Analysis
- max time kernel
105s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 15:02
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 894KB
- Sample260727-semehsvgnf
- SHA256 ddcf8038c49fcba5078802bf542f609213c0b27703f7948063b0ef9ecb76a637
- MD5 02282bbbbc87f917f5fe2cfe5cf2387a
- SHA1 03968a1c273f8b21e53f593ce433b6b3e156e423
- SHA512 0281645d8eef112e83cd279b98f773559362dd4bf9f8a516e4dd667adb94ee4c61af2872b30bec52ba0591a57ac3c30faa3369b8cc4462d75fcb15d1aea4bc4f
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaE:J/sCv7J/sCv7iUg4Y+CugYCRaE
- TLSH T182158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 32 IoCs
resource yara_rule behavioral2/memory/1416-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c478-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c3-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c85-58.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-469.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-585.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-708.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-781.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-818.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-849.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-868.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1000.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1043.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1086.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1129.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1154.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1167.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018923-1500.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1416-1819-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4880-1850-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 4880 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1416 2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4880 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_02282bbbbc87f917f5fe2cfe5cf2387a_amadey_cloudeye_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1416
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4880
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 894KB
- SHA256 ddcf8038c49fcba5078802bf542f609213c0b27703f7948063b0ef9ecb76a637
- MD5 02282bbbbc87f917f5fe2cfe5cf2387a
- SHA1 03968a1c273f8b21e53f593ce433b6b3e156e423
- SHA512 0281645d8eef112e83cd279b98f773559362dd4bf9f8a516e4dd667adb94ee4c61af2872b30bec52ba0591a57ac3c30faa3369b8cc4462d75fcb15d1aea4bc4f
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaE:J/sCv7J/sCv7iUg4Y+CugYCRaE
- TLSH T182158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 947KB
- SHA256 f59902389b5db4a00c771f86071792f4033a7d7ce464cc49b5af63bff031886c
- MD5 11f547ab5a4a1790edf07cb9958b6338
- SHA1 fcf7e0c716501dc266d833d1d9e0b82f07da9eb0
- SHA512 18c2b22092f827ba2ba93b0f08d8641e9b5c393a1b57adeaa9e1e2ba34df5b405243923c5be043acd70790aba44b1359e9202390df498a69afa85196922086eb
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEUFfj:J/sCv7J/sCv7iUg4Y+CugYCRaE6fj
- TLSH T192258D176BA441A1D463453048F94613EA35FC2A1B20979F16BCEB691E31BF0BE3D72E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 7becc1d967194a9937dbe93714ae57cd5fd1b4ac6e74cea785b608b8fd0edf00
- MD5 2813a74e4653127f2201869aea6a1405
- SHA1 03e84fdfd6191200a06a9f5ca39e6667789e2680
- SHA512 135b59ad98d5c68284b7981043000758169542f95733bb6ea746b3961cf09ae6daa50f1a79fa521ed6bdc15df23969a355ddce76baf66a69e70ea92ec44f4b57
- SSDEEP 24576:J/sCv7J/sCv7iUg4Y+CugYCRaEP0Le5ji0hmxNrM:NZGzHt5Pji0Aj
- TLSH T19E656C17F6A44271D073C174C5E69646EA31B856173086CF12A8DB7C2E33BF1AA3A736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 909KB
- SHA256 5e4693d4da6e56d8d2aa62a1b16b96a019e9c8ae5fb14b80cb2a0cbabd6863d4
- MD5 d0657f18555e26876d83f314c16edd1b
- SHA1 b0a7e4af3ea412ea3d1405d9b7469255532e45d2
- SHA512 8ff12db21decb1df277d6746cf437511d4a74bfb1453146c1c3e0c965e4583576ef1846aee40d68ac3d23f63be2e4b3f614c861887582c7d47a690c901541165
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaERa:J/sCv7J/sCv7iUg4Y+CugYCRaERa
- TLSH T10A158D1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 942KB
- SHA256 8b098e1a3ca696cf6ccabd8499b1aefacff9b99ff0309308b24d1ebe2f0ba20a
- MD5 ab12422d5aed6771d4c77867c5231c80
- SHA1 397ab578de7e07a7e3d3ab9c4ed7b444a58a3bf8
- SHA512 8fe349c2ede84ef09d18fc27d45be249bc13e87c060a812750c49826bdbc96cf66ca491185b183d386e3391234d42da6cdbfc9bfd99c4008a97288fe803a9f1c
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEyb:J/sCv7J/sCv7iUg4Y+CugYCRaEyb
- TLSH T1E1259E1767A400A1D577453049F94213EA35FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 918KB
- SHA256 f3100112ad94f0dc5c6cda4c87aeb014908d9a58404579b5d5bc450ab3845f5e
- MD5 494bf49d900eb3d88ee9af5650504031
- SHA1 3e908e15d8aedfe9e8ceef2fcaf7c1c69e738cc0
- SHA512 a961aceb6cbdeb12325b228f0c69736763b8479ee3b31a3892815c8f56fd2636ff2f4c5722940508dce4f31aa0a94387dba2b60591bf43c0b20aca7b5028aa8b
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEpu:J/sCv7J/sCv7iUg4Y+CugYCRaEpu
- TLSH T12D158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 918KB
- SHA256 762ec20f0796d49beebf829680e129ac54242e4c4b5ba0bee34e6e05b21915b0
- MD5 789a832b254924d5befc9ce2cb526d5d
- SHA1 9b5025f71a5d67f970a26dfd4ab881ba11a6a4d4
- SHA512 48c29eada1cce5d3bd82816851c7d93bf864ff3494e9a9e9f8c8a480e9055285308783451855c5ebf2481263fff29abe1170f06f85ac331fd57a23cd66fa88bf
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEhb:J/sCv7J/sCv7iUg4Y+CugYCRaEhb
- TLSH T113158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 918KB
- SHA256 9fed3ce3d14fc1c1bf624fe89953d7e59cba31cf3fc94c4b8cde8be8bef8784f
- MD5 b9df4ea865238aeb9569408dff815857
- SHA1 868b37d06ca9cc5b6a6866b0906267e84b4d705c
- SHA512 3db32a75d8f3c92ec9564edb16424736177e9fd17c908e86191f24be89184ee86fcab6ae578f5e11ff1a87398a30fbf051d1f6adeba99a172642c5365b23dda8
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEpf:J/sCv7J/sCv7iUg4Y+CugYCRaEpf
- TLSH T1D9158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 918KB
- SHA256 33545c65f883ad1c6f065db55848a8d1fc8985c4243d69fd2bdfc9ee0cc9234f
- MD5 4c0062d959647d7796742555329645a0
- SHA1 a226581f3fe12ea2d444923fdae1a31b3d77f36b
- SHA512 8fc7f0ea17f684ad04f7a2c1334be87fa5078c804a0872d554bf5cd0b6e4dee14fe1f26ca0ffec2ccc3be7b33180d9da7604f5e81ac267e0c197ea4414a09ebb
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaESK:J/sCv7J/sCv7iUg4Y+CugYCRaESK
- TLSH T126158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 918KB
- SHA256 169b02b18e369299aa120716c155f02959dbfe646db2e9f3cd32693b06a10d85
- MD5 6448058dc39007c87bd98e027fdf4c06
- SHA1 a2ac89367a9a8f017a1114a5c660df99ba33bca1
- SHA512 a3cf11df68561ddca9760fa925fe3e21964d2be5cdd71971558770b3e65fbb51d74e17c31ae7f29753ff732693ad9749488376650c0568a3039ae71703b482da
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaE3k:J/sCv7J/sCv7iUg4Y+CugYCRaE3k
- TLSH T133158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 918KB
- SHA256 9f756d704bd9f5308cda5dcbcfb540e5f48cfce9a90b54026609396eb5e5c53f
- MD5 22e49f1f63602584b28c01bda370685e
- SHA1 04833e1f4af3f1afb3d87a910d6974417cc0e481
- SHA512 a4046a97c7d223977fe9e863c8471348d7631ec7e76362acdcb080bcec8562f1709543b63f73e1ddac7b0c3c73a68f83cac0b31c0804aa3c5e184a2a8d1fa173
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEA0:J/sCv7J/sCv7iUg4Y+CugYCRaEA0
- TLSH T189158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 918KB
- SHA256 d0a8eb3e0321132e21f789a47d0094b8b3ba305f52e142f4360b1e28f125e809
- MD5 a5dd49727888477ca5d308ce66613709
- SHA1 3befeeba1587d455e5bb0683f4dd2a778bf7f5dc
- SHA512 c6d038a86c71696d98f9560d9c831d20c980c4895c5b1d840a929111030aac253c5e08bbe74bcfad9a801de095cd2b0c8a14dc30427c7eb71568dd1be7ead3d2
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEb70:J/sCv7J/sCv7iUg4Y+CugYCRaEbg
- TLSH T154158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E31BF0BE3DB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 918KB
- SHA256 9945ad04a64a973ae12f0a8a65c2d76288837c9343bc635514a8c438fa58b984
- MD5 f14c9379c07f4a4aa6023413b90a9fab
- SHA1 d8d113606e2aaf5f6238bbe6def96d9dd07570bd
- SHA512 d7357f2681dda9d881f3b332e595c9989edb0d2bbd11a8e21717b07d228a3795ec1128572a9697782964ce31bb2135fbb469d6e07464f866b9977e42c671cae8
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEWr:J/sCv7J/sCv7iUg4Y+CugYCRaEWr
- TLSH T1A2158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 918KB
- SHA256 0a65f1bcf93a7b4a7ecd120af162dec505f6adc2c046de1b1c503a1a50272ded
- MD5 fbe5286702b35525b47220eef6badc11
- SHA1 4bc37fa440eb275207fd3d4309bcd929685fa344
- SHA512 da5f91dd895c538277cd6630df3f81476e08137bf880052142d4e176237784f522dc0cee337a2685d14c4f84818aef2c27fa14c9e5e3e55c0b72203001a3f26b
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaE8n:J/sCv7J/sCv7iUg4Y+CugYCRaE8n
- TLSH T178158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 918KB
- SHA256 75b98f524e022dcc87d586d5ee69032d19f00d8e9894903d9f91713a48c082ea
- MD5 9736ba6194e938c6780bf0771415f24a
- SHA1 a6a02ea52437459f582ae03f44ac756dcdb70680
- SHA512 5ee541218aadba28df07530dc142aebffed73afc13a70f45c77ac1f3528f3ec071c0abfe0d19edf6cdc5d3bd0b1995bd5bf6ff9c1a927583d8778e4f2885efa9
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaE6x:J/sCv7J/sCv7iUg4Y+CugYCRaE6x
- TLSH T1AD158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 918KB
- SHA256 a4244f43865c10e2d5a3ba9bc94e40018a93091082737d4e1a7bf96ff7a1f85b
- MD5 f74ce2237a1be3877194af1405c3d214
- SHA1 89a294b0bde89d7adb509e83244a9be6c67b071d
- SHA512 7531e8cbae21ab471dc1eb114ff1db9a1de2bc5476e79bf3d7dda8ee0a72637a3cba3f85deceeab33a80de2584fd6cb1e346f82e30d6379453963dddf7f77800
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaE8A:J/sCv7J/sCv7iUg4Y+CugYCRaE8A
- TLSH T1AD158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 918KB
- SHA256 31fe373224773443c037cd6fe0bfb303d2872c6ebe882d50c502abb1bff65064
- MD5 63a87f5a91935e9ac62ea9d8b8cfb688
- SHA1 07b741ecb02a50acc48093dae45104f509fb3676
- SHA512 87900fe601e6144b2b1291c90f136d2f4b38c535b9845b3678a51224051d0c69ff9cf3a9f55626f559ed3efcd572ee865178d2f428ad649c0ec53746b721753f
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEl9Q:J/sCv7J/sCv7iUg4Y+CugYCRaEl9Q
- TLSH T13F158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 918KB
- SHA256 ff270162df065623430c01df268872d225ba0847254f3a1ece879fb6a8f19123
- MD5 e4f154bd053bf6d548727bb69c49f8eb
- SHA1 f5268361c3e4f9cd2434e4579f960a5119ea610b
- SHA512 77018b33aadbe060221fe3ccd1d7fec0cd8c6647d6b1c1a6672358fd94985b08db89bcb1827b7b8daf5a52a81dd8770de97f5cfb8bd8e41b958f28ac0a5124b6
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEQ4:J/sCv7J/sCv7iUg4Y+CugYCRaEQ4
- TLSH T1D9158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E31BF0BE3DB2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 918KB
- SHA256 f22da94c04c8bff5ee4316db6b06482531ef26e0d7426489a736a0dd5106a93b
- MD5 5bd986c1b8db0235ace8fe0faf2f82c6
- SHA1 81b936a329fc577af2f2a31dd1b892a64ea1df60
- SHA512 59410e2130c7d57a19dad930dc19ca56ac7232c73648f5aee2bdb1bb6c50994b89e55798776d1b16f080789e814980349abe158e2ef0ac9b670e70ea1908aad0
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaETu:J/sCv7J/sCv7iUg4Y+CugYCRaETu
- TLSH T1E5158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 918KB
- SHA256 fb8775cac65791710248f5f73277583973c9d0b65ebf14870fcdeb5a86c71e38
- MD5 6bb9c4a11d8420e8030a93fa1ba7f440
- SHA1 09cb7102688f4b759aa599e6e27f18b432ca6873
- SHA512 a88215bd573a1f19089caaa8b59e19095c87fb674ae980b2434897c127ddfcffcc8ea34c83f46e4100dfa64a572e5fb4e8728bcad88b24420468c2925ed58e80
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEOj:J/sCv7J/sCv7iUg4Y+CugYCRaEOj
- TLSH T113158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 918KB
- SHA256 11f38f5e8ccfd8bb8eb44ece110698c99b8c866af7e5a8120d25c4aac1736b1f
- MD5 18324f94bcfd770c0dd04fc05f369165
- SHA1 6ab07e4e79ad91a9fdadc047a23943fffb5f3465
- SHA512 39764e9c48d970217f7d9a9d57ab2435685c6a153d0e9c7cc32f356e0b34ced45f709f6d663b665dcb70baad3f3e21ab6bae1c927704ab18df0ab40a5450a1c0
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaE7g:J/sCv7J/sCv7iUg4Y+CugYCRaE7g
- TLSH T1F2158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 918KB
- SHA256 e3284a9232425a2c93f8920962ffea1b88c30303e9465840eb5b7c7b61e58d87
- MD5 2d1e63dc107f803ddb956346aa720867
- SHA1 0f08ab1b2edaf16119e55ea4939090c8b6b91dfa
- SHA512 ee37eb42112a7b70189befd3b9e8183b3a015d868e11e7cca282058257ba3b1864f1facfa9ff1b23e87c6b6bbf2a07c541b164d24955820347bee1918e8a0a90
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEmI:J/sCv7J/sCv7iUg4Y+CugYCRaEmI
- TLSH T1EE158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 918KB
- SHA256 a6b02e7fa69cee89f7d9dc5212fde4bc9026680e8488d42845996c0e22b0ff7e
- MD5 426ab491c1dd1d6416546b5f728ee6c0
- SHA1 81245ce45fd0abdba64f8ce86f6ecc59863b4cf5
- SHA512 eaac3941a54ad9f28904699754e48a42ec8ddcc4652eb8965f37b7844f6115ae09b17bcfd31ba1fd4e0063b5963197295cb63dbf6016f90e091b310c32a7a6e1
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEUo:J/sCv7J/sCv7iUg4Y+CugYCRaEUo
- TLSH T104158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 918KB
- SHA256 250f9581366037a5de6423f8dded16c229e59b1d827056d4e09fcd93f690d589
- MD5 b88c73a76b810c243616719cbe88c731
- SHA1 8f4215dc4ebdf0d22471d034bc84190c72f005fa
- SHA512 d82b9709a60db97b136f9703449fa945366565f67ea0fb4058aa754879468ddac412586fabc627b97bb250301124aa29c1868bfb91357631bc54168232685b85
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaE3+:J/sCv7J/sCv7iUg4Y+CugYCRaE3+
- TLSH T18E158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 918KB
- SHA256 91b364004417962c1909a6a9386990ea899618e6d1b51dc61f2177165c2851fe
- MD5 eae9437f02c2f519d8b84c2f0c6632bc
- SHA1 0cf8747657dd9c55e4595173040ab88f5e854354
- SHA512 3119478fe3f6829a2f41fb48fb2986d055b1237ffef0768f0c9e021a759111512db3b08cc4966074d7c893626bdbc5035b1d843c932e9f092e51297bfe904047
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaENQ:J/sCv7J/sCv7iUg4Y+CugYCRaENQ
- TLSH T181158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 918KB
- SHA256 dc4686ee9c2d23ee5cc953525eb61c39f60386a7bc4972a86c3a09b50743bf3f
- MD5 e04859c1868d1229eeaac4df9420c120
- SHA1 09cd5e65712ecac70205bf4327c4dd0a6937313b
- SHA512 5d76aa8173be5386a7e5e421a94eeadc760ca22ea62c67638ad691d3b9b137ac5bbfccb1349c0dfca60bca90df5b44a8c49fcb1e30a9f0963532021391e6f37a
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaECX:J/sCv7J/sCv7iUg4Y+CugYCRaECX
- TLSH T13D158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 918KB
- SHA256 3bbe0e16ad1f83e04abd0c9c2235f039fc5a32d88338ec2fa3ae24e5e5350c8e
- MD5 d3aeb05b68135f4372b30e7dc87b2b69
- SHA1 6c707af587d89232dfa7e64ae4864989970c531c
- SHA512 9107619b477badc8a0760c9486bd4de4cf47eef0eb5c7b9b0ad5dd0518cf9e2b5e48bde27b3864dca79bc08cbfaf1216fc63e4bf44cece598f2146c0d7afca55
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEkL:J/sCv7J/sCv7iUg4Y+CugYCRaEkL
- TLSH T1F4158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 918KB
- SHA256 d7ea68d050ad856376e7e4e16ec20444fa66bd4dde8c5d75df0b9ec407c89755
- MD5 aafa8c242861c813021dfa632f919968
- SHA1 b56cc085c5db2989a37288b8a63be037080759a6
- SHA512 acd82299dee12fdb7687d8d1fa3f3c987fc1883cfbd44adec4d9f8bcc5f119e07cfb39578ab115af7e3c779182515eed0d33cc6dbaad34de804a132f84b922b9
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEAFC:J/sCv7J/sCv7iUg4Y+CugYCRaEAM
- TLSH T133158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 918KB
- SHA256 e0049deeac46bf6e11df70d97444cd0019138b3049d38f3013560bf0db883120
- MD5 8cb91b0a965f8406a7ffed5b00cea6b4
- SHA1 a1b6387f43fb7415fe256adae83dc46834e2bc6d
- SHA512 bdff82326755dde4f38503d9b2992abc943e972673ad872f4654cb97d422ee5e945d8badbc479d17be1406427da91c4fb1927136840797fe5c213b5b2bcb6c8d
- SSDEEP 12288:cPE/72wcCvRRqE/72wcCvRR58LUeDuUlI24Y+Cut+YCRaEhh:J/sCv7J/sCv7iUg4Y+CugYCRaEhh
- TLSH T13F158E1767A400E1D567453049F94613EA31FC2A1B20979F16BCEB691E32BF0BE3D72A
- MD5 SHA1 SHA512 SSDEEP TLSH