Analysis
- max time kernel
110s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/08/2026, 01:10
Behavioral task
behavioral1
Sample
2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 764KB
- Sample260808-bjs97azvfy
- SHA256 cbef93baad7feabb708e1827a6fbb348828f3ec0d7a4244dbb0d5620457074bb
- MD5 71d1da922e0ac350c37da6cdecdd614f
- SHA1 dc0172cf1aba1e55cde4e7cda297e28c97906dcb
- SHA512 e5f89f99e434afa629df10f99895adf1a4c7ddd6bf4cc5aa0a60dd86fcba1c798a7bd12c917c35068ab89b974f43ca9489cdcf465916b45ac48e92d6d52123f1
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0lba8KaEpNa:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEe
- TLSH T13FF49D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/532-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c431-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/532-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1824-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6b-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-306.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-445.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-604.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-702.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-734.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-748.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1069.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1118.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1143.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8b7-1375.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8b8-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8c4-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001d000000018890-1550.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8ce-1557.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b0-1858.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c431-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e6-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6b-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-306.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-445.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-525.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-604.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-629.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-702.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-734.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-748.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-828.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-878.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-911.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-937.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1049.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1069.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1118.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1143.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1174.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1188.dat aspack_v212_v242 behavioral2/files/0x000200000001b8b7-1375.dat aspack_v212_v242 behavioral2/files/0x000200000001b8b8-1383.dat aspack_v212_v242 behavioral2/files/0x000200000001b8c4-1391.dat aspack_v212_v242 behavioral2/files/0x001d000000018890-1550.dat aspack_v212_v242 behavioral2/files/0x000200000001b8ce-1557.dat aspack_v212_v242 behavioral2/files/0x00020000000066b0-1858.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1824 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe - Drops file in Windows directory 24 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 532 2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1824 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_71d1da922e0ac350c37da6cdecdd614f_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:532
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1824
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 764KB
- SHA256 cbef93baad7feabb708e1827a6fbb348828f3ec0d7a4244dbb0d5620457074bb
- MD5 71d1da922e0ac350c37da6cdecdd614f
- SHA1 dc0172cf1aba1e55cde4e7cda297e28c97906dcb
- SHA512 e5f89f99e434afa629df10f99895adf1a4c7ddd6bf4cc5aa0a60dd86fcba1c798a7bd12c917c35068ab89b974f43ca9489cdcf465916b45ac48e92d6d52123f1
- SSDEEP 12288:A3ZUnXoZ643ZUnXoZ6irWcRGJlFoL0lba8KaEpNa:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEe
- TLSH T13FF49D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe$
- Size 1.2MB
- SHA256 1e0d01c85e97c9cc3aa2a82232f057c5166a76eac956bb12feb853c2ed705381
- MD5 66416ebda687cc01fb9034c30eda5a7b
- SHA1 8808136454138494b49c79ceab8d0818a4f5b197
- SHA512 e443962106c0ab4d90c81cd3a988776a363042a19bc2bc25568d81f87471dcf05f06e1609b136b14cfb3b1d56bdc9cfea0c521da526844dee7828c93477765f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNawTWaLl3z0zDeO:A3k03kHRJ2T1Llj4
- TLSH T1CE459D03F3D404E8E567863489A58A22EA767C550B30DBDF1398A61A2F337D09E3DF65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_116531\javaw.exe$
- Size 1.0MB
- SHA256 347a595e98387aaed2f4078e11f85c6bcc40853d2ff4af64d462be4321897827
- MD5 12f967d0ab9ddbfcc7295da8b257812e
- SHA1 548f8c7ca819a4bb41659e6f2c21dbfdc1a66639
- SHA512 4b3f42072e24644c7186f4104015a3b5fa779840613e18476b604f16a9b4f071f29b03fc2a2520f1e090d912cbb34e961511be8064f6227eabadc7f6267a9e45
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNawTWaLl3z0zDD:A3k03kHRJ2T1Llje
- TLSH T1BB35AD13E79400F8D55AC1388AA68A22EB71BC560770D7DF1364A6162F33BD0AF3E795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 863KB
- SHA256 6de5e9c33ef3bcf659ea0f3b53b958b6c7e77175fc8857e19618abb60a471e1b
- MD5 6bae40ea3f716c9d76cec51119c5bddd
- SHA1 f5e13d41bda6234993d082a9935f41a5b8235fbd
- SHA512 e1e90b701e2e15f3afc951d83df53b509a965779357b85744d29c4860e8133e2cb2870aba5d5ff7f5c3e41d3bf85520e1d61facccfb07a98afbe20326352e45a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa82MqDBxc:A3k03kHRJ9Mqlxc
- TLSH T15715AD03F79400F8D15AC1349AA69A32EB76BC520720A7DF2354D6192F72BD0AF3E795
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 e5bef2d5fe16ce2fc89d742c15334d6927f9f71fd1a66a382deca867c0768e44
- MD5 6df5126e0f0bb60daa0c9e6723d4e061
- SHA1 d75594b71a5a278d69e3ec8832df5e220fc2241b
- SHA512 e1bb7872462aa693ba802762cab4248847bb304259d76a1f0757c2d928cb7f504d55a17d4080b20a255cb348bce6628a89473d855b1e7f96e110214c120a8382
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaP0Le5ji0hmxNrM:A3k03kHRJVPji0Aj
- TLSH T1CA558D17F6A402B5D067C0B9C6D6A65AFA71384217309ACF1394D7283F67BE19B3A331
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 779KB
- SHA256 8c6ed58ccf68fc9cf9c0acfc337d6b82440c934fe4c78dd694bb62277d7a1ab3
- MD5 690b86e489b0cf6ab6789f5fe3878cc0
- SHA1 9b06f16e7d0bf2c2f5be13d11e1f6c518252d0d9
- SHA512 8ee74c5bf6997e881b6a18b9d3a932cf5ed3dfdeb9869261310ea2566f1a199f87e2cc255c04487ff28e9e2bfd3b247a6f81c24fa1ded84d96fbcd7de2af7ce1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaRa:A3k03kHRJ
- TLSH T1D6059D03E79400E8D24AC1749AAA9A23FB75BC511730A7DF1368D6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 812KB
- SHA256 6f4870f6826c85fcc338f01e24513b9674d7975b63b56a6382df26389266bb68
- MD5 50dfac7f10d59d0867470ecbcee0a51b
- SHA1 48920ec2212c8b6b3349594b7f51c03773ec4e7b
- SHA512 e0cbfa46f5e76256a366495f7d4c35e6079bc37d617435e37e66b24788d5783e457846593ef437f30c6178f53f3db42e394c49f19159ba941e94ec067829cbf8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNayb:A3k03kHRJ0b
- TLSH T144059D03E79400E8D14AC2749AAA9A23EB75BC521730A7DF1358D6152F73BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 788KB
- SHA256 284512a33da9955541b66e4b01e27a52c66106159f1f206f51ca8ed8c851dde5
- MD5 cb72ddbe5458170441789429204e03ae
- SHA1 c32d86d06b90366b08f3341b2d7298a528e1b87f
- SHA512 1a59bf961083e9b5a6c81eb8e36c5d73619d7bdf367089ffaf307082970b77a7344e9a0a126748840e65120cc2b35f50e1044acf58d04e87f1ca1112fb0d649f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNavC:A3k03kHRJE
- TLSH T128059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 788KB
- SHA256 1ac76fd134aaf297ada700ee0d0884fc410d5b98448b8d8488726c5af5c73868
- MD5 5d36c7e431b7e0dda3d77954cd2d4bed
- SHA1 d8440f68887894970cd8807583ba3265b76a48d0
- SHA512 8c973ad0a0984db41e56da1f95d9c13f3e0074fcd39256f1d872c1e41c0763aa9708dd3dd10e0c1bba345ab75bb30b15900a186fabcfbbd9233e4cf347b39724
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaQw:A3k03kHRJZ
- TLSH T130059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 788KB
- SHA256 cea31f30f2024e65a3001683c0a12878509138cdd89eeff8670f86741ff9562c
- MD5 9e5993c463dd03427e1f3b9389cb4388
- SHA1 4881ddf3b99123bb4732b3cb3933189a80ea3126
- SHA512 356f390b2caae9012a17809d0e366de5c71565e4897445ab0fbb74198360b00afa13355024fa24a2a67973756e3ba8a2e38bf64d4197f59ccb8d622848aaf304
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNavT:A3k03kHRJN
- TLSH T175059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 788KB
- SHA256 d8a3af78164d7f9b6ecc1cbb4940c316562d93a972090850a590abcd1e3188ca
- MD5 58d9bd8cca5e928f07e0e35bc618656a
- SHA1 1a35f37b1d2eeaceab6051bef08d3dfb720f7383
- SHA512 638e8b6eea4ac0df7b78840f57af45a14a970534fafa1468dfb5e453c6fda2e341b1d5abcacad921fc3245f9b3650a482bd28f93b6a291d2ab627e104ee41552
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNapu:A3k03kHRJS
- TLSH T118059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 788KB
- SHA256 da51deef070b1ac6e5ea76cfb38a2014fbbb60b2b253ec36b992a10e29815acf
- MD5 d2c38a16e4ded43e2387b0515b24f52e
- SHA1 f4d2366d352684cc85d16f6524c647c1c6891f28
- SHA512 20a723f15a3cd31539c74ba344a1727a60d0544fe975aed70420f8d0071a8bbbf564e4b3c4da78756de8e26650a3434fdb3ee42f9ef6abdfee81badd61def0f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNahb:A3k03kHRJD
- TLSH T158059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 788KB
- SHA256 51238fc09e3b96cd201b53027000eb3bd6421131571b690d6f2fb38b3f77c605
- MD5 35894380228ac8425e78efd725228471
- SHA1 4afc253c4c20a47528bb61792c171e17e6fbe6b1
- SHA512 750952b72c557445eabc32f3b0eabe8a09bcc40925e437427f2003cd57d65a4d5db685b2df3a941a657491aa74454d656385bf9ece2880d3ad743549dcada54e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNapf:A3k03kHRJ7
- TLSH T1D4059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 788KB
- SHA256 21f05e56287553df4012aaaead901f66b4dff000e1a4d4921acab9bfeab5526d
- MD5 68471e8728f6c20ce096f6fde479d27f
- SHA1 a9dcb23df648d5ea9445f9619422907a2c9dd160
- SHA512 90649d88bd05adb056be03dd6de5acee8bbc1497343ec8d4b0d9a1c6389cce4be1a06815b63da5dd655106c117688d2409ffdcba799f42b034711347e976dbc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaSK:A3k03kHRJr
- TLSH T18F059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 788KB
- SHA256 97ce266d9da0fb12884c42968f0c458a06782cd459e2326710168246b16dd083
- MD5 5fbf296849f9539c80fbd6fd5861bc3f
- SHA1 3f12eef5912983a055ee2b7a3d722b83933fbe30
- SHA512 95116492a17ec7394b534325d5d4e4c4b95fd78629d03f6f5e60161c034f41aa6e504c5b59330753f5b22cdc1c6d50a870d8da90f3d2543d8fc0a223bd876fe2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa3k:A3k03kHRJm
- TLSH T1A5059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 788KB
- SHA256 9c60ee73618081923f9cb34778430a7b3b169ac682d6a1153bf0c3cd339b640f
- MD5 a7f058dc9a992396873342bbb2585900
- SHA1 04f465e975e80b641c0025cbadac63d7729d18e6
- SHA512 3104750c001eaa39f6fa277c36f752876a70a7371dbbb902212bdf1c12665d2f57731ef183f5b9d41055924af65d6345ac29738da1db0a04c669a5a434ce1bc6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaA0:A3k03kHRJb
- TLSH T146059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 788KB
- SHA256 79ef7f5a353db5c95f93525a2ab2506d58318c1b1429180dae3026236f792d3a
- MD5 8ab882c5d5ecbff685bfa9037e8f1296
- SHA1 333f1e4c6e44cf9a2b947a477118f0a87ad06eb6
- SHA512 c94d7a2c40d05547629fed62143f8bfe6744b6c22b49416209cad466c51126ec334c8de9ad8ed1fdcc90520d8d026b52d5c4e8ba15370c7bad847f58f19783f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNabg:A3k03kHRJu
- TLSH T118059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 788KB
- SHA256 f5ebe04ab116cd436314f0d921e96dd3676cb06594fdb52870d076a3fdf25610
- MD5 30f305b2823aef30763f48e9726621e5
- SHA1 c49e17bd87e83f5de027b588f9a6e790262276cf
- SHA512 d50f95a425d0de54db5f265c146faaeb240784f7f361689d98e1146ef2bc502ac0fa514b007c0d6fb093d6506ddb6aba18c6bcfc7f39c68961a718c8f436f1cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaWr:A3k03kHRJw
- TLSH T186059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 788KB
- SHA256 419bd6c6277dd7e8264b219d6b0acd3bac61c29923d2b089be7d226a90b7467d
- MD5 9651ccec99b3256e3cf3467cf09af2fa
- SHA1 b9ba512c97cfcd9897af427ecd505b9042f0d104
- SHA512 72cf1c53bd12644fbb18f48486e85f7e3b1ee18b393b809890de73bc06a01397c938320e07718bd9c798c55ddbfb43980754d96fd9718b1f58d2f308e06c75a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa8n:A3k03kHRJi
- TLSH T1CA059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 788KB
- SHA256 58cd6147f7a3a2875d1b73d0e52c08e8e92f037eff30e36385473eea1e985dfb
- MD5 ad95ae1d8de9240735b0cd7633677b37
- SHA1 6cba33eeda98b0f9e5b4728a055f9d8ae1185be8
- SHA512 2f18732459beabfabd3bd9e3e484cb576c1e7b1374a3c7df0c49d2e1f69598a4c75dbb784d62dae640cdd2c8af5d03c7feb9da1cd5ff5736f708c6a356ec12c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa6x:A3k03kHRJQ
- TLSH T1A2059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 788KB
- SHA256 2e74175594dbdcbcf50c59eb6320ff69cd61e3497c65ea62abc71f80101fcd6d
- MD5 56738a0c66b92ae33c9781bcf2495ecb
- SHA1 de797b3fb024ae30f603b965f65c94fa0c42db57
- SHA512 1d1e30374315659722084095ac144cb5071643ef5cfdc54c08267967656b7fd0594b1658e9397dda57e0b2f4301719ebc4e9b8db4e255d1f95aa3a02d333a0fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa8A:A3k03kHRJz
- TLSH T12D059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 788KB
- SHA256 1cde6cb910332c8504018dfe613e23be995cbd010524f992f2f91d592b384637
- MD5 b35885effa6b110a07a70dd2325aaa4e
- SHA1 87621886a9db4307cc2be1becccb6e5fc1d4f6bf
- SHA512 dd964f849f1a21871de9c1d7beb1104b10a1c70e99e3096552aa31a36f8482d0f97220c1f1f8c2cb2acd175d37c58dd0e90370e112a17c160eab5fb9ec0dbcf2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNal9Q:A3k03kHRJe
- TLSH T1FA059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 788KB
- SHA256 22d8a519bd1e9fb9b2b1fbe7f5d7f511675fec7dbb0b8585fb6b43632effb924
- MD5 5154d2988429b91f20854171ee556de4
- SHA1 ef84524eee6fd901e91eeedcc354aafcce3a4e4f
- SHA512 bd905fbb82405b03bff35ad9a75f72a033fef946bf4a7250c2b8b241ae4301554c30b0a796a56666f61ecab53eddac4292a115ac6d6e5125d475edbcd7c62e14
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaQ4:A3k03kHRJd
- TLSH T170059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 788KB
- SHA256 81b6630deb97b8862291e485c5b6da6958c23889d69e11aedc70124abf6ca0fb
- MD5 b62c60777bb69b71b09596ffea50fc0b
- SHA1 658dbd2d1bd20ed837351e4ebeb94f53387f9297
- SHA512 984927bd1e822ea3de054fadcacb6b5f2d82366c9db03a5e1f9b47bc1cbdecc13fc3b5ca281c9aa5dc2a5ed527971058bdee4086aba8fc37f9f6240794646c97
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaTu:A3k03kHRJ4
- TLSH T170059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 788KB
- SHA256 6a72693c50f0d0429c4ab04d51eafa1fd0190a5cb0208004c06f0c21bda572ad
- MD5 0b96dfcd3b5b6d784aa313cef01b7d12
- SHA1 aa5acac3f9f9c6b0ad4cde2232c2c6225265d0e5
- SHA512 22f7bc7bf49d53cbac87db3e0c3909272988f1aea7a34803cf4ef4431e73292e88b962e6f0580b1b65132bb33ebd490c386fbb1d23715497e93b89cf34014798
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaOj:A3k03kHRJS
- TLSH T124059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 788KB
- SHA256 415d97991a3aebcd391932e2a3d7262f03b472f2209322feea9e9294c5097ba6
- MD5 41fe77233119c7e6ffd6d53bda9ec317
- SHA1 887e106a4247b9994fc609e801ce89afea03c5ba
- SHA512 dbe9666612e806df5f23e969eb9a643d8f527883cf4375251ea897240a7092f370fb4559be3b7256016637f18374a6799d1b2431704a74b22fe7d58154514e6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa7g:A3k03kHRJW
- TLSH T1F3059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 788KB
- SHA256 d69469e8e097053cfdecb6b24212ae3f0d6c5b71e52df0b240858a155a35c117
- MD5 bd4606a1763a8db4347b52426972cf3c
- SHA1 4f8255a7f386ad373c3a4dd66df1cd0fbe20313a
- SHA512 aed48927e4a426076daf8b6543b838f12e3438fd0d23972ed622ec33a403a32fac7b0c5de1c5a7cc34ec7d04f650d6cf59e97873372c620c79cea4a5a6e99f8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNamI:A3k03kHRJ/
- TLSH T1C8059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 788KB
- SHA256 ce48858b1465aa41feba0b0a1dff618a42d46d336df8a38d8aa9858096d2bd8d
- MD5 87eb0dae51736c6710aeca9997866bc9
- SHA1 b7d207e882a7f4192d7edc9134f0f8385f1b6369
- SHA512 fc8f7a5e6a45e830d34b00f4f11f201ebef886b0b7ac13531c4487f80fc9ba8249786002f2fa848a89d9abe25318c9ca44d755c54befdcae639b591000fb255b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaUo:A3k03kHRJp
- TLSH T121059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 788KB
- SHA256 cf263a974d2e1999122ee3408587113459c5820a42161fe8962cce1e655f8e87
- MD5 128d84bc1a24a0fd40ad0b40f0aa1298
- SHA1 deaad19a0708eb54547e072bce08fd044e3976f8
- SHA512 1fcbb7e86e560a9f374c773d1f5a647cb784ed65bbd3a0bc8d2a7ead0d4f3e205be9ceec28a91c0fd26879dcf06526710c8bcbd0fc834ae004313d605a57e81a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa3+:A3k03kHRJM
- TLSH T1DB059D13E79500E8D10AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 788KB
- SHA256 2c49ec4cd2e7be58bff2aa19eb6494b319103ea21448fc0e06b49498df0872d4
- MD5 9d653d7d86457b7ea26e1e3123cedb42
- SHA1 748e4288b072e2cb9952fc125fa75de27c055f8e
- SHA512 96bd570b44594ae8271dc03128203cfee072f3015a758433df8cac1921380a90a3111f880131fcf375f1925cef3b318e5b795ff42d7665e110aba27a27c58994
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaNQ:A3k03kHRJk
- TLSH T1C8059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 788KB
- SHA256 a28cb3e56da54051ea346432a9e428c7659eedae89514db5383ce3fa62b4d256
- MD5 c1d94337dbe4cb209b9daecbe822b5cb
- SHA1 49dffb4231db77d1d3b70e1562ffd346a77f9b4a
- SHA512 54e54f6f3a28765fd43a8b47f0402f19df03781e5ff7e0114a97ec530b0a1333582821b3c2ede1742070c5d6edf7689599fa26958a945c7c7d245c1d21e95d5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaCX:A3k03kHRJE
- TLSH T187059D03E79500E8D10AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 788KB
- SHA256 dd758a6ad3436ada4dd1d8a84de569ee24520b17b1c641f0ce754bbbbb45acb9
- MD5 b251aecbd8969dbed0de672fa56631eb
- SHA1 4df02d61f0514272095ec0f4043e462f03fe7777
- SHA512 0be7e5be7eb070b7d717487c4906b26f9f6aa073df78206ed72766e33f7b6c63b1a6956b5ff84c33e11267f32ee14558d8acec589c01db2a52631501e3ec417f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNakL:A3k03kHRJe
- TLSH T156059D03E79500E8D14AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 788KB
- SHA256 20864720aa1365679eb3bd3ac6475e2fdb955b7245da441f9f172f9421e4b1ba
- MD5 f101cd709bdd7abb7e5c8cd37263dc1e
- SHA1 b8dc906250a5df313ee36d2facc7684094e003e3
- SHA512 d3f190157b3cf5eeb1ca1195d4250acdf364cf26319255d710ccdf061404188c6c8062617518ee3e761da52701058ea5e0a17b4e4966a38cc00adf43b25f03c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaAM:A3k03kHRJr
- TLSH T117059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 788KB
- SHA256 87bdd5a803137d99f977c5d45e780f0c276b615df2d78f951f7cee88fc455a37
- MD5 e3f05a9dd6457c36f070c172bc20678b
- SHA1 ad522af65ad4560dc3a53dd4c0d87933f367d6fb
- SHA512 07309388dbc5c844956be7acb4ac17bfac0255ec110cd86a23a508a44376d7c7d9d9610d1b3477a16284e8667e7bb748cef83f141bfd4f6887a4cd55543dd4c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNahh:A3k03kHRJl
- TLSH T180059D03E79500E8D10AC1749AAA9A23FB75BC521730A7DF1368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\pingsender.exe
- Size 847KB
- SHA256 1b02953ea67f7cce1fc4e472543b818f027cb73c529de4026aafb0229e59a11a
- MD5 6c80bbffba1d7abed7a18f4b54f9c192
- SHA1 f77ecc38beeaf01eb5b6dabaffee496f306ed144
- SHA512 274d424100a36dcfae6f343f565803ac8ec446015a254e49c712be5882d68d231cbe7251d01ea61f1755028eae8a6f99b5cefd84158d80db7ee3d540f9797de4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa+1:A3k03kHRJy
- TLSH T1A1059D03E79400F8D14AC1749AAA9A23EB75BC561730A7DF2364D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\plugin-container.exe
- Size 904KB
- SHA256 d21b77a6b3ffe7959e3f0c785d304724eb09ae2c8af23ac026829a5008857d1c
- MD5 999c33d502d75b529d366f6fcc1540f4
- SHA1 7da9e0ebd481996773b4b3377f4df8af28ae4d8e
- SHA512 83405b85fd56f097d5c7c2f2db7819a1bdd466d1ee2d6160bc4f02fc7d083a9ab4f6602442581d0c34cc730bc7700d98f5103b7483524c630061833f8ed6bf4f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNaL6Iam:A3k03kHRJF6IR
- TLSH T126159D13F78900F8D14AC1749A969A32EB75BC560730A7DF236896152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 829KB
- SHA256 f67da671dd8803ad18e4005727605fc5fb1f381d4eca274146ea99908dccb9ec
- MD5 423d8bf9faae771f44176c73910b7b6e
- SHA1 4606c780d0d8e20e4ee76c5bfb8c7c2b9684bdd5
- SHA512 b79f48c8e63df703e9ca6b0b9f0e12367f0d5aafdf4fefffe23f82c84894edadfe7792ac5cd9bd4e5cb32c8ae6d4007ab6e99476353a9466fff2e4c5b5a4cc83
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KaEpNa2p:A3k03kHRJUp
- TLSH T16B059E03E79400E8D14AD1749696AA22EB757C111B3097DF13A4E7292F72BD0AF3E3B5
- MD5 SHA1 SHA512 SSDEEP TLSH