
- SHA256 87fe24ae5c848677668d61ef8ac44569b4e06bacc9acff84888f31447de4062f
- MD5 4fa39d8724013d1675bd48100797f72c
- SHA1 981dd93028bad50b823dcdf9a2bebb4682038dff
- SHA512 1c0abb115917f8cc9a4c1fd3246bbbc47046d428707812164e32921b8214fd2cfde843b56568073dccd40b476aa4765cad79d2ba50e5ad308019dbddded1d546
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E:A3k03kB56r
- TLSH T193056A03E6850FA4D10F81749A968672EA737C121F2097DF1354AE253F72BD0AB3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 943KB
- SHA256 4efeffd0d20b7148ae750612a1cd548dd6b093730bd04bd607fb3dfba86bea38
- MD5 9631aa0cb4610b634d5a6e5419647036
- SHA1 7e5cb9223579e0dc7380d3bd0d2c733d029de65e
- SHA512 ab466b9ae3e0c433d9dc2de34fde2bf1fd359a80a60092a450fc6f1915615e3dd77679e14d8a7df4a7aab6ffaa093a944d7de5aeb8077a75f23aae187ee23762
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E82MqDBxc:A3k03kB56rrMqlxc
- TLSH T110257C03E6840FA4D11F81749A958A72EA777C121F2097DF2354AE253F32BD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 d1a910874e01a545765ced7e669bff386885606b5166a61b4dbd574487e35045
- MD5 529429209eabdd2a70efbba99fcda707
- SHA1 b0c9627085150058273ce6e46b9d6fd58746dadf
- SHA512 af1250b1ae8492fef67944ef866e441957829b7f0b3578a08fa883f0f1542d0c3ba384ab50c086b9fcd37018521db8a86bbe70e9b13057a66f39d35336099454
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EP0Le5ji0hmxNrM:A3k03kB56rnPji0Aj
- TLSH T19A654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 893KB
- SHA256 6b9a2df427f9fe95847afba62816e01d6a781e2a56908bc18b7f4c3a4d638d2f
- MD5 481e11c2212948d8bc92741189d95bb3
- SHA1 aa3bf480978309dac380f4dcf95a0c24f9ad6de9
- SHA512 1026d357f2905457305a19f291751295cd15a15998fb14a50ce2bf08d8471e6dacd83aefe008d31c66dc92dbf3f826a3f3b65347d22ff1d89c06e869c3ecf4d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Eyb:A3k03kB56rqb
- TLSH T14F157B03E6880FA4D11F81749AA58672EA777C421F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 869KB
- SHA256 dac93c3d47ef98544407a44abd1646ddf09acf0cccbcfa488b0fca64ad586445
- MD5 6499bb868d64439b72c8903922508af7
- SHA1 b1ffcbdc0053b0c513e059129a2f91d64a6dd12e
- SHA512 05b274cf141b1f5bf71cb1c56e31513915c76fb110d29cc9249b43f1419e96b8ae497868ae4c0f3545e703d3444aa010e939d1dd52913d7dc5bf5c39b1db7a7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EpZ:A3k03kB56rL
- TLSH T1F4156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 869KB
- SHA256 106a1fa3a62ddfabdfc12f472005c8f062197c982511d2a86df32b90ef61d616
- MD5 5fb284e416deac344e7e1893f9049b14
- SHA1 66fdef9612ec23fdf683baaa52965a7a9b08f971
- SHA512 3bd81103a52d1f1d0ae8015e5fdaae3683ed0de7cfabdd47b40276c140eb6ea18fa13cc94f71c0e94b93d7351a16bac4127e87cefaa002f9557b0e51c9943ad9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EC1:A3k03kB56r0
- TLSH T109156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 869KB
- SHA256 aea2690a7281344235d20a1546e7ac78c898ee41c20b04fdd960059a820773f5
- MD5 417cbf44cba005ab8b1199b885fef410
- SHA1 4a63faa655723298f9eaf10d5e5dfd8fa0f73555
- SHA512 584c152899f845fe4be1a38caf73eedb5faac5bdae93d164ef960d10c1bf3c8a13a060172223b1c2c7ce5b06554e8d2ddbf56b8ccbe96bd30925400070ba807c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Eo6:A3k03kB56rv
- TLSH T1FE156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 869KB
- SHA256 ac2a9c4f306299ef32e655ee5cd7a0d4f82c133df74dcf47aa0314c89f582a48
- MD5 ec0bcdd6120fac62cf554c3f8e2462ff
- SHA1 8df2b87ae8ff1dc6a8b69827bdd6571227699b1b
- SHA512 5a4e04409623afc3fe97eb92405c238337e93748699187176b97fc438b64df6e75c4ba79ceb20fda85b98ce92e5fe8c5fe3d7d993d127691fdc2f5298e97c36f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EsN:A3k03kB56rS
- TLSH T180156A03E6850FA4D10F81749A968672EA737C125F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 869KB
- SHA256 dab91adaf813d8ef0df7779fba67f94ed3304183de7aa67c05ba08fab8b3c9c6
- MD5 1612b67c4cd003d1a60a41a4178d456b
- SHA1 2775aec46d25775b84150a1964c74bcc1b3bf699
- SHA512 c0c2e3a6086cf75189ead2feba7075744513fc179693ebefab005f6af8e417d16cef02443cc3fb87c25f590fa120a6463f6ef3f50ec0ba68209f8fb7e986f03e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Eif:A3k03kB56ru
- TLSH T199156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 869KB
- SHA256 fec30c985f0bf3a54c01115e8b3e70cd5ead0fb3b083dc63fa19a826ebb902c9
- MD5 ff7f29555ad18f016a7e114c4d39092a
- SHA1 066c722139802c972cde73f13fd692024d930e4c
- SHA512 47f7e5a836b09b043602cc63a37f736dbc114270b8acf9a2d365f92b940dc22892fd288773b29d52dc9eea24dc6c3ce5d9bc732d80d3e8b21ad1d1091bc32a6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Eg9:A3k03kB56r8
- TLSH T19F156A03E6850FA4D10F81749A968672EA737C125F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 869KB
- SHA256 f30954fe9f05b45208afffd41effe375fce293735526f53dfaa7e06ccfa0b0ea
- MD5 4b4bb8c5fa52bec34992a966bf85600c
- SHA1 8a9ab48fdac0f002728730b76b1c6005ac6679d0
- SHA512 5c21db54d6a3f407441f746eb5c4791757407b5766a846cc91736e176fc71806a037dcffd071fb64b108e2fcc1d784579be1bd6474909e5eafa01f0be13ab9c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Eoc:A3k03kB56r1
- TLSH T1B9156A03E6850FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 869KB
- SHA256 8a0eb91c1258a5a2d3aa916cb05f21b3456d1b417e55d82d787f21ecd6697fd7
- MD5 b20e6cae6acb901ccebfea6d7409fd5b
- SHA1 a47babdc8a3233c77fb9f6f917199e63dd3f935e
- SHA512 56ce725642d8945f13ae77d6a7c597833a92fe4e0abb02d8d4a27e9ed71512edae73db3bc30b7d58c6da8310a4ce158eeddad68f963469a499f6e6310691731d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EBp:A3k03kB56r7
- TLSH T1C1156A03E6850FA4D10F81749A968672EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 869KB
- SHA256 3fe524e2718beb24d01bb587c82e2bf6f0ebca1dffd529629af9f833bae60a48
- MD5 95323b114c9aaa4da9a03a090cc98830
- SHA1 2ee91734975d4e308d616e2b3b30500746dfe6f1
- SHA512 852377018d58ebea2cd64125c0861abfd127bbbd97ad19cf5bc1c285493810b21df4dd183bc9854fce2ef2c3b4d6092e3e0eac73330e5e6f4495c148b8eea2ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EWN:A3k03kB56rA
- TLSH T1D3156A03E6850FA4D10F81749A968672EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 869KB
- SHA256 73c209ec4a8a2db7b294fa1e4a7afe6c8fd7f883028dee4a9bf22afed315e580
- MD5 e5e5e60f95a7c3c9af0e3c0261ca035d
- SHA1 d9d9b28a033ff183cebd15c7c2253cb76c23ebfc
- SHA512 5778b82bea1742ee54c163212d6c56b27195944be4f951aca942ff2fc0783085124dec8da0cbad53ef333b09e772c4a6409afef5296e24dc32aeedb9a20dda5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EaF:A3k03kB56r2
- TLSH T135156A03E6850FA4D10F81749A968672EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 869KB
- SHA256 4850f5468d32d46aebda9e11883c0d324a573ca2dceb8dc59f7ad56ea139f396
- MD5 7370ad553751e879524de845d8f14690
- SHA1 66fefd19c0e80bb5b69b5983a873b56e289a6a0d
- SHA512 20ec13e21a8c2ac64c391b5435eeaf0373ee3f9f24d1b1f83ded6d10bcbca89b298a9e23d8b32bcc44fae4def39f2720aba2bd09c9c7b568b25464f9c797580e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EvC:A3k03kB56ry
- TLSH T150156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 869KB
- SHA256 e5f1ac1516abb37f6acb60b7bd0b1ec5d6c71ae2645770ee243461961775c8eb
- MD5 beed1c5efbf56f6641277c5ab92fac0c
- SHA1 bd07b75f8908c34bbff78878acec7e33de0ff9ff
- SHA512 f0f9d0b96f0c5adad7f427b14590126421023409cc8b8a56abde34ab6335e7523c32c6aa7dac526d9e609799a07256b29b36a44c693060f51248addc22b937a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EQw:A3k03kB56rH
- TLSH T1F2156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 869KB
- SHA256 f747f5585688f5b018aa0812c5ca9fb94578bbf2cea7acd970362fcd60875d0b
- MD5 7f194f0bd93a5460be2f23a56480eb4d
- SHA1 7b5e8c88ecbe4ef39930e7b724a23a22cf4c9c11
- SHA512 5edcea7e9dc3aaf948fc57e236536ea9e1a5963dac0135c908077fb656177f6d8e718e4133358669d0248c347e6a9122b28c39a90dc80e0e4f4dd507b8098956
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EvT:A3k03kB56rD
- TLSH T124156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 869KB
- SHA256 7488761dd5436f0168e782174640ee60bf3cbea7992670a270151dae77020a36
- MD5 ee09abcb5e7988ab084dfe79a2c48ab9
- SHA1 106c52801a15037d8d58ec98cfbe960c7c0844c9
- SHA512 fc02881dbe19e6e204b85109454089ac9f5babb081ee0343f8140e93f54bd032d7526718c25054378ce894cc3fea8c18fa63419df3679e986025ae65c2ead7a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Epu:A3k03kB56r0
- TLSH T1C8156A03E6850FA4D10F81749A968672EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 869KB
- SHA256 7b7d32ddb375aac7896cbb8a10e056868cf2302a1fc17fc29c933acbd303bc30
- MD5 7a210d29ad74cdd2d34cea13764a2892
- SHA1 46352f84d44bfd56dbd1c28a18c7847a1e076b4b
- SHA512 5fbce7370d2a2a2b0145f798737b788f40cd5520f84caf93edce70077265748e87108022da942ac1e6756b9934c45ed432e5bb8ca57c57708b5eaa5137442d5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Ehb:A3k03kB56rd
- TLSH T173156A03E6850FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 869KB
- SHA256 147b5d4574db4f6cb008a1fcf5310623a570aba3cc79a18e59f9724e716ca579
- MD5 85db94fed97fd41b7ae4571a255d0738
- SHA1 a2625a628d993b13105aa4a54202567b88701d3d
- SHA512 d60bb70069c112bc3898c24f052c82397e09cea3ac5e75aab488e7e1dbdfa4e7a0b071b68be908325c0e94bcddf23291adb478d793e5471719236b485ba9afca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Epf:A3k03kB56rN
- TLSH T100156A03E6850FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 869KB
- SHA256 4af6786fb5a7eb41c773139ec7f96496daf459a66b7625d7868509eb8e390acf
- MD5 aff8bfc7dd70ef400ec1a37d10812527
- SHA1 66941e521aef1a2874ee203c734ec82a17694891
- SHA512 e0c5685cc95fbf4396ba474bfcb211f8d13a46ce11da7322838506bf1dc197490a1d61ce3e71c2895d70a9f17f711a59e89d4a046188a1b2c0854040a92ae5ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1ESK:A3k03kB56rF
- TLSH T1F6156A03E6850FA4D10F81749A968672EA737C125F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 869KB
- SHA256 52c48b74b0b5f3b0db56049539689a16a906872efef20f8d02016ff5f1b66656
- MD5 5a83e8f94f4e692767f1249c3c77d225
- SHA1 2e38d22209004ce36fdfd22a372b75cf9a4851f0
- SHA512 b870e6d4243f528b2e74ff4f54f8a53667c85e2d1453c0ce0e13828caca8daec9164b306bcc4fec47d3fc45282f6b5acf843ddff0815dd63ea74213fee75f7ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E3k:A3k03kB56rs
- TLSH T12C156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 869KB
- SHA256 1000f187b34130310f121b8c64069b4acb98aacc0a5b1073c6d3c3ae7736dc58
- MD5 34897b3a5201bec43b65f6807d6908c5
- SHA1 ea2a15791928f46605e9752f660ed9add1a7f3d2
- SHA512 eddf205ac85e6083116868e3ec551b77bc6b709cc2e12d8d7b0c55bb1fae8a7deed3ff01098591a16d4bfa33b173172ece6391d20c0c1d02d71131d006adfc14
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EA0:A3k03kB56rF
- TLSH T1A8156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 869KB
- SHA256 865e4fbaf0edce0affa10291db05e5912b83fca132446ff4dd59accd7310c293
- MD5 af9a8d0efa72ca5b46d551bba09a313e
- SHA1 8e20a5767d64d903eb679efef724f38ea0ecda0b
- SHA512 118b4f5cf605f503e7eb79c3979d066b7728bf457d301e94565c5163e6abcb092447641b3371d5163e93baf5b71c3a332351b1de8ad37a09ca459bff1a007a80
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Ebg:A3k03kB56rk
- TLSH T100156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 869KB
- SHA256 8064f1329750f4ca0f259551f598dab632ca57cd32b7f76babceec0574140746
- MD5 20c1a315b73a7e1b04be0d81bba0aba9
- SHA1 9050f6041dc2a317e0829ac44a259e560aa0a84a
- SHA512 9f005fa353eaa26951aa9646a67ec6fa5d1abbaaf06aa8faff5aad7800bc83a8375a817cc73cca3443a4f0094d03ceca2c192838a79d1a93621a10ea251fe264
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EWr:A3k03kB56r2
- TLSH T18B156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 869KB
- SHA256 7b009f3bfb9ecaa982498182191f05bf2961e4205e5e0cb998182f15039cf7d2
- MD5 76f422bf4bf319cefefa53625d601efc
- SHA1 0434023ad4c6a6208ca87ecdbc5485a924044851
- SHA512 b2608c19e27b8472324bc1a6f640cdac9e4401bb751411208649f75848ac65bd7d5a59164bc0f6922d9d0cc350ac1091d2b676f06e79d7ae252bc7cba7a0dd5a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E8n:A3k03kB56rw
- TLSH T162156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 869KB
- SHA256 20439d6b9152ce46852ce10b8defbdbce4da21153280e898d002c7e17bbb55c6
- MD5 e0182edcfe529a1da9e9bc8ac5ed8ee1
- SHA1 2ada144c5f26fe2c9173c64493bff5c0082116d8
- SHA512 85334a4ece9033df0fbbaeef84033e3892af0b4b64b93a544dd5f37f022d4b07bfac6517abc663a0d6154e112d2897d1831f4cbfe5bdd1aac1eb72c3212873f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E6x:A3k03kB56rW
- TLSH T1AC156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 869KB
- SHA256 2ce5620ce7573fca5844550e77a32a101f49f49aa4656f7ce58ca00916c41abd
- MD5 999a6f52fd3ab4520c797eb46a4bd6f2
- SHA1 a60841fb86420ad5bd16feec9e5c8194b6516468
- SHA512 7b6780ffbfb647854365eea604d920434d3413ff1ff4e75fd6b0122fa22d50b29964533ec9dcf3c5d208ecb2bbf528ae3af16a2444fe80d040009c6c97298ac7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E8A:A3k03kB56rN
- TLSH T1CA156A03E6850FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 869KB
- SHA256 7f67fdfb0b4afafb01369623e9785fba7bd7bd9a97d6afed415df6e9893f0202
- MD5 1b7c97ad470546948a583d0b8f442a5a
- SHA1 0e5bbd4953e17e1557ef65a00ce31c479044fe8a
- SHA512 b201713e967237fc24b6deb2fc6ac8288dcb1cf25fab617665006692b23ef7d4e47f3622188eb46e0e57717dc42d0e684b8aa5cec36a1f60ac4aae2a3dfb2ab2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1El9Q:A3k03kB56rc
- TLSH T1A9156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 869KB
- SHA256 d435aba7a6847d41eb526694823e40d4708ce357a23d21fd892a74eb548cd842
- MD5 3ce7c77c4bff305fc99b3292594d647c
- SHA1 848dc37ea50b3cb754a8b11067eb6dee0a5fd75d
- SHA512 6bf64fd4f84f5adae7eff3a5fa0334eb6c2aecc2de6e4b2e4e6455d2c6bff520c8bacc0f4119885192779ef72aeb722ab936df886893dfcab1cc431bdc85325f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EQ4:A3k03kB56r3
- TLSH T101156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 869KB
- SHA256 fa26e5971830ae1745bbd57bd266abb53c8a550a61f93e38c225ea7b676686b8
- MD5 2948b9533abd9722b21faceb0259d61f
- SHA1 d1272973e139fd52eb2e180107253a8a9ddecb6e
- SHA512 3b3ab50a325c2e9f57e1f5a068e4d201462651721836f573891f82b262744fe03fe0bfb628d495ba4445a154edf2bc6c1a65c3b64308fff189add7f56b4b1839
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1ETu:A3k03kB56r6
- TLSH T104156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 869KB
- SHA256 dbcf144657415de82dc46df08612786baf8946d11a09f34a9baa39150c79f77d
- MD5 da7b20b016be162034c42c0e7b0dee6e
- SHA1 bc3d55a1acb5a92fb6e664200f657658365320b3
- SHA512 81536fe09245156dff3b04dffe6724a0838bfe60eadc73ee012611ba9603c7dc6cf7107d031b2cd3b1beff764fbc47bc9e1fbc950186ee0809571cdbc0d6f54c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EOj:A3k03kB56rU
- TLSH T1E9156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 869KB
- SHA256 370bc433bbfe3c90f2e5f662ef0fefd070a37040c1bb35127b8064fa6f2c4d0d
- MD5 cc61c164542fcdaf5379153a70b69f31
- SHA1 8dd42509a6891141c9cf4c44461b00e14100c623
- SHA512 3e8829549492726368553d38a8ab29ec6074c05954ba0e540125d0a2fe3e90f5072b3942488ec11c34a810b3d565e4788a57a1155f393df8a8adfe9a41d5cb95
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E7g:A3k03kB56rc
- TLSH T12F156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 869KB
- SHA256 953816b982316656426f5b9a620e9471776374dd7ddd0b51a3c8e87053ffbaeb
- MD5 9a0ef5cddc6ab53934f53e2c39f511a8
- SHA1 04635f6b452be89ff5b27cfdc0d9a477774eb480
- SHA512 455c0009d0b108c1600b85ac04927c9159a387f3f9bf38a159a0f2278d5fbc5f65681a97e80fd058fb353c776f22f2d649f7707c446227a9c881b28652000878
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EmI:A3k03kB56r1
- TLSH T123156A03E6850FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 869KB
- SHA256 266615c0e3826e9d450d3b23d4cd16acbef104bb271c420923e415eb7f988db8
- MD5 d642fb27661335a8aa909c74895f5986
- SHA1 de7efab6d4d086175d9ab43c5f257f92b32e64c0
- SHA512 706053364f7edc4458cb71e9df3b5588cdfd47e10723b4ff10afd8772d204980d59e030dd7d44254b92b2531c210ec0b96c458f64979979997f1fdd73050f557
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EUo:A3k03kB56rj
- TLSH T141156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 869KB
- SHA256 754313aca8887b2bc9dca5457c70a2acb0ebbfe2ccc9af3a4cd893d5015ad44d
- MD5 34cc2efe61ab6d3fb4b03ff46102fc78
- SHA1 d8aa54a8efffff10dd45db8b30a70d18955c4023
- SHA512 a288a99a6178c86120bacf9daae14052a2e5ac490356e03eb90ea75c0d02e25c150a56dee78f20c7db5b15660ac87fdff0b2906f22a3b6d9fa38edc7642ecedb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1E3+:A3k03kB56rm
- TLSH T158156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 869KB
- SHA256 856a41d9d6f9d6612d888e8e8b4d9b31a14a1665cd684d7e743ec86928687931
- MD5 d4473cce1748c859648568eddffa3abf
- SHA1 8ff214b87d3999c5d98824ac37224dd104b2abc8
- SHA512 36faae357b5638bf58ad3113c0bfdc53c6882c632a43ea000083ae581f365a9a8b6a3c8fc0484ca1ec16415b492b8208a609c56d6c0e6ee8baa88ef693fe72d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1ENQ:A3k03kB56ri
- TLSH T167156A03E6850FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 869KB
- SHA256 bc9900791ff4d8e05aeb6cad1e20707cb9b59ee63a3efee191a57d43e2154e8f
- MD5 4059bf04af22b32c4caa0ea84b402259
- SHA1 5646a5e43bf766f42a0e027079718d854a30ab7a
- SHA512 c6f6197a02368ebf414d62013ab461c99e73b11708ee59b5a03bf6fa7b6ee9007ff88f66158203ae9e0706e26ae043c7518fa7547ddbb23ee9fd7764bd80d57f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1ECX:A3k03kB56ry
- TLSH T1F4156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 869KB
- SHA256 2a7bb59cdc8e7cb348f64da9e80be686ce09d9b73286237c79340fac2f2e35f8
- MD5 4d8b38b3a65a79c12daef9ab7cd99f0f
- SHA1 dd3f1e9a2213959e5afe98112d5f9f56ceaf6892
- SHA512 4b25c0cc69d303be4a75fe8082d9a7f7841d878bb43694fecaacff029f8d7fcab6ccde7bb7f031f28d43dcec0596ecddb14881e1bb621248beaeec9598053f85
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EkL:A3k03kB56rc
- TLSH T1F6156A03E6850FA4D10F81749A968672EA737C125F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 869KB
- SHA256 0c2645147e51eb66157e572492d5e7a9f834fcf0311464ea0f82420c8cdc42f1
- MD5 56d3ef6a2984e94bd3de90066961719c
- SHA1 8dbaf718994355fb587e08b949bac99e3521d437
- SHA512 bb1282886ce85f86bbac912d44db42977e29658ea4130f8aa9104c2d724827522a7380f99a166ab5cb0faacb93a410580244dee192a7caabb3b0ddd2b067cfbb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EAM:A3k03kB56rt
- TLSH T183156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 869KB
- SHA256 45e41cabb81b4102d22d8e34178b481e312776f1048224a9d7235bf355ec8ddd
- MD5 f7c6b44c6d896ca072c8cbad10fb6aff
- SHA1 4ad5d2cf356cb0e9db60bf29c64a5394ef50436e
- SHA512 b26e78ac705b7c3a8972163c3b46209cad077df138a3c7e53adf02841ba2d2495b8e012d3cf1a1db1ab6c915ff69e51f87466d24afaf3bd2aeaf3bc2effaba34
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1Ehh:A3k03kB56rH
- TLSH T188156A03E6850FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 900KB
- SHA256 76865337fe4eb3cfa27d4b810f227b16dd7036febfe27366547e43510e8128f8
- MD5 a6c0275508e1129442f1ab081285f43e
- SHA1 ffae0db391a5a8c16996965c2057f25914b78bd3
- SHA512 ab6662f382627a0c445bc2c92e37983fcff102210a762c01bedb61cce64024b18d3249e0be29ce8a25a9f6c3dd9724e57154b864443bfc2e9175eb5c76ba4c0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EB2+:A3k03kB56rE+
- TLSH T1F3156A03E6840FA4D10F81749A958A72EA777C061F2097DF1354AE253F72BD0AB3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 906KB
- SHA256 470d0501ee34312a9ac4225bedb770c2941cab460c92c88c511ef0d5acf41d99
- MD5 05649fd3ceb394f978764a71b027e5dc
- SHA1 12f386c65394775252d8d4a63bd98298b0a13204
- SHA512 5650d161616b1b9e2b7212c178d674cc5f2d2dadebd06f20bc2d0792764ac327151cd70d771dbaa8948c83da8a87387fc601a2f23cf6cb0812ec98f4485787d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1EE:A3k03kB56rs
- TLSH T19B152813E6840FA4D10F917096994622E673BC0A1F2057DB177CAE253F36BB07A3D66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 924KB
- SHA256 dad3073a720c90ec0bc2430a21c170b00070cf23a629e7953228515e8ea0198c
- MD5 66ba00b607fc283b3d72a01adb963d42
- SHA1 f32f89cf69c158199eab39856cfdb7d9f0eab0c2
- SHA512 975c0df2876ed56806c03b1d793cfada77c6f664c760c03b381201ded1792b4478d237cbca006c09697b5e7ac8fdea051a60e2faf479c7dd70c6b78032928c65
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoc2Q1ELF:A3k03kB56r5
- TLSH T1E0155A03E6850FA5C64F81309E968662EA377D811F2097EF1354BF253F32BD06A3A657
- MD5 SHA1 SHA512 SSDEEP TLSH