Analysis
- max time kernel
106s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 10:55
Behavioral task
behavioral1
Sample
2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 907KB
- Sample260810-m1k6passbx
- SHA256 58c41a98ef4794524083cc85ed451fe9841c2cd7d9f47643e1df75f73e5342b1
- MD5 05a57f7e0bb590610400a4e1361820bf
- SHA1 b25396feabb95a13ef6baabf52362d1d823ebfe0
- SHA512 62d1ec8fe389c331237f0452045f925ac253828995a23d864e41b2e2b7bc8978f524acac81ffea405e04c4ec38e66f18dc498f8d2beb5af4781bd276eae69755
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuC:A3k03kHRJN
- TLSH T17E15AD13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/1136-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b815-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1136-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1968-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001849f-107.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-283.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-471.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-594.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-710.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-827.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001bb2b-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1098.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1326.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1358.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1402.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b815-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-59.dat aspack_v212_v242 behavioral2/files/0x000300000001849f-107.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-283.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-471.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-503.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-594.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-631.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-710.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-741.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-827.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-879.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-911.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-924.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-937.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-956.dat aspack_v212_v242 behavioral2/files/0x000300000001bb2b-1011.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1054.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1098.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1142.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1173.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1180.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1187.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1326.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1339.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1358.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1377.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1384.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1400.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1401.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1402.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1968 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1136 2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1968 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_05a57f7e0bb590610400a4e1361820bf_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1136
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1968
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 907KB
- SHA256 58c41a98ef4794524083cc85ed451fe9841c2cd7d9f47643e1df75f73e5342b1
- MD5 05a57f7e0bb590610400a4e1361820bf
- SHA1 b25396feabb95a13ef6baabf52362d1d823ebfe0
- SHA512 62d1ec8fe389c331237f0452045f925ac253828995a23d864e41b2e2b7bc8978f524acac81ffea405e04c4ec38e66f18dc498f8d2beb5af4781bd276eae69755
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuC:A3k03kHRJN
- TLSH T17E15AD13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 b239d656d480c2a8eb75c98803b84ec93e5564d859a361025945f174907c7044
- MD5 5783e5c7bb7256181e73c3d3fbb0621d
- SHA1 dddfa915bcf44c8e9282dffdb2c6b586261485e8
- SHA512 b6822499ddb5d8912f5ca2c45410d098895095a5c38fbb0e0dc35a973fa7e52308d74756c3c69c0d20eded950064639efbb82258bc0ce4d71df8db0722b65fc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuC0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
- TLSH T1A8658D17F6A402B5D027C1B9C5D6966AFA7138821B3086CF1359C7283F63BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 954KB
- SHA256 9f57788ac728f67fab232e11dfa05953135b0fac2fa382224bb01d99b182317f
- MD5 5674d3816f90e377f9e3ea55d2f415b9
- SHA1 a7e2b6f83a23bed94233649c73880b06e5789e03
- SHA512 28c9fe34c2dc20443be85fd45d450768a40588b4b4123cfa20212c854d728268d0bb4df42acebab5f0e758bc7108cc4fa41f893b02e24f6b213bb9979668518a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINunb:A3k03kHRJIb
- TLSH T1D225AE03EB9500E9D10AC2749AE68623FB75BC56177093DF2358C6152F62BD06F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 930KB
- SHA256 6b9642da8911545394d3cad5191ba99454b72b2c2e1633af4229e965d0119e81
- MD5 7eb5032a74f6af5c11d20434ad97081f
- SHA1 886eb585c5744777697723527f75fb3257c14fcf
- SHA512 a94c5c46b8f3ca4b9e218dd6d642bde65b299d153f4af0027ab533424645f28b90452ce7c878cfd1049c96b411237139feca431823d55a561ddf08dcb9a97aa0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINud9:A3k03kHRJq
- TLSH T18E159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 930KB
- SHA256 9db367d88e6c8a997d14615bd6f8d48c127ba0841e9913024ae446d6d365cfc9
- MD5 27f13fae868d7e4dce261ef9279cb6ef
- SHA1 636224e635b3c75f810a3fbd396425a7bcc2243f
- SHA512 e4f0630f65e4eab1f8016c6b6b29b7842ba21c78b71734600c3e1cb0dc0fe745739a00de723f1066266c531a770dcd8f26ecdb2acb5a7ada535a7a761f44e438
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINu5c:A3k03kHRJH
- TLSH T19A15AD13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 930KB
- SHA256 d57953e3de3ad243161b4039d3787c934080803e0b2092257e279fd0ea17ef02
- MD5 240ad04b76b518135b530049a953b60d
- SHA1 36b00cb4b55df5283a23f49181395672bb9fcf6f
- SHA512 6dcfc119cf80b143b92fcc437960828d8f251850fde7321096f12d545c5b691ee72c18589ed5ab152d88f6c8dcc7fb4d7212b0d9127fb5534e899bc8fcaa3cc8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuyp:A3k03kHRJd
- TLSH T10115AD13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 930KB
- SHA256 a8aa7856139adf2c719bb397a2911bd113402a934555814c5138ee45d6a867f3
- MD5 1c69be3d909c85ffc7ad50391d3ffb0f
- SHA1 e20e5ed034231bb1f68f4330a003a16615e9dab2
- SHA512 fa0fdd7083c6c037e6144d34dad8ae20974d4754d2a483ab9c991db8db5e65d810eda3f91778608d980759772f91968064971f41d0d50062b8c5065b8a4e1e48
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuFN:A3k03kHRJm
- TLSH T14F159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 930KB
- SHA256 0f9610dedfb01a317feae2d15e892e79185677ecbf3b9a9802ee3b5f1ceb4cee
- MD5 5dd58dbc58e33581bc40b804eacc3764
- SHA1 029bab0753f98ca0999a82a9c281a87c1a411c02
- SHA512 ac5c4e8ac6b369de4189dfa5e1e348461c0598e1e66fb2516a06b3a27796a7328242fa54ff67c3e19b100308aa95511af1bfe44ad0e6f0cb115059440238d775
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuXF:A3k03kHRJE
- TLSH T1FE159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 930KB
- SHA256 0583f3b8c3ca2a84c56a9d2511125401d0fc98d401bd1d2f72288b89c26972cb
- MD5 6a87bc4e7d276c62aafd45bb6b6c6ffc
- SHA1 322af41b064aaf95f36cd0a396812f841d1a543c
- SHA512 a9977f307b9fec718e0c3ad5d5faab4994e2cf2bf6f37566bbfb1e387e58bb65518562cb14f62962cadba86e91f749470e7e1e4fe3a60d37728091c88c280a62
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuoC:A3k03kHRJw
- TLSH T13A15AD13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 930KB
- SHA256 93a5f40594705dba46f71ff9a3e01fe7c3eb122ffc5f171d702facdfc0e2f277
- MD5 e480d571248058739e66660502d6b17a
- SHA1 148620590f5fd839f51b298b74ce09fc9c04c010
- SHA512 b6ba83a107eae0da3218ea9c941bad30fce5f2d647e1d147c30f7fc6b71734aa9cdac338f327508eef62458a4276925b84f4eef4d57a6dd30e69974f141adee4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINu7w:A3k03kHRJN
- TLSH T1DD159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 930KB
- SHA256 1096800a37bc5acc2fafdee95a853529775a05fd8e3b6ffc1e31d549eb83fd74
- MD5 07e5b8e0cef25df09d30cb09b635ef8e
- SHA1 514e54f56555486fb5117d7f485fabcf281da644
- SHA512 56ebe400ede13c65078cb128c490151c4b499a769a0597c2847286a37b83a19ac98a15dc6397e9b0d8af31f84208c6e63b7da780f5c086b2adcdd3b94e019a67
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuCT:A3k03kHRJB
- TLSH T1A515AD13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 930KB
- SHA256 319945d6768c92aa1b2b4028691e42d3a97825e64bb2a5608ec70b5481b9ebc8
- MD5 c3b1a875369d368fda06b6b9b8fa96a4
- SHA1 05c4a7a2b87ced02f5c6ef271bcae7c0207278f6
- SHA512 02006e3015bdef6cac3465c900fd0bc5138a01f787dadf98c742a7fe66c6c06ceb5080aa2ce9c94c04239ad3722e90f865ea3304b47c8cf5638398ff63732a6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuSu:A3k03kHRJ2
- TLSH T1C1159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 930KB
- SHA256 414b805ca0d6c8df48b5e9dbfc4716c0bbd6b6ff310bb3b12bd9ff9031ecbbe0
- MD5 545e4374fb20da8e9c40656cbcea9224
- SHA1 3528d99a6462c607d214cd55e92d3645ae592203
- SHA512 15354b1939e5e0f5b9aff471337dae86b85b788a52789e7e28f7c0341dd18539913bb6f671642a343a3bec642caeaafac10d294adb9a3edd2b53bbf04f856d9a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuMb:A3k03kHRJH
- TLSH T1BE159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 930KB
- SHA256 43d998ecc6e5b32df66a64529db4a760638c4adcaac2f9c1e27bb34e909dbac9
- MD5 935fc8148417b709a6b128e33df17cea
- SHA1 2d209817d1cdcd6fd85391825723dd77d773a15a
- SHA512 4db0cdcb9afaa8f624cabec9871a87d8de4a264f90a54d89b4abecf30c1b7e0353e282ad657b003123140fc5b895b4cdc1c39d5bebdb1bfe7aea6a4c73bd31ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuyf:A3k03kHRJv
- TLSH T1A9159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 930KB
- SHA256 d24231f26866fd1c850cbeb2479570369bfe126009df5889b22e264311a1b01c
- MD5 76d6b13e3b45b896cfc4b38b252dc298
- SHA1 c569fd65cb8545b57ab86eb6e062063083a0657f
- SHA512 29dd15ab25c499a26ed0208d59bf4e6119f7e7aa7c7d8f7586be75b004636104fedbb641a123b98a1d77137fd5cf5636f88f74387968a262326aa5415720d4f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINufK:A3k03kHRJP
- TLSH T1D1159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 930KB
- SHA256 4991d39b2e87428912756c3bf9919fba97807246b19a7f242d51b3e858366765
- MD5 b9a3d472140f09a1b69d9abc7b9f6326
- SHA1 e79ff4b47fc23f4de902bcdef0a371ef97d0f7ad
- SHA512 59d03401bb8d44e38ab1e9b4f358c1fd6c8e89d04df765df2e7255d4b4688df6c83344270bdf3ce44a87d5d7010884d931d1e6c9226d2c4729fd0cc6474b83cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINu4k:A3k03kHRJa
- TLSH T198159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 930KB
- SHA256 8596d668b2ed5f621f66c68d819f45408dee5724dd1da0628e3ebfbbbbc10c1c
- MD5 bdb520a6d8fd4652f06eb95ce2d09bc2
- SHA1 9ec69c2c9ed043b210b67301f8467d070ff78642
- SHA512 2fa412ce27345c2628124d43e8b94130d10674ca3d14b44e7c201640ff3904f10ae27b2f626a1e7a4ae4af5eda1d3dc85858a87e62e326a2e3d9fb75aa2791b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINu50:A3k03kHRJv
- TLSH T13915AD13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 930KB
- SHA256 aeb5e1f3266dd906aa18eccc3e621ca84ca3a02c4ca34022e98c2f32ed617594
- MD5 475fa0ef4ea98e587b3824d77c3f58db
- SHA1 c031cbd7b22ac425e4bfa9d5338d5ac179837b34
- SHA512 fffe252b786b3e856edc93454019b48b103cf21655640d6bf35ed43423126c49ba702f6afb2bf82558e81685d6b78159af21a721b653f2a4ef10025830671857
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINusg:A3k03kHRJy
- TLSH T163159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 930KB
- SHA256 70df94d64e22fc93df041340002acd6831f655bbeaa9e42cc8f08398ae1b8a81
- MD5 0487e4bf3f069da36fd091baa4a3d14c
- SHA1 b06871d1491b62f3fc674f780cb7518c91d0b744
- SHA512 a9eb31955c34fb643bdc33202b0370e234475343880c37c48fe6f84237b59780036c5a0687e249ee6632083a214778fbfbbc267c9521a51bf3e0b35b36e0072f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuJr:A3k03kHRJ8
- TLSH T10A159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 930KB
- SHA256 adbea4f567ad3d58c2d055ad866a293a15ed4f218bab7d6544accbcfb06d34a9
- MD5 730181dd8f3732f4c7abf813813e01ac
- SHA1 3eebb178fdc6606fbc9828ce9e3a6b75b5b7886a
- SHA512 d51a59c0d7a37bf392b30454b7608d17a48a14bf5eae2a96badc144f52697203fdfb099a344d4e14a9093dce6aa747367aa4c37e7256626f4183715f577a6993
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINurn:A3k03kHRJG
- TLSH T19E159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 930KB
- SHA256 de6a279d21ead28dea7e9bc06a05e5bd528bc9b9c2e28c9e41c51e0c25bba3eb
- MD5 81c019c5fbf89bcf0621e2517499783c
- SHA1 5fe9e0d26dd975f8b211622556cfeec65d0d042f
- SHA512 f6afcaa3a846ca7527486d6115539ad9125b74caf2af4ee28c138cc9876b47eaf4c730d4e9694f7b756537b26fa4081c50f6567d5aef5583013374cbe4939928
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINu3x:A3k03kHRJc
- TLSH T1B0159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 930KB
- SHA256 e06b128f335bf061472074aa28cbf61f734013418a2f5f256fd50b084cd5179d
- MD5 04176bb4c0362aeb2b3c57cfc798467d
- SHA1 1580820dfe5691ec98a88668b5d501243d1c7159
- SHA512 7d2aeb0086b11330b1d99b90b94aa7cea9239d5eb3397207dd024c1b24a921c9e060e2f3a744038ee0a0a8680d13874bab452a9e5c9ea72784ffc9003b55a01b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINutA:A3k03kHRJn
- TLSH T14C159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 930KB
- SHA256 b876f2779f137a27f575ef7cb9f4b043338e7093616562b2a41a1c0fdce2e60d
- MD5 379c92a5b613bb1ee631c41dbf340afe
- SHA1 648ac358569984d38084454ccc32a80ed2e0f317
- SHA512 fe446d1aab75373e9168fea7a14b205c343b8250d895ea99669894356433ca1863f9c837356b5a7cd1fbc05e4f5ab3bdb1dd99189a3e2ec2f1dfa40159f34453
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINum9Q:A3k03kHRJK
- TLSH T140159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 930KB
- SHA256 2e48bb176b868504cd922d42877468a49989c64dc4b98463c64723a3fc6b3002
- MD5 59be3edb3a3d83f2e3fd8aa87f16c9bd
- SHA1 44081b10690e04780cf1593dcd22fa47334ba9e3
- SHA512 962d708e73dfbe1ce836366b2d02a258ab51351144a9fa63edb69b8536c13f6a16c73b2196b5db015826c8c91b3a8bb37d4157f45660001ae9a11c32c267b387
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuD4:A3k03kHRJJ
- TLSH T1D1159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 930KB
- SHA256 70b3679c1a19fa5519c3a8efb395d9eabf352bc51895bf8cf125ea8f063de500
- MD5 5375838cb895a7d7d0c720f48f52fe40
- SHA1 0363d1df925eee68aa481b93f7ed0c3d4cb3c864
- SHA512 02a058b278da9edf73620e7325173814204ac86d503c6b7e64bbc4d86ac0cdd4f7794951a621a9e6bfeb195cff0102995c9eaaa84f0b64e43b8f034ba76b4f80
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuqu:A3k03kHRJU
- TLSH T12C159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 930KB
- SHA256 0dd9db23c26c63aa84faa9956b8e8a83df4a24ef88d320751de62a472bd6ddef
- MD5 085ad5241a172572776d7a44034c0d84
- SHA1 6e5f6b97ffe3806294abf58067a93630dd848e72
- SHA512 d1851f49fad12c7e10c8ac880cbe6a131b32372f8393fdacdbeb2cc7a885768fe57e3279424851ddbc2c4fb541cbab167202ef909a2d3c83523a4780192d6e29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINu7j:A3k03kHRJ2
- TLSH T143159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 930KB
- SHA256 8311b7433a9536ac7f4f563054ad4581056cb455144fdd08e45079978f15a510
- MD5 5ab76ff9762437b07fd9d6134550747b
- SHA1 17a1bdc2bcd5353dec5fabd67b0ca676ed301a40
- SHA512 40826fff6568de2f2d692a99990baa40b322aa0b730c253745bde94a67b391a954d6d99fcc1acd5e6192d1ae5c1acef8cdcd200374fdb1af77e4fd31ef98e6f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuGg:A3k03kHRJa
- TLSH T146159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 930KB
- SHA256 2336b1bc57475964c0ddec6b98744e15df13f8f929050f1cc76a82c432cb1f33
- MD5 fc5a286b338a21f442a824130b5f1c9d
- SHA1 9dfe90d0f8a11bf67cd5aa11fc48c9b1fd330021
- SHA512 9199add7804f88b9eb2a5665b7188116cacba90f50d48d050fc35858cd19c4a3e870d26a1023fe9ba6d8396e1973b753a98d56379bc077ca0d7267df3579799f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINupI:A3k03kHRJb
- TLSH T13A159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 930KB
- SHA256 ea6aa59dc03091b5eeb8d2eca223d9a75e82b669fa972ca64ada3258b487751a
- MD5 40c4fcf74367cb4506e307bc03c5a3d7
- SHA1 85ad656218d85fb95cc5174bc23de44ebb7464e4
- SHA512 35d06d386ee356c818cb0f155b0b313e8d6c255b45bdd42daf9090784d7b161682e2bbd49b5147c6b6b269135c9beef444d1fd330f47b62045d5876a335ad087
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuLo:A3k03kHRJl
- TLSH T19D159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 930KB
- SHA256 66bdeed82a3a3ff524e1d972495190b3fe5933083a98af8c76754f398087e772
- MD5 7f2cee743d28db7feb6b3f6e05edaa9d
- SHA1 1de4b3740ce2410d778ff49bd1b44f78ad0f1a42
- SHA512 366289435b7e6506847255a10e59c0e8274153b93498f842c58c0415ccb30448e88ccac2bb047366715b30b7236fb072d33d450b5f965199e4c9e0d43ec77a85
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuw+:A3k03kHRJg
- TLSH T1C7159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 930KB
- SHA256 a706b45ef8da05420748279f8d61fc7a3bb2a7a53f160c2c22334a3da377962b
- MD5 2fcc891c9b72be73f356a12c7ce6abbd
- SHA1 1b4ad469e98eee7e5db137aa98a8ec589cd9eab2
- SHA512 294db2140bb564b45d2d53a1eff5c96ffdf7454e5690df51718e395efda847e566240d937a57be07ab8ed74abfc2fc3b187df0f10ddcdf6ece4ddfef705d8f59
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuIQ:A3k03kHRJw
- TLSH T1C4159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 930KB
- SHA256 abf22fdfdd952a4d1cc6f7711cf733ddab23db4054adc309a38f59e763698fdd
- MD5 30acd9c9989dcfbe8b7fb90864dcfcaa
- SHA1 66b2870703bed6b57735570e751d0051779e700c
- SHA512 bc8295590d68872c387406682eb3a1f0e97feb97c68f049c4c9965322d154c9e99001e19fcbbd7178be4681221396f0f911a30cb8ad36cf8b8118e1585835a9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuBX:A3k03kHRJA
- TLSH T18915AD13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 930KB
- SHA256 0cc92008cf13ff80001088c0c6ceb46e3011b9779a7d42e4bb18866d023c4499
- MD5 c92e2d6f0eabb69ed0a0d1b47869b20c
- SHA1 3f80ba57bea0e1f272a85e62d9296e2390663270
- SHA512 468f32a1f7d6688a89b61599844d807d6ce0abca5d51d5353bcf75bfe84dd94eae9272053df256b88b788df8867ee4c67c1050826ccec4a8a58cb6c1ff2dd45b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINu7L:A3k03kHRJi
- TLSH T165159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 930KB
- SHA256 b8e42d4508ffb7dcbc3f47c018b82cf22f143c3185dfeda8db2a92ba56687fb5
- MD5 365db16d509469c34ae7a18d70a51a31
- SHA1 c373d3254679bc77b285da2b30b3cf9df5edcb97
- SHA512 54860c5a6031397138c98cbfabd3b508780207f94215e8ba7d511b08747177695d7c23ce849702129b9658590027ace3f134eed9c581f00171d19253ce382815
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuBM:A3k03kHRJv
- TLSH T1F5159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 930KB
- SHA256 ec15d7e204d17d93d9fa8d65d68c21d0de84c981274df403fcf1e9861bb91e49
- MD5 fa18d44f96d8d3f10a9a89db3b67bd32
- SHA1 d3082e28bdcbdb63a72dbbabc4ec9f6654a427dc
- SHA512 d3d024ed21b44bc6d0ebd30f2c51186bc1c549dacec70dff0d1f2505843bb0d8786f92a998fe9926a9c79d4c3cfbfc5818dd2974fbbb688d8acfe2cdd635e33c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuqh:A3k03kHRJh
- TLSH T1C7159D13EB9500E9D10AC1749AE68A22FB75BC56177093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$
- Size 967KB
- SHA256 ee44208704aa177189fd9735f5943e31d566c195b50a5f5149d6c7bad2117f7a
- MD5 284a7d4cf5d22c0bd5016c59bd0b4393
- SHA1 f01ca622f0314f3cb3c2e0b4be56ec571b98fabc
- SHA512 bd2fbd42523e2493b82028212a24dc659dc48ed5fed8bc1bb9ffb8ca9a9d09bc52ddbdaa4168eee9be6539fb23229a9658dae54b229de1a19bb14b78e5e6665b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtINuLjv:A3k03kHRJID
- TLSH T1E025AE03E79500E9D10AC1749AE69A23FB75BC56177093DF2358C2152F62BD0AF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH