Analysis
- max time kernel
75s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
18/05/2026, 16:40
Behavioral task
behavioral1
Sample
2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe
- Size 942KB
- Sample260518-t6vqmsg12v
- SHA256 cc1703fa71c0f3bc5e6f4e24db0fbab06d419da404a0dec9dee15994de3a6fe2
- MD5 3a75f62981c50a65734412c1e8cc947e
- SHA1 404b03bfd648f3dda60b1c27b1815abd87930d23
- SHA512 4a4900efdcb164c112cac0b9d9208e0c8e139e116e346bc4dbd066acced07a1052c2d43d8047deff063afe17bc50a469d9d1605d98c47b0a486f3fefa03900e7
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj
- TLSH T157256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7682F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral1/memory/4028-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0011000000024393-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3632-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4028-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3632-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212aa-217.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000023542-261.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ac-406.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ad-473.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002042e-498.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b1-589.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b2-620.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b4-657.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b3-724.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b5-743.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-787.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b7-825.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ba-856.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b8-875.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bc-888.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212bb-895.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bd-920.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212be-933.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bf-953.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c0-1008.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c2-1052.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c1-1083.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c3-1102.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c6-1139.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c4-1158.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c7-1177.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c8-1184.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ca-1245.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c9-1325.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cb-1345.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cc-1370.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cd-1377.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ce-1384.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cf-1391.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d2-1398.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d6-1399.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212d5-1400.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202e7-1465.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000024470-2090.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0011000000024393-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x00020000000212aa-217.dat aspack_v212_v242 behavioral1/files/0x0004000000023542-261.dat aspack_v212_v242 behavioral1/files/0x00020000000212ac-406.dat aspack_v212_v242 behavioral1/files/0x00020000000212ad-473.dat aspack_v212_v242 behavioral1/files/0x000400000002042e-498.dat aspack_v212_v242 behavioral1/files/0x00020000000212b1-589.dat aspack_v212_v242 behavioral1/files/0x00020000000212b2-620.dat aspack_v212_v242 behavioral1/files/0x00020000000212b4-657.dat aspack_v212_v242 behavioral1/files/0x00030000000212b3-724.dat aspack_v212_v242 behavioral1/files/0x00020000000212b5-743.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-787.dat aspack_v212_v242 behavioral1/files/0x00020000000212b7-825.dat aspack_v212_v242 behavioral1/files/0x00020000000212ba-856.dat aspack_v212_v242 behavioral1/files/0x00030000000212b8-875.dat aspack_v212_v242 behavioral1/files/0x00020000000212bc-888.dat aspack_v212_v242 behavioral1/files/0x00030000000212bb-895.dat aspack_v212_v242 behavioral1/files/0x00020000000212bd-920.dat aspack_v212_v242 behavioral1/files/0x00020000000212be-933.dat aspack_v212_v242 behavioral1/files/0x00020000000212bf-953.dat aspack_v212_v242 behavioral1/files/0x00020000000212c0-1008.dat aspack_v212_v242 behavioral1/files/0x00020000000212c2-1052.dat aspack_v212_v242 behavioral1/files/0x00030000000212c1-1083.dat aspack_v212_v242 behavioral1/files/0x00020000000212c3-1102.dat aspack_v212_v242 behavioral1/files/0x00020000000212c6-1139.dat aspack_v212_v242 behavioral1/files/0x00030000000212c4-1158.dat aspack_v212_v242 behavioral1/files/0x00020000000212c7-1177.dat aspack_v212_v242 behavioral1/files/0x00020000000212c8-1184.dat aspack_v212_v242 behavioral1/files/0x00020000000212ca-1245.dat aspack_v212_v242 behavioral1/files/0x00030000000212c9-1325.dat aspack_v212_v242 behavioral1/files/0x00020000000212cb-1345.dat aspack_v212_v242 behavioral1/files/0x00020000000212cc-1370.dat aspack_v212_v242 behavioral1/files/0x00020000000212cd-1377.dat aspack_v212_v242 behavioral1/files/0x00020000000212ce-1384.dat aspack_v212_v242 behavioral1/files/0x00020000000212cf-1391.dat aspack_v212_v242 behavioral1/files/0x00020000000212d2-1398.dat aspack_v212_v242 behavioral1/files/0x00020000000212d6-1399.dat aspack_v212_v242 behavioral1/files/0x00030000000212d5-1400.dat aspack_v212_v242 behavioral1/files/0x00070000000202e7-1465.dat aspack_v212_v242 behavioral1/files/0x0008000000024470-2090.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3632 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4028 2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe 3632 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_3a75f62981c50a65734412c1e8cc947e_amadey_cobalt-strike_conti_elex_hijackloader_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4028
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3632
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 942KB
- SHA256 cc1703fa71c0f3bc5e6f4e24db0fbab06d419da404a0dec9dee15994de3a6fe2
- MD5 3a75f62981c50a65734412c1e8cc947e
- SHA1 404b03bfd648f3dda60b1c27b1815abd87930d23
- SHA512 4a4900efdcb164c112cac0b9d9208e0c8e139e116e346bc4dbd066acced07a1052c2d43d8047deff063afe17bc50a469d9d1605d98c47b0a486f3fefa03900e7
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj
- TLSH T157256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7682F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 971KB
- SHA256 2a2a930738ae362bd280a053e66d84072020db8c2075f757e476cf3b3a8964de
- MD5 69229379eae78be147c780e2489b7e80
- SHA1 74134a8ab77f5c9aca932fc93a9147d0228b7cc7
- SHA512 1fd85c126b89c29b27183dc83b8a2e438bdad2f3bde2ac27c81eb31e88a35b03e89cd9b6bb56c7d92317f3fe8a50bb0c3d43d8f65556aba0b5ecc9b49e591a35
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojxP:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojxP
- TLSH T1EC256B17F7644275D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE19A3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 4473081cfbc4352ed1719abdf94b5250eff8f4cf39532f822a484e00ee6718bb
- MD5 80d014b39cf49bbe8d49b6223812416c
- SHA1 1ffefe1ebd04bb5e8d18f51ea025249dce280a53
- SHA512 b412958b4d31d6a14298af99b06fc1cf836a7c9f779773710c6684827b9ad6b9ae2699cc933960afbce3c0648f676dcbc2093b252ee0553e127d0074bd3c4569
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojP0Le5ji0hmxNrM:A3k03k2pYqCPji0Aj
- TLSH T14D654A16F6644375D073C0B9C6D2AA9AEE31348617308ACB1385D7783F67BE6863A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 966KB
- SHA256 9af0d6fe85ca9404af9b5a571463c50314898ca3428d0e5fc354db0882e19031
- MD5 31e91683d621915ada58b974f6a6e8d7
- SHA1 8fe214638336f6c2cb6d7956e06be75581a6d8a7
- SHA512 2310a254eed8cd1425257f9c8c43a414a27f3b23a5ca4c6b6df9ade3b29e6aa6532e10a3807ecc81136fba0d95c1ab6df35d3a4a827a08f70fa7009461fca85f
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojo6:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojo6
- TLSH T174256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 966KB
- SHA256 be310cf7e979daeb18455f2613bac63f10410dfe99b15e63dee946c307c2f3c8
- MD5 4a5e9f5892238cf5cf96f9a2d033c0ac
- SHA1 3e5e239aa78b6ed8459e68073a6e1ffcfae37f1d
- SHA512 1823832afe87838231fd4f7df6b6036bcb0117515dae7ab3953aff0aea17286f1536e4999f0fca0aea6246d65d93cd083ce3be0639eb479a6ec824ddaff297d4
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojsN:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojsN
- TLSH T163256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 966KB
- SHA256 c2831d9287ef42da3d7adbbb1b13771c6f9646284278bbaf528d33e8cc264478
- MD5 c12ddcdf04c33a44859fff89ad34470c
- SHA1 07fbc560583ac323982d02cb1e9d761e015db1b5
- SHA512 dab6e0d700d7bd1f51e27ca69b57a620070264b87e06fc767ea16555dee783bd7022bb922098427745db6128531fb0ca97522851ff01d6a220a0382298a172a4
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojif:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojif
- TLSH T1E0256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 966KB
- SHA256 039fed62ff0f0536b66c77137ee37ab98b01e82ce5f3fb5849d817383a5024e8
- MD5 f4623279caca9e60e9e780c80e758795
- SHA1 a471d81e785ff26bf457193254354f8feea5cc0a
- SHA512 83287fbeff5f85aef60764323767bfbe71396980ac848d80929cae9f31df226aac4d8c4391041061e9d811d550907615078b0b71816cab5995fe554ce6ad330d
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj8o:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj8o
- TLSH T188256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 966KB
- SHA256 0a50331a06732a21b1b596e5b570d9893bee80652789cde32727f9617cda4d39
- MD5 f1329aa8cef61afa3402d202e3ff5d80
- SHA1 86799cc6a79ca684913245556ebeaf2140b41bd8
- SHA512 e342f728cf073dc3ad042bbc5931b2baa98831174bfa0cc4f155976fc7a05f2794e7ec39f8cf773c8461e87544958ad47c79352b7a10ef16a8769d3e658297e3
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojcu:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojcu
- TLSH T1DA256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 966KB
- SHA256 4e6987e3f7aa1c2d1a7821ce27a408486ae3867349a3bad89cba72f565d85e98
- MD5 163943030e0721e02f45fef0e182ac4a
- SHA1 7dee8256904735ec04c47219c3d46e93ee150f82
- SHA512 a6ad26fdd2cf483cfc66515958b4f2ca54a96e10f7e6866bda89d95272d689632a37f4c704f735c0d03b72d8a36809f52e5d8b47d5e16cbc25a8a72911cdb4c6
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojg9:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojg9
- TLSH T157256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 966KB
- SHA256 dc49be4c86b95ee1ff3f696c72cb121dc8f59e4c556d74497e001688dc2e7fe3
- MD5 868cf63e1deb6f7ccf3cca85c54df79b
- SHA1 3c05d84e2900657d8efa53fb645295035c7a66ac
- SHA512 cf48324414b627fcbe8afc9a6faeb6ce0d6b4b7269aa50b378985e2edbd0866df3973e22b97849a8c5a1c36f8e7cce83eb13e9f1afc800498331a13f15c6ccf0
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojoc:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojoc
- TLSH T15B256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 966KB
- SHA256 7ac592d6ce5c3ef368efb9bd30e390d49f87bf13f6d57861e4c8970765f02770
- MD5 5631a5e01afa1c556d88e2342cdc1d12
- SHA1 757e415b10582498bae4e2da505d264bc75bd98e
- SHA512 f77967de12b19c5b4e0f049bf1490b2ed65e067fa4a67ab645a1dd299a88fb228af7c7a9dd3f1dd9fedd4c124190e4bb3a4edd009afd9d350315169de3d33a55
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojBp:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojBp
- TLSH T1B3256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 966KB
- SHA256 b9791e1f4e9c96083a0b647dc3200906f52b398f3e006151f96801eadf45638b
- MD5 0b69e01d037404eafe7904a1b358024c
- SHA1 ccd79882f375adea778fb925ea68762284b28f32
- SHA512 c8c9aab9ac48c6d72abda4a82b0ee09b484ba43c3fb1e243f0f2a22449c3b1483d09669d86166dc196488247e741e52060dfd6749874d1b09e96623d9e830eaf
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojW0a:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojWN
- TLSH T1FB256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 966KB
- SHA256 ce6c46f1ce85563bb2e0fec66dcc178a82af39b687842ffe4c8f58aec137a685
- MD5 956e84b9e923d97bab4b0bdca1c4f5db
- SHA1 1fb9e7f096b7a83dce63cedd77d1c09caeec7674
- SHA512 fab3ab915f803a9362dfcf73ed4463f01ace877594ca9b3a501c9372ca33306a36e1a1969413f1739c609abd74d965b61bec066e998c562d45cef16052158f0d
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojaF:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojaF
- TLSH T14A256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 966KB
- SHA256 efa3b49b3e378b350e86d94fa8ba4262d51d3b948bc46b2e5b31751f2cf1746d
- MD5 81f3f59e016accca83ea508bf8ddbdbc
- SHA1 483d3355dd6cd86adc751e44a01fa9cc070ff6ff
- SHA512 982bedce744d6d5bb8a08d078187d483bee536d5988c3f727f428fa99a827f6136f778d568ea1b1cf33d744ba1600e9cee01d9592870e263d4bbc9fc84cc410b
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojvC:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojvC
- TLSH T154256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 966KB
- SHA256 f2897616f30c304a153d9f08e4b5f716cb788d915026275311c34178318ef788
- MD5 01501ede019a4f4d1adecab322737b31
- SHA1 d3c10b74f799a21e2229b7826d790bd59a116150
- SHA512 393a9d79fa982fcf210373b9ccb38132455b9512ac75d929bb3060a971442a6e1ec218b6e77448ffc88499f3e99ae7caf1c27cf2a39ed61249a83d99e33859c3
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojQw:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojQw
- TLSH T196256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 966KB
- SHA256 20f8b1c65e16488c03306a7560889ee8ca51dab21cf1af1362b868426d7e283f
- MD5 c03f4d8b3df61f7757b2e17830d927a9
- SHA1 3b055c85e3734b25818b3f80b9ea496b735ed2ab
- SHA512 86ae2b85ddf51aea65b5256ca5118c27b72d573be5ad55689b3f56bc463feaa269703a78d0bd3fa3c67becd38d593de83ddd23c616657456c6c7e339adf9877a
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojvT:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojvT
- TLSH T130256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 966KB
- SHA256 e32f780354fdd9674db216236befd584dae064dbbe1214a5236a2cdd6ff9a386
- MD5 4fff46ad4014475f22feabafd739b33c
- SHA1 e092e5b46e364ecdb493d51b20a9e15cb10a988a
- SHA512 28dbd906b5ba7f910c1e035cf0df55b5418567f357f1217fe4b3f55288ee3338e4ac105fadab3b280ba97faa6de4d7ab33c68ed646d3a8e194468f46cc727b1a
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojpu:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojpu
- TLSH T1F8256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 966KB
- SHA256 ec60108ede9034196f469cc5719608b90065c0274c343bbb0e94c0eaca5b0226
- MD5 8e437af0ff1760bbd3d7851588801feb
- SHA1 1739b8cc1f6bd41c1d23b1f8f3ed983c5490805d
- SHA512 0a42f1bf871afa4f5a2e15a0e761f719d2f5f0e38fdfa2fcb26cf27be5d48cf28b963c4fc73270532ca6417587601898a24eb6420cde06eb62ee2d87d2007c73
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojhb:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojhb
- TLSH T1B6256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 966KB
- SHA256 24fa4effcd91dbc9dc1ce34e82ffca907436d425b9d428690f5c8776374837d3
- MD5 214de348fbc76851ebad62ad7a8db4a4
- SHA1 1252210c73cfccb7a32f124f1fc4cc5476a9d35d
- SHA512 3f074549d4bee90e6a878550243404a52740f5b7a5897c9613d14f3fe346837245eb51ce20f7e0d9313e5f38cf47c7fa8667f1db5bbd2a4719c11b203c1816f9
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojpf:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojpf
- TLSH T1D2256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 966KB
- SHA256 8486d02e020ab26d7d255f1c552e60dfb0343458edbae6712772ba55b9c5dc19
- MD5 606f241681edbb7462b62f869b1af212
- SHA1 d99364aea0f1a36d8b2a6eede5dfcc4563e2daa8
- SHA512 ea2eb62a7eb26e7eb064a312ca70759c784a88b1f4f7ff494f5434b3785dd9f1706c1c7458d3fbd72c18c7747584bd70b42d5c6f9e523d0cc43f6be6a091d0d1
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojSK:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojSK
- TLSH T116256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 966KB
- SHA256 89c508cad6459a4dca11c6db4444423205de9b7074fbe2e8e89b32e346c5625f
- MD5 8e9ecade682f2234ece74200ff0d5ca6
- SHA1 404036632a370462c41c28d9c8f2d75bb391953c
- SHA512 fc75a33f7e3bbcee8f6e5d21e86458c55bd426da4c01aaf059524a74819f3956aae0429024a02c58fbfbc74d661fd8dd7359d99f45d8d1aa2addfaba998c26a4
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj3k:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj3k
- TLSH T102256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 966KB
- SHA256 cf2c9010494b35585c40073e516edb8007d792dc51e3a2992e2f6d5d59a422ff
- MD5 c45c93522fe837292a4ed0436d6b62f8
- SHA1 4f802ab78fa8ef42a40abe99056a71f2d8ee09ce
- SHA512 bfd59ae6436fe8fcf571c35aa15c5031ca7461b3ade8cce089cf17db1ad39860a68292ea13f8faa16058a3e491e43638867b13cafc46157842e1c68343b0e2db
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojA0:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojA0
- TLSH T1E8256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 966KB
- SHA256 fba2132b326c07589af08b4aad020c4f600ecbd08f9595d141e90c5ecaf1d685
- MD5 90dbdaa775b227cacba83706722e235c
- SHA1 ec6dc394f8abca35d1179eff7560c326a14be938
- SHA512 b1efc0b3838d642715946daa3512b10b6ea2111182f6d4cdab53ce4148ab8d510bfcc468d381e41594f6c692f61c74643c1d4cec9653b1bd73affc12ba1373a8
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojb70:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojbg
- TLSH T1D6256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 966KB
- SHA256 48454562b30e3bb930bde06d7b630197ceccd8a91b97ecfb10ff9b48570df331
- MD5 b536ddf60c85ccd7c0770c0b179455ee
- SHA1 77524b8fcd660c4088b9a6967d23c36867bdcfec
- SHA512 066b55577a4b7a5ad47c1769aec93c05e21c0cd6fa68343810d29461ab6c55448cf4b5ff194105ceaab568df1d3e616e5bf763a34bc74c3db3c7f61f65238d9d
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojWr:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojWr
- TLSH T191256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 966KB
- SHA256 bd69573000e9dddd7540a0ab243bcb2f8a485f23651a30fe397d4a4026c7995d
- MD5 da73ccf1d58646d035c1726731b00b48
- SHA1 befa55a19afbe5fd47992beb63a0fab7e81c034d
- SHA512 ab118ed8d0df8be96190df122ef11d219fd5fe588db6c88a20b33c22f093ae5d59f9b31810fb2ed8486670841449e01d85963278bf727070b53f437b56ed1a64
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj8n:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj8n
- TLSH T135256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 966KB
- SHA256 825163ba65e7e36d84b3c20b3bf186aa7c299187baf86fe7010943780747d332
- MD5 9f69ec707579a2dc5845d48f41d7b8c6
- SHA1 5d3550bd8086f141c435ad88caee1ed7674d98d5
- SHA512 849caeaeaf355f96f4710feb5a45f6e412677271f25433375aa9606a089f74ee6bd9c8e8d7a76c6786586fcca597193181736fa22413ae28df9df595eaf95e42
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj6x:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj6x
- TLSH T174256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 966KB
- SHA256 bb5fd2b216d7cb95f6dd82542746f9addf30248e7fd36613e335f90ae9fcd90b
- MD5 31383c970ba0ecbd2fdd7599014475b8
- SHA1 20bcf3dc113c42242741cd1233d231ae3329f04f
- SHA512 5a9f46a3746c586143880b46e63d63bf7dd4bf079ac3019fe85874d87af1d337e4570be08870bd354c7f29a42164cc81532058f6504c006d6faa0b67a8c5bffa
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj8A:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj8A
- TLSH T1E0256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 966KB
- SHA256 2bf90e79e65d6f580b747299ff003aeb94dc45d4c695ac868e4be3e9b2d5c2c1
- MD5 692373920534c85e654e77fbcceef7bb
- SHA1 85e37f7a8f1dc22bec16c4637a63ce246e2f1b3f
- SHA512 c5374f3be44abeab3ddec4e674c8bcf02df22310434828b8ff5389f7ea97429c41f681297ba87cd495cc97ef80b2bafd98bd833afd0683764ade16b6891ef263
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojl9Q:A3k03k2pYqz
- TLSH T123256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 966KB
- SHA256 4abe1d2b5ef16ddfdcce2c5540ea614254d70d6d07b09e47ccea75a4cd45a60c
- MD5 ddbf61c43ded2148d158670d996ffd16
- SHA1 5e38603e254edf5765d25eaa85628b11ceeee312
- SHA512 2c747d671220df089b5065ec395c211be8ac43241e29c579ab3b65277a3fa67df7007a4e2b4094c855a6e3b14ba21a14fe72bf98edfb3475c6041c62de48d04d
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojQ4:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojQ4
- TLSH T1E2256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 966KB
- SHA256 f0ba0a6276a9b09eafc0c29b9ad49d1c37002962ea53b6bc048f4c974eb0ad7e
- MD5 d4fed93540710d509c589a28ba4de5f2
- SHA1 7725df49187acee854251283ce8d94e089f14a0b
- SHA512 141ce1664a6ffb4ceda9728ab99d64de53aac54a65120ef2cb1bded12fe8d58744410edeb49f404bc8abef753e6679e66ba30094155c0b533158ee96a5b7b475
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojTu:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojTu
- TLSH T1DF256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 966KB
- SHA256 e80bfb2b051dce97ae5b1bd2288217f24675dc0e15a545cfdd09dba80990637f
- MD5 b01bef2c99bbb3e900c53099146ea8c0
- SHA1 7929e4c409bf9887ac7a77d90106f7b8e92fc633
- SHA512 a6d37e9f85e5b7d9518107305c8273a2301bf6fd0defaa3870057f8e7f818ebea892532bfb7dfbb461d159e485cf31e003a353299bc6ef344773ffa3d7aef109
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojOj:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojOj
- TLSH T1DA256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 966KB
- SHA256 4f709dce953c1f0a415353269286b32f47a1e31382378f92c85b243c9b737179
- MD5 78613571888b5a584c35509bef93ff2f
- SHA1 8c9a96b2fe7f2dbf0d0ae05ee3ddb13cfe89f5c0
- SHA512 6f338c220bcd47deb5cae64dcc7a1c9d156caab71ec43be85c0e79a379606183c88edaaf7019c42f988be95e17b416f6988d43195d6c9ee8973ebe4b44897766
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj7g:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj7g
- TLSH T1A8256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 966KB
- SHA256 b460312986b8519bc831821d022678b59b26a49c09581000233e58816e236989
- MD5 a2ab2ee51d6d78f0505d928ccb417e5c
- SHA1 4268fbc6b7ba9975b61cb583c5d21114d65217d5
- SHA512 91429338d274145e165f64a0948533236135496e710c9b900d532e91649444529cd176e180975d8b9eb780004a8b7fdb862492ad6403d4a536d917dd0e54eff3
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojmI:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojmI
- TLSH T14C256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 966KB
- SHA256 c713a8cc06b614143138e86c6cf497b97f3066a26c7befa306b86dd0345003d5
- MD5 202e02a7a72311623173f5a45fc42f09
- SHA1 588de9690a79a136f506f0b431aa0c93df82e764
- SHA512 84a884c0d1c1f24a26eb3d9b402001dd5eb4cd12bc5c304d6bcf1fa87c6efe0d64063a0c4bb7f1880a84c20a74670f315a37d3a9b90edfdffd83133c4ea19c0a
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojUo:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojUo
- TLSH T136256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 966KB
- SHA256 ee275f8f451756fad6d9f56824e7cb56e63032121cf3c4f1c256f156d026aab3
- MD5 aa4a813a2d8da2c146c7b82d50dceb3e
- SHA1 c5d930661a6ad923ccd473f53bcfad939616a4b6
- SHA512 15f4bc204a63e8e8871bfd2a21adf858abf6d6a79954d7b7249f07a23d71f6c7853635e377cb537df2b05763779b169423b1e052f399b39b53a1c0da6e44b1e7
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/oj3+:A3mnXoZ643mnXoJ5jcAkSYqyEam/oj3+
- TLSH T155256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 966KB
- SHA256 72ef2392ea155d6d640cb39ce066a848c5685dffd031c75cd86eaf1cc5a08afc
- MD5 b13f079fef0112beab911653c6e5d070
- SHA1 7fdaa13426d85ca5c62fd28745690594e8c3cad2
- SHA512 1e9d65578a12bc04a40cecb5680bfa21dda16b3207cb03b595a00f8d531c01262504bf06f9be9732c9bd4e2593b70cfd1b5e9bbb49390fcff8f4c7cad7e02b59
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojNQ:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojNQ
- TLSH T11D256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 966KB
- SHA256 296ec69e52e596051c6b1546551d740d5f5a13b5f52a2f450e61c77554c62c14
- MD5 893e07618933d63819e60a932c76397e
- SHA1 1846a668d7970cf22db5bca69c8b64e7318d974c
- SHA512 07d6f70054eec4cc01ae223bbbfd7382018c63f0c2688f447c0b609ba6d12fc2fc03844e3777ac499101f111072711d5a575cc5df17704c0b70e9417de59d7ff
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojCX:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojCX
- TLSH T10A256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 966KB
- SHA256 6c7e81ddb799bda6c8be8235e08937fe2aa5d0e015420312c08af600039e9f75
- MD5 3b1e297a7844fdc16e4a5fbd292a7162
- SHA1 f85cc930b212293401db247cd52a0711ba49dfa7
- SHA512 785db954edac0e752a43bb033e13239511e6f2bf255ec39c8b2fbc9eae12bf1d67e400eea3f1229f9959351b11b6875a06c6932e0a2c1ae8e3d2a8dc4b2a69b3
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojkL:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojkL
- TLSH T1F8256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 966KB
- SHA256 18a485fe592587721ac3b8dd8db67cb90347d69948b7e3070e0a5aa35ba93eab
- MD5 6e2ac128cd5905eb5b380c21332d835e
- SHA1 3e6c7cda3cd7a7cef34d50b47040ce8806c830e7
- SHA512 893587e30c9538142c6179799f273e420a7bc52905038ac521150fdd4b776db2c754de4c5003024862b332a3fbf883c42b6b8f6bd2c5a0af7df98d0ccee38a25
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojAFC:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojAM
- TLSH T10C256B17F76442B5D073C0B9CAD2AA66FE31384517309ACB1389D7282F27BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 966KB
- SHA256 1e4dc6374cb29291258dd582680c4dcc93ebf1f3f86a40cb5e258acdd9b01a89
- MD5 3314725da30bb61a10297dd63adf1c71
- SHA1 5c3c128b813b7ea16d55bc6d0aa0de2baf61c41c
- SHA512 2c43ff568096d9b6e70796d10bcd10c00a87b298dbc2cd801f0a89820a3eafa942bc5602353416726e4caf3662723a7faf7aaeb8c2929b6e4c375a6b6a3fa30a
- SSDEEP 12288:A3ZUnXoZ643ZUnXos1gL5pRTcAkS/3hzN8qE43fm78Va0X/ojhh:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojhh
- TLSH T126256B17F76442B5D073C0B9CAD2AA66FE31384507309ACB1389D7282F67BE1963A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
- Size 1.2MB
- SHA256 b033beae1b3321c76a78e2528a8155477253808f8e816cc3b9aba071caf0245e
- MD5 cee4f7e3d03b05b6d4d8f02936fee8d8
- SHA1 10d35a67fd249d0db4bb52c6bbc691f0cb7a5983
- SHA512 3fce3bb02459c2e013e75e63ab82b210c4939dec6f84239fc8324a137c4230746221ad32315fb6c694684be579fb37a6d20b6b1804c25f58b01e2784de6a42a4
- SSDEEP 24576:A3mnXoZ643mnXoJ5jcAkSYqyEam/ojLV+PAk2hMH3:A3k03k2pYqQi2WH3
- TLSH T13A458D22F7A44175D073C079CAD6A67AFA313841073096CF5384E72D2F67BE19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH