Analysis
- max time kernel
123s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/07/2026, 16:53
Behavioral task
behavioral1
Sample
2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 938KB
- Sample260701-ved49act2z
- SHA256 ccf7f7c64097fbef5c2ed9c17c83360a8b3851c4d31cf8acd6584c64815796be
- MD5 92a2b32f448203bae1be3cd307c4f769
- SHA1 960ca437cd3ba2a42ca1d086f99503f583d3ab77
- SHA512 d604a7e077248a905ab71198111ab44a3b4c74933adab95dcc02604faea63901e4101f3db61a3e397fff8bb76340224f6fdab9a6049124f6cdf313684d210e10
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSK:A3k03kHRJo
- TLSH T11E15AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/5320-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c559-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5320-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2080-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-239.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-302.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-481.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-648.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-752.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-943.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-962.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1017.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1100.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1150.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1232.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1335.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c559-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b4-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-239.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-247.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-302.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-333.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-364.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-402.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-481.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-598.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-629.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-648.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-733.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-752.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-802.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-885.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-943.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-962.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1017.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1054.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1074.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1100.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1137.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1150.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1181.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1188.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1195.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1232.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1335.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2080 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\StepResize.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5320 2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2080 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-01_92a2b32f448203bae1be3cd307c4f769_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5320
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 938KB
- SHA256 ccf7f7c64097fbef5c2ed9c17c83360a8b3851c4d31cf8acd6584c64815796be
- MD5 92a2b32f448203bae1be3cd307c4f769
- SHA1 960ca437cd3ba2a42ca1d086f99503f583d3ab77
- SHA512 d604a7e077248a905ab71198111ab44a3b4c74933adab95dcc02604faea63901e4101f3db61a3e397fff8bb76340224f6fdab9a6049124f6cdf313684d210e10
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSK:A3k03kHRJo
- TLSH T11E15AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 2a409b3bc8f7d7b8c704c3baa9107c57b3f6fc5338e441c51f48fa384516662d
- MD5 9a55b7301addc448a0b21558bd81163f
- SHA1 b77f089693605f6c6183ffdf4974c259f6301ad9
- SHA512 ff57087edbc96a30806f9ae049db5a3ab97bbe0f66311e96f5d152f14578344acc5e7c0c314fddb9d404c9e5c7d55a9b8d634696df41cc57e91becc88ce5fbb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSa0Le5ji0hmxNrM:A3k03kHRJwPji0Aj
- TLSH T10A657C17F6A402B5D067C0B9C5E69A5AFA713842173086CF1398C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 953KB
- SHA256 de62806416f895b5b18c1e4bd3d9ef716634d2b99299ad312a99f6a81bd0b57a
- MD5 099390fe855e1279b484c949da33accd
- SHA1 2a7d635a9fa0d84900a7566c5d2df2a2cf7914f4
- SHA512 a97d98e4210b590c81d3ab6db00a5c2c044eae8ccc03d558a8a50acf9a74ec93ed6dedd3037fc2b41fd82aff490db9971ff5eea9487dd7a747213585999208f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaS0a:A3k03kHRJ
- TLSH T15C25AE03E79400E9E10AC1749AE65A23FB75BC52176093DF2368D6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 962KB
- SHA256 098bdf8425ca625e3e76db2c6c580c3a6ce241a050a854288275d5a50b611a26
- MD5 a3e3c38e6eaab5f8bc1b7bac10230084
- SHA1 1034ff0dabb158ac9ba3e216578e4205efe0d5ad
- SHA512 cd133039a25f1daa9124f2833bdbeab3f26f043698857c98e9ee7dede2e2b86966624f082a28b851d07d3ec70664fad5d8da2e1781dae83d4d40abc1bbea1543
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSzo:A3k03kHRJq
- TLSH T1B425AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 962KB
- SHA256 a9c92c99bf7eb7555f35b942c29405359ea38a2c09f8df9f516b0d2a9008fbf0
- MD5 1effb1e190d19a5e4d1bb0d793fd5eef
- SHA1 77ea4d14836c2f3b97aa761fde0d525e07ae36de
- SHA512 0282a95ba8ab6d649c9db45ea311a7352d0b3b25d08e79fab9302966cd63e7161ba784c99b05893ac809b0d484d5dab338dd8de5c39bf558a1879b55dda4e5e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSnu:A3k03kHRJk
- TLSH T1E825AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 962KB
- SHA256 303c05bfeea07436b3b6e2dd457b7368de816b88b7f9a2cd4e54c4bcf70d1039
- MD5 a09c5959e55c4d660cee179b47062807
- SHA1 1e6d6d6038d4531c1d368ec28f0a07ccad956fbe
- SHA512 3a4e8fcc22a49b9b67e25bc7d79278b7852ec21efaf73c19f9c41dae6377e3a758204e7d145fadf3325e3a5dc742c7b44cb8a012813094d434845d2fc57aae29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaS19:A3k03kHRJp
- TLSH T13C25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 962KB
- SHA256 6be046a90d14dbce3e8089f9c2fbc280a62403f4c2078c1f8f272f36bf832fff
- MD5 00d80d8a2e3b5b835f6462b158d7bc0a
- SHA1 7961623ad409ac80e091ed9e218570f5a4bd1859
- SHA512 69051de5a0ba67489054b8c9cccd41bc089cef96ce068ad9a9c24cbe63311cfd69f84936984630edf4f5e28589e67cba753144071ccc39b00f29dcc22db29307
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSRc:A3k03kHRJs
- TLSH T1A725AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 962KB
- SHA256 9df36e1f9b75e74e8a6babfcc246ef5b3c33b09663b242e90320a49d06bfef6a
- MD5 01d3b3e1185d0b38d1902f31e45600a5
- SHA1 6b9c8a32b9aeaf7c03a6e4a0f1630f2540bd98cb
- SHA512 4759bd6aa0423779aaa68797a920ec2132dd10fabdb5537abfcae70f12cbd8a7a88b442f40262f5626b8018e6bef3244560c216f9318070e994854bccfe53233
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaS6p:A3k03kHRJa
- TLSH T10B25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 962KB
- SHA256 7adfd9b6f0e0af7a4dc9d232cce786aa897b4f30cf3ca904db58afd9a8d23c9e
- MD5 d383d0a600b89015898cd5ba79ee1d33
- SHA1 f9a87c5736575a4affbdb3018d5b7ac699dfb5c1
- SHA512 a68ac620397cc4dabba8bbbad88981540a3fba638180a00dc01f36b1665da62bbb2ae68520f969b949a3f5406b5d874acfe6f6b42522759cd542d6c9d1ae77a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSdN:A3k03kHRJt
- TLSH T14C25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 962KB
- SHA256 603a94bcd7f5da51b62136427162ff078286f8fb53df87479d9394110c4c20f9
- MD5 3aa5c34ee8f72883e885027ca9759cf2
- SHA1 9aa652dc040c63ccaccfa716673b07cd9a6dbd03
- SHA512 371ec6651db5cf2aca91684c5ca10c98ca699d0e11d2e31b030cd8b44ca893827524a05cd0b38a2aa448e073a94c2babb9aee71b005ca32ffebe287d8988b024
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSPF:A3k03kHRJX
- TLSH T18B25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 962KB
- SHA256 57d397d2d77b20be77f4f4c599fd2c556b172b7354a4d56f797e57759d6292d5
- MD5 3aa74af4d1f5c06cbfe719c533aa3bf8
- SHA1 222d1536b653733b3d5d07f505d2c967a3e4f34f
- SHA512 a027defca56aac3bcbc03e3daa6e3ded7ff7f274990796c9df3b126c69cf3528d0955400f2c7b16b3a2896333e54b8d8284a51e56a6e49bfcdd7f45e01de9a63
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSwC:A3k03kHRJL
- TLSH T12125AE03EB9500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 962KB
- SHA256 76d4a9deb495b5a83a2694311d4d0fda9958e6c28060c965fba01d6ceabe44b5
- MD5 dea036c0aeadee83e81c888a8a0a919f
- SHA1 04a66d4acc98d13a51b9d4f9bd032536aa301524
- SHA512 cbdb366dabcbee6c494d65809bffe2991b98304ca38d608b3bb2330464a12331035292693fb84f71cfc95378482b56c2fc37b6ef14fe9c16b2a027371aead6e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSjw:A3k03kHRJO
- TLSH T17225AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 962KB
- SHA256 d999c7119b115fcbbfc7533c17dfa6e058444c18d6f21c888ac47d8307317e31
- MD5 4aca1f74d2e476b6c5849dc1bd6a4d1c
- SHA1 d473cabf96fda5cc9d15a5f13231bbb16040865d
- SHA512 c136616eb5a3916d7e8b7f529d1b2b5dddac7c4f02323d1a97a41ccbd6c99ffcc4ec9d5ac81b33c0f6db8d87b57401a116a79e62b0d6f3254f6b1d0638ee248e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSqT:A3k03kHRJu
- TLSH T1BE25AE03EB9500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 962KB
- SHA256 91bc129c886dcce700569b1d4937123d74ed6c9650eeed0346c9f2b9a43b33c5
- MD5 f51fa84a0d562888aa5533ebb166fb05
- SHA1 5d62a8a77575d7ec9ee5a5326d6ab5236d70d431
- SHA512 4b9e9e37fca48debbcbdfe7359b7d623d384a5fb7f763af6bc4ef9cbcad24db18169aa88021af876e608d85e8450073ee58cf0609641482fb9668ec0e2b106e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSKu:A3k03kHRJZ
- TLSH T14425AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 962KB
- SHA256 adbd52f4e29a4ae97385d61421f26817d96b074db0df0a3b56e66533ae6ba3d2
- MD5 b58a112b22c95e3614ceab9d73ea33ba
- SHA1 02c1ed8de7d830b4d8958012b3608040ad6b7c1b
- SHA512 346b0fa4d14d17ffaab55056d7921d7b751ee6fe654698e5c1204f95280e6c8770c6795e15263b5ee987eb8c27a69844a07abb89927b8fb1516e69ec70acd837
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSUb:A3k03kHRJI
- TLSH T1D225AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 962KB
- SHA256 c8b6111ff399ad4eb1378b7878bc7b127b35e0e44a964c3a2441d4dfbc7e4d54
- MD5 220749534148a7eba376fa759b8279d3
- SHA1 9838a4e69ff6c189a283c4691f0f2abc4e4a8a9e
- SHA512 302a6f9e6176e3b3564d44c25828fce5f2a199a2c260cad17b2444177e41566f26dc4c3eb7b206c6fba0b95000867a0c564b568a0d1abc7cabf0ddd73581e85a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSaf:A3k03kHRJI
- TLSH T12525AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 962KB
- SHA256 5da241294e2d4be228b3fa883dedecd60768010f3f39eb30be4046abe954edaf
- MD5 7333bb46c3a684cf098ae0a750462212
- SHA1 90819c1ca9185167c6a7983c1dc8224b359994ef
- SHA512 69ea15c450489608d70f37e7b0823d92809c350aca52c810a29da9d92f521d9b2f6b73f4928a70eb6306f42835979ec3d14906069bdde980e440df423b433f5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSHK:A3k03kHRJI
- TLSH T17A25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 962KB
- SHA256 d1a6f2e41f14a10e8ada7dbb04957c37a185a3a8691058255c3d09f7b7c4222d
- MD5 dc1a41ea223fb21095595931ca05cca4
- SHA1 f953610faab709528442a1933ae91d01f0bd2eb8
- SHA512 04e34e93ea81f7e5a662855eb0d4aee177dab7d5e63e50693807c930f72623a45a5fc5f5112473c8fdb04792bf12d04b9a915710e15db47a8abefc7abed8e725
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSQk:A3k03kHRJh
- TLSH T18825AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 962KB
- SHA256 7cd1153a5a800b036b643038710e706a401d48b6294ad94cdf2db9f4149d8f31
- MD5 4e3b652c6693d3ebcf3d05ac5caa1b73
- SHA1 1b4529a60dbac0bd2cd2c1c7f88c50a6c67a2046
- SHA512 7ffdec22f41b53c27b396ac29023c6070b0ba12fe0652e66eb5a624e351e2bb41716da5b290935745852e26ecdd39aacf83329cb1b63dacb6c9b89ccac15e15b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSh0:A3k03kHRJE
- TLSH T1B125AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 962KB
- SHA256 ac648d9678e02e4208a2f4a5b6fb938d7de0331e666a68c5059dbbadfb5c2b98
- MD5 313510958f77f1861fb4a92f6083eae7
- SHA1 416d0899b84e2e4bbf96a990b55d4da268c3d207
- SHA512 c1da3dc91258b02c95be3f2abae57842bd0504f135d96120a68cbe2346588e63a2eff442bd1a26085ac601f6143786c31f01df2959d963671653c2d2dcfcfcf0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSUg:A3k03kHRJ5
- TLSH T17A25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 962KB
- SHA256 c83c525da451e4f0358f2a670e490c8b877e050f35c6742cb9c74c243d6f6147
- MD5 b76907c202651c7bfbcac5e9489a3ec3
- SHA1 6e1e0c9cd348a84712d9760e3bcbe61d332fb11b
- SHA512 a2d6a3b4b7d206759787e456fc956127cd71b6f4fbd8673e175f80d7b89c18e0217c9d9d102b94179903d3ee52a14f6639d2631faed322c0b11c04b08be4b383
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSxr:A3k03kHRJj
- TLSH T10125AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 962KB
- SHA256 76789fadfe7e6360834bb56953503796a20fd2f7e017bcf65061c175fc36960a
- MD5 4b52b0916f0cf40794df558e73a20f95
- SHA1 148377ce494f820e29b31d150a77595e21ee61f6
- SHA512 3596d4fa41dc7071dfaf39273ebb19803a8d010cca83e8c2b4f237dca20d1bb81f171599652357fd8970046a88697f8a52f80df9cb92fe92c26228b88809e542
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSzn:A3k03kHRJF
- TLSH T19C25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 962KB
- SHA256 04bdb48a816b82ec63a281403bc5fb7d1cdb2706e4fae4cd8ba374244034d446
- MD5 c59186d5d9fcfa59b748c146a08dd73d
- SHA1 dae2ca5cd65346056eae1a708357ee84a40f823e
- SHA512 18b57ca33fb51cb464fe173013d8fc0d923c91834151242d18cc0db4dabb050c8133682524fca9bf04831edc2fa60f6bf0929235535fbfa6cae01e02b634c1ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSvx:A3k03kHRJ7
- TLSH T1C525AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 962KB
- SHA256 6aafa7dd801aca78906f1fe266bd2af0663c017b2033197d2ef550b41fad017e
- MD5 e42a71d23d5b35a03bc83a0108532864
- SHA1 f77e8f2817e29e9e93a11a3c94b980f8673d1d2f
- SHA512 3226090bea05e7756b2ce29fb4518ce93696879a44c5332d51133a22336ec72c6f43124e59524367e70a034fac1ced30099acd12944b8cdead09af7b79dcaf07
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSVA:A3k03kHRJU
- TLSH T14A25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 962KB
- SHA256 36142517ae6e835c9a10c7d16a4f1713605e18ae9ebe7d55e2102c2faac9a830
- MD5 4ed052b926773efdcbf3e61b89caa0f5
- SHA1 7b10e8874b536b6d7c1cb6d242688de04743d609
- SHA512 844bbf8d74dcf693161d2e757f8c018cc439a88cb1fa273c0e23bc56c573f6c5399385e4720daff80168de608e29a181cc46ad3ae12803fa6ac5b48bd8e5787a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSu9Q:A3k03kHRJl
- TLSH T1C425AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 962KB
- SHA256 6d4c971fa6fe4942c817eea54db3deb95783eb46458e31dca56f1b25b2d53a02
- MD5 cec76e8cc52c433d5164ea53783eeac4
- SHA1 a9d9b75bc237d2b007c26cc87a8f96e04cad6556
- SHA512 04ade973d71d4f78d17ab3dc89dd0ef984614bc6c8b2490f4482b857658b3120514075434923487ae665c85b6aac32d02a7062ed2a0ddd3a144565089519c8fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaS74:A3k03kHRJa
- TLSH T16E25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 962KB
- SHA256 a984632cf602fe88afba3bc752b4c6f8991486eb6ddf1c7667cdb32225c36842
- MD5 949a8cc9374e1c42c6611ceff553ab49
- SHA1 fb98c7c93059767082f3f62f8beea2604878c67c
- SHA512 dd5b6c70fa54b9b0a76d95fedbb44c54ab170927efb9800046d819bf753c49a5a4331a9fd48476e18f62db2ffc710d492ed33a61ade9581e322e112fd0efb674
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSSu:A3k03kHRJb
- TLSH T1C925AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 962KB
- SHA256 bc4b673388355df4eff49d6ffeff0dc667bf220c2ee6a611bcb341fcb3cb7283
- MD5 9854b132adc39e6f2ec094458209d973
- SHA1 edf0d6371dae53911979f2c4eb20dde7a6ccbfc5
- SHA512 983fb1f5de6e496e1546c1bf1d2e5dc3d2e2d99ab63da7c4a5df4a6b5ebeb279fd8f2f158063888df0c44071fbfd2e8f662c0afcbd063801368aa8a185ece24d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSDj:A3k03kHRJF
- TLSH T19125AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 962KB
- SHA256 d5014906359754db59f6fd9806dfa444a9c41abc19bb6af54ec60ff9f277946c
- MD5 99812715541e514ab579ab1952e35b38
- SHA1 71934f854cddc25856fe0c87cbadce11637b7e4c
- SHA512 e347730f7c7c2c873dfc8dd004b6975f553590dadbe674c1304b770de203b818089bc065c6f473cd4e00590e48d224990699c84e128c211c4dc6e062be7781e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSug:A3k03kHRJ5
- TLSH T19725AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 962KB
- SHA256 4ecfd7740f4f064f44d3b4057ceea4094c1ff85121a9cc5bcb43261ebda96c2d
- MD5 a320d49f6ed503d5189496133e0c3357
- SHA1 ee23735b3abab773c4311724f43719aaf737ec16
- SHA512 326f49e1b0e213e596b9d4d8b3191fd49542744b9433b88120805deb49b107faa6aaed9b93c20a976ee4399d610e346948100af8f1bd130fa34be84e211b3640
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSBI:A3k03kHRJ4
- TLSH T19D25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 962KB
- SHA256 60186bdac78acc35a94cb6df5b7d34a5a8bdd61229545dc28c8f557e12a48413
- MD5 7970de0b15618c9f270ac2f572dd6269
- SHA1 b03e230a6f0f0b25651be7dcc90cc42ea7af3458
- SHA512 3d5f4d167b4d08dbf398545a65fecf93b437b8ad7006805e84046507489f883d9646090c640aa83a557f65e150d0d22f88c413d0645bf3d4d92e1514b96ef35e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSDo:A3k03kHRJq
- TLSH T10625AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 962KB
- SHA256 a4348b4326712f5335b8a47323fe9ea9af70001a278c8bb039d16c94be6b0320
- MD5 f62c7b6c2fb05ebfe677e86b5b4689b3
- SHA1 92de8efb261c41a32049cf71b82221baa12c73e1
- SHA512 803e389fd5d4bdb61ef2deedcf3d06e2073c658226e752e321e899ef32a72f9cd8ebd7d78067c3305a83477985944f29ced9edc9382450ca10908808e60717b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSI+:A3k03kHRJv
- TLSH T1B925AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 962KB
- SHA256 345ea24d70b17381681274e1072072822d68af9bbdee055f5246cae8ba483b12
- MD5 022b7caef6e631d4adb4c56986f4d2db
- SHA1 8917896949e48c3cb047c63515641b067a4241d7
- SHA512 7507ca91d61f0156694ea9e9454724ac3307f30db71cfdab4fd076c2943be7c82ae78f3f965b308d64d3590cefd5ee7a22f019357c6b83c018f8117ce6c85387
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSgQ:A3k03kHRJL
- TLSH T1F025AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 962KB
- SHA256 da2104a70b0b3dc9da341b70ec950af7eecf2e723bef362d01af6acd5e984a08
- MD5 1f44e2d3131c0a7e88da9ba35853241c
- SHA1 b410909bf6c1c9705e6180c5f445065344b7a713
- SHA512 1b9bf22a02f4da89f157da2ebac38b5eb1eba9f8ceea31cba2fac36bda1a8ed66526a5f3070768cd80828baf743cfb67c21e5a480127add7e007cf3dbc384cd0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSJX:A3k03kHRJ/
- TLSH T11F25AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 962KB
- SHA256 b142a4ab7f1283fe2e54d4180491230caaa77926095eea1d6c13e57d17fe1018
- MD5 1633238f8eaf3c3d7f13d411d7d5708f
- SHA1 fd3ca83fd7f509eb9ab66a3a06a0aa5ae60aec04
- SHA512 03d83ad07dc896eaa5789d8a7fd9081306efb8bc1fe9a1e28ed616cf7b8125c9bf4058ec2c36645e23bf4d293fbae4716d4f2d1f09de63efadd31e0cbbb4ebed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSDL:A3k03kHRJR
- TLSH T1D025AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 962KB
- SHA256 6af2c982112a176c04f79c66d081337f1fc1f2c0924f930d1c418c4a6e4203e7
- MD5 4f4cae97cb84ebb25d2d0a4790dc949a
- SHA1 c22eb389428ea9b200cf7259700bf6370e8f7135
- SHA512 48251cbadc1c0f704224994122abfd47a133250e2e404dd34d75d206fe2ca08e84f769a2fb51bf2807e07acde173af66a0b655f7a7ddae0c197209983ad9313e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSpM:A3k03kHRJI
- TLSH T1C325AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 962KB
- SHA256 52aa85ac934208ea5415bf2bb9e6c652734a886e58ef57c739201b1d66714565
- MD5 e320216e2b8291d06252c52a7ffd21e7
- SHA1 1d2ea46edd1c0ce4af6c845b5e8246f9e47d5d14
- SHA512 0b41dbc289a04ae1c6a0b2acfea39545330f9c4e33e0c27ca74be8098d4264754c0b0a152b616d89b495c5cb52946b59cb95e7dacfe08c4b1a646c8dfbd1f96c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapeJkaSSh:A3k03kHRJ6
- TLSH T11225AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH