Analysis
- max time kernel
120s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 06:55
Behavioral task
behavioral1
Sample
2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260730-hpxccssglf
- SHA256 a81662393d33350895da6b322bc6343d0b276fe66af2a2230545a72d8dc4c73a
- MD5 6d9f5f54cbe241617a9550f4b7f224cb
- SHA1 1e9dde43b90e9d5531eb3c10309e3c6ed18c41db
- SHA512 5e8e10b9fa9728deed58bba97130e4595fde774c84aeef487d6729ccd6cbe00a086c6e9473ef3ea508ba63470ffe85d75dbfc958cef1982cc8797da1e2c9d7ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5c:A3k03kB56rM
- TLSH T116157A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/1680-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4e8-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1680-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5288-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb6-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-444.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019908-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-513.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-655.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-847.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-912.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-925.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-938.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-957.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1070.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1101.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1132.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1145.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1176.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1190.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019929-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1351.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1376.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4e8-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb6-60.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-281.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-444.dat aspack_v212_v242 behavioral2/files/0x0004000000019908-493.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-513.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-599.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-624.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-655.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-728.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-747.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-790.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-797.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-847.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-873.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-892.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-899.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-912.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-925.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-938.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-957.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1014.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1051.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1070.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1101.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1132.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1145.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1176.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1183.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1190.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1228.dat aspack_v212_v242 behavioral2/files/0x0003000000019929-1332.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1351.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1376.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5288 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1680 2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5288 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_6d9f5f54cbe241617a9550f4b7f224cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1680
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5288
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 a81662393d33350895da6b322bc6343d0b276fe66af2a2230545a72d8dc4c73a
- MD5 6d9f5f54cbe241617a9550f4b7f224cb
- SHA1 1e9dde43b90e9d5531eb3c10309e3c6ed18c41db
- SHA512 5e8e10b9fa9728deed58bba97130e4595fde774c84aeef487d6729ccd6cbe00a086c6e9473ef3ea508ba63470ffe85d75dbfc958cef1982cc8797da1e2c9d7ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5c:A3k03kB56rM
- TLSH T116157A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 15a475eab0c3af8596f743113cb6fd93a682d1ea5a035aa9c82fe9ca18add6d1
- MD5 b643e16b44cc98dc88ea181f70438091
- SHA1 23f18be701fdb8d9cf2880bdd3818a9299640e39
- SHA512 65fd7b52e4463ba9045c220cb4d09d170abe720c8f227843e2f45c3ea97862aadef4735a2303a169adbf9a95835372b7169f8e9756e5845f20a37f3cfd9a581a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5k0Le5ji0hmxNrM:A3k03kB56rUPji0Aj
- TLSH T14B655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 4eee92bed183b072417541685115ae810922c4f1939ab14042b8e28e2daf69d6
- MD5 544673fae79539077666d1865c6e2447
- SHA1 638fe6ba2028436476017c21b5a5cf7e4b092198
- SHA512 4dda98ad07579e7f0ae58504c7b3ce74418c36571034cbe948fef7031029b3da58128635a88092ddec14af26d2a0d20d961c4cf7fdc9baf406f6c5a351df73db
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Oa:A3k03kB56r
- TLSH T1E2157B13E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 972KB
- SHA256 d17f5bdf195967025865564693fd83ddb74b27c4af637b5bf969d79804126b5b
- MD5 86980d4c0b76cecb51a8a693a86b7306
- SHA1 9220505eff9c881685dfc6f0f8ec0ac554be55ab
- SHA512 2f17ddc8756aa48e3ea56436cfe99a6944e6de8eab1eb58f231bc62bd9b9a6f1e4db27d2c8542acb21e17502446a4299c213a32e8e2ed1570ba21353b6f5412f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Nb:A3k03kB56r9b
- TLSH T1D9257C03E6940FA5D10FC1749A958662EA777C425F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 90680161a8de8dd47696ddf081e9d2c483caaf91646cd0f49b88ad3df1a38e74
- MD5 54aab2b8c6ba4fed1887ee3f469f535f
- SHA1 1b85706da9e10f27bf4732b44556526199d76414
- SHA512 f537b93792968bdbf9c0c14682321df0666e60bfaab741d0921d455d69f772d0041794e4c9b5640ee36b58e65ee101e62d915e22ee7f0d87b47211530a89ee11
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5/9:A3k03kB56rF
- TLSH T164257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 b784ce0ec4c9c75efd142b8f0ca1c05c6f129a070f156932435b52165f251899
- MD5 0eb341d0aeaf5bd5d2dbdbaa66f4a022
- SHA1 a04fc455672a15d0d8e9eb0aa733cb9ad1a56651
- SHA512 987737bbd54e3a52e9507b42805d5372d50a91ed59eb7f8e4d9f81d92fb141e3d83d47838ec21f5db028075e2a42da5be9ad746ed799c46b049b3f5ee13a68b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5bc:A3k03kB56rA
- TLSH T1C9257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 18548e005e34a7e0dc08769e2c0f82f94b1db5d0fc161ef5389aa2a20ec5294f
- MD5 0f683769e230da09266cbc8f81f30844
- SHA1 e80d68ff2557dcbe3972af178c497cb25cf22270
- SHA512 eadd170d3f1075009ed964a5a3510fbb8b2932d6b810526e63124a2a8b808b637378c948491d9aaef07886bd80bd6bc2bc5fdcfcfa8c5706b4ab3242d7f3317d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Ep:A3k03kB56rW
- TLSH T159257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 0b623955c494c3b04019ee4fcc974f4f7dc55da16f5b4457bf69baac7e273851
- MD5 93ea58734d6843f7678a604b1b6e51ed
- SHA1 4679004641ae12fad04652e524c95ed03bc5efda
- SHA512 b6b3e1a3f8fedb9ed3001911fad22aa48aaaec6660fa433bc7fcee71e12a8b350c8d635e528ea304633294505ffbfe689ce9ade8a415a4b361c27adc3e946aa6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5LN:A3k03kB56rZ
- TLSH T128257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 b65a88adf477b210ab6fd35dd6afc09095c036f8c0d90d2b7f37734b26f1bc13
- MD5 9371b64c581c840d7592d36522b73a02
- SHA1 c49664246ca2a1bd5f03406bd9b96abddc1a2a86
- SHA512 29dadb069f197fe50763b65cdfc03b6e2fc6a7c2c437b17e321bfe7cca310e4c16623c4922979392b54237283f531666adbe4e1cdfd35da97bd3b16b64a476a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5ZF:A3k03kB56rL
- TLSH T112257B13E6840FA5D10F81749A964662EA777C425F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 832b4d8c8b133ffd0ace7da476e0b0eabc29a66bc1e67e99986a78de76e4d795
- MD5 298434e80fb55a85e795c10f342df083
- SHA1 d30aa4b6a7db7b353587e54bbdf212389ac99128
- SHA512 ca3c617504dd90b2e368dcc63015cace4c65d86236bbc1da93cba57e6168115e5d339bf605a8e2203da2d2b75acb99d12006b763730dc04d1913a1ddf7f87c85
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5yC:A3k03kB56rn
- TLSH T17B257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 c447c4700004c9114656cf01380345a3718e5919fdaf0951a65522886fd886c3
- MD5 1f258e81cf625e15d36edbc0d7bad691
- SHA1 89805b709100c9267e6c0f4f64c5d072a603c8ac
- SHA512 42b75fbc496245cd89de6be3cbfa3e5bf9608119af60cb3f08d765ea05c6879908033fe80d216b1bbad17ec4c5a6f7e19bfdf0a68bed46ee57fa176ad506a6d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5tw:A3k03kB56rC
- TLSH T165257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 2cbe9b86b2010227dde891fcdaf6f3575fde82c4825963d7dd873a977a326098
- MD5 0bd32c898d239c41226ec61af9118577
- SHA1 ea2cfd195183ed61167f35ae95dd9535c50063fe
- SHA512 7d06d216be7b40b21d57a09f3e1ebbdf38b5f2d6ad00efad07a362fad9736a4a19aaa5677add553330a57e6e51a6d797bf8df12c15b4f2144039a060dda2d235
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5cT:A3k03kB56ry
- TLSH T1E9257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 505c6380c73f787267d17205854734981f628a98e50bbfdde3cf5333cab109d8
- MD5 e6b0dc81a06de935bae057e6d6fa4660
- SHA1 64f910d5e1459c5c568d22dbc225621cecf4279b
- SHA512 eabf81a2036fdd54516af0072ec9bf05b0cc0b7112d65d510c09783d58df5021d418cc306fd3218ac21c8d436abbf3b87f6dfd0a19c9e1d8d49b892d76e175e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5wu:A3k03kB56r9
- TLSH T117257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 0328d0067e3c19bdd28ba268649e2488c2f74707d5c6ff5b0079dd218814a8cd
- MD5 240d7d4bf526107838545366f1efb44c
- SHA1 206f1286d822cfae54de8611621d93c9186b1b10
- SHA512 75f0b42b8f9c8c4250e2330c296c7dc80ccd17cd9f4541db3e02e18fcd558a822d4a909b0399fba1502b2a91b73a4e880b3ea210dceecdd4c4f715ea987aeb61
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Ob:A3k03kB56rM
- TLSH T148257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 6eac20a17666f0d75f838a9ac75f4ba270bf3149c1c3021747c7b46fab1a1cc1
- MD5 394524d6bedb63695c31477e5b6398cf
- SHA1 5bf94778aee9e5b83dd38658530f9ee8c1f17155
- SHA512 08c40ddf7627ee94917bdd08371ec8396e2b192d812f756be0e0695a2e153a6879478487b5a43c4a08af05cf5573daf495ab124c6b7b26340d8775bd4d168fe0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G54f:A3k03kB56rM
- TLSH T1E9257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 588ef6ba9a6f8cc71c304002c60105dad8d4797513f216496f02284c05e8bf52
- MD5 131ab96437ea21f72b1923497a1c2e5c
- SHA1 98f042aa312edb15970984cb43a30f2e48878835
- SHA512 a1d4c5530b0a00e622d5717ff6de326fc357c373911196dcc14e5974d82c44bc2b3317f82b0f71428da0a9592d575d10634e65f396b2cb4d613c6a3499f16fac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G51K:A3k03kB56r8
- TLSH T1C2257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 fbb2bc4d7e4d97bf1eb57c6559828d697c23f62fc39f4b3f3d891a930a2ba559
- MD5 13ef998e2e4d560a761e2508f2325dc3
- SHA1 3d9c72d576060301ace64854e2c0095617fdfe69
- SHA512 35cad33e66b18ba9fdce5af8ecf03747185d779a5ebb8bac4a68fbbd744bac7a70cb68e2be7acd461a82f62ba9945a9591a13d391b36ed1a222c2c657fc5e765
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G52k:A3k03kB56rF
- TLSH T117257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 c35163c788ebb8a107411398b2504c8ec304339a493e629c491e70bf2ec57300
- MD5 4c87ee0a6af26777d2af81a4aa04cb17
- SHA1 a2e32b7839e33f2dbc0077737d573cf225c04f5f
- SHA512 d22c2ffba314f2fa1496cc91c174aa95db0b95b1479c389b61ed35a7787b998c3264c31a91de131794467ad2c35ba00e1676c8e5065176279596c56adf0d759b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5T0:A3k03kB56r4
- TLSH T16F257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 5537991b4d153b58c702840db231eacda079a7d8f69ace30d281e39fdfc11421
- MD5 4d69e72cc73abd8db7e972052a3c917d
- SHA1 f191ecbc70867c6448c55279353526ae592da3c2
- SHA512 179393f4177197620b2ccd6618884ba09ee961ce3f6acd3dcb374f30e1721211fab00d565bb8cd0fc8985a7ce330fc372288da62e695c6bdd85d158ab3d909fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5ig:A3k03kB56rd
- TLSH T172257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 a912173a2d7224897a169e7b51c660dce7627c7037d00f5a495cfe45fb708eff
- MD5 9d6ef703fb9821f015d260c4f5177182
- SHA1 0f487616b15606cbbbe4a79043193ddf3b2062c7
- SHA512 87ac699e24b517412c62df5c1408d147db365dea21b01ccc30d25a7cec1a9e856c3069a9e057aef73d83598f5d552b3e8a678d8b6fa35b3abbc216d13e83ab31
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Dr:A3k03kB56rf
- TLSH T123257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 ae5f66c8e5c3bb4542b6d9fa61e4e29cf52491b5d9c5d9c5df563efeb656cbd1
- MD5 188f624c3174d6326ae2154958789010
- SHA1 8f3d3e45b218f1c7fbe1ebdbf2c4a3c11e337c33
- SHA512 29e5a1aa6214f1d4899ec69b1493a2441f3585cf47163e2259d92495d366c06e4232d2758666e6fe44e3490d51d11f7204752c0093cb2e66d3b95a2c285819be
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5ln:A3k03kB56rZ
- TLSH T1BA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 7c68ab5282dc55ae9aa059fbb2475673ea808d1f111bc915e1199a3159a62325
- MD5 e451ab5911e135f59082d11f565e395d
- SHA1 92bfc6f08529f35c315e4ef3e3558d04733acca2
- SHA512 f14967dabdf2ad17865ecfb2969a0c59de03355e3a6dca2824dbafb31781b14905d212fc277e1ccc14c36bdfc63512eef8ff2d00a0b9894cd83e9a23205715ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Rx:A3k03kB56r3
- TLSH T1CC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 1838bf8e336b89b6dc6997261271826bce3f64c0c3042a4f22ea64d429320be8
- MD5 6d4a13a1e37d887c67c83a6490d38c66
- SHA1 78a947d031150c972fd03e064b12bf8a5cfc1eca
- SHA512 67544113e25840481c9bc7b0f3b56f6d6d88515f3d7c67189376937d184b20ec92f45f688d98662d2c7506b6c66d312b12e8d1e30c9d5da19684ba9d380ec424
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5/A:A3k03kB56r4
- TLSH T1BB257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 4d4eee4eb1cfcc264a6218a91d5452c21c40b458970fdd09c51749ea4da5b9ee
- MD5 71a2c8161b98ec82302a5c617d2438c1
- SHA1 da097e299dc6b510796cfac0c1b16ae07b7638cd
- SHA512 b48a427dfffecb433e40bf1aa12631bd4761dc97a2b5de4eb9299257a0cd66cc97170c3293c4b0f7f27d1a23781468a5de6ba7382a3fba86b847bcf3f949c40d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Q9Q:A3k03kB56rh
- TLSH T17F257B03E6850FA5D10F81749A964662EA777C425F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 0e3979e7132abfbec03ca3ef6144a9f1fd405815d35ba27757aad8bd7e28fb30
- MD5 cc33e897aee904cbac927946c55c23cd
- SHA1 f1732a9132bc3f73bcf424256627765417811337
- SHA512 109f89c162b455d7ea003a325590d9334fe88c09db65257b49d7d6c37eb327d85b0b66bd116ade10dd9bf98903783b43330f940a5b12da8da16701dd26f13228
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5x4:A3k03kB56rG
- TLSH T1C4257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 3e07cd55be27ca33c5cb551b7297d6b0eed95d1965c919218bade33dbfe50230
- MD5 b562de571dc0a69342c1f3345e5ae1d9
- SHA1 f6f84048f8e541c717cd7b1f3c6fbc0c64410610
- SHA512 d597aef043b5cfdd0510c7fabb48398ab8528793a4f8c181b5ae31bb5771fb17916625e6065f964479772020252e281e411aef5f2068516e58a36ced79e74cd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G50u:A3k03kB56rX
- TLSH T109257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 744c0a01dec7933c5337486f1b3acbbb07fb86ff61b525474e2d0d32c5d9e454
- MD5 eb7576253badfa816bd0a1a1fae23c6d
- SHA1 3bc517a260819d578c7f52ff1301f6e23b46c45b
- SHA512 5d3c632b7c4828dfce0964ea1a9e552b547cff07aecaa64a8866a0252a10dfe13458184dfe67951e335d43cb4eed0b58a0c13cdb9219d1a592dc7d0a866d5959
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Fj:A3k03kB56rZ
- TLSH T1AF257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 43e5abc088eb81f286d8bc85b2c98b128103ddc5253dbe41e9458896dd066fda
- MD5 9d2e79309e427ef05f7499878c473a26
- SHA1 062874e0223cb7abbee7fd4fd73c90bc24c3f5cf
- SHA512 b16e0a746d4a4bfbc99b29dd50ca44479a03a29f0e6fa4afa7a754ee3ccf735fd2af1825263af5fde9cfef62c6a0addec2f060f897d2660640fbb34d353c45f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Mg:A3k03kB56rt
- TLSH T1E3257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 ac9364c57f24dcbbb6c0ea87548d9db36df853be6a00a653462464771fcb8b76
- MD5 8f58866b4c93bd6a71ea26e35411db1b
- SHA1 4a84630b9e87a62e684ed6c0efeb355fd3b3893a
- SHA512 7987c54a7435fe3cb8ae5909f52363017f567372056efaed72ee63ae52b00a90f26940d5bc932866e807e49b3702fec3034ee98b4970111d11260b1c530d7e07
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5TI:A3k03kB56rk
- TLSH T105257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 39bf42517a2c5ca8d6117caf1558bdfdae69555ee3fa7148bffbbd9ba6d48d1c
- MD5 c00fc2e8402630f042a438eb74c5503a
- SHA1 8ba52fa41d500f2d2671d159b51db51b685f9f47
- SHA512 248ee308a85250553332c8d05b87dea23a60daa6b2dc06f515a9315c8f79d7e1b66e12e4a6069944286b49f3c98bd7dfd39935a14a3426ab03c53eabb9c19594
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5po:A3k03kB56rW
- TLSH T1C2257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 083434e0cc012c01eae7db888bb634e439f9204c93ddd58ee1417f9663941e17
- MD5 a4edcc3e823e916e5a7d40b00022a636
- SHA1 81f290549c46c5b84dabd33ab47ea1490d682cc3
- SHA512 a0a811cd63852a9c8d2bb63ec113a23d6f57209c9e902ae44e35e507758439224e898622c37f72352e6cd07f4dea43ed8994ea4840e14d02452e3d9e0c28079f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5a+:A3k03kB56rD
- TLSH T1C3257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 de397f52220739470017e208bd461aa1b31b3a21a683d7e795bcffbe8cee2262
- MD5 4ec2358816a1c9697e6ac8af79f69de8
- SHA1 64da666cbd34d79d9be2537e6a4fa21c0bd1d14b
- SHA512 0d0ed17c9fa9c2f55088405cb98a681de0c9ff5d0f41a93d20a69c4dbc96f2e76e69fef8873c49cb5f93f18299690f63ff95d3932b7a287e22f336a7f79a9bd3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5aQ:A3k03kB56rX
- TLSH T11C257B03E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 cfa961740d750766095f769874d8c40a9bc985d7331ecafb6b12653f0fed73e6
- MD5 69780763eae55da4c5c2a03a15aba66b
- SHA1 500329f76ae41241f878dfbb36e47f294dcb58ab
- SHA512 8d36b6dcab00bd20aa789dc70bd3482dca7f34196dc3ac0fde4f1b33f439f22b0a003d07a1b39c1ed5a9e0cdfe2c812da8ba7f35cd1b53ecff63fa47819a7d3b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5rX:A3k03kB56rL
- TLSH T1EB257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 85d1f4b7c0fd751caa9b6ec23cd8eaaaab1660e6033f123e4303547dc8cf8711
- MD5 2120f79fe9768d4e0ae62b2294820779
- SHA1 53ae4a91545460c2c3d72bf8ab4f50ec98350278
- SHA512 b5b850e137f93f6d29c4d1670c976d51a7370020db50f6cccbdb700bca160310d6313a01bd1ccf7851b1c8bd17c8683889165968a1d594467a49e5e7e59d29ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G55L:A3k03kB56rF
- TLSH T1B6257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 1233dc4ea8961f2e980776288f9178de05222a780d35db03ff3cf756c99ea8e3
- MD5 d8e9ef60400548607a0be18d794e94c6
- SHA1 95cabc8060949369a28f5821139fe1e3bf3d29b3
- SHA512 5f636422534c5ffbf4a966c6be776ad08a0e50bf0b1d2cc083879c334b4403499f8df71e8354dd3cd215e6a86f4f394a049e70a17f25cc2864b3946b9adff699
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5nM:A3k03kB56r8
- TLSH T1C1257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 5ff5e33c25f69eef805be8eb8fc63ead2eb8e1edd673b4230441fd0a45ad1d5f
- MD5 6e9764138609cabada3d8b72950cf802
- SHA1 89319906db934f4a8747a78b06897f5cab77e415
- SHA512 038435e5d11e8a612b7ad0a9bc0cef33aa36214a7a55028c5a8428b69a61d80ca35ddb4d37e35b478ff6ec6a034399796c6442c28ee9f3182cd503bd35f47b7e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6G5Qh:A3k03kB56r2
- TLSH T128257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH