Analysis
- max time kernel
130s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 17:05
Behavioral task
behavioral1
Sample
2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260728-vlthhsstas
- SHA256 085bcf2d39733b5b911da0ed693463d349cc6abe9578992fcc8b1acaf1ac1bc8
- MD5 95877597b7e272c9a27c62b379ce5cc1
- SHA1 87d18e85ee9a813416db481b048a43486ce1501b
- SHA512 5b9f3ab2cb34f35d4ba94f34064850898a53e0915429494361f1243dff3c7d533908a5722cf5dcb39ef8bbb5bd4513341b35b6e417a3c228afef4be120245e79
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEc:A3k03kB56rV
- TLSH T1CD157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/5604-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c36e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000170b9-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5604-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2800-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c94-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018985-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018987-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a65-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-290.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-303.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-405.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-418.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-438.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-464.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-465.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-466.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-521.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-524.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-562.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-654.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-709.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-758.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-777.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-827.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a4e1-1030.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a72d-1104.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001891e-1503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018924-1546.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c36e-5.dat aspack_v212_v242 behavioral2/files/0x00030000000170b9-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c94-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018985-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018987-211.dat aspack_v212_v242 behavioral2/files/0x0013000000018a65-230.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-231.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-250.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-251.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-290.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-303.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-322.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-335.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-354.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-373.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-386.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-405.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-418.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-438.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-464.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-465.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-466.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-485.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-508.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-521.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-523.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-524.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-562.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-629.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-654.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-709.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-758.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-777.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-820.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-827.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-876.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-890.dat aspack_v212_v242 behavioral2/files/0x000300000001a4e1-1030.dat aspack_v212_v242 behavioral2/files/0x000400000001a72d-1104.dat aspack_v212_v242 behavioral2/files/0x000800000001891e-1503.dat aspack_v212_v242 behavioral2/files/0x0008000000018924-1546.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2800 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5604 2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2800 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_95877597b7e272c9a27c62b379ce5cc1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5604
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2800
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 085bcf2d39733b5b911da0ed693463d349cc6abe9578992fcc8b1acaf1ac1bc8
- MD5 95877597b7e272c9a27c62b379ce5cc1
- SHA1 87d18e85ee9a813416db481b048a43486ce1501b
- SHA512 5b9f3ab2cb34f35d4ba94f34064850898a53e0915429494361f1243dff3c7d533908a5722cf5dcb39ef8bbb5bd4513341b35b6e417a3c228afef4be120245e79
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEc:A3k03kB56rV
- TLSH T1CD157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 953KB
- SHA256 2f5175910a300620c4c1df49881efdfe82e3437c686a2f1391f376946836eee2
- MD5 d964e816d2520d2734a2163b20e7e16e
- SHA1 3166e61322b08ec9ff60cbab598f31ed3b85ace5
- SHA512 32e001445a962bc8d4a9cb2db76f89106d06fa98673d9d6b9bb8ac85717dcb717016e79b4d88301825a3b2ccb6e1f4529e6769675e2a27662608dfdeea8bbbb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEGP:A3k03kB56rD
- TLSH T1CE257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 970KB
- SHA256 0f5daf0627565dfb1d5441ec1d3474198e2ff9e241a0e97962dfb493e09768be
- MD5 6cadf721310ec10749789a151e20c8b2
- SHA1 2c1d2d82d1757c966aaf92037eb1890e0d00b0f3
- SHA512 06e0a53c7e448a06f3f42d81f954639a1a67e00e8f2928c13b7d1c83a26e7a2ac2548898fbfdb1fa1a90f060d11821d62f7b29da9ec2294894ecbbf74460f374
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEp0:A3k03kB56r40
- TLSH T17C257B13E6940FA5D10FC1749A968662EA777C025F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 4036c3dd30c6410912c2819adf42291d6b5489b258b93ca92522115e13ff74b3
- MD5 8d9c221958cd0a07e49fecc364447780
- SHA1 dd8ce8ff218f00728ff3bb7aad1f2e31264d8a17
- SHA512 0a339cd3cdd2142695d667d66390a4d5ee03f92972ad8a42ec0b988aba0447c516390923398139557e00e8e5e67cc8e9ad39fcbcdcc66394b2d36f0a9507ed2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEk0Le5ji0hmxNrM:A3k03kB56rRPji0Aj
- TLSH T1E8655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 6f2abb1e7fb0d118602ab1f2973796f3ca09a3fa520c64cfe13cca113db0c379
- MD5 b07ff818fe49cb768e79f1a3d3de2524
- SHA1 6c7de569277f5a28be81ce450ba4b100d588855f
- SHA512 9158012bc6505cf28a2ce341f30a46570a845ffa3ebc0bcf9275e67760819270469a9d36c960af330eb7e8fea67124fbefd4e189b749f94a6a352e4d0b8eade9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEOa:A3k03kB56r
- TLSH T14B157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 8048adad7eeb2a4a2c695b70ac9af848fd5335fabb5bee1ea183b7b1012b4d7d
- MD5 d732286f05c09c9f35e18d115839376c
- SHA1 634c097f4aca2ba937729bd3fd05983676c49881
- SHA512 5e9010c1aa5633568c4f516305dd497673ac495e60e9758efc0c862d8e38c706e956cce14541ddf462346989ab64591d211f307f2a6caddd367d3fc21b1160b1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapENb:A3k03kB56rgb
- TLSH T108258C03E6940FA5D10FC1749AA58662EA777C425F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 947KB
- SHA256 3da01ad96babe9253bca280f91ea4ebdd52482e74bfa9240da0a34dba4649050
- MD5 2014484c37bbcd90436419d152ce92b6
- SHA1 09520ae94b7ac4433276d9cb4a0906b5f5664871
- SHA512 b3a925bbed7601df3c1988c7d9854e30fc220234653d57717cdc71fd6a3a00af053d2f021f75cc24d390762b4b982448f3f5d7ddac8ca65f5e285c34f849a453
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEQZ:A3k03kB56rV
- TLSH T1CF257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 947KB
- SHA256 54d1437e1c435e21628effd34741e0b967c873bc2a1e30dad3e428b3fcb44cfb
- MD5 3ccce5cbd6af4bf86b32145f63bd2f50
- SHA1 7b2ed671594b27a8ad3539cbe05316c613cd82d1
- SHA512 e94819d174067ef187ae370eca1d5c739e30a41561fd2e5ff3a36ce0435520030074342d3ade8c96f5795796cb1ccc28bbb03e3ab72f455d4f17ea29ee927645
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapE31:A3k03kB56ry
- TLSH T151257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 947KB
- SHA256 6752325f6886fda0f65c3d02174243d75173127da633b298ed07b195efba1cc9
- MD5 d0512b4507e8827a6d3fc99a943c3fb7
- SHA1 3b2739cc91f8df01631861c81208b97ef772fb53
- SHA512 6e2baa0bd1cfa00ac53d317ccff08d6afcbb0934179c85a4dbba274e2b61e616b1724dd1f0b9f87850721235c9b266b7cd29b30221f98ca5d640be3f32bab02a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapExN:A3k03kB56r8
- TLSH T111257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 947KB
- SHA256 fdb644958113fcdaf9a95db1af9e43e6fc9fb5b2e255482e729bb813ddc9d997
- MD5 1223ea978ac355aa5e78b3e4cc39b26f
- SHA1 b0290da1f66d1b0e64ea7f1a42d0fd2e5b46a3cf
- SHA512 a394b1dd185cbf43536be2b3066fefd5f22e0c2cf4a1718368edbb36e7d4179dd41894ebb32f844dd2b75c6824d3f891a57921bfc2e6dd426fbf0cecb562f221
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEnf:A3k03kB56r8
- TLSH T170257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 947KB
- SHA256 e943d54f81dfe61b065f9cb7d3dc081f4b74c460795fa6736edfacccf99709b2
- MD5 412d787fe4a61865bfb675a28e2e47f2
- SHA1 7a908274bfba330e46ae07f2ae93ed161f3a77f8
- SHA512 895a631e1baa8d6dd75a27061cf7dd7d8238be8923d33febd266acb0dd54a147c56411f7652fa363518fea3d860094d8165525a9a5d12e5170cd90356664c527
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEpo:A3k03kB56rx
- TLSH T158257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 947KB
- SHA256 d0ce2729e9d9d02ddca53c6465b627983eec959a52ef950a54f402e5cd26ada8
- MD5 58fc3f3a8080c2a7368ecd6408677b70
- SHA1 4514677984f71504aeaa487f9c99b22f2f7b7aca
- SHA512 30c205c6c21b024c9f14c058a5cf2d7977de5f71d90f23c7fdc331b18895e942bc40226971a8694b73cc79b19a3e4849d14f8f590000d475eede807d8edcddf0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEZu:A3k03kB56rj
- TLSH T1FF257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 5352c98510069ffcdf6f6ca14220adeb0ac73e10e1236d20f98bb18fec9dedd2
- MD5 e94aba93aef03fe4bd48be70e9d47b05
- SHA1 5445d4a87351291718ea8b320c9a1bb456ee617b
- SHA512 c9b87ef7300df050e808b30f714790b71eb4697f1ba11d7d30052fecac5d353640d9e25be641416ae3d999a9397870c9c5200e864fa8a668f67a3d8bf77bc10d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapE/9:A3k03kB56rC
- TLSH T1F2257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 6d03e4f20ac54628a76c9a7f720521eb9dc433a4301a4c0752ff4e0dc587209e
- MD5 50fe8e47f9c687de6e915f8104db4edb
- SHA1 1eb78107012cc45a31c334e3559f4e9bc40fe945
- SHA512 08a5beb7d4d1e2a1856a92f2cdabbdcc3517c07685d811fa16f486e10b52967248c2a230e1c057b92dfddcbb912621703bc973fbe979b229fa55c65cdbf30058
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEbc:A3k03kB56rv
- TLSH T17F257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 24ca86043a8deab244001753a6eb069b16e577310bb70cf20af7273ee97e73a4
- MD5 51dd534b6a4c8962585a71916fa4f2a0
- SHA1 e64d5f65c1d42596f7d917007da0f62173a9da0f
- SHA512 d16c69620fff9b94f0d88f0d394104a1a4522f6f160750b5ed9af834915d279fa4a493c5176052548c437ee10036f3eff7296086f558c37bdb1fcbde1a2b4be1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEEp:A3k03kB56rl
- TLSH T14D257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 6d840d1ad5192a6f5fb76ffbd9010efe11b0c646f7e73458901edbb6aea3872b
- MD5 6327f0693c0d2239751a4f57061b624e
- SHA1 0474e5525a7809864134f7cd671e446c35d7334c
- SHA512 fd19c169c2ebc1cbe15314716e40407127dc864e66c44e7d7140b379bb1a1ddb236f9b7a3c947305218bf74dd667293a2d1acc69f7e1dee078264ce8dbbc885a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapELN:A3k03kB56re
- TLSH T1E1257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 f13271015090502b548d9258a9ccdf82d8b74d55c5e3b148dfe0b17eca747d1b
- MD5 97b9cd7df3ba3058fa38741227509bad
- SHA1 a3e9baacd7daec55266317738da619c64485c3ec
- SHA512 d6aa560c8038c246400a7a81927b07ad50a01f2348af6dcc474566ea9be15dec4c9eb7e487331c010d8102966b3084522cfd5b185d57405e21ca27c78a4c94f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEZF:A3k03kB56rc
- TLSH T1B5257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 a0c4749ca201712a78190ece1465ac9f09939d33b6c09e9db3be9a1677a77df8
- MD5 251fa21b1a222ad69136fb531e4af967
- SHA1 c615844f88dc4ac84e24765f700ee44cf38719c4
- SHA512 03ca9fd928b97cb6cb4ae1458436d6e4f500e185b361ca04ef54f89e13232514f32d6ad03f3aa18d00d572b02e0fddf398d8cdda92773d558e634d117edf36e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEyC:A3k03kB56ro
- TLSH T122257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 7ac7c697010f00c7d1098de71c2732ba798d48fd60fb58bc810624557dc1c5ac
- MD5 b562a9eca1ecc2546acf6184528d1d63
- SHA1 8c5e8c92d42e6926497cf487b42ef8d34bf7135a
- SHA512 f11bf64eec878338619e7abeee9aaf1d091fa213a7e0c5872a7ba4556eea8beb07634f21ed56eaad7ca74b79aa09d1c25c5512a426a4ff906b729889761de603
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEtw:A3k03kB56rF
- TLSH T161257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 b886d961c5c0d5b1af0a4370c10b3d53151f9a413aa3838bb417d18934ec3559
- MD5 2d098fc3f2438df3a79a77a6da5d4554
- SHA1 47cca3baec2b830a872b5ac461d40a5690450226
- SHA512 46d2577630f934e7a73894a9b0b98a1dcf3704680a1791f0e90a722c52e386a896840c0276526c063fa22a93eccb4080dda8cc40d7da4821b1d2b5424a29ad86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEcT:A3k03kB56r5
- TLSH T1E7257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 e02b2eaeeb8f26026cc95000aeeaf23d4aa3567c3c8dd4fb0d7e645aeaf9c704
- MD5 ea71c053b4478d591edafb383eb6ea49
- SHA1 6d936e6218577d42d33028f065f18023c2c6858f
- SHA512 63bf9c2c25621ded129fe75c1e288dc3688290e3c6e81503f72a167cdbc76c01d45331f238c5517cd97d5d3f0620309e533177c8d3ac5b03889c59693b4d7c45
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEwu:A3k03kB56r+
- TLSH T186257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 e0cddef62562a7c7eefb93e6d6a470618d901c4e94c17d780268dac4a36509f5
- MD5 6e34486f71cea728c30ba0f6366d9cfe
- SHA1 788ce7278b1aec055feafed47425095997884ba4
- SHA512 7ed480d2746a3a8ae846eaf495d022287d51c5321af3d19e4cddbe4e30b51631cc0e68781d073c21c415af533aab2c4054bb6cef8f1ef3b08f61e2f44483bfd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEOb:A3k03kB56r/
- TLSH T16E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 b86e2bb98ce358aa07d376b2598bd213f635b9caaf9cd226da3428319de921c1
- MD5 d65988c623c467827a977618114a2958
- SHA1 106f49bd42ebb3944e615641a823cdccf45d998f
- SHA512 65f447ebea939df56a908dd638a204806ce5b88283ba97c2061fb8a30b239ea42bb9e791fd017a0c58c412f0c7411d70debbc7e1aedee439205c72aef335f4d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapE4f:A3k03kB56r3
- TLSH T130257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 ab1c2683b222dac47438d17c60e4d85e3695f8815d7e666fa60c38d1c9b414e2
- MD5 67ec4e455b0473ba25ebec1a4936f979
- SHA1 912b96e566ba5b88ebc7380053d67efb22ad8ecf
- SHA512 ad92b86c2b298b19cb5096ff314f7cf3953b05f52346b9663a57d76f24c77ca399158acc591fcf8c89399b9ac5ce7af96688c9569f2649fcc684e5c675d91561
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapE1K:A3k03kB56r3
- TLSH T160257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 dc03921a4c3ae995d09e3648bebceb5df0abe7dc84776f496b9411a9e9413cca
- MD5 3cdd6654582b43bfb2a8c95a30882510
- SHA1 4f428746734ed4454671bbcef1029c30759157aa
- SHA512 0c5d9e2eea973da305f81497d4287f6ac00b6f732845cfff3066a06680d9c27b7a3a011afc1014db4540c801c3a6b69befd8525d4b3a62a6997d92ebf2904e48
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapE2k:A3k03kB56rS
- TLSH T1D8257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 eb8996a7f6d3314247680a8a423a3f69d946b659618967995aec4e3ca3ea85e7
- MD5 370359caea3bd86e7cd59bac1202f2aa
- SHA1 85b56ad606c5ce76a634f0c221222059021e4177
- SHA512 d00a1eef4dc6710cf82e0b227c4dc6e96b8dec55c1b1c41b919ba6414e2fd0ea67ba181bc5e7d04895a3fa7bd74c56fd8b3f303dcb87023a61e3c27bc8099142
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapET0:A3k03kB56rX
- TLSH T1E5257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 a1ded726f3a11af192882278597d247dfea5e1fe0f6cb542cb1d61c69534cd71
- MD5 f83b1bd14e5fac20e72d10cedd9d182b
- SHA1 cb6405bfc600c509cb73766d9f47403ffe46f205
- SHA512 57e6686f1ff86073427fcd32793f20bda3704e6be8699687d80b8bc6c46455fa08351a3e515faa6c745327d4494d8398a929f0271509dfa29c6b8b24d9a53532
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEig:A3k03kB56rq
- TLSH T10E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 d5c1a2c4a9c26af3f7e442c531674e1afac2307b0c00df2b9f209eaf38909a98
- MD5 727ede9e0fe773813a9ffc2cd4266612
- SHA1 ba82d058f56df16a5d115ae21b05465123aa18c9
- SHA512 ad79fae146b16eaf37c321fc6436c35f557f8d5fd165d717864f31541d8542edc6fa0671410da5ecba3b36f27e65b7073f35733abe1d5d34c3b9e8f838e02606
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEDr:A3k03kB56r0
- TLSH T190257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 79537810af75795b12f27332db7f67165077a137d9a21ba9fc5cdcb613417ba2
- MD5 4b6e70ecfb7f6acfc1269a9fad2b999e
- SHA1 e3ef93c2234f91dd5e7f64d67ba89511abcdaeef
- SHA512 dcf9ba73cb64238141d36d9e123b93f1fac5d2ed82428598db5077af08d8b89171d81a535d1cb0bedeb3a3093814d6244f288bc9e8eb7c4d7de77090402411d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEln:A3k03kB56ru
- TLSH T102257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 0b24f9b3b191494a262ba03f1b8e53c8e597d3fc80889ccd946321225cc1ada3
- MD5 9497c52d12d1460bf31ba4c3fe49bb33
- SHA1 16e7fa4a57e3f373d51934118ff3211972499b57
- SHA512 1649be71844832f1f8a2cba30e1d9d125130a2d89c1ddc8edc5a076b8fdf38dadfa9b0a034679692ddc494cecf64755df2a2a5a1ee530c908f0638186cbce6df
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapERx:A3k03kB56r0
- TLSH T1B6257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 281e92f02b41abcfcc5d1d4f97d2294293c912a96d2f889984dbd152851cc3fb
- MD5 c27768c98bacfdbeae1a8056c93149c2
- SHA1 5c10d9171b086b1ee1b5dc10d022e47815b00555
- SHA512 797843e36f9efef0e5fb147dce448d4ff02e8196f8c84c9823318343ce63189debc61a584d93304267d074908191d79e149dbe931b163bfccb1826a905a1a12e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapE/A:A3k03kB56rf
- TLSH T10B257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 bf71595c225eb360e1c6786ceaa4a02b170086d04dbcbbfeaff75621637c7278
- MD5 7a0458ee2e45ea854adb431d160e65eb
- SHA1 7f2aea0708bc3d271ef07c085b39060b60541838
- SHA512 98f52dee0ee8ca187d57a95e513cfbd0ce013a12aace4de1def334f6074b534c8d0ee06d0769f025af672a1b814bb82e3d461ecb2787749ac3be947fbead700e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEQ9Q:A3k03kB56ry
- TLSH T19F257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 8df387374a6d79f692ee24833241c3c68b14dd94128743114da9d305a21f86ab
- MD5 3eaff234efab5e1dc3d0ecc7e2aefdff
- SHA1 f8bfadf08bd27c3b472f1f435cd0d46892bbabd7
- SHA512 12eeeaff833c44d249f13eae2f4d2c831c02db10efc49f2ba49616dc23d07106fc25a9f09c6acd1426cefcc4ae6b8795c884ff10313d25c5f303693235fb4341
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEx4:A3k03kB56rB
- TLSH T1A0257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 62772e6cd8274d3c26c00b5cd3625445cd3c8ad4c3c444896d5813c26c169d52
- MD5 bfd449fe2f5790b8c12b40a915682ac0
- SHA1 b3009d53a53d6f07fa5f1012d4b96e6ceb2926c7
- SHA512 dc4637f3d469ed2b50a58568e12458ca30217e1fce8ecf3fa56f2539d5d6d9f6cf0a872ec2de0c7fcd8bb8d8ca54fee4e4e1f41889e390002f81923e21f34f6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapE0u:A3k03kB56rc
- TLSH T128257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 c08fed300beb94fd14fb0f16ca3dd4d6123dc0f70cc44d7c85025374a4528eb3
- MD5 171beed07ac92d5ef7eab0e84671aa79
- SHA1 a27bfb2c803dddfb68161fbd73aebc7d658dce3a
- SHA512 e0c25025067cfe95ea2f7be3fd54dc97eecc29d66137aab686343a9737a10617b45f130647c4e99493831c2b3e4d2fd18b8fc3cd200dd8e199bff7ff60eb0fac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEFj:A3k03kB56r+
- TLSH T1FA257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 aa464e6d458a1aab8e06dc56208868749d53dad6cce70ca0faac7fdfc1165221
- MD5 22ddb690054d36fa419894faf3d0e7e4
- SHA1 9519f4f23ddbfe3dcc319fcb132c88ae77f1bc65
- SHA512 def46f1fa0ca24abb6199c74e75c9b04118fdd2897a2e6ad87a5bcba6eb530771080bd9a02345c904f21405fbd332beb7ecd43edc621aeec3c62a3474a8685fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEMg:A3k03kB56ry
- TLSH T19D257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 4faffbb367f104e147a80f90e37f96f7a01081866ec5a7ac9778d51b686f7c6f
- MD5 85d7d58e41d6628691ad7d5e2fd7da9e
- SHA1 7d22cce5948df19dde18a791458ce09d2130c711
- SHA512 e1b763080800b0bee8322ea954bd818915cc57e0e9ff00e59d999ef948af740f6b310cf0b3c5a0ada94ceb440322e6b9403bbaaea3d800415f5c369174685cf5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapETI:A3k03kB56rD
- TLSH T1E6257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 daf36636321fdd23fa3c8577515f9954ac54eb4759bfdec6e56915bd7243a2c4
- MD5 1e30a9cace201c9d9583f53687596517
- SHA1 7857a0e10bde7c6a66369c6c683c5d92bd040fa0
- SHA512 a440932e78e7d560fab13e01ca2df6066415f8a8ca67ab48779321c2ccd2bf07df9da5d0d09a17e99dc817d273be85c050eddae6604e1f16be7f4c62c30c7637
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEpo:A3k03kB56rd
- TLSH T1E7257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 2215d0755a6e7555ae89bd44d501da42340264430418248ff0773384a5b860d0
- MD5 dd62a2772c9efeeb4df29a293288d383
- SHA1 ca3e248ac37b7df93f332e7ec221e55bf2dcaaab
- SHA512 b841cf95b4572addbd904496de782d2de2d4a89f262cb1a489deb45a60e2b37a7d4830520083854dc6c02920a566f53611df915dac5c30b3399c636d7b7bcbe8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEa+:A3k03kB56rY
- TLSH T16E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 259971ca1dee088113184f524e8a8d7e364a15a2c27b8cf8d46ccead48bc48c0
- MD5 757f0d05fec73ca659be522d16266ed2
- SHA1 584b215e32cd231ccea3f70efad1814d75e72535
- SHA512 523a726807f4959920f7be400ae4cb2338b5a59307237c6c2ed99ec1624cd2bf46a6a62e604c1323287386778dbacb897707d5f7c28f433e65b245d2c1f65334
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEaQ:A3k03kB56rY
- TLSH T16C257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 48c53709ec5c429e577ad48f3cad48915e0c698b01e33f187e63f48a10683263
- MD5 f3dfd94469bbc3773e7786884511cc3f
- SHA1 cd5edaa7b7db9050c53374c7ed1f94eafb22f38e
- SHA512 26ab17c56a80ba66839cdadb52386fac5cf5b600ddf5a120581669dc9eb1b6b60961a734324a4c07b90cd95e1ff0266b6c8a02909f4cb4e82a19425c14ab40f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapErX:A3k03kB56ro
- TLSH T106257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 fa71bf306ec2c69f72fe372b568833dd3061a7ee420ec96e83d0a7ff906c7073
- MD5 743ccb3c2eba8baeaea5cf4f7569d81b
- SHA1 13656369034b6f071f7e1dc1e413fa73b76f5d35
- SHA512 563be16cecf40cc0d578faa16973075e44a52dd374a581c9505a4b1bb37ee54c0f0637532d6ef3197c6ae539ad9e0be430a097eaa374051f45717d4ee5ce7afe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapE5L:A3k03kB56r6
- TLSH T194257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 0afa54ed092d5637dfc7238d667aaa82a95469734ca8d97ecadd3a477f06e92a
- MD5 55f013f0c2b56f9eb23917a18810117a
- SHA1 940567d243e9050d2c2f1c13b26532906a9ecc0a
- SHA512 f6b29d580b8691b4916e8102b9eaf9f3574fc19e7f9ff42b9089029ca50fef28bc25859bdb4ab7ea1c301c24476f5fefeec45375f7c5ad81e23999b8ed0add32
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEnM:A3k03kB56rX
- TLSH T1D8257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 38188cc85930960d4f9e7895087221227d0c038e16a88c5e087138a6c8928d27
- MD5 fad5dd0f6ac4d5f5a072f46ad0a8bc03
- SHA1 efc6232cd53a961289835b07c4ca77774ca4a8c6
- SHA512 1a008aade192419cdb648f8b115f393ae1da360074dd7f018a0d6c7260c4afedf9ec86584df45a2514008be98c2b64b45959781b9094be19edca82b571ee6a7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEQh:A3k03kB56rJ
- TLSH T11E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 957KB
- SHA256 2b25c1c74734cdcca7d3e1110633d4b607f20867f3ee2ae1ff3fbef4a03a7635
- MD5 f1ae72e7cb00ff0c580fbd2d95cc2e3c
- SHA1 e28c0cefde27d5b35e0fbe9acdd85f0a099247a3
- SHA512 cbc7dd06507d6af52e806978699f5fa84465331b7051e365135f04218debb84975954c5b4da5114b99c1466e5d9d8c105d7c5c6088aad335b6ec0b4fd492dc5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapEF1:A3k03kB56rc1
- TLSH T1BF257B03E6840FA5D10F81749A958662EA777C425F6093DF2358EE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 968KB
- SHA256 1e7fd03dc1231822c403b97547d3cf060d6dacfb5e1bf75a82ecdcdf9829f260
- MD5 5160629f6236fa00825d427ac0ef7475
- SHA1 33cd6ee64c7028cc6a77adbfe9c51b1e3b609d65
- SHA512 7a2567e71082f84c8b6057256e49f62f006c897a5843a502c7fb6aaffd3cf6042fc7c7b588e66f476c6da07558c94faa7b9a68f2c670cf2f5ff89ab2744bbce4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LapENwE:A3k03kB56re
- TLSH T1CF257B03E6940FA5D00F81749A958662EA777C425F6093DF2358EE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH