Analysis
- max time kernel
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/07/2026, 12:10
Behavioral task
behavioral1
Sample
2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 939KB
- Sample260712-pcdstahv5q
- SHA256 b89a7ece0eb7dfc1a408ee6447ff3c7729f3bfecd4089b035c55009b911ed694
- MD5 9d6d666339e232e8001654a148689c95
- SHA1 ca1483d112906fc8c97ea929bce611ce948bc9e5
- SHA512 5ba8856e42575b4239733de2047243ba1c9c1bc59310284529cbce9eb0c5c703436d27dedca7ef1d8a31b04b53f24997922761033252b9194b4951a633cecb44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1u:A3k03kB56rG
- TLSH T174157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/1460-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c481-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b311-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1460-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4872-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b316-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d3-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d5-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019853-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-473.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d7-504.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-583.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-614.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-751.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-839.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-914.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-928.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-961.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1016.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1059.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1072.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1103.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1159.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1206.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1408.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001886c-1489.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c481-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b311-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b316-41.dat aspack_v212_v242 behavioral2/files/0x00040000000188d3-202.dat aspack_v212_v242 behavioral2/files/0x00040000000188d5-209.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-230.dat aspack_v212_v242 behavioral2/files/0x0004000000019853-267.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-364.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-473.dat aspack_v212_v242 behavioral2/files/0x00040000000188d7-504.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-583.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-614.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-633.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-725.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-751.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-801.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-839.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-863.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-901.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-914.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-928.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-942.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-961.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1016.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1059.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1072.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1103.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1159.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1179.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1193.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1206.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1279.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1334.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1353.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1378.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1385.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1386.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1408.dat aspack_v212_v242 behavioral2/files/0x000800000001886c-1489.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4872 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{F9EB52BC-12F8-400F-88C0-E0E8FB418737}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1460 2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4872 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-12_9d6d666339e232e8001654a148689c95_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1460
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4872
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 939KB
- SHA256 b89a7ece0eb7dfc1a408ee6447ff3c7729f3bfecd4089b035c55009b911ed694
- MD5 9d6d666339e232e8001654a148689c95
- SHA1 ca1483d112906fc8c97ea929bce611ce948bc9e5
- SHA512 5ba8856e42575b4239733de2047243ba1c9c1bc59310284529cbce9eb0c5c703436d27dedca7ef1d8a31b04b53f24997922761033252b9194b4951a633cecb44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1u:A3k03kB56rG
- TLSH T174157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 968KB
- SHA256 7568d954c83a9b19b81c4f44a1c82a62efedf415acc385d8599c9ccbf766a110
- MD5 020dbc0d7d3f1384f63adc9268ae3360
- SHA1 361baea7d9927fee04ba2c53e096ce66600e2c36
- SHA512 597847ba9280e7110edf77fa0d5243ed8cec38412e125a2f3dedcbda3640bc6908992e31c6183f4244c71b4930e3c4cdc7f83b0795db6938c85b32b29babfa6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1oP:A3k03kB56rG
- TLSH T1B9257B13E6840FA5D10F81749AA58662EA777C125F2093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 640821ab2e8f6fb71061d194319c70ba6464d5932e18fab7a93bb34efb1c65e9
- MD5 011d3b740bbc73bee891aac605c44237
- SHA1 9318c783e9d3cc64604a03d733f4cd50de4bf3a5
- SHA512 aa44f3ca95c3c010a17071f78b020683f677081db8add7e965247953263a42bc2df15fda35e93625011fbc136317c3727299a588fb7426f87d7ef0ba3f6e693c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1e0Le5ji0hmxNrM:A3k03kB56rGPji0Aj
- TLSH T186655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 953KB
- SHA256 71cf0ba0e4cdf5668c975f26558b6af1b6ac98576b276af8dd6ac257edc8b82b
- MD5 f6a4ef8014c8110cbe9680cc019b0b46
- SHA1 83a8deff5c2abf78d485bebb65f6d319bfc3bcd1
- SHA512 a66c80f224a7ba77188eebc251cddc7c83ff39652903582204cdeea3cdb3c655c7282fb9ad3f8e8d1e075f31079bcd6d510a131a3d28e84c831f518e44b53569
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Ya:A3k03kB56r
- TLSH T11A257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 962KB
- SHA256 2709098cde42b3ce10dee6129c0475010897de079756c9cf205d2d90e4b976b9
- MD5 9c6937150a311f95359513206e4c0fb2
- SHA1 494dcd540011c10ea2b898f88986336b22905cc5
- SHA512 91757dc9be3f8271dfa36ea64788a613aa6ee02034e04c255681691db2865956d2553926b512eeb6275d248b358423b0b0d9c22579fa0612d8ee46a1360f8847
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX16Z:A3k03kB56rk
- TLSH T18E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 962KB
- SHA256 0ab46592b3386da703947701d1a98fee3cf493bc84396eed7f2d094cc4eb02ea
- MD5 e9ae4122f5ae4a340b857a55ad113293
- SHA1 f20f76b7242574a8c15c92d0d4066f14d1edf263
- SHA512 c933cd2014025f62d2ab8fc273f8bd248cfff0f2a7039c1a35bb7369b04b4efb6e1ca89ebcbd6a3a19506bfdccdd517ab4843a5b828e06733a63dc9815960756
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1F1:A3k03kB56r7
- TLSH T1FF257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 962KB
- SHA256 f31d8ed08dadd48c4db4e6e40930b58d4fabacb854d125c0bedc12430a4c2c20
- MD5 a8fdb90d53c34205c925b0b22ec3126a
- SHA1 f4f177ef27eb444734d900df3524aa62d0f9a546
- SHA512 215770b1f0cf9b0e4624d93fe374ffbdd503fbd8dc0ff6813536a596d31b9a73f93c73ca51a9439cccd449b766b3bf07103a2543a54e19b59faf56db63a578f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1x6:A3k03kB56rw
- TLSH T182257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 962KB
- SHA256 0cf61c82e4abf246299c3deaf8e8e7ebcd6aa0d9a63e52ecdeadfbeb0e98443b
- MD5 b33844e3d36810031ac4612869419486
- SHA1 035b95fd5f7091ad78b2405297ec39f4b52f7386
- SHA512 65b2cf40b6ba6c76f657bf5adbae1ae05ac8529065217f890a3eea64826532c5d768127081d16ae8b1dcdde13c261c371a4d5bcfe1070f0f82937120d5b33c9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1vN:A3k03kB56rt
- TLSH T1C4257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 962KB
- SHA256 e1279d62e59f65ead4ac121bb8332f99940ae5a7fc187729549e2296cb3513f7
- MD5 609be92e05168987c96b2bfb8131f6ff
- SHA1 44d645072b5ee63671674370c4396b808c932699
- SHA512 8cb96d861adf0e49ae61db67760d11409d2efe69232787b5a0eabed1eef4efce10731d1764c265f1e4107af9864b1ffe0d62ccbb52b37107521dd4b3d5c49917
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Vf:A3k03kB56rF
- TLSH T195257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 962KB
- SHA256 0a84fe32b634f7684fb22d9e29ed832d775af6ea4d36c113235d1392202be14f
- MD5 a9a827d46e0482a574cfaf23313afca9
- SHA1 36e7b2a03f7406527ab50897925806450134373d
- SHA512 8f99d9fe2f3f14044adb73739244093457f093d22bbe21cc94496ef9f27e39fde9787d17b0ff49fa140fedf231e881b9facb1448c0b796c7b38147e920f6165e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Xo:A3k03kB56rQ
- TLSH T121257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 962KB
- SHA256 d9010489a96d6e7b595b12b1851447e679104de58e15a991cda93a2519f58794
- MD5 1d5553ebe7c57164aea086748f952eae
- SHA1 49258129a570423a223bbc3f26f7d56b5869542b
- SHA512 ee4c436bc773a7f76f3fdd9a789fa9d31b09f3bb1f4e4a2270eb679fe99a261eedacb72fd7c224c1e5a01be28989919b76dc91f789af2e2c780dbc09fce96235
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1bu:A3k03kB56rS
- TLSH T137257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 962KB
- SHA256 2e940f415f30a93e1f82e58e691af551a021e13cd4b7de1ce14bc9f1f3aa7774
- MD5 17ef57c339df1da045377c1bc4c62da9
- SHA1 7fd2b656f3500e211f7de7a61515a0315291f79a
- SHA512 9e15cfdd96cde9dd50eaf10389d27fae395e2559d1c20c5c4f38ec2806db92b91869681bf1601870aac43d85f0bf2db3bd1b003ae703999f91dd5f9fa15072b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1J9:A3k03kB56rT
- TLSH T11C257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 962KB
- SHA256 8e016e1dbf2b8b2b3ef91a6ff7dfafe4d695100270c65769acbef3429e462faa
- MD5 30fd2ba4309d2c756894c983253654a4
- SHA1 fa6e50e3e4c229eee4933b9b0bb538471bc46ff8
- SHA512 78336d055b4beca2ec439e3610ebde84dcdf8d496ca6dbec23c99d57ff124aba0975bfb97a4a3231e4f6806de1f89c5558eb66ee44412a0949a052e141abc3ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1lc:A3k03kB56r6
- TLSH T1AB257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 962KB
- SHA256 af543ecdfb788b6e61ce4f7b11e9f5e66b67ccc1f2dcdaa4558ab5e24f4b5827
- MD5 bb414c87a949d3c07b736918a8b5e203
- SHA1 e8be3c48e1643ca651daaa9170097020e09868ac
- SHA512 d6b97bf1ae08c9cf5b72f421af338d6a41f06c3445ed99589ebda1808c2b0df395870e5d8998d03d21b859270678e48e89080687640c9533b38a0dc81eeed52e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1ep:A3k03kB56rg
- TLSH T137257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 962KB
- SHA256 47e99a9adbfd145f84462cc6eeaaa57fbac51cf95e10a57d658a736d69d4acd3
- MD5 edd31ec9d3dd8bbfb65f13b7680ca224
- SHA1 1f8c0f01426343efeb3f7732d72632eed9192ffa
- SHA512 163bcc68bc5a25669915a47babede3c9721c9c46ec7f831c65e87c813572fa6a8adbf99acae5fc6f1886d213ba1674148e368d5f5939885b38e0c5464100f0bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1RN:A3k03kB56rf
- TLSH T155258B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 962KB
- SHA256 854816fcdd063c9425c1c0181cef4deb22e7c49ace1e80c48a386e1286fb8b70
- MD5 c83fa7da65ec0628a2dab73271be8931
- SHA1 fe8b28ffd4c745d97115c56cb76daed49bbccd70
- SHA512 9bfc7c71049c82ac55b1bc6ff868099e618ebf2b721d34f99d48fe4e3fe3f91c7c521949fd08a041983d907bd0c5693e2d49bef9515f8555696a577266c2fca6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1zF:A3k03kB56r5
- TLSH T1E0257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 962KB
- SHA256 d9e4d5529c59f6394f0b12a5ba9e3e3d6c2d1812553b55b9a9f33c2f364b4742
- MD5 f216542c320bad57036ec32352ca58dc
- SHA1 8631dc2a0bdd90618c5b78a7dd784fb46d4153c8
- SHA512 a8e4afc3e896896cb9abce6198d4f4a9f84609246c109ca1a9deb56e5d9f399d96b92938cfcbcfeac64e0a2ce991ba141914b402e3db3e880e0bffaafcad7296
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1cC:A3k03kB56rF
- TLSH T166257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 962KB
- SHA256 a909a3844894857718340c77d0d7dfda72c73b7efee80032732fd535e63444a5
- MD5 f164086f77f92c4921ded92e0e5e8803
- SHA1 c2bfd828e0922beaa57d5892cbcc49087fdadce7
- SHA512 eb58cc00a8cb430d1000fdf6925b87b554551beaf591dd5bf802a861284f1a995df282c07b9548457e6df8e960d0891ae111f36b62d93dc24241be4131f40db6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX13w:A3k03kB56ro
- TLSH T16E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 962KB
- SHA256 3ae67cc7298479b588e54eaf86148240f2104d6b2bdeaeca4a287bf2852e8d13
- MD5 73ccf39aba685d0468d2d739e48e4176
- SHA1 0cb6aabbe744d08c53cbbb83b2d9f93445a298fb
- SHA512 25e98e0a408f7a471b60f2cb48f1a8ae240f091ec432f64f84b4522c55438c71a40e6565d9d1b403f1fbbabb28cc84f53289e0b29999016041b838aa763ee958
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1mT:A3k03kB56rg
- TLSH T1C8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 962KB
- SHA256 84f84ebfc3c1dac8c18ab2a1bdf01f44e843d3e8e4bda60d52e6da32eff03fb4
- MD5 c37c30e36bb268d2e0874644e2c67e73
- SHA1 5a9796cdc6300fd3b9b6154fd6f87c9540ef7d06
- SHA512 ce7bb4cd0bcbeccbd2eef162fb95fed9fe150448a59e9578a0f2fc5f837c23a5785426ef5d25350a49c0013c46458ffb8b05fce67cf0226ab42cab59c58ae5a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1eu:A3k03kB56rf
- TLSH T1F7257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 962KB
- SHA256 8307377bd686d266371b8cef2ed9089f553e889dcf1f461fb9b06fcf7024bd44
- MD5 c09fbb8aede58e04c0e5e6c846f785d2
- SHA1 8fc8179267eba3f0af688d11ddec6fad6b64ed30
- SHA512 6bdce12d0ebd37cfa4185500ea37d9c044209bcda0b6ca88a5a7dee86e0dee7e9bcc55a59386f24522c77ac48161532b92c329b5cdeabc9ad93b746cc25f2208
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Yb:A3k03kB56rG
- TLSH T153257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 962KB
- SHA256 c5189299d708dcf3c48efb9fcc69ffade9c1b145e45ef2594a49f5b9ebe131d5
- MD5 b3e490853fc6e6f34761f8b2f4b23645
- SHA1 4860fd1522060e4e875ee5f7ddfb1cd09ef35695
- SHA512 8212a897cb5762f3ce5c49dc21d3c5675e58f69e9596df563fd30dedd930f6f9795cee93c81345cb4b8d6302b83a8d2b33b722e73cd62fde7c30baac7b9ba8be
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Gf:A3k03kB56rW
- TLSH T1C5257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 962KB
- SHA256 47925fb7cb44c15858d5d0329fae0c95ea73350692fbc159be884de928cbfc6f
- MD5 c2ab744036c7634c642097e6844c1dda
- SHA1 0ae47fa3fd371f3211f757bbe56d29f1bda7b3a2
- SHA512 e27f44eea568555c0ccd24ce5d51cff6b6e05aeb2b7bc98756d5af55b2e90b734038719760c9e7fd50161c3af9c211d1a10cf75129bc7e12744467fc9070f57a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1DK:A3k03kB56r2
- TLSH T11A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 962KB
- SHA256 0913b752fe8a5d4758098c0347e2eb9168a3f8a5821e5812ad27637cabf1b8fd
- MD5 6fd839dcacd0d54750ccedf82f6862c2
- SHA1 a649f655b9e3fe5a6b9f51a0d9c94b9378b0eaab
- SHA512 b9ebe3186cec9d05e878297ab5ffac9243fcf5ef9d21a1fbb12faaab22e937ffe6633ba5c639b6e532a236deb57dc51ae9e3558a02c825522aa6d20b9661de63
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1kk:A3k03kB56rr
- TLSH T145257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 962KB
- SHA256 6c1b11967d2bb733459f7026efa2aca2710af91d89960c8461d2968ca7351ddd
- MD5 2dd2a86dd610273f8f913ba0fae1fa6f
- SHA1 6c699b8fea75bbc0b3d6fb6a919e8ac176ded9fc
- SHA512 f8e33d5282bdcc18a11a1c5485b928cabc5ad3bc4fe233b5f9cddbbfc4b7127033e7339545221f882cad039fe823e600307bcd4aca3c6b11e14ff38adef8e521
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1t0:A3k03kB56r6
- TLSH T1BD257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 962KB
- SHA256 96f9e5d15e9c2641d67e45b6ee2c0b8a2f6d46701d593cdd39e4b50d12021821
- MD5 9e85c843bca8c6a469831740efa9c3ba
- SHA1 019d40337e8227b016837aaa0083cdaf9be7df6f
- SHA512 cac4885f54b2f9125cfef2c78011c0c509a732efa8f6efac00ef43a93758e1e84daaee886137b0efa91d653a1aeb9a488c664ad9a534a8c09be54dbdc375f35c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1wg:A3k03kB56rD
- TLSH T186257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 962KB
- SHA256 4f27bdea4644e10b569956cb43d174123539f5ca5e4180633edde0cb0c407d70
- MD5 53ffaa851b0b4132017cee6aa603d2e1
- SHA1 89f59648fb04f3ba0b4fe03fb9c94b020bc6444a
- SHA512 87acd80f62d4b12f9204dde5c81abfacb33ee4dc885de837d8f9ee676ae9c6640ad87a772ea1726376b9013d56c62a6ea116f16e0ebbff8ad1314d6907ad9162
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Fr:A3k03kB56rV
- TLSH T16B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 962KB
- SHA256 2c7125c8363bf4b69e553a2e4c48fe9bac654a858ab1d9e9c4c01102317d8945
- MD5 4b9281ed9c131e1ddbf30894176dbbfa
- SHA1 45bf6aec6c948997a718c56110cf9396ed29a720
- SHA512 9530d021e6a786f0e993490f8c0dc5f669ce76319845e35a0d00df133bbfd53b136af762b091863dc2deeca444d55107a43a31b5f2a9646c11fc934103bc8773
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Pn:A3k03kB56rH
- TLSH T1DC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 962KB
- SHA256 99b68b4d4406ee139a954e25921f616d927e89c3f81541c339ddb912f39d3b5f
- MD5 83484aef97fc63bd3930ea1d2dd1bea4
- SHA1 eca10de695c03b53b5a165f3318c43d05acb2846
- SHA512 a51917e994db90d7d153ba1df50d08453127cd66b9c72dc1ac5154f6a64b586dbd9d9b106b96edfc4e95360ad9892abb2e2151b8a1f015ee41b2763fc322afd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX17x:A3k03kB56rd
- TLSH T176257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 962KB
- SHA256 8617e0a8ee971b1edfe6213c74535ffc9f4f765942d23cf5f074bdf129437954
- MD5 49c136fafa57223942e75ba96ef3dfd6
- SHA1 349d01c47f242d501479d4af4abfab1e191097b1
- SHA512 ec791c3e727c28e989bf7c9a94637b609510ffb8dade416370c404e95056982425a572e616db2259d7fd27dccd875ee04d34dcf438eeb9594e95674fb854f1a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1pA:A3k03kB56rC
- TLSH T131257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 962KB
- SHA256 85b7d4597cc3ebe0e638fee08b931b87c1bf4702d317d00afcf948da91af7a84
- MD5 a92f87b6b01d52540f3eb9d9738d3aee
- SHA1 1a1745307aec27558708999978f94584713e69c4
- SHA512 7dc33d3b44f7c8a450c40d325dead7c6cdf9b27c4f425d13e4d74d6cb839acaa0c5ab0252457286346aaa6254095281452e1ffeee5fec9b7ee9f1d84b735d5a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1i9Q:A3k03kB56rf
- TLSH T12E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 962KB
- SHA256 90eaed9d59b9e935b01a342c16582ca8e21be3182240700dc0731a62f01d8ced
- MD5 7e5add8fb3c7b12607133d1547d554c5
- SHA1 1fc4dbe976ebefaa45b622eba39c60c104f28ab4
- SHA512 6064a8243a62f40da295b036c8b2034d33b372875215de18e7d834ac30a9e697e123ab8185fd7bc0a2255746765b818e9c4785febf63ef2aedbf998cb091e23b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1H4:A3k03kB56rg
- TLSH T127257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 962KB
- SHA256 105fca2f6db00ed8c5224242e6a0e9c49b9c9c4ac0ec2f8a3c308ac245270510
- MD5 9e1ae130ac82929b72bdf2383cb50165
- SHA1 c19b1b16b7ae8dee099183e180d49d3f12364c0d
- SHA512 4e0e56f805007257fbb2f10fae025a239ece1292a8733a26fe66e91336575279fa742c405c29a9277665c8ae4e11477e6d34e43beb0fcaaa435eda462acb674b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1mu:A3k03kB56rB
- TLSH T12E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 962KB
- SHA256 e2e377d8ea90a8c27152831801c0f1df0628f533342f40a45fa1ff45472b5c15
- MD5 a96d600f182f1936c3075c3b50e4ec75
- SHA1 feb56494c1f138ddf6eb7087cb286d3bff38740b
- SHA512 d7600485173129be921e3147f703af636ef2769e769d514865f59d3b7c9e0bf9ba3550e4ce6a05d2141b2eefbc62e77e2fd3bb092e19a25c2ca0e2994eeb4e7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Xj:A3k03kB56rr
- TLSH T104257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 962KB
- SHA256 729f597da4536f3fd987fcc30fb5ef95b8d8e90d8e7fe2ef413975998f7165df
- MD5 18d6ad2afb5ea46a6af1b51d964656a8
- SHA1 171ade329f20de17569534c242fb56634cd9361e
- SHA512 7e290a9d980829c067d0d72b5ecbed7387d71fe2c42f2f9220845b45dfa8a756dd7f8e3e2744ce1e35ad3021cb823e4475d8319967ef8ded973d6fcdeb8d5114
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1Cg:A3k03kB56rj
- TLSH T169257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 962KB
- SHA256 74b1d8557fcbff3c831609026531b77665d236b7f1913293eb80dbe9d7d0c3a8
- MD5 5b0fb546b55db6a223fc5308387cb9c8
- SHA1 040ae247e827c8b0d435ea586f7ce3607193e023
- SHA512 77b234ce69b9edb9055aca1838d077428fc799f2ff9dbb0eac05811a57da1667dd8197dcb6a63bb4df2f04977769f1dfcb9c07a5cf3854fc11d8be3ebaab6d00
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX19I:A3k03kB56rq
- TLSH T1F9257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 962KB
- SHA256 4401d5a8f67a95a72092f4a28a22c7fb65f92bd324abbfabd4503b25f8cfc856
- MD5 b13f80a5a108c878224ea2a519f82161
- SHA1 f6868dd046e6b975c0f5f57b99ede8920552eff5
- SHA512 eabeb7f91eb18eb0e641955b05e33a6f9727911b8279d3352698c7b2ff18ef0ae7aa3c8fa4c0d615cf046ea752260262a40ef554d05f37589ea632c7f4075f48
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1vo:A3k03kB56r4
- TLSH T122257B03E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 962KB
- SHA256 f0a981c5c755490e01ca8cea51614c24ebb37203a7d9364952991376451b2e35
- MD5 a0849398c915e1d35c5d3765915e57af
- SHA1 ac16082f852a72fae1ce49489df678bed02a8afc
- SHA512 6eef97d43c8c4ce6a18df907f70e892dc8b3362b2d8be1b71b4340ccc2a11c589f5c869669181ea3004f756d391c98fdd9a25cc14ee8a4a7270158ad15936795
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX10+:A3k03kB56rF
- TLSH T11D257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 962KB
- SHA256 44c668262b06f86bd2840266ede0e1898c02931aaf470ed838e191b6831efdd5
- MD5 ad5d2e7afc2416dd9c62d1f4632d74d3
- SHA1 1032ca6c638759b0b58cd170c1528c0e64d59c3b
- SHA512 92c77f8d8eb733adb1756353fdf63b217dfd6aea15606e43e440dc7f7ba2ba28b22a1280b032a5adbedc3f9068a861167168b2c64bd2a1cd1d222a5e262baf91
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX18Q:A3k03kB56rN
- TLSH T162257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 962KB
- SHA256 53ed8b2b34c7384f4b13035ab422ca9dd94f82f88a7af6217a58de5fafe1185c
- MD5 2a3d4aea7fd742c51aa3ee394fae86ed
- SHA1 a334f4f4724d84954f88c6124201d39a09a1690f
- SHA512 8ca4c516620428fee5f9fc4f96a7624f698558dfb787477188dbd91b84e62ef40f24b58211b39f7f670b93a36638ae3c5be9883e113e7647e58c5fa6fac16caa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1lX:A3k03kB56r5
- TLSH T116257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 962KB
- SHA256 596287e03c38cf930ad0d33dcde6f21c549f0c954f34fe7d5d40336cf79770c0
- MD5 cf201fe92921c9e2a8926ef2f8fec4b0
- SHA1 f7bba484981e9e802966ce38fec716e23f3a081d
- SHA512 75357ac066822dc6edd0df0b18f6730723065ef61e6964055362561f2373dfc9b15dc6a81867b331b8008005eef9fc5b65dc62bc90ad83c4265cec74d2d853d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1HL:A3k03kB56rz
- TLSH T143257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 962KB
- SHA256 3023466ecc00503a67b1d42a9b0e9bbabb810f60498ea80da1cb7a7fa27c12b5
- MD5 3f3e2dd107652d2498229ea8c11c098a
- SHA1 c87fdc7e81aa84ca4a126fa16793138103baf945
- SHA512 fe552219389f591e33b99e92a0c762de23bfb2759db268be72242ca415d04daf4c2c725b3692dd8ba9c4a1c3911a243634178d3acffe6d8efbe741e0d96ce815
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX19M:A3k03kB56r+
- TLSH T1AC257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 962KB
- SHA256 4495cf3199e054ff9e0968403d5dd66b6cc6401fc9894b685e928d7606786399
- MD5 b2d413a8f78ad7e2a24afe9dcb061204
- SHA1 d4f402672e758963013a0142728136a7c3a1f17b
- SHA512 21bcfee8f869f8eed079c51a05c8e3ce8437f46b65deede30bb7eb880be3f8c6cf8c5c2526e4e0c67ecb52ac638bbb440d362ee33e11471aeef3b09467a0c411
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipmiX1uh:A3k03kB56rQ
- TLSH T19A257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH