Analysis
- max time kernel
111s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 08:25
Behavioral task
behavioral1
Sample
2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 922KB
- Sample260717-kbdzzaaz81
- SHA256 f422eda9fc60668aa516de885bceb697b42cdf3389b720b4ebd214b97f005a79
- MD5 218a011458e5eb7534473848754a97fa
- SHA1 310a0d19a2058bc68411a1a83a8390694ab592d9
- SHA512 f13b2e0b26c744b04e31b1a2f7ed80a4509cb86ede49a0e35a4f7ee1890717122654bba66d95ca304d93bae1353854966e73e4e0dc02ec7c6e3169948956201a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa:A3k03kHRJARJ
- TLSH T17B159C03F79800E8D15AC1789AA69A22FB757C560730A7DF1364D6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/4980-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000001b858-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00050000000187b8-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4980-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2032-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7a-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198c7-239.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a4a-451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-591.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-708.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1090.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1401.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000600000001b858-5.dat aspack_v212_v242 behavioral2/files/0x00050000000187b8-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7a-59.dat aspack_v212_v242 behavioral2/files/0x00040000000198c7-239.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-264.dat aspack_v212_v242 behavioral2/files/0x0013000000018a4a-451.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-591.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-622.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-708.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-921.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1010.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1053.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1090.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1139.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1170.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1183.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1208.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1323.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1343.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1369.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1376.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1389.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1401.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2032 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe - Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4980 2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2032 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_218a011458e5eb7534473848754a97fa_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4980
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 922KB
- SHA256 f422eda9fc60668aa516de885bceb697b42cdf3389b720b4ebd214b97f005a79
- MD5 218a011458e5eb7534473848754a97fa
- SHA1 310a0d19a2058bc68411a1a83a8390694ab592d9
- SHA512 f13b2e0b26c744b04e31b1a2f7ed80a4509cb86ede49a0e35a4f7ee1890717122654bba66d95ca304d93bae1353854966e73e4e0dc02ec7c6e3169948956201a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa:A3k03kHRJARJ
- TLSH T17B159C03F79800E8D15AC1789AA69A22FB757C560730A7DF1364D6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 420ef3946a5b335c7440809c39bdfb8735fd2c66db14d3a2888e64068f25bd41
- MD5 53108414de9496ca62aaaea33025581f
- SHA1 880db722bf3712d1ffaf9ade668baa495387e3b7
- SHA512 cd022923942b885dda25a5e732d6f65001d118829556f9443d755d2a3952f5a9bff9021b618e9635918e887860f26197fa0aea017b9abc12c2a1f11541b5ece6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaP0Le5ji0hmxNrM:A3k03kHRJARJ6Pji0Aj
- TLSH T115657C17F6A802B5D067C179C5D29A5AEA72384207309BCF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 970KB
- SHA256 4dc12e97aaeb763d466cd1bb79747d5944b3b7b9caed311d5eb03bd311ff7a8f
- MD5 e33a53b16e880c9a4435a58c102b53cc
- SHA1 dc01bebe5ce1df05afcfce9a3f24b3b976454bbf
- SHA512 b3e3f9a30b5323bf22370c3155ac43bf63c4f12bb73952ffe7923667b2fac0cf295bddeef4abd3b96b96072b4573a3698dfb90497e5bd0c022d04d18527f19d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEayb:A3k03kHRJARJ/b
- TLSH T1B3259D03F79800E8D15AC2789AA69A22FB75BC521730A7CF1354D6162F73BD0AF3A355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 946KB
- SHA256 f8c0d6228e7b82fc053934ed54461c09fad4731d082b5fc86c4e599398f8d67a
- MD5 cb186917a1e72638ecb6f8938023be08
- SHA1 0a28ffbdb19050c4435b5e6428e0652ad12f9ce9
- SHA512 4c4921903eb5edbc3664a5d294917a5c9693ee1f71783a3ccd84da131804ee8b98211209a8ff812c50e16413ce2b9d039336ea229527fd651d6db13f5e48fb64
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEao6:A3k03kHRJARJE
- TLSH T141259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 946KB
- SHA256 9b0d5353fd8ec18035c2acc1e509898c4482d15027b33d727e11350433909df9
- MD5 2088804e34a17dc80f459793f2eaf18b
- SHA1 53d00477fbcb17c1880df42b56ce1784476aea2a
- SHA512 9625599a7f61513d64f5afbc02d76670ecdd67f415f9d5091ad61bff5256723114447e9713ffd163234dea1570ce7eecf34826e1e805d2a8c517d7ceaf49ea58
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa8o:A3k03kHRJARJs
- TLSH T106259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 946KB
- SHA256 33939e1834294aa15fcd59df71817afb0cff7a86cffc9dd18b5c0cc0bfa48f39
- MD5 979bdda73b69aa18fe549c483ef44458
- SHA1 6f36d133a033090935e5729c8ecdccb909d9356f
- SHA512 1bc4020564a430ab9665ea65bcd0bd3dd343e0eba62ad2e8d9f24ad4dd5f569a0a4567912ff3453258fb52db4ead50b046365911b45838e3689c2f5b9f08b60c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEacu:A3k03kHRJARJO
- TLSH T1DC259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 946KB
- SHA256 6486696646a8c915be651de82f08f50c1b0df67a3c83556748a7abfc72f0c53b
- MD5 6ea56fa95dc32ab991013e5d7d1a64a6
- SHA1 94aef235fa93d47373f5ff0b26b0000c5d2e28c2
- SHA512 eacc867ae1d12cc52d000dc650ef4589a7c130c6c44dadeac504d47ecf84a42ab6b9e7194d5c7dd6967fb028aa20d3766f32fbe3166b9dc0fc8e7438e3cd4ed4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEag9:A3k03kHRJARJv
- TLSH T12B259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 946KB
- SHA256 b9caef9603f285e78373d0f0aea629f63c522dfa19fdecf12cab5016e1e62b54
- MD5 1977597899b24495d331e3d0894efa96
- SHA1 e809696ecfb2782925a1787fb1679f6c206e656b
- SHA512 8807a02e9be2e02ba0566d08b1e79f46738f143233d206053f3212e48378189d40aca0207846b615155f3223e3745b358f98025ab2ead7b6862eee7f074019cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaoc:A3k03kHRJARJu
- TLSH T11E259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 946KB
- SHA256 aa6889dc3091c58db8ee1003bc6a6bad8187d49446e7b034fb53ef9548ecd72f
- MD5 46ab99cc8caedf7983988af9692ff5b0
- SHA1 28650a197c1317c16da09ab20b76f5c75fa8f980
- SHA512 451d1faab7d2aac75ac42d3f5102b03ebfc9a91ccc41bbb98d2754d1d5ad99d1fd987211acc497b826af29ad74666ffededc964d3614f37c7ad59b7c37dbfa78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaBp:A3k03kHRJARJc
- TLSH T164259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 946KB
- SHA256 912aff0162ee7df1da7bd3a00151401380d97c7429eb2e717b9fa5532360a893
- MD5 b9cb8c2ffdb938bd0829a26a028b6a69
- SHA1 bc90e269b950852561bbd4a250add56a38f0c07d
- SHA512 74eaa41251b5711ba4166feeeed17581548cb8d96926462f47f439d17c5ccb9d5106d64aea1ab3d5b8c30fcd61d8dfa1e28c7fd3a2a58228e39c4d1c865fa81f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaWN:A3k03kHRJARJ7
- TLSH T190259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 946KB
- SHA256 f4379e5cb5abe85057cb3d9032f5bbe63c09d43c4ee498a738b4a38bc2a9dbe3
- MD5 3a05d5edcd25722c3e8a833f99c6941e
- SHA1 f7bc07d16a9b57d8b903bdfe731b5483f4619245
- SHA512 a28b32b2ddb57f9cc2c02e8277ad0e48a6d514fae78d0341649297e13f02cbb0b0439384016cdb4afc11ceb568888a0726c206cc357a378edc239d7dcb9bd69b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaaF:A3k03kHRJARJt
- TLSH T1AC259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 946KB
- SHA256 b6f92a97e2831e9bb69c244a640bf0a3b7ff06781ea3d05292d44ef2e2e3366b
- MD5 e60a2040fbdfb037c5869842f4451ec3
- SHA1 979874a95b4038f2329f79dab3c2a5c396be6097
- SHA512 9a3efd5c8a554c21ecc55cf76c140274da6063a0ed6e5387b648f8001a727d98a5360e534370524f18afd40ce2718a93e2faf1bf35933b86b35e3d5dc9290491
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEavC:A3k03kHRJARJR
- TLSH T114259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 946KB
- SHA256 b6354b94e13b6e9bec3ff6f93bcf9c2c2053265e0e5a9b0b7402c858959c49e9
- MD5 d3b2598d08442bb6e3e6c6d332cba33b
- SHA1 788519c86f3f0159bde4846097ef126f7c7349a1
- SHA512 d4a178625ee9756378faf862b07fa62f26afafc500260fff72486adeeeb42183df94972f5b92deca0038e3eb53a78ee4266f465efc8b18f3945568aca6bdd144
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaQw:A3k03kHRJARJc
- TLSH T168259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 946KB
- SHA256 720fa977a3f5ee400799d15a54f3a918f8776339f4561a0198cd0e29115ae975
- MD5 e8301db6b36cf4123eb55956bc74a542
- SHA1 4452acb69b878aa82b61eb7fc7e0a18e10eabd97
- SHA512 d6b66dfe07a5b3a7e4eb103b1f39f29c186d90500cae4d88fa5b3791c63d2eaae3cf623967251558ef70d842b58329fc21d2decc6271052a3ac8f2195eefdfea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEavT:A3k03kHRJARJE
- TLSH T136259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 946KB
- SHA256 2cb8cd347554a841c4738a6f3c09c5449835dac51bd8a30e37d379a69a09b276
- MD5 d64f2e33062f58bdd1737452ee1d061d
- SHA1 fe1e4e1e5813d55c3d130dce28f952cc86f8ede9
- SHA512 a0dd0c2594dc1a64d911ad989a87a85247995d8e4304c7f2099671952e32a63041685d83fee3fdd8f1ba4b55cadf030a2957fef37c1cfcf3813da120271193c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEapu:A3k03kHRJARJz
- TLSH T1CE259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 946KB
- SHA256 c1f8ff21fbdaa6c3234fb5ac3d3a4c3d394359fc0226b98733be6b8214c4fea8
- MD5 87fabdf9222e033dd25f97c57d35bf41
- SHA1 871bfe7b22301e16c7b0d9e8bfe463cefee6b173
- SHA512 216cdd20bb870e7e13f1c60f54b6c1daf87963ebe59d046d67c7ba92196096c52e49621d9ac00736ca1121f6a82f3e97b36e970772becb971d647b7d6ce3e7ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEahb:A3k03kHRJARJ6
- TLSH T1BC259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 946KB
- SHA256 9731509ba8d109768e94dd7385a10f04ad72055b01a55d93ca6953b6b417d0f0
- MD5 5021a1bef2a19a017f390dc79a0a0db4
- SHA1 cdf3f2d10af062718456aeb47bc62d3bbc1efbd3
- SHA512 78de840470a8461f99a6f19b1370aaa143c29fa8ae9ff3e12a07305feb33e099c2ffa387f283bb24db2563a323bc11f63d6b75a067fba0bfe21011105a7360ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEapf:A3k03kHRJARJK
- TLSH T1DC259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 946KB
- SHA256 0ad33b3c4e39f71231bb391714dd340df97ee02290458b4f04101de02b75cffd
- MD5 a5d6b04bea24ee392a5eecd3be6b075e
- SHA1 ac047d8e239ef9745f20ae926b89eaef0d8ef992
- SHA512 55bc63e9a2f99daf675bf93462cae0d21434901bc83b0a3706e1556dd35d6cb8a82ef1bd1611c491bc1ab1d2c7d6f32fde33fc770eae0b8b6eaff5b9389e2d7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaSK:A3k03kHRJARJK
- TLSH T195259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 946KB
- SHA256 70e40a5882ee2391aae6dc4dc8078894b76b72dfefdc4b0ca27f413f01ed28b2
- MD5 18c5b31e63c941fd06b6e07a6f4bf332
- SHA1 489f4f30e3c1c3baa1e714a63741f0b0cf84f85b
- SHA512 5289564de7ca9e24307a29799ddda977ca1fc94ef3aaebf9cd2f0b4846dfd49022cd78a30feec04aa8732a6c63c7776a16b18ec4c2deb7edf2a35d4e644afdbc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa3k:A3k03kHRJARJv
- TLSH T1F0259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 946KB
- SHA256 354841fdcac1af2bb9f603359dad3f3eee36d980b3f3623e4473f038bf8416ec
- MD5 1b54daba6e18286af928521b9f2dec6b
- SHA1 2ac367e7149bbcf8d8e419bc7b7e6d136fabccad
- SHA512 2cd83cf3e415cd956dd5204dc2e936d64e0f95062b1e5bb28c23454c3a5d4ce9010dee4216cfbf7a92d5fdfe8f22091726df4be98f29488d3379e6393bae7df6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaA0:A3k03kHRJARJe
- TLSH T1B2259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 946KB
- SHA256 58402fcc9790104d1aa276c8d7adfd30f86508a5c302b54c8f11ddad0cde921c
- MD5 aa2af066408230cc6a60115e29490699
- SHA1 ecf9dc2574a9835795553c0dedf0adc9b698e367
- SHA512 5e3e3f7b0771e9fc5b55b4b3b7d1ce3640637c010e6dbfacfa0c69e6f69627c87d377359d1d7fc7add349f20210d7569c0ff3b865c30b5727c63f011bd694a23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEabg:A3k03kHRJARJH
- TLSH T10C259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 946KB
- SHA256 3a15c5b994d4f320e99f72166492a8037713e0769cf59fb772a68058ca91e665
- MD5 51d478563fa8b083d3a7c7275cc365de
- SHA1 a39b0822129568ecbe14a65e157a60e095190333
- SHA512 a9048a09bfb443369a3545a12684273ebee8cd714ef46819c03b3fead85f1cedfd979d943d75ccaa1189484f263388bfcc186c70b5edb547a74bb746aa63512a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaWr:A3k03kHRJARJh
- TLSH T185259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 946KB
- SHA256 db00502e80a467946d3902744e21ebd94d865f5306eab3be97513b065673899c
- MD5 33635928b307705eebee9828b029607d
- SHA1 d0773774c568e35dc5ba61bebe1454b00edd5709
- SHA512 9aa1f19335d56f36a0a1514acf0fb90ba79ddecd411363c9066b1b15ceb92d5c7972f28cd69061716091b6989e583090a2485427aacd33ec828337334dee6c9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa8n:A3k03kHRJARJL
- TLSH T1F9259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 946KB
- SHA256 5645cf75562604f40e4b14cab0c60db80796217db4fc3cb258b6e25628d1f68f
- MD5 8cd01dc0e74332bb617c215245cb7d3e
- SHA1 c127239673236ae9c53f11d7d25415d1bb220921
- SHA512 559378073f4ca00e9309707e7f9185b553d4b74c17bbf1c5cd5b213265c32fc7bcd3c50d27d023e1907858d20550c514f598f2dc77b58efd503eb7ed8ff36c90
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa6x:A3k03kHRJARJZ
- TLSH T12C259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 946KB
- SHA256 14b8516d278157c7e0645e29958a3b6aa9676fd59cadcdd5fc1d76c559e79fc2
- MD5 9041079ef2b0e00c4a5187c1d69bdd41
- SHA1 f6c968b6e220e042b9ea961eae3927a25d685e39
- SHA512 5cd270590dcd84b40ec9176f9ddf8f79f4772c6d42324ace2ae241f8fb3c078982d88f120ce1c30c4166cf4cd917f69c514bf9d0dda5686420dede8e5d3ea88e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa8A:A3k03kHRJARJm
- TLSH T124259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 946KB
- SHA256 0be15360094ec6880d32ff51811b362c5f0c4c02c23a8c3708282048179c4ab0
- MD5 796358877196b9e1de1dd93908cd31f5
- SHA1 db0c7c8da1c95526afaf228f49444088af34755c
- SHA512 b8c870f09378440f5851199d7516efe49c1dd429296e1cdc063a3d2d55b8018a7918234d3b8d4e42dc0f4019023c1ff9cf9ce1eb4b9d074fae77688ef5130471
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEal9Q:A3k03kHRJARJ7
- TLSH T198259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 946KB
- SHA256 f3724106f2f7615c41f49719a257cfd566aa8c2c49bcc17f7b1a0dc31d054df6
- MD5 feeab9ade58595a3ee02af4e8984aab5
- SHA1 cad27c4a9766ee3c9a2bbff313c10aaed38fa9d7
- SHA512 5bc6c1a4cea477c9d293d9323ec36f64bb2fd5a33e5abf66f8a7c84a18f229d1d71fd1442f803d5808d34632a216c6f73d83af690a0303a1ce49415757e785bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaQ4:A3k03kHRJARJs
- TLSH T196259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 946KB
- SHA256 88dab6e0de863837105122300124ae223557ce134ddd7574442cba873185475d
- MD5 a72dc610a70bb7c4e80b23c27b136009
- SHA1 ece7955ea4b9b177278de9c9614eda0601f91b0c
- SHA512 e815d27010ef956fe8274f387494a5627c23c5e2e4267f4a00af070ead36aa704445e2bdebfab9dbb6aecf0ad1dace5c89fba7ad8ef286a08ef95729b2e95f5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaTu:A3k03kHRJARJt
- TLSH T11F259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 946KB
- SHA256 25ba45cb020a83d7f99817a17df9729a4213e4a4040251b8338e452a75cb13db
- MD5 605c418d2b39a5fe366f3e8203b48ed3
- SHA1 86fe6b9320072d99ee857cdd188bc76f6019ca3e
- SHA512 928661a13b02a822911b040c315ff7d14c6abfae5182b432543352ef4f30fe8cc48aa90c21f1ba7f26f86c79c7ea933938f95612986fea603ee03f956a0a807b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaOj:A3k03kHRJARJP
- TLSH T14F259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 946KB
- SHA256 d05fff089100cbeead5ad6d78ed15825e171870086baa8a3db609dc56a182550
- MD5 d86158bcbf40e28b58f090f0cbbf0ffb
- SHA1 e3b50e0185a2d3d271212f5602b68de89dd0c657
- SHA512 3783323dd94f801a0f1b02d976f9d41b1d876493931371b155792371959cb1fb49fd43704ef9329878ac9be958f3a688ea9df821f93b1c67555aa2ca061f7585
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa7g:A3k03kHRJARJH
- TLSH T1DF259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 946KB
- SHA256 20ea19c89bdf49cf39197be7f0db43f8854ba30e1d3a7595feecacfe84b5d524
- MD5 4335ea54d1af703053e4b90337cc1c11
- SHA1 5a388039969115fdc56be5c88a039195ec5a0b12
- SHA512 f48b28b4b02d8d22b2675fb9bdf52de29c9b66baeffd9ba7fec0fdca5399d28271ebbec5b359c1ca78e41b85f87419122195de6d0b940b6f52818f306403716e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEamI:A3k03kHRJARJm
- TLSH T1E5259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 946KB
- SHA256 392012c5920d92bd44221977b10d5acb4af3960d9170210c99a3f6097102c11d
- MD5 8708db632d22479d5df00d872ec0fec1
- SHA1 f614702d83983c402abae4555a00cdef38fa5560
- SHA512 1f48fc502fb8ea0985a98523877b133c1992abe2d2e4f41b65aee876bbd9a5e1e3464b11d2f9ccadc4ede8b9a37b12d5e23abbacfbd3c5e48bab1e12c9737d28
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaUo:A3k03kHRJARJ0
- TLSH T1B5259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 946KB
- SHA256 f976a1f1428d55903aff933c0ae5f9b9d7ffe11fd38696fa333861d5161449fe
- MD5 ecd17f849c9b689d6dfd30c5c6dffc14
- SHA1 6db5ca581d0548ba1b05bda9fe53e1f6310c7b29
- SHA512 ad8821c8e09192ac94209c2a737f8782276f78828f354c8e21c69f1add259c0ee30ad92ab6e757857d6d3cf201c08b1f89ace9c91309856d5d131c1ca4ac4561
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEa3+:A3k03kHRJARJp
- TLSH T154259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 946KB
- SHA256 3177a15d8ea6c40110c4461f61dcfc510b5d72fb020613651237e2d321726624
- MD5 7a03ce6332114823f5b50a85550ee86d
- SHA1 7e6874a3208cc0b39c8f446264e0cb1798edce56
- SHA512 d2a141b0200576f69750a3a59efe22834888c468279d8c1225f94c7b6bb30ea55fa8cc2aadea55d5606476858491a50f994d186c432d34e35e3dfac10204ee19
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaNQ:A3k03kHRJARJ5
- TLSH T1BC259D03F79900E8D15AC1789AA69A22FB757C560730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 946KB
- SHA256 56949d45db8a875aa9b8460f26123ca2227d7b9fa0f78e4ed913131093f7923f
- MD5 9e516e7ed009589289254c9c589706e0
- SHA1 3519bb39b310637e0b267ad7ab3846bc98a33906
- SHA512 57ab14045590bafce5d0a06a47b761f806df6b638454fe4c2127a0d8cc847ae9ec86d69be4faa4fff2160be6293c7dd10ced58a2e929d42c69c5d42aaf8378dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaCX:A3k03kHRJARJl
- TLSH T182259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 946KB
- SHA256 65e35014564ab8b15cce5ca80145a66a7a54fe595e2e1f0ee70e39fc5684e7b8
- MD5 26c0a23d00235eb71640ef250f416390
- SHA1 292772bcaf32a55dd0343f717717dd60527720d0
- SHA512 086714b775eaadc3607863f6c5c656671f3891874c8abaa9e429dc1b956d64c77b91e5517616477cefe04dd7b04246bc20ecb700768bb67e8c3fa45843e5a558
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEakL:A3k03kHRJARJX
- TLSH T1C5259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 946KB
- SHA256 9be4b5bcca737834c7eb40057a05c1fbabbc3ad2ce1f9f676d560c8528ab5218
- MD5 9c91d74be977a2e0bbccdc6d7fd2e135
- SHA1 c94be6db5914cfa45f6e7044d2d82160c85592a4
- SHA512 b74a5cd7707e24fe6dfbe00c71ee9b62893b0cedf5a1fa3aed070f1b9f78e813f2d034219fbf33f3c18e1e166922397fe29be5b705a060b497e9aa1d9e7291e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEaAM:A3k03kHRJARJy
- TLSH T174259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 946KB
- SHA256 9e0a288912cb4bd55a5bc5103b9889716faf274de8b39d3796db7de413b4612c
- MD5 8066af7fd137d085e16dcdea52512a9d
- SHA1 83b5c74241dcf14e9ae7de89a2a270f69c640fa0
- SHA512 8de3e52a49d0cc08e4275199e482b7c8919f7d1334cb1cf21ba4e9c677400211fa1134ad77dc5f286e66b4b16eda68322ba87ed3bc04fec9862d3cf97f48b1cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavlEahh:A3k03kHRJARJs
- TLSH T158259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH