Analysis
- max time kernel
110s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 14:19
Behavioral task
behavioral1
Sample
2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260710-rm688adt2y
- SHA256 58fd4d0ea3d572adc65bc7a6c0341cd023d545f929bd2d0c84583987bc6a1623
- MD5 1182e0c58db2b3de4d6fd06262fd61ef
- SHA1 8cb25f677af79636611e0a914349dd76e0edd1ee
- SHA512 481f3ef0367b2b5c4918cd48a5287919101952bb03df99ebe96c979d6aef4de580f36010a966a0b1ff2c4c73bd023dea4130b472f1b9768a0b8f4fc043b6f865
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXr9:A3k03kB56rm
- TLSH T1B1157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/4600-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4ea-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4600-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4808-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb44-286.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-474.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-591.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-719.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-824.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-983.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1038.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1064.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1126.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1151.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1176.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1220.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1399.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4ea-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b300-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-60.dat aspack_v212_v242 behavioral2/files/0x000300000001bb44-286.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-474.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-591.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-719.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-824.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-856.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-983.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1038.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1064.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1126.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1151.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1176.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1183.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1220.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1323.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1342.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1367.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1376.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1389.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1396.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1397.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1399.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4808 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4600 2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4808 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1182e0c58db2b3de4d6fd06262fd61ef_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4600
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4808
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 58fd4d0ea3d572adc65bc7a6c0341cd023d545f929bd2d0c84583987bc6a1623
- MD5 1182e0c58db2b3de4d6fd06262fd61ef
- SHA1 8cb25f677af79636611e0a914349dd76e0edd1ee
- SHA512 481f3ef0367b2b5c4918cd48a5287919101952bb03df99ebe96c979d6aef4de580f36010a966a0b1ff2c4c73bd023dea4130b472f1b9768a0b8f4fc043b6f865
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXr9:A3k03kB56rm
- TLSH T1B1157B03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 be867d667750b5dc2269b9c2326ad59fbbc0191b84745b9bbd1db3e53bc20a1b
- MD5 ea8342f02fdbc3bb5ea5b313a0cd9ca9
- SHA1 1cfd1d197fcede06491bd3a97748d2753b3ba35b
- SHA512 73e5fd3a496f13d51e76261dc2a1ad80981d88dbf5d984d6df9fc01ad48763a56028459901477c5e134e04ab95f8f66d918c391f65e6fbc6e47cc9a61b1fada3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrJ0Le5ji0hmxNrM:A3k03kB56rmPji0Aj
- TLSH T161655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 b8515722b5f3e6dae5a4550318b98e426176db2aa9205b5f30715e80c25d212e
- MD5 0935091b4e79e37fddf1b869da70a0d1
- SHA1 561012c88fe2cfdd3ff946aa39d647f25be1b753
- SHA512 12a348dc0e959554ab2fbad02d0eaed835bc29ad9f961ba7b49349b0b7d7ab58e0fffc245bcc23636edb0cb8bf8e830e2975301d58f2935142fcacdaea86449d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrba:A3k03kB56r
- TLSH T1BF157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 d87951561109ffde06b2c0e0bc2cd6e765f6e4fde7f02f1a0ee43552e9e26627
- MD5 b82987a164f9d799bd418bd7aaaf5875
- SHA1 a8c6f7114bf7a2876988d1f2d607d7af81bb3056
- SHA512 445b3dffbe852e3f0152aa8e458ee06a54cb7450bcdbc75e2f4de5237e61cd733b0adbcc479f72ff88f10a7cade4895aa553218db3707ec6b2c4502542fc3839
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXr4b:A3k03kB56rbb
- TLSH T142257C03E6940FA5D10FC1749A958662EA777C425F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 342eb920916a735160774684e3ca2eb461d9221b8d78cfb61fc14bd0a3c58df0
- MD5 ea382adbb9c04c27c3ae2f5d59c092de
- SHA1 46ac0b2c234ba343f386ccae1324bcd965cba392
- SHA512 0ea34faa08974d22f0cc0981bf3faf90667ed693ddf0b320568ff63f25bf3dbd2b6949ed08dd6bb4736f35001da67ecfb5de5e34c1172677fc3009edd2f03527
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrq9:A3k03kB56rz
- TLSH T1EB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 d64e721adf1f45492d2c17095f8552be1bb74bb46058e962846f647cacab832a
- MD5 9ea47f70134ab3957a788e6368d3c82c
- SHA1 235eeb586731c2b3679debe0b973119d9e734959
- SHA512 995d089b6b2ee88148a7c6b7cb6fbb137c83110ee41e85c9e9cd643ce183013eb5f01a05bedf8ad2e4dde1494eb5fa3a087819db71cbbd4d0c094dcd9f37560f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrqc:A3k03kB56ra
- TLSH T17D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 63e5db6f77531089bd8b88fddf79bc1e4ddf4a42aebf7cb943c256cb91ce516f
- MD5 1855dd6da3daa549c881fd27fad99ef3
- SHA1 b93c0f5fb5994cfccb3367840d049070619b0ebf
- SHA512 994ae7baa194d71cb39a611e5b7133f9209879a685d7ba1482e2f67539a4b1188e0e16338476247a90e984eb7b90988d16811cc434a80097a0e730555fd88403
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrjp:A3k03kB56rA
- TLSH T18E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 dbc5a73562ac151b2f94c9623e5782644a507a5953b553285d553cd375e45c33
- MD5 d406ab658f83384efa04246957f26be6
- SHA1 1da2339edc2043199cd19e594cf963d2ab494a15
- SHA512 4f9a8753faf03dc9a0a7c0dae39b826397ecae5624a1a9c19717b7d5e5191d1ad8e3d2e2477c366c86cd3d31647614299da13e93eb7a0d8e371e50b416c4d7ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrEN:A3k03kB56r/
- TLSH T18E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 30227c7bafa2c76eb55b9d190940544c42a96600990350819535cfd86e8a7a9a
- MD5 529a117364d3c46188a5238fa83704bb
- SHA1 cefe238e66ffbec1569df84906646a1dae26e322
- SHA512 041f6cd6062409db20297b79c0bf469246b0881d582837dcf7775af8899e1c48bde4549e92e453ce57190e64e16d04e612e969a873d0c1f0b75a74845fbf5864
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrsF:A3k03kB56rZ
- TLSH T1C8257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 42f1b36c058ddfc130e98b647b69083fedab369a5c3562af1859165bc30226ec
- MD5 dae6363e099a96bcdfe96b36b10270bf
- SHA1 6b421473f6239979c16de4b3eda872c158c04d60
- SHA512 246cca18fe7de509e475a8deb6f509b0b60b717f03c8466c86a39a0607e3c1dfa516f91b4f848110403e665cdaacfe91f1de821adf2d96aaab57394b1cd70003
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrZC:A3k03kB56rl
- TLSH T1C0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 d5cb597ecd5e75c0c6f074f7f2e1c45c43b3a46a38a2a71e088b6fc82c3eccf0
- MD5 adfcb79a21fb294b0fed615375b1f69e
- SHA1 2705ceefef34cb4a0e84e1f812a3f0dd1eded614
- SHA512 57313b0834cdef2a4256fb15301c326668b3164bf4682d3e9f0d7c1224ec9aa9db9cd88e87a4b02a3e753f74d54bcca64bf54bb36967929c5d9bc5a3a235b57a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXraw:A3k03kB56rI
- TLSH T1EC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 abf9b5c1f5978d4d450f6ac88eb9c3726bb59575b4c37b83ef5627d2d6489f91
- MD5 90512878da10041759b34263cfa921e4
- SHA1 d86e299899a663d52f7d71198ac715df31182013
- SHA512 745c70003b3c99d0a35f4059f0336b249a695a763713b83dc1b14767afd197c6c9a1f3fb98a1a709571651fdcf037a0eed00bf2d79ca27a7d32247230b661481
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrhT:A3k03kB56rA
- TLSH T1CC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 1244543a9f85a16dcc7bc32fa27a099d712c07a9e666c06b2b2aaae9fc377c4c
- MD5 41af5c565d6602ea49af363d150a4f60
- SHA1 2da0d437cdc00bdd311da34982b133bc60538e42
- SHA512 83bae62aa13ca0df60a8766ca1f4452c84a07255f79efe67c75794f8db1976b4bbe96351e4960f9a4bb89851994a805f1bcd9b8c03c6d5c54d5abdefeccedb22
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrPu:A3k03kB56r/
- TLSH T165257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 44f62347412c9f9fa8d9bad62b509cbf26f29e2a7ed69031d81c0a862e6dd78d
- MD5 48848c891dbae9d19485af128f19ebe5
- SHA1 aa72ab2219abf39096fc2f28e714263c60844908
- SHA512 ce049e09e2441b61ac09227b817d3e1dca02337745bdae290fde31e29fa8a6ee610525562de87d9e7ced6386df7fcb7111ad52390939ba31dbc3112c76cd9672
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrzb:A3k03kB56rm
- TLSH T17F257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 0c8540e074dec4a5ab5c80cfb0c393df0227a9c4a024f2198afb8936bdc7fe07
- MD5 8ab26c741c9cef2a2d8d988b1b15915f
- SHA1 02d4f08fc4c306eefdd20ccf411b0b50d506e161
- SHA512 de59d526337de54f44059a8e907c95f98e748443cdea8f0bad8ac3fd10e3ccd7d1519c38ec821b61cf2cde1673825cb17501fbb7ae672c8dafb04400cab52de9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrHf:A3k03kB56r2
- TLSH T154257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 7ace171ac71669ffe19dc36a0bb983d0f4bfbf5f881d808202257e7e735f2d4c
- MD5 0b8999adeb50e59d5569a55088f86a98
- SHA1 ede9520d2291c9e88c9fc4747368e45db7d7ac8a
- SHA512 298ce38f84f669a1ced7b3120866423e0482056881bfae4dd845b44433a55ce4404638917528e4bb499fdbf1883c7db7d2e2dbca488e3163667e878e840dd63a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrwK:A3k03kB56rW
- TLSH T16A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 4c7c7b3f1d336a9afec079bf410369204baa51f57682bed72ec59d46a57092c7
- MD5 c6223dd8e7b50f00f9504411b81375b5
- SHA1 d117b11f78b6e0fc5a5bc2fb10f89c3514a25f74
- SHA512 2c6452018f93753ccdee7c6e8409cdcdd32ee6715e935bd1665aac41f42d2a0b78743d850c544249f2d48df8d5c01c35f37e9057efb2b7e58e3d1f9a386c10fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrtk:A3k03kB56rL
- TLSH T124257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 82260d8a32e25107a7934c846eb2b42d79d7d2a42d6a2060b6b7cf6a397288e9
- MD5 9ee6e8755851127d37db711f8e0729b4
- SHA1 a6cac7eee8b66e1a9b71896180cc2f7e5ffae88a
- SHA512 950c05b9f49a9a0232badc19b6df773405649b9add2d433fcb8ef8e44e7afd66cb8c1d20dd81b1492242421749c645426d81584c289916ef06fca0b5d780094c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXry0:A3k03kB56ra
- TLSH T122257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 b9e6b1b4ae93c11cc4893bae288d4055b089b057fb4f9c19a4600abf3c19ed16
- MD5 b935590c7125597ef0e8e84bd0cb3aff
- SHA1 5625b68198ed8d64d24bee7b17d3766972ac983e
- SHA512 2113b95b020aa0ef4185247130f06f2f8deeab9401b56da86f4a485d1375e9a9731341cddb4666eea3a789cf381186537137b127c8493f4d8e931989ff9c3460
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrBg:A3k03kB56rj
- TLSH T191257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 3584061462a1e90e7e5670126b366c361be2162dacdd97bf251be30aa380ee3e
- MD5 ba15ca859ffd4fb9b05bd5279914f1e5
- SHA1 ab341258453485becfc324fc7752f944aee606fa
- SHA512 dddb795f367f55526caa14a356290a39cfe2a3100b1a005252f9151c5070187ad8f1dac55768133d3531bfbda9eae0ee7948fd396288df12054cb7b3efc9e051
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXror:A3k03kB56r1
- TLSH T141257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 7dc10246f4e19cebd967c793193b95c8767bab72167f184c4238c3eceb094375
- MD5 9f6cd32b7cafa080cc1c5d3619547e46
- SHA1 5d5109716be67f1e1ea4ae846eb7535f03b61d0e
- SHA512 75bdba5d0405669cc28a435d3e1e8722a38a6fafb0ea0d4935558b728aeefcbe770e9be34da0c971504eb46dd8793526e0d5a9dd9abdd1167830e3e4ed46d171
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrGn:A3k03kB56rn
- TLSH T193257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 d6bc55f3633899f551e905eb4b3a899959701658b1bde1db2ff038b2160d1ed1
- MD5 1e2dfdeaced9afb635043f83ff0dfa89
- SHA1 ecf49a8d26f73d5eabcdfa5bbb524c75ff2d81a8
- SHA512 cf818ff59216ef6c7dd3efbc9a65168453467ba4016bf01f1728c6e346eff572c1e8a833a11525c8087b62fb2f36e97c4000d58609a6038696ed1f6633b16094
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrMx:A3k03kB56r9
- TLSH T111257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 a9fa69a6c5b5621e650ad1dc34f4f686a39c257eded4dbed3cf40c39ee338a37
- MD5 1e1014b2ae4227fe764161e222bc923c
- SHA1 54828e13853250cbeb918febeba3625d139f8375
- SHA512 1b13e579b3b828e92017922b070cf822642f291775ca3e770b1b6c2c7afbb988a9c17d8872185dce032874612aa44ee3fe36dce4a3d5a3577c36ad8ca2d50e97
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrGA:A3k03kB56ri
- TLSH T180257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 7d0bf850b7f8b6bf1f25d5ee0c6b4ec496c7924f5031b402cc9aebbf01fa79ee
- MD5 ac1b0ca0a33c60c653b88f8fd7aa8b69
- SHA1 d6428219af0d3331e0a2a29f9a76675714422ab2
- SHA512 e341589733c0d5081ea18f2f2d03917b6e8fcd233263ee7ec15b619ea034b3c316e2e9e68fe00826555a058af5eaaf75f5a89c4a6528dbd803ee4ff05d18d5d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrf9Q:A3k03kB56r/
- TLSH T12C257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 9d1bd523ef00260e139e025a37d100505ddcf025cb2377272a3ec4d12be22402
- MD5 23757955adae7ee83ade1a2bacf2cb2f
- SHA1 f48dca32e7e804ed891c731dc06c2a736bd0f987
- SHA512 03d298f85d067e9a83c278ba21e056d97e5ac5b757f1965c5ea6e8fa836d132a36a326fcc73238791924a8dd0913f49a423ce1792f19a7f16160a0d9d61e074e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrW4:A3k03kB56rA
- TLSH T13A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 57e3789a6e26769207b955365b98a6fa7d02fea274fd1a939b8b27f3e16c2600
- MD5 feb373e660c3184175d3484377956af8
- SHA1 1d8401362d38bc25de2a3d67faadef860b415fd2
- SHA512 a39d5057b574d27e9e55ba86bfae7d82ccad335716a46a6e2f1b1eb25d8a5a7306fa957ee391122c7a9ba5655eb4edf2d87cde7982efd1adaf0552c76a1f7a93
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrFu:A3k03kB56rh
- TLSH T1E3257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 2d67fc6db9b8d93d7c21e1fdd92ed829819bf9e62b49a17e5207ea909a2d5ed8
- MD5 8375836b38498dd1919652fb125364e3
- SHA1 3d2221f59a17fa7f29146e4ef62e759beac3efcb
- SHA512 430d019d0dadb23cd6ad4c9e54cf2ea9474c50564cef1c5690b1543695d1675c25a361d078e9bdf133ed55458f34986a8a93dd3ef5e8bb390fdb616e06b60744
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrYj:A3k03kB56rL
- TLSH T189257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 67eb8ff818d13866ab8ed63e33c937f6fb2bc09a3b9571ee895ded04ba40df7c
- MD5 63cde8be88310a64b9d1383a409d5c56
- SHA1 7c390e15535c8d4bb391ad6e4c9746461ffabfa9
- SHA512 23792c2ca5b6cdb329f8acedf9e971ac4fe0feb38d0bbb2ef1f0f407920ffc8429843d2f1b2a4c5a51c3efebf5c4d61f3975c94c543b851f4c81a2113f55ee2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrpg:A3k03kB56rD
- TLSH T162257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 9c5fff8d2d66ecccf75d53b36c73e348045ca3d1822a14f255192a75939dda1c
- MD5 93a4f319401e4ea07fa5deb106e54cdc
- SHA1 57a6c1ef384780a3f157ef57c186427dfafe4a20
- SHA512 dce60f2035c0c24e56f43b00736622c3e659c673489806da413cd03905d2dd60325c8206a7d9369ad0095e2fc90194eb886375e8d4fa5bd82e4ab806fe4b8ead
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrwI:A3k03kB56rK
- TLSH T1EB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 1976abec940b9daee86b6164c14b20d9b8851c756891d93662b4a662921854a0
- MD5 19a42e480129de47a8d5810d630e8fb4
- SHA1 7dbb10a6300f64384ff5b7fe37f22e58cdbd7420
- SHA512 2f160889e8dcb449bb23d57c0d2162bbb520942a75b9c9bae9a56d0054f25a99e6f44e0d08bf75b6e7ac708bb2d5cc36ee09a2b91bc616d89e11742d3adb25e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXryo:A3k03kB56rY
- TLSH T114257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 f7b9686f4695e7fe838613b4c2c52ad1ca2e2801f6f3162934f96ca855f868f0
- MD5 d994690a435287cb7b6a76cca4e7fbd2
- SHA1 687d27212c905f49bfbd11772a5be5dfcd1f788e
- SHA512 90118d729e10afa5dd8bb8bc1afd5c520eec009356d4e2c73854eeac1131ce54ec5876fa595369407398c33a844cd43eb612bd88ce7e75eb1fcd1bc30bc2543a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrp+:A3k03kB56rl
- TLSH T17A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 46cfbb44d14b5353ce30732d4c65a1a7704df852c5f0845ff275e3e8821bca7c
- MD5 22743dc386f13eabb8ff32c67b8e0dad
- SHA1 db1231fc410c98add3b3d1ecf47eb376ed2bbe49
- SHA512 c5afb3e8d1b9493e4cbb5d90b6ea09d14c69ef9fb50be9e1d154d17a569ab404c1d5285fe5134e4e99b6f8d6b51b14829c6e9a6a5e3aea2892dbca3f5a4c6a7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrXQ:A3k03kB56rt
- TLSH T141257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 c4fc2e341118d0dbfa00a9bd0516a580a7e54cb39bcd10d738e476c7db2ef03b
- MD5 d3351cbebc3b386755cb15a6e3c23777
- SHA1 edcc9aa737638ebfe163254287bbd4269b940fce
- SHA512 b2a68d9d4511120a51e88e3b4240f47adc130c650278c1ed790c1b2ee592d2574db10d678932832d57caec23f22cf24de7d841b4cd6b94069e35564aee44f954
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrsX:A3k03kB56rZ
- TLSH T13E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 93a66e4ee0a732dffa790f6efe602c538738eec3a1c319443444dc91d2094f1a
- MD5 9d313ba047466bf0d39ed2070347fe1c
- SHA1 2288109f818bd1d697bc37a1d0b57117f50ded55
- SHA512 4694d2d9ffb0112a4bf99b0c3dd909010da0885dd7a884c41fd59dc3aa5d2508d5b9e9cb3a577d4430b1d417409f9f38dce137178aa6fc0cae4803e19c706662
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXrKL:A3k03kB56rT
- TLSH T142257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 709edd9e1ad1ff5302ed42a025e1b4a90c750c09ee5eef2e7f0fd85dda0e1fd3
- MD5 07bf2dae2e4401275535ee3835ac0ced
- SHA1 1fe7353add69446575f99e35fdf170821362075b
- SHA512 e569d85bf024f8b5f51543ce6c5612d873f7ff8503fc7341fd0f00ffa282edab5e10f0b4ee2de93935b23007ad5916192e420f076eeee5f2358401c4af1b9161
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXruM:A3k03kB56re
- TLSH T156257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 b81c6374d98af7dfbb3f06e3c2a7e2af3d0751095bebe13810b8d2e16a3895be
- MD5 ffdb4646a4f8592f58ed043495dac398
- SHA1 b4c0e98bddc8e4ee33df6f9ef7a5cf24b32f59b0
- SHA512 f1258694fc9f1e72ec65ffed52298902f14f13ef68a27d940d4acf1dfa8276c541e5992b7066c7062493356243fd06759843cd2b2132c05d7f4ae435821904cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagPbXr3h:A3k03kB56rw
- TLSH T108257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH