Analysis
- max time kernel
107s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 00:42
Behavioral task
behavioral1
Sample
2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 916KB
- Sample260807-a2d3jsxyct
- SHA256 9fa92a79f2e821de4762bea2e8efc74f42c07eac9a284128c3f50fdd0a22f79d
- MD5 66aae02958cf8f035900fd3a6fc11f50
- SHA1 42b7becf1fda09f3fa6523b288d9df0fe0b55763
- SHA512 b3f24ca5a6e90a1770d1d4648a6cbc965b686f5aadee261498090ca95a44e453895d454a427da218e29e42e26569e2fc3997a9b35b5a59c01703f3f9355b55af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhC:A3k03kHRJz
- TLSH T16E15AE13EB9500E9D10AC1749AE68A23EB757C56176093DF2358C6152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/5800-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4bc-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b311-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5800-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3204-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b316-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-276.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-445.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-579.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-677.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-770.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-845.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1046.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1152.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1399.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4bc-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b311-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b316-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-276.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-445.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-579.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-622.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-677.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-770.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-802.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-845.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-870.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-953.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1008.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1046.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1084.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1133.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1152.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1177.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1184.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1221.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1324.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1343.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1368.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1383.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1396.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1397.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1399.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3204 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{F9EB52BC-12F8-400F-88C0-E0E8FB418737}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{F9EB52BC-12F8-400F-88C0-E0E8FB418737}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5800 2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3204 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-06_66aae02958cf8f035900fd3a6fc11f50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5800
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3204
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 916KB
- SHA256 9fa92a79f2e821de4762bea2e8efc74f42c07eac9a284128c3f50fdd0a22f79d
- MD5 66aae02958cf8f035900fd3a6fc11f50
- SHA1 42b7becf1fda09f3fa6523b288d9df0fe0b55763
- SHA512 b3f24ca5a6e90a1770d1d4648a6cbc965b686f5aadee261498090ca95a44e453895d454a427da218e29e42e26569e2fc3997a9b35b5a59c01703f3f9355b55af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhC:A3k03kHRJz
- TLSH T16E15AE13EB9500E9D10AC1749AE68A23EB757C56176093DF2358C6152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 f55cafbeda9694bd84c3a4cfd4102a823136a8cd974a68617e3c993e6bd7edea
- MD5 3ee381331d591414a7452d41e4109ef1
- SHA1 bec81147bc56aeca156359c57cdd12e86711482a
- SHA512 1b63c8f19483e63183853535bd3d15a1343025c12bf4eed17cb96d13cf764196a009d7a7d9ca2af6fec1b7d7785232f3ec166d172a3e45efb293ffe8d00b47a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhC0Le5ji0hmxNrM:A3k03kHRJvPji0Aj
- TLSH T15C658D17F6A402B5D067C1B8C5D69A6AFA7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 931KB
- SHA256 6731511a7694230d3370dcd83627c4d01b57b30bd10efb4a3795be2fbb879c0a
- MD5 881dc1c4c4c73b2af0a63a69cbdeb970
- SHA1 50e1f7d1e9704d92fa26a3b317733a6572bb095b
- SHA512 644930ba1fb2f6b508bb01cd6307753fdb2d8b81a5e8ad0a63b57ea625ca409e3d45f43ead727eb51d30f80228474a75c409bb73d62cadd44ccdda5c6c7027a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhMa:A3k03kHRJ
- TLSH T1B615AF03EB9500E9D10AC1749AE64A23EB757C56176097DF2368C6152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 964KB
- SHA256 d13ef8c4bf74883a2aa6afef2d4b11fd1471ce0de7a03708e281e07d22d4d14c
- MD5 dc8e3b48e0bccb2f4e0eba013fe9aa5b
- SHA1 e96a611579adc6b7815bbfa62268a643f9f8acc3
- SHA512 0ee450e1d9f6173e99d9300a8d6949393f183440d85ec1d3504d95cabe8fa0ae0d5c505b7bda9beae1d24d5b2a96e24a513808b4c9e820558943e5e69295314d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhnb:A3k03kHRJSb
- TLSH T11125AF03EB9400E5D10AC174AAE58A23EB75BD56177097DF2358C6152F72BC0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 940KB
- SHA256 849e91294450b9584c186e4897ce39f6d8347a57e4c7d52418f1819c84d58a34
- MD5 c974f49c73aa59fa2fae9874da939169
- SHA1 187f57bb6fdf8df6223d59acd3939ad00bd2335d
- SHA512 5e6f8c13c321847bddd6249c1744341a6cfeb7347ededc0da660066a73e265ea307bbeded1a03b524b5aa0cc5eb629674ff0ac36632fe899fbf075c9bdf7a577
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhd9:A3k03kHRJE
- TLSH T13B25AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 940KB
- SHA256 437ca3b00ace2b2512fd17b2987f529f4bc42dd1347403778982ad43852362de
- MD5 eac7e3e8f059fa15a79f8f13674ce6e9
- SHA1 5bcf16bb9892d681b07f6b636260d4d85e2bc266
- SHA512 2f2ffef129dcb8a3d0e1e9541d2b1d0137bed8b1f0fcaa1099ca81dc2b4d58bf5ab18c71766ec88bad0cc7f3af19984ffa015c7cfed13514624d48b3fa206f82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEh5c:A3k03kHRJt
- TLSH T1F025AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 940KB
- SHA256 b2b3618f98209d7370280f449ed3636d2edc422be1f062c6c2706aac5b946a53
- MD5 8d501a657c2c9e5f243faf9379657f45
- SHA1 0a7160a401dcf7e2401a6017321ed54954b2ea54
- SHA512 83977191baccbc787571d19cea224518b77004777593ab79ea3ba2c15eac2bca668232ac61dc5713c43647f4630d515cbf3d64c21e37fe71be7f79a519614568
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhyp:A3k03kHRJz
- TLSH T1D425AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 940KB
- SHA256 2bc08243d1685201bc2422c2bd11ca961a82f1f186b8c1e3771975229c22496a
- MD5 7721e9576a099d5efa757b49d87109c5
- SHA1 97fb1b6a888cfd62f38045d5cf9f47f4e44b6eb4
- SHA512 22d58d8ce6c8669cdeca276d0e1b5cc28911af1555a91a66e703b5e8cb1c9647d878068bf96cf4974406a8976d891ccc5cd8efd985bf2fcaf0dd067794481ee4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhFN:A3k03kHRJI
- TLSH T1B725AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 940KB
- SHA256 ea0ad9cba5b67d0e63a52a1125fc6c0ba86e2a5a61bfa25d442b33433ce19db0
- MD5 ff78d736267ded03c475a962cc20a74e
- SHA1 b485cc4d007ab19acdacd24ddb1f52b06f58814a
- SHA512 19b3b88887fb15af1e5bb58eec289e2888eff60eb7c5aecefdcdf84db40bc445fcebac7338db7119a0137f20d108b0fe0ed7e117bed7d6b1c2b38e25317e990a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhXF:A3k03kHRJe
- TLSH T11025AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 940KB
- SHA256 30f8f56191a6d9f42dcfc6442ccf6cf9988c3b73bdc5c1f336a870326452ed6b
- MD5 44ed7eb8c098d040939da592424d9da1
- SHA1 2b43e145d23e5dd47e69aad16427b97e24f6da5a
- SHA512 67c44de4a5c276bfd3c718a8f0fb633ffa35015f6c83e14a0b0ff6be3738cd6c3c1d4e61edf33b672334f5afcac4c9134886ad6f03c5701ee00af1282c935ddc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhoC:A3k03kHRJ6
- TLSH T1D225AF13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 940KB
- SHA256 58bee6ac7db9e65ac129e6027839fb6d6017f26327deb7cd5b65945d007607ef
- MD5 74ed23ac0693ed6aff49cb3ff489fec2
- SHA1 09269a537e43d1fb1a3778be8fa8db8fa62f64c6
- SHA512 959793f250417245921825720a5bc07b87907b0c102a32286065ceb56edacc89954340d4ec94f34e4229a253e9c03b19842bc8b46d651015eadde72457f35e13
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEh7w:A3k03kHRJP
- TLSH T11F25AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 940KB
- SHA256 a76f28440b6c0ddd9eed9435230014d79f24d946c6b20769ddbf830be2f1655b
- MD5 6bd5e44d2ffae0c066179e13a2093050
- SHA1 91bb71c36465a5f2af19a7152d494c9372e5d3f5
- SHA512 104a3608550f04ae59147d0cf551833bd801f7a14d419068d195523cf350fbe871cb632d60226229d0da3ea0973b72036493f4d123d28fcfbac487ae8c8abb76
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhCT:A3k03kHRJr
- TLSH T19925AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 940KB
- SHA256 19c7fbfece145c0505bb9ed3d4a288b32d340c604f9cabffd37608c6804bed75
- MD5 11fb8d39f755a7b2c85f2db5bfd18dab
- SHA1 363af605f4cae3d55fe90fe73e926a9f35abaf17
- SHA512 4fc7731ba0117ad9eafc7f9f0af7dd420aeee0af84f7d3e941c9114e32494bb4093c12590c2a1456bb2b81e3acd052b4ac8baff4e56f8263040a51493ce4157a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhSu:A3k03kHRJs
- TLSH T1CA25AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 940KB
- SHA256 d6195218f61dc9e7216167c8fb6817377845d5e455d789730126546bfbe7b17c
- MD5 57961aedde1aa1a9a3faba04f0a0da34
- SHA1 3fd2183c1dd2ba32721647f7a1d766faaa783db3
- SHA512 30e078332fb735f00b818c964b6f1b1ac408042bc848ad1621b4faa20be2963e475f249ef482dc82623b1aedfe4790c57c40273d4c59954657358e1b18f9b8d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhMb:A3k03kHRJF
- TLSH T1BD25AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 940KB
- SHA256 b6273fdf4935cd5014d406d59adc54a7d8e3d4a183e65132f9f918eec4f361fa
- MD5 94c74d2887e55bd9dd5580a92cd8df77
- SHA1 9300b78d71947e8d09b17501d4ba72974ff14703
- SHA512 9d4aa67a26e0796ba53993ea74446bfc941889e894600a9a37266bd6bd2ef83f84ad12f5c300513d9ac5259e98b633406662f92776da71ccbd154100b03391b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhyf:A3k03kHRJF
- TLSH T15025AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 940KB
- SHA256 3384b25816927152972f3d5e2bd70bdc6ebd1fb4fea3aa23eac151ee49ea9dc2
- MD5 313aa5d054f5a94aa583968d6ebce0c0
- SHA1 c9807b15884267a445acff098428749e39e5ba15
- SHA512 2f34a6cd6d5c0a37d3ab4dc76e87270e7ff56ccebdc625217bbe2119f4ca7532af348396facf13f13ffa12a7c886605269088988f719a839a7c99d000a634c37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhfK:A3k03kHRJ9
- TLSH T1A825AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 940KB
- SHA256 3d19e6383e0dee0a8ad32ac687bde66adbe3dfc757ee696bff92924da471be65
- MD5 663a3e22117d5e077f036a33eb6c81be
- SHA1 00feeec077f44b94b92373329b142837547b6e34
- SHA512 843d53b0f2430dd0f213c965a49e7e6bda3d49b22e599ea7ddafbd894c46934bfd69c2eef4584f8be2d123d8db8df972593fcc135e0e39dd976084edb2724436
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEh4k:A3k03kHRJU
- TLSH T1D925AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 940KB
- SHA256 45f664cda91517e69c242fa1383f9197b8651a9ebcdff1bf40995c9ada29e531
- MD5 7f69c0ba48c8a849dc65e2d55a109a1d
- SHA1 1f7865dbe755a24c8cf3a000d4f993af98945f1f
- SHA512 6cbb461cf84fa688acfd8c90ed2c81bcb46f2abcd6f733649aeb941a8555981207eac92d9da86da2eeac3d153e2cf0884605fc2010f3ef80205c8ed9c81e7230
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEh50:A3k03kHRJd
- TLSH T17325AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 940KB
- SHA256 842a095d0d1bab361300f07feb85fbcd7e6fa0005778fe194b7d86318f1630d7
- MD5 30d24f987134be4b65727e6300e38834
- SHA1 b735c60574cdcdf03acdfc04fd1a78788e86b4fc
- SHA512 96fcc17e8a283b1a9a2e3df100c1a7be017eab9c2df2dc97e573a7c30decd9a4d253bfd6fd38012db600ff59549c98cb12e3cc378e463bed28586385c685f77e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhsg:A3k03kHRJs
- TLSH T11025AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 940KB
- SHA256 1aa84ce414ea1b2638ae790461f0fee705ee78aeef422e8739b917bef69768e3
- MD5 c535d8e473a4b14f3d58cab86ea2b3c7
- SHA1 85fb70d601f52e24867b37e120c4a7a31d3e3280
- SHA512 d56dcee5bb0c690baa46eec3f674ea4640b2bb979baf65e65cb06217383331db034387c0b4d219eed2ec9f4ed12df4da48c729fa4a39d460cd4fdf61662cfd55
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhJr:A3k03kHRJ+
- TLSH T12825AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 940KB
- SHA256 90924abbd6896db7004428b7301bb5ef3fca00b716002da1eff5c85fd50a3e6a
- MD5 c3d0b301db350a99f88eec950181a01c
- SHA1 2c67e93d43e30082dd981acf47c4a11a7a54c150
- SHA512 a2b5bc3bc482aac3a011ba93508bdc725f4424206ab3ffc21b88d00c50ff181506f692b197ac79c07dae6b841a9936f1f19a79fc5bee4b154972675ac5988dd5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhrn:A3k03kHRJI
- TLSH T1B825AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 940KB
- SHA256 2a8b81d498f1e535a6a29ec93a909abc596eb8a3b2b4171dcab941e6f2234d56
- MD5 f983761105e802d1c27e79acf88eb8d0
- SHA1 7f216c0877deaf5eea0de3066cbbe5376f7db97d
- SHA512 d5b694c076b4066a0ef346d0bdc2947dabc96d67c70764ed04f98f2b5a5e75729e450172cd45b6c3c92b826969f2bd0c11e31e730bb648ebd71c80d2510f0d87
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEh3x:A3k03kHRJe
- TLSH T1E725AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 940KB
- SHA256 ba6a5fb6a85adbe862269e12b892644cbd6ad11f0df7b19bbc901c8b15c7ef92
- MD5 0f73a79be0e0973a44f9713a885507ee
- SHA1 814fed452e9600dd6bec55d94998cee671ac5555
- SHA512 cb729773d4f090aeabb7e30a6fbde19e155a4674e66896555b5e32070e4d42ef1c13219495077f9925847cbb9a69103a640e0da1b05dfbab9fe4284458a32ea5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhtA:A3k03kHRJV
- TLSH T15725AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 940KB
- SHA256 43f03177fda9d710bca8d8ae5bfed96c008da19083c2be46e69aff6ef5d4136c
- MD5 4cfc1b8402f71254dad2d7a981e80039
- SHA1 ab6636b5274a06559cf937669c08c9fa8f2bdf50
- SHA512 b18673b7f0c63dd746b76959cd97c443b2fa6a7dac8e8881d8517001c74c50f5f4add9b2e785babd50185b764e2a5628ca36da94e9730de94be6acdbb05f072d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhm9Q:A3k03kHRJU
- TLSH T1A125AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 940KB
- SHA256 661b0e7cdc28f4e7baea7b312250213b30fb458fb5531f43c0430df978272764
- MD5 b4592e0c9269dace0ff4176b59686034
- SHA1 a28666b6ee199b6d897fdd439b27ff9ed4f4beb2
- SHA512 716b18ce9ea12f82e84a09c9150ac5d3a31e15f6f0412229ea55fe928d180b901749798e723065f2bea25bafd3a6d1bed8606d13564333881b6c646f499e52c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhD4:A3k03kHRJf
- TLSH T1E625AE13EB9500E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 940KB
- SHA256 42bfb54184ba16b438008304a1300443fd368cb6ec2073040ec8811f7c3cb667
- MD5 f9a253a237fa808bbbfb1197373f58d1
- SHA1 2367241462ddb7fce2940e17300625a0833942a5
- SHA512 cd8c3c084af424892ac3977205ba7281f7b45b6df13b3b6e97cc1b67b4af2758021560baedb38ab86d9371e4c7aea316ef3139de9197026c6e380801f7ef6b45
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhqu:A3k03kHRJS
- TLSH T17E25AE13EB9500E9D10AC174AAD65A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 940KB
- SHA256 d60bb6acbf2f14770f2e82ad7d1bb6c8c07bd0e7625562960f43821c436c2923
- MD5 193c7b5cff0c17e887df9d4b438a54de
- SHA1 d146ed3bad28549502a68bc13d7de4f1664da478
- SHA512 1d861dab1ead8b84bcbc99a08c580a04cbfca2de20f77563f09f4c3c0a980e76a948c8a3f3d69b246f02ed649677b3f25be5789ca7f14596c00b937430ddebd4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEh7j:A3k03kHRJM
- TLSH T17425AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 940KB
- SHA256 fd810be525969116453348e6703980f7b787147496b1cf22f1c00e8f04dc4510
- MD5 29edcdc21c2643bfdc481e76b7df580a
- SHA1 f246e2acdb689e7345dbd82d0b33e72dfef09a01
- SHA512 2b0cd06823fc7f9eeaeeebfb9f4833e84243f1a40a1b031196d7de06b1a8dbd7611836dd6277db6d5dd6d84e5597bc241d3d937111b4e32d6bab8b6d20165c3e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhGg:A3k03kHRJE
- TLSH T14F25AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 940KB
- SHA256 5884a3f3c150cfa0623f11d1951774e5e6526333c956561e15ee4d0b33213767
- MD5 abb26f6eaa293491b46ff992d946be0e
- SHA1 80815127918c956ddc32066fbe90c24ffcef59a3
- SHA512 54556c5750e6cf64b55551411d85f8482101f398b1d417c03029dbbb765f3be9656c76b99f4b69f7a6fa3a1c50b7d91c15a64b6502cac2bec50ddf5565c20b71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhpI:A3k03kHRJt
- TLSH T1AA25AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 940KB
- SHA256 cc115e36104091e5ceb6eca2ab5154125cba27fdeb504ba33e55b62356358a7c
- MD5 440a724ee35080af34aed8304c290d18
- SHA1 9f688f581dddd825c33ef9bcaf6d26c4b36a9789
- SHA512 22ada70ec09a640a82f4f4743191f8331a5214957554c44b956480817569f9838659c91f051cef8cff14e6d63da626edb9c72b57b8e823b6cd7eef9131656480
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhLo:A3k03kHRJL
- TLSH T17725AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 940KB
- SHA256 75f96568c42d4249657a0045b2043566c7f962c36ae1f577df451cae0144d64f
- MD5 083432a4fb5ea4057642c772d0e034bc
- SHA1 9fbba54daebc28cc5ccd0d9fc8889b938014d306
- SHA512 b7328714682155cf465948524253e3b09f0f57ab1e20ecad54c5a3390b7d9fcc607c2ddd8f7114eb176b02e4a1270a5a7c68665cad395b8dcbf470461a99dc29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhw+:A3k03kHRJO
- TLSH T1E025AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 940KB
- SHA256 6d749cb75f57d48ae52060d1b72586d13588c514124627e0bddc77a6f129f1a4
- MD5 8ea5dd1470093bbe0bc95ae34a2bef3a
- SHA1 597c4ec229433f2de986947247aabecd6d915444
- SHA512 e5d6053e47bc79dfdfd4058855c2dc4ec1f7061725d53ffa888836efd099c9c77c4e5ec76ab5ed6391b4744e44ebc441a93cd026396e05cdbb273b61e3c131db
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhIQ:A3k03kHRJ6
- TLSH T1D625AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 940KB
- SHA256 3aa90eef2e78cd9f83db4076e9d85651cffc1a63e84462eb640cf4ecf5d73b90
- MD5 c3bc3e618ff99902b736f47e3fe5bd8a
- SHA1 20cf62b11092ac38e31962e67fe17b7406eb843e
- SHA512 e0e4f55dca4ec1f2a7ae4fcf38a072f0cdfbe9d92879c0226217812b7726982abd91ad2f6ca7962dbaa29a836181804297a8fabc10ad7e4b45b6b96ca47409cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhBX:A3k03kHRJq
- TLSH T18F25AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 940KB
- SHA256 f37896e5a8c273ef35f3f2447fca03f374f15cd728c1ba2095e12c35f77a4609
- MD5 6123f3321c0b8959714cfb7d9329d338
- SHA1 8e38471aec17a1a6bd25184d1c3c6822e405da62
- SHA512 6e11605e915fa29d6d19bc3f9afe6f9988b5bcedfdb7d063f962baafe4f9be57d400faf4c775c3a4115203baebe3b25a3d6ca472a1803aa1d4c3978e0e4241cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEh7L:A3k03kHRJE
- TLSH T15925AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 940KB
- SHA256 639370e2fe76372c6b3fe621cc57592e406046c06d9147edf9d7e02bcaada0ae
- MD5 05b1f79333acb652804ea2d749c09748
- SHA1 62a8a7840661487ff11a06378c6df2103a0480a0
- SHA512 d0827913f8ea1f5f6c573b76877881e45a0c68f5e66b4672241e3b71d6f380c9e5e8aec721ca46d28adfe782461539262f01ed78c824e472ed4ebb60179de6df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhBM:A3k03kHRJF
- TLSH T1E825AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 940KB
- SHA256 b32c3ca17288459ba23902d533cbc0923e247fae863067243c9b01df2a517096
- MD5 cc70602466dde68abf02e238a8739652
- SHA1 b8671e17823ecab22c9a0ad9a06fc5f7896c4eb9
- SHA512 3d496603d185b552881b4bf2eb9f88ac188f3fd68cf54d96960e7c49e3b4afc25143a67103786190a533f92855d2fed4b250b718206073ea4e21c373d2fc071f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEaEhqh:A3k03kHRJf
- TLSH T14425AE13EB9500E9D10AC174AAE65A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH