Analysis
- max time kernel
120s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 18:57
Behavioral task
behavioral1
Sample
2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 916KB
- Sample260810-xmc82awblb
- SHA256 84e8ccceafd3ee4ecbfa16dcc4f2487db286d39b2685140f49b803af712a4666
- MD5 1de6285f7a7435dc95438d3b6c7ea3b2
- SHA1 156133e36779bed7d6d9334ed125e3d9b0395eba
- SHA512 b152b81afd15ff86b009cf62fa0a68fd3e4a9e39a44ed15a6c0689e9d412a313aca4c212e5a6c6bed1a5c3a8eafae4a3551a787522005daee185b5de2aa6e184
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG:A3k03kHRJ
- TLSH T1B515AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/5180-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4c5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5180-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3200-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6c-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c1-431.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c2-481.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c3-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-592.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-860.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1043.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1094.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1107.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1144.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1163.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1357.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00080000000188f6-1482.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00080000000188fc-1531.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018985-1569.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4c5-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6c-59.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-274.dat aspack_v212_v242 behavioral2/files/0x00030000000198c1-431.dat aspack_v212_v242 behavioral2/files/0x00030000000198c2-481.dat aspack_v212_v242 behavioral2/files/0x00030000000198c3-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-592.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-623.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-642.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-828.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-860.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-879.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-937.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1043.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-1057.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1094.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1107.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1144.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1163.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1182.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1189.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1226.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1330.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1344.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1357.dat aspack_v212_v242 behavioral2/files/0x00080000000188f6-1482.dat aspack_v212_v242 behavioral2/files/0x00080000000188fc-1531.dat aspack_v212_v242 behavioral2/files/0x0005000000018985-1569.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3200 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5180 2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3200 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_1de6285f7a7435dc95438d3b6c7ea3b2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5180
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3200
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 916KB
- SHA256 84e8ccceafd3ee4ecbfa16dcc4f2487db286d39b2685140f49b803af712a4666
- MD5 1de6285f7a7435dc95438d3b6c7ea3b2
- SHA1 156133e36779bed7d6d9334ed125e3d9b0395eba
- SHA512 b152b81afd15ff86b009cf62fa0a68fd3e4a9e39a44ed15a6c0689e9d412a313aca4c212e5a6c6bed1a5c3a8eafae4a3551a787522005daee185b5de2aa6e184
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG:A3k03kHRJ
- TLSH T1B515AE13EB9500E9D10AC1749AD68A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 945KB
- SHA256 add9265d3f3453d9e3ab9fb159053f4fa8400ba4c154c835ff643c4206378875
- MD5 cd545a577e23d03745c5db2de66cc773
- SHA1 09b9843b724facd6bb0386729bb68e5353103f98
- SHA512 9b8dbbba278faaf444ea10bbe703a1ebd1f0e0f4745bf70040e06c006bcb6a593d8dc6b0475f50ee7a134ad7d3e217e0cc7bca3fa1a7ef9abd5bb8b5101fdcc4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGxP:A3k03kHRJt
- TLSH T19B25AE13EB9500E5D10AC1749AE69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 962KB
- SHA256 8bddec7082b7bdfb66201e833a8072c1425f3e7d73859ea9068b746833e01edf
- MD5 83b9e6fd60d8caf3b62cfc353cd6b0bc
- SHA1 1f7c255834d9921f051441b25e5e60a811116e41
- SHA512 16c654329257ef177cd59d36c7a5db8c99edb51c26d18cf503e8134a7b34339be912122a7160b7e15650203dbd95a92adf39d4e812f617dced1617f79849c870
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGa0:A3k03kHRJK0
- TLSH T11325AE13EB9500E5D10AC1749AE69A23EB75BC56177093DF2358C6152F72BC0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 968KB
- SHA256 54bd69fcf2302350987595d08b6782d072c7dbd7f70703e62836a656e6af4c46
- MD5 e013cac7462d65f15b56c59490ba47a0
- SHA1 f3b78b981f3090dc409c4bebb2fd4dfe20fbdc98
- SHA512 1102ff2c2f5444fcda266507eee52ce82caf047f36d19e5bf8cf0ad312419fdb765132f27e249b88881f70e65281adce1056748c6b5cf29ff1bab66d01926e32
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG6fj:A3k03kHRJAj
- TLSH T16E25AE03EB9504E5D10AC1749AE69A33EB75BC561B6093DF2358C6152F72BC06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 09de0b82ccae4a0172469138ed61c109ea5fcb37504deeeff322d756a47a706d
- MD5 2b9be1227c7686a5e0c425a5fab46c5f
- SHA1 395dbd6013a3d4cf53d95311717cb89f5dd79303
- SHA512 4c13d0d238dc291549f16476fb0dc919619612a7fc1d79a4a368c14a9363efeada3e61c964887a5855a5a78816e44f5dbcafce6ac1e1be0d003d59e72078ad16
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGP0Le5ji0hmxNrM:A3k03kHRJfPji0Aj
- TLSH T100658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 963KB
- SHA256 26c80aa7fbb4287a24c9d10f68a50da334170a11b94f671a60791a80e16fec62
- MD5 a3542af3cac45668341b0d6e24dc6b85
- SHA1 c175614997e2ec455703f6d2a190444d261cc8d1
- SHA512 45941afe78f07143610ac3adc8f5dcda96ab25f0b41e66fe4ea1ba77b63aaa1b8331f711d3c3ca9473722dc5cf3a3c80d1cf8b8e38251fb81610a386538b5899
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGyb:A3k03kHRJCb
- TLSH T1BC259E03EB9400E9D10AC174AAE58623EB75BD56177093DF2358C6152F72BD0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 939KB
- SHA256 91656a59bd9013177ccd7ea9f4cce6675f26b73f4709b90be73cd861a3b1d129
- MD5 1c49ea62b9dd14abebc3d16d54718bfe
- SHA1 8389faaf7cbc7ac82aecf95a9ae7a3993cfaa252
- SHA512 f4422a020727deb1b6e9284bf4fa2b2ebed3736c1e565ddea028f2e9cc99f1d0c0619052a39fc2ac98e4d8e37d5dc6b40fca68d02885db29ae692fdd42fd89f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGg9:A3k03kHRJU
- TLSH T1F925AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 939KB
- SHA256 656e9748e2de0d1f6ce381d5249d25a5e917e0b7e7ac726891c3a15bda386ebd
- MD5 013f397d6ecd66a16531276722ff938d
- SHA1 b3b7d63b127b3a366a7a76eedde1801d8f3b7edc
- SHA512 bed9f6ee497afc4798576d04ecfd5c3e2d76a64510f02d50c952b8801b2a8c2bee49f58ec12311ae0a7b626720f5654cd9ce039912cbc9f719332dbf2689800c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGoc:A3k03kHRJ9
- TLSH T14C25AE13EB9504E9D10AC1749AE68A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 939KB
- SHA256 6f0d16a0ab2b552c59d78cdbb4f5d606a2249566056e44067085296132be4f50
- MD5 a4433914c6fbd79885673b066ad17ccf
- SHA1 3a7bf2929dd38b9c1ea1bdb7099c0fc3984f8640
- SHA512 3bb4bc6a65803e93e0628421c08d625ed67c60d08a0e396adf35c401f8707c038d19e11682cb081fbc929fb547dfd1165046c34f6050398fcc11245dcdcf1c84
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGBp:A3k03kHRJj
- TLSH T17725AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 939KB
- SHA256 ae1c41202186004b1f23e721c513c495622da0e3aa0c78997b0b1afe0fba45a3
- MD5 3751b682af56f66a74b213dae72d0237
- SHA1 00f410905434a3fc7eca17b763d38c2bc787360d
- SHA512 e6f448322b016b6d70723472017721d3e7b115dbf8d4c66cc630703b3ebf6dea25895b723b87473718d6f8ba40d12e5b533c3d228de1dd93735f62bc74144962
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGWN:A3k03kHRJY
- TLSH T1A325AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 939KB
- SHA256 b5ba8ae3b95f023dc7e3260570a15eab52dc7064ca8e94f2d6cd1df5cd3e9a96
- MD5 55479a5dc3300ce5bcfafc7433c2ae7e
- SHA1 53cff4cb5115f6a842ae6318b4642b4aa93999ad
- SHA512 e6eca5aa0d68b197be947ff022eddd012cf250e8418534c85316b45e80e6775629beb42f7b6121add21a6f12f2fcf0225fb0cdbd3905f1b14c52601beac3b5d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGaF:A3k03kHRJu
- TLSH T1AF25AE13EB9504E9D10AC174AAD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 939KB
- SHA256 0af0d72fcb3a917f3b3ac74ded4fc74f70b57260caf615fe3c8710a73ee888ce
- MD5 87c69c573f1c8c0bc1690affcbe9f550
- SHA1 2f955a4594a739a6d55b47d7b563b1d980a9a7cb
- SHA512 a8d4df9622b80dfcf27da5af775b2f8ca3da4dafa16c15db881d5e51d2bf32e089401e9f3294c769d666ebf92a189fc8cb4a8cf76152bacfa07409b3a8b8e348
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGvC:A3k03kHRJK
- TLSH T10725AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 939KB
- SHA256 102aa5840bded81e51a52dae4be75436095a1c059aacbd408c1031b30c8a8f99
- MD5 94fff751968820db11729e0d36e6e491
- SHA1 79ef0ef5e95154d7f33b1d48b71fa9aa8b2a124b
- SHA512 714574d5b36eeb4ba27a35a95c6b5efa9c986dad079f18c8b603345baa1ff51488b7a904746bf5c4669c1e1ce7e00c0e4043ab5bbf49d4572ec8f65727b92ee0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGQw:A3k03kHRJf
- TLSH T16025AE13EB9504E9D10AC1749AD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 939KB
- SHA256 d520bc9ab4ca816d458d722d37ab47279aa8884b05976a6f9b31230cf232a148
- MD5 55e504a33fdbc7e8f11b9f196714b1d9
- SHA1 8bfc7ec4f81779a468225d7b8b9a4f3e43ffcaf3
- SHA512 463b03d772a1e8e86e42d9b84f6e531f52af7da4339b772da75f426e44a851e2a6ae731ff7a0aec003a7418f1b8a7bd534bcad22b93d0ddd07cf24b32f54b89a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGvT:A3k03kHRJ7
- TLSH T10A25AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 939KB
- SHA256 f629b0c86bef2df5f824d7cf0085412aceaadb141c6cc8f34fff73be96fd3a47
- MD5 fcb966296954dbc103ca178cf1efa7aa
- SHA1 7cf05694cead3095e5ed6a135545578792436552
- SHA512 7a7271ce95c6cd1ccf99d99af9b833dc46c738db3c27c7e2b6c1bb786b10a256831ebc103570b7fe991bb32f1318fc5e5eb02cf142b9938399c91ee4c4955ec5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGpu:A3k03kHRJ8
- TLSH T1C925AE13EB9504E9D10AC174AAD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 939KB
- SHA256 0cf64d0e074d1cd8e124af95fe4e7f1d4ddf257668355b28f8198ee6933955f6
- MD5 01addaf4991a0405f41a2ca8625b296d
- SHA1 8fd0494fba096fe261cc9b745a9810f116cad4fa
- SHA512 e96dc8798557e80bdb6df15db77509696266fcff584b9ee5891bdf1507f12eb89860b470955e5a59a97df346503b5dbf4ab2cf45c44e156b7bcfe1ea3aad9629
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGhb:A3k03kHRJV
- TLSH T16B25AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 939KB
- SHA256 4bb1d086b5c4dda998b558c06a7b482256926cb97cfb9cccea90cb1122bbb727
- MD5 45ba780037dd137543a31ae3c1744c5b
- SHA1 88c56ba1870dad20ea3bdba63bc42d7f217db0dc
- SHA512 8f0930e35d6a20868bafa9247aacf43cdfbb9cd7c1f2b2886e8127464fef24f8387d89d5df94b1345be61e69d9c777f1e20180a76e57c1af092b0fae61404225
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGpf:A3k03kHRJV
- TLSH T1B225AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 939KB
- SHA256 b17a1f08103b2a6968ec13b3a021b0e0c8704afdc24a667fc3fef96b7be575bf
- MD5 cd3b5c7ae69995f808c9e2633c0e5c86
- SHA1 44d89cb20d459f63184ea351d92edbe26ac71f05
- SHA512 8a8576e1c346a6183427769a34861e4dafecf09582f2322ed44602c321a41c80aac90cf817125d45baa028c35589564b7922ee0c05a58c04b152d3d7de5da75b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGSK:A3k03kHRJN
- TLSH T1A525AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 939KB
- SHA256 cdc6d3a855922dd00b034ac8dffe6c5ecbdfedcbe87287acd3ed6e489a7afe76
- MD5 333548a1c7cd286740866133f2b6222d
- SHA1 2ac886346869e565d1806423203aa9d8f40a0532
- SHA512 d203cbed0d4019bc6ec0894d779012405f88d72ec8359f73c47f424106563112fca49b4d95aaeb72486a39adb1483536171ae77d3d15f247330f67351877d301
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG3k:A3k03kHRJk
- TLSH T17B25AE13EB9504E9D10AC174AAD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 939KB
- SHA256 9aaf7111b99c2d1e7d188a9876fa9328c5fdc696e642fe40798f797a22673012
- MD5 13d87cbd813548a2d736179b9593e8a4
- SHA1 65613ec8bf29f505f5cbc8bc4a477c3fe9f29061
- SHA512 080dc5b83aacc7a9ec676e93586be3cbd1a6562cd32fd49b1dd6f1e9e6eed2d5373b472c8cc2d91e76ca17860fba97efc97f83ce319589ac57359b2ffce056fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGA0:A3k03kHRJN
- TLSH T13E25AE13EB9504E9D10AC174AAD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 939KB
- SHA256 3b3c3c4e9a7bd68cdf6031c6b5551b0cbc986944b9cdc6445ea8eb2ae6d77165
- MD5 5bd411749af9fb833cc5e09319c4af0c
- SHA1 a1634150e337644ebbf5dd5ce93e0bfb9e8de82c
- SHA512 9575928c31d3b9dbd9cef3ce5c951022b8d00e56f4a111e85c2c6d8da9baa8b6dd2243cf5a0cccc33d90f1197e39aacd75e7657cd6bcbc5ebd7fb64569517e9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGbg:A3k03kHRJ8
- TLSH T1D225AE13EB9500E9D10AC1749AD65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 939KB
- SHA256 987b4c77a8ee9b9dab2c6f9e60cf8168c24e7a6cb54a0b900aec707835b8490f
- MD5 ecbcaa179b60d5ad2ddefac5c4f9c12a
- SHA1 f8921e95c06f4ced764b28709abff059f3d619bd
- SHA512 88bbfb695ffb45d6dac3d1e518bd4aa6d35de6860afbc2570ae89043331771f962ce72d3189cb9caefd3b1c5e7ee902e1da161bed306199612b6d59fe596046b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGWr:A3k03kHRJO
- TLSH T1BE25AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 939KB
- SHA256 baeb6aed27d826198f9b887db5c7fbbade5d610f5195c689a95e14a5c7aac2be
- MD5 8ea2faaee88c0455a2605fa325793956
- SHA1 3a4cb4eeb652289050ce6675ce4fc505c4ce4bd0
- SHA512 7e4f1fd9c12e1732d5c1b26b0d9d951c03d05b28d3a1cd72053299a410c4a6ac89925caeb95796516ec509fd13697e554058fa379e62ebbe62733b1b52ed391e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG8n:A3k03kHRJ4
- TLSH T1F025AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 939KB
- SHA256 4c007ecedae9f1f5a70dfdd6e798a2fb37967c113c34084ce53ea62b760ed274
- MD5 4dbe0ebc46f6b75c35739816c9198268
- SHA1 132bb6045f0b36c185f4b735bc5b450666ba1f9d
- SHA512 a53d760cad2200484edacb6689ed476fdf691fe892cf7e95e8e9fb2fec85a856b0acd10773e0df40709910d73faeecb55aca55182af2f4b2f1c3ba0672f51802
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG6x:A3k03kHRJu
- TLSH T15325AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 939KB
- SHA256 20312330bb2a7e08ddf719dc695173b872cda9dae37c217a5b49bee846c15bef
- MD5 bd11e1e107d6aad25bf7b2b188256a36
- SHA1 cf56de56daea332b4d7ae0fa4b60922ba8bc526b
- SHA512 1c4ebb4c67409f706f3bbfa268960ae424b44968cf87ae9a5509d12b308ffa5d3ed54da3c85730022d4dad3541fdcd3a07c148bfbae854473e0dae67ca8f4516
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG8A:A3k03kHRJl
- TLSH T13325AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 939KB
- SHA256 bdb8ef8ec1b48ba9a1029d6b68bcfd3ad95519fcb79a2a7184f38d033191ac45
- MD5 7ef520f1fe3eb41ac51928f8091873aa
- SHA1 e6c15adfb63c8160ee30ac0dbfaf10abf864dce1
- SHA512 aebb071893834c4a5508ebf11e5e486e82d0bd5e8b8e2fd014582ebe80d6a667fc85ea16b072d46bcf13b306387e8997271c018a19f1304c5b3dbcbeed9defe7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGl9Q:A3k03kHRJE
- TLSH T11925AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 939KB
- SHA256 0708d476e46090dd3ab46a9b9ce9bc4b3e0e43a468535e48dd4147c753b3c7cc
- MD5 649315b9cc5be3268fafbf8d297d9207
- SHA1 6496dea049c00b351c8b3c03425a05722ba06eb0
- SHA512 bee4a1b78bbb9422209bbc95dcdd3554b411eeae2ccf9d4c848282eb6ec47249e02973152f5742b7663f79c807aae24e2f23e63cacc60b3c736582a2a22521e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGQ4:A3k03kHRJv
- TLSH T18625AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 939KB
- SHA256 474079cafe20b6ef0893454ff2e54cb1610346ea11477fc4a6205188ba51b9d0
- MD5 d37a0abc6df3e64ee1921ca014fa1181
- SHA1 4eb0c89f84b2c2ee729da843b4cc2bbee492f191
- SHA512 3a19bbef68b8a727756e771c02de8877c0f31f8b064f50ffe73a7d3b864a3ac8dd8c246e66f5cc7ad67ebd82c898585aa39e4b441347010c5d1f1d78680f7700
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGTu:A3k03kHRJi
- TLSH T1A025AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 939KB
- SHA256 d24b6b009100f7f2d9c548e5e06858b53588f1c19e016d13cca1ff74d41c20e8
- MD5 6bf3b3b5df6c385d89c266b3233ea9b1
- SHA1 4b7002097bf53985d211cd462ab455055f145c3e
- SHA512 cf25534751d3d76dcb1dd251474ad872b123e110441892c410493a95dfe19a6f70828385b627e6e624e1aa5c3a2f4228544ef117b67a9013521c16dcc36557b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGOj:A3k03kHRJ8
- TLSH T13625AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 939KB
- SHA256 c52266f9f307657b222a0d35c1b82ee3f79e3e1df076063e42e1fb422c0d440f
- MD5 c56aa5f51e893d57793824e4b8c53956
- SHA1 41ff02ffff333f5fe60429fe855b0844e173293b
- SHA512 327cad5a629906a1d0cc1d5edcfd3a81c0ff39abada7a88abf96a1e8062a48565d6664994256b54c5aaef00f8f99461ae155ad8143cff27ea8f790fec55509cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG7g:A3k03kHRJ0
- TLSH T11025AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 939KB
- SHA256 b060fe9fd2789df8491937ff613cc73cddf4aa8b101c50db6af270d2360b566f
- MD5 5404db2c9bae6a3064902137b592ba7a
- SHA1 282c4da6447a7eab27c25930291b0b091d128197
- SHA512 cdfd93d2e5c0984914668bae0d095ea285b41ea911965b03287244783e86b05bc6da77967fca522ba7be82f3caea5a62fb7b57ac336e30be5595492adc9516b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGmI:A3k03kHRJ9
- TLSH T19225AE13EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 939KB
- SHA256 e9593a96d94eda350a190812a1ec6cd1e6709ebc8c1582d0c1c156f957a49257
- MD5 fe65e9363f8a1e0c80d222e7f6f3232c
- SHA1 f75b34b8fec4e9152f83af3e5d78a2575dff036b
- SHA512 1f1bf7e3150c7f77ad3bba45fd4e94fa89c82d01a275bea7d5d1b6d199dfd8ada892293230a9ba2d79348339aba34636decc95c3dc4e96f3192d5b8a4728b9f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGUo:A3k03kHRJb
- TLSH T18825AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 939KB
- SHA256 ad6bd3febe954505ad272b0a67ae7bb4c12c5cae1dbb9a93c672e4a710f7c1dd
- MD5 3e18ea77b4bd0124cc40d89e845459e9
- SHA1 24989cbae94342dd5a61b3661fd407a3af1d079b
- SHA512 5d006abbd74762e2dfcb184958244079b9dd41663ed6a04f64c9492c34cd904e6f3fd2c16ececbbcf7c1c6aa89ba0de6080450fb723dc724d1316f808190fc23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYG3+:A3k03kHRJ+
- TLSH T1BB25AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 939KB
- SHA256 0de790f088e3a65e96209349344951767cbe6263d5d7be0f295dcf5f6028f993
- MD5 82d28a629f33024ffc2488b3a7922e41
- SHA1 4331b61342fb4a41704cd04f3b7bcd96ea6f77a9
- SHA512 e29740330351adaa8534823a81609a12d84ac08426cab76519afd37856c41f0007fe5f7924ead0f7a4a6adc5be762bff317d09efef3ff4467a78a7fb6bbef3a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGNQ:A3k03kHRJq
- TLSH T13B25AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 939KB
- SHA256 26c51e280bd695e4a3a51ce2c4649e2299776a62126b74477bd1f87ff523c76b
- MD5 46fb01ddac1b21fee5d472eab17f132f
- SHA1 9a5d7c08ece6fec50a97ddc872b86c06a281f3c9
- SHA512 66e77352e6a841774eaaa7dc96e536372d4d64910606445be4090d1baf31423ff5d50205a5f894cf66bb1246c6faf247c72f0d99cbb1559def46eb3af85db1e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGCX:A3k03kHRJ6
- TLSH T1A025AE13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 939KB
- SHA256 4a2794d255c7425a072a279ec761c0c59992f3c64d3b669f5c21d9f6a046bd14
- MD5 c2636738de35900561b20af144f348cb
- SHA1 24d79d3a8af52db896a9d8e00712e65e82fd7c92
- SHA512 7da90dd8b4b6e46175e74f2353181e4330d5b645492c3cb45ac37f5b791ab63d57a40d38a15569786663abab8740eab341183a225a786e0c2aaaf43d2499f067
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGkL:A3k03kHRJU
- TLSH T16F25AE13EB9500E9D10AC1749AE65A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 939KB
- SHA256 a8c6a4eb5f468008530cfaefd32350e1415c0b722689d4a420a1953121042289
- MD5 4c32cb5dd81d80a7f1db34bbf73f29ab
- SHA1 4adaeb310d87228c02cb97312ec950aa886709b5
- SHA512 c64e0d0825d828d49161107514a1a6a18b3f854d754baca749cbad5e680223042a631ba6069b12929511e72cb9ff9ea641c30f40ac3ecee9caf59d3949bc89c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGAM:A3k03kHRJ1
- TLSH T1D025AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 939KB
- SHA256 e68c84a95fcb89010370427bef8239829a2581b7c598a63ea475bec2298006ed
- MD5 e5344bde096027c8415aec66177b8d5b
- SHA1 2ff38d351703ea64a631f3928b7ea254a1b66e09
- SHA512 cdf05b357c4e93b6e6840265b7cc48c1a674dd2a951cb7568e84447b1904bd02c3040451b0f2cc89cae9a9e07da5824265cac9a6ee8d2514f3a4030d9a840da3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKacJjYGhh:A3k03kHRJP
- TLSH T11425AE13EB9504E9D10AC1749AE64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH