Analysis
- max time kernel
74s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/05/2026, 17:21
Behavioral task
behavioral1
Sample
2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 948KB
- Sample260522-vw4fgady21
- SHA256 1b766c86459cb126cd3c49e85ec498a19f75ddf12fa29c91f22c2e4c5685a4f9
- MD5 8f2f5ebbfbee8dfa8810af1f89c8e3b9
- SHA1 e117fb380a77c2c3661c0a6297ac248d12634517
- SHA512 f363e9ad2ba7587d000dbc648fbe657df0889714453cc34d1a148ae4818ba12f610f8b9ac0bd46175930a200d121775f750fb8b2d3486e8b8bbd1290ac67bef8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa:A3k03kHRJ
- TLSH T1CF25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral1/memory/2540-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024485-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4300-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b65-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b6a-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2540-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4300-60-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002029d-219.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002359a-262.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a1-354.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202a3-468.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020299-499.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ab-578.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ad-621.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202af-640.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b4-725.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202b2-745.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b6-788.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b8-802.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202bc-845.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c2-870.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202c0-889.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c6-896.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202c4-909.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c8-922.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202cd-935.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020305-955.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020307-1010.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030b-1054.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020309-1085.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030d-1104.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000203eb-1141.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021266-1166.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-1179.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-1186.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021269-1247.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126b-1333.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126a-1347.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126d-1372.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126c-1379.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126e-1386.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021271-1387.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-1400.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021274-1401.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0013000000016917-1922.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024485-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b65-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022b6a-40.dat aspack_v212_v242 behavioral1/files/0x000300000002029d-219.dat aspack_v212_v242 behavioral1/files/0x000400000002359a-262.dat aspack_v212_v242 behavioral1/files/0x00030000000202a1-354.dat aspack_v212_v242 behavioral1/files/0x00030000000202a3-468.dat aspack_v212_v242 behavioral1/files/0x0003000000020299-499.dat aspack_v212_v242 behavioral1/files/0x00030000000202ab-578.dat aspack_v212_v242 behavioral1/files/0x00030000000202ad-621.dat aspack_v212_v242 behavioral1/files/0x00030000000202af-640.dat aspack_v212_v242 behavioral1/files/0x00030000000202b4-725.dat aspack_v212_v242 behavioral1/files/0x00040000000202b2-745.dat aspack_v212_v242 behavioral1/files/0x00030000000202b6-788.dat aspack_v212_v242 behavioral1/files/0x00030000000202b8-802.dat aspack_v212_v242 behavioral1/files/0x00030000000202bc-845.dat aspack_v212_v242 behavioral1/files/0x00030000000202c2-870.dat aspack_v212_v242 behavioral1/files/0x00040000000202c0-889.dat aspack_v212_v242 behavioral1/files/0x00030000000202c6-896.dat aspack_v212_v242 behavioral1/files/0x00040000000202c4-909.dat aspack_v212_v242 behavioral1/files/0x00030000000202c8-922.dat aspack_v212_v242 behavioral1/files/0x00030000000202cd-935.dat aspack_v212_v242 behavioral1/files/0x0003000000020305-955.dat aspack_v212_v242 behavioral1/files/0x0003000000020307-1010.dat aspack_v212_v242 behavioral1/files/0x000300000002030b-1054.dat aspack_v212_v242 behavioral1/files/0x0004000000020309-1085.dat aspack_v212_v242 behavioral1/files/0x000300000002030d-1104.dat aspack_v212_v242 behavioral1/files/0x00060000000203eb-1141.dat aspack_v212_v242 behavioral1/files/0x0002000000021266-1166.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-1179.dat aspack_v212_v242 behavioral1/files/0x0002000000021268-1186.dat aspack_v212_v242 behavioral1/files/0x0002000000021269-1247.dat aspack_v212_v242 behavioral1/files/0x000200000002126b-1333.dat aspack_v212_v242 behavioral1/files/0x000300000002126a-1347.dat aspack_v212_v242 behavioral1/files/0x000200000002126d-1372.dat aspack_v212_v242 behavioral1/files/0x000300000002126c-1379.dat aspack_v212_v242 behavioral1/files/0x000200000002126e-1386.dat aspack_v212_v242 behavioral1/files/0x0002000000021271-1387.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-1400.dat aspack_v212_v242 behavioral1/files/0x0003000000021274-1401.dat aspack_v212_v242 behavioral1/files/0x0013000000016917-1922.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4300 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2540 2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4300 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-22_8f2f5ebbfbee8dfa8810af1f89c8e3b9_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2540
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 1b766c86459cb126cd3c49e85ec498a19f75ddf12fa29c91f22c2e4c5685a4f9
- MD5 8f2f5ebbfbee8dfa8810af1f89c8e3b9
- SHA1 e117fb380a77c2c3661c0a6297ac248d12634517
- SHA512 f363e9ad2ba7587d000dbc648fbe657df0889714453cc34d1a148ae4818ba12f610f8b9ac0bd46175930a200d121775f750fb8b2d3486e8b8bbd1290ac67bef8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa:A3k03kHRJ
- TLSH T1CF25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 0ad2e83f02679a466ee7e1d2c9d70108772e4e7724fcf6b85ff541e811967b2f
- MD5 88b8448359c6eb1ea744e3ce74513fd2
- SHA1 4c18d62e6d931486a8acca92550a3a8cc0a277cc
- SHA512 8688e9ddcbc422262afabafa31c08be0588caf532f3699a8125f84adede35dff37651cf4a808d0bb4d661d0c8e4516f245094683301de46726e8cbf8beeb659e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYabUr2d29dBrtpDiI:A3k03kHRJVUidGl
- TLSH T19265AE03F79404E9E05AC1749A968622EA767C561B70E7DF13A8C2252F73BD06F3E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 c79eac5f3e00406bfb953ffce9558671d07ac5bcd8999a7e0ed1220eb6f6371c
- MD5 19adfc92645220af2149b24b51d24934
- SHA1 3317e50dfb172556052fe6f4640d0ab0d3d1d9bc
- SHA512 d352722cd8f605c2a6582bb3c24a3e67ac06d27cad73f48e81a6159b4adfaf76b7add9d7e5e59eef69e724d68f438c4a18a49645060090c76aac8bac18789f74
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaP0Le5ji0hmxNrM:A3k03kHRJ5Pji0Aj
- TLSH T149658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 962KB
- SHA256 87003185fdfffb07e104004fcec2a4695d335dd63021a347e220fd9e41443778
- MD5 9f40f7efca90343dbda4a8efec691402
- SHA1 f36b24900f7ce196cd7ac550bf144ec5b487cf9b
- SHA512 34f37782041c226f9294a296ea9f9a08b8ea04d0b76433678f5a618347ce69819a274aeb4b996cf92d681a504be8dbcebf0e24e67aad99e7cca84e67d8260d8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaRa:A3k03kHRJ
- TLSH T1F625AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 971KB
- SHA256 c990b53f2f40e5f287e6e0cd77f0406e82929a58cb7b76645b00e2d5c25d2c85
- MD5 7e1fe0336fde80833048d383fedbf7ac
- SHA1 120c47a1b3e0408833710c1f1eca9859ace2d048
- SHA512 afea08a82dea5fb583e1e74c3b5a76e998508b8325e64a0cfb92f42b7d99cae7754c413d30692b9ef354ad750ecf899d69693e8302db8902a0e3a66628bc2558
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYao6:A3k03kHRJF
- TLSH T1F825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 971KB
- SHA256 b2cffd1ff5a21f3272dec43e03c68a97f907f989b40ac0fccd7a041a28379e98
- MD5 ec3e93a678a44c346cad6dfb6beca5db
- SHA1 d1ab395eceeb5a083b0b9d6f94e646f72f239a8d
- SHA512 0c3d88acaf25a200860c30a3d8954fb72e493ae32f0d681fefb5720037cc478818be46351deb69ee307f4b525cc9f2bc6a66fd3bfff6a2931f0dce5f105889b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYasN:A3k03kHRJU
- TLSH T15E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 971KB
- SHA256 33f1a2fef106a2a25592db7e5d93977fcb1bef716bf8aebd72fe674ad5c28d3f
- MD5 63fdcb542c413e5aba28103fbbd50abf
- SHA1 48e7b644aefb0a4ee8c2276a86570a10e35838b4
- SHA512 894815466d1c5f0785cd7f81ae15379afcddac06d936021a9a7f4e033644bdfcdb6ae9133d7c310848ce63649026a025985e8dd51203f76f19f29392c2394066
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaif:A3k03kHRJ0
- TLSH T12325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 971KB
- SHA256 1714c25875e26141a449d9657541b20e1a80cd9ce2188487ae9fba9cb51a69d8
- MD5 e1c46080575c9d9497df947a6cc70780
- SHA1 bf6d32ff25d35e4db92a8dbd08e03e382ec40491
- SHA512 f982e6914382360c807beea9db263f454c9fd5b43617a68b8fa74e62fa2487fe59b5918c2ef54c33a34eff1e6c8e00f1aa7357b53d6f5be04cdcc2a7d1ae0779
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa8o:A3k03kHRJJ
- TLSH T1DF25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 971KB
- SHA256 f46de4117b81d3e2730d9d24395e32b0d0360745cb9a977951b3e3955c45a317
- MD5 a7f8262e3b8856ed8584cb7bb8023b25
- SHA1 5d8b3065ffb3aa81966f00eabfffb9d6ac522e70
- SHA512 5874e162fafc306c2dad33b9611725a4781035ff6ed0757510b2fd36b734e380337fc1323890402d1a3b70e5a248fa432015320e82552c858295e21d4434545b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYacu:A3k03kHRJr
- TLSH T12B25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 971KB
- SHA256 ac97c2456346f161c183c3fda6e2582cd129947161d192c660fe9e2d16c84d0c
- MD5 336f58a19593e6830754cae408a89b7d
- SHA1 57a7ecfb435723e18b26bcb622f93f8e4b32c2dd
- SHA512 f76a9cb751036a0be706f93df238113d267b42df9273e8896a15115315fb12b45e59ab3005e52cf4e136c0257aa653b62700d2c31d2fea2d20ed76f2a7bc11ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYag9:A3k03kHRJK
- TLSH T1FB25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 971KB
- SHA256 9b4fdd3a2d483e16c150899c7dd16341f4f736eaf74bd5ff425c93cbe6998e7e
- MD5 accea3524ee15f9cb887e080262fca8b
- SHA1 49007d98c28620c622f644982102ec2a960b57f9
- SHA512 d7f7704897400f941e6bf60167b8589249c28d0973242c8783d07b4ac94a3dc2bdbba49f65ce50f0615b2db58613e2f92c43b154b13a68547a6b445e684bc089
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaoc:A3k03kHRJn
- TLSH T15825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 971KB
- SHA256 47174f8a1f30cdc46dc73b64e3c8648ec4a68cc05398874cb7ff6bd1150a137e
- MD5 6e15fd5713b0071de1350ca2a91289c1
- SHA1 19814a850ad17445d051c85d7197baf66b5afeca
- SHA512 3fab61848c29fc41639be68f0494877434a5e8450158868b251759e354444a77b2fc3da3971bb604808b6ee7928194442a7da734b135f9c64d1b94b6a4a7cf85
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaBp:A3k03kHRJ9
- TLSH T1B425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 971KB
- SHA256 2a6eaaf9d2eab6edd5484b04c99ab903b2df9369faa10f934d0656a18ce247d0
- MD5 1cbb39b1e8ff71e4e77e6a755768288c
- SHA1 ac767966c25c415d9669da118bf8890b2f8e787c
- SHA512 8f2b87e42b70d62e9d08d31473b341bfa79e501c77bb0d2ffef0b02e6790888a1a020b7e3bec4999397811255b3558cde6be1f390496db105505c83e5cee20cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaWN:A3k03kHRJG
- TLSH T1EC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 971KB
- SHA256 1c54b2b932afed625590850b82fbd2c8e6a62036a34ebf94437860d8b33a26a1
- MD5 f978859de0997d17703f53ed56cd4a47
- SHA1 3f216e0b5811f75aec56ae4d7d981147644ef82c
- SHA512 f47535c9ae64d8102e99d44c715c4983fc2ba7603d968bdfc32ee72fd16a154864d1a8a917667d95202188f3d4b553cee629cf84380c79c871e6e39a1ebf0d28
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaaF:A3k03kHRJk
- TLSH T16F25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 971KB
- SHA256 852e28f81bd533d55943fdce336edb2542324a492541a6ef499abe4d570641d9
- MD5 84fc9eaf34a32904cc3443bf1c9b57cb
- SHA1 b783ed467dc9c2319aa59ece8bb1ac7c20fc8418
- SHA512 9f1e56f2b9d58f8bef9c034fd0b7470994dd9aba3a8d40ace865e16a9e73c8b808347d4f188eaa96def810e1d79d66bc31739cd623668f1b944ed2b410d4b6aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYavC:A3k03kHRJQ
- TLSH T16325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 971KB
- SHA256 304cce0229b47f7851363f1762a7da95103ea3d7378b148502867b09142d2dd4
- MD5 6340bb1bc4a94892ae4821feb5d96238
- SHA1 4b89ea0034e246ef2fedf3e9ce41c2ffa1a41efe
- SHA512 201d944ff61f7d06441a0d90c190f575d1042c9ec9942a590a8a623745c68bc948f5bfc37f508761a9d891c17647c5b1c066b5c7283028fc1de4378d7237fd96
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaQw:A3k03kHRJt
- TLSH T17725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 971KB
- SHA256 3e2d4f8bb75ddb9d8cb98bec40c6d984a3cd10efbea08a27aff5d83e3e3e60ca
- MD5 14b56aa1a883425486c389cae9ea4701
- SHA1 2f67da6398b18223630eae1ec94f992646799ea1
- SHA512 71f2a0456642875a36b8ef27f4fc321510c87d3670bf823798a8ecffa0382a4365c26d5d115e0f9e0fd98e4b5419a63604eb016c7727dbf56c7f4671e997eade
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYavT:A3k03kHRJh
- TLSH T1DD25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 971KB
- SHA256 5126627706d203be3ff2db5378df8bcdcd482a077c4ca87f26462aab349c8480
- MD5 33a228801db4e90d460f55b991ee7823
- SHA1 1c3233631ef7330badfdab6868c134822aae8685
- SHA512 587ac6e39606f982d81d405b3f8cb4eebe49ca2cfd6e4f52599bc42df94ceb84c90463653883d358ff5f7cbea5b3bfadf2c356febc762b7d2d076124bcc5c55d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYapu:A3k03kHRJW
- TLSH T10625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 971KB
- SHA256 3c4cc1f70506197c63b7f32b97b1077924dfbca5e6ca1f035f2d1785eb16ece2
- MD5 d4835c112f480c5e6fd712231327efee
- SHA1 bd7637709592ea765689b8d5e9a92d356abbe5f5
- SHA512 48c6c35bc623fc22f57c16acabe0d2ef212f2a9a0f79c7960a31ef56f0ce5e158c36e85edbccb027dc4cf6b722b464334251298d5f6d155b2a4e55abc713ffaf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYahb:A3k03kHRJn
- TLSH T1D825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 971KB
- SHA256 89db530a8c4e9e140bc4c38d5c805473e1d8738dc92a02ad9df9c07c9228ddf1
- MD5 9619b969f0d7c28a745c32cf6bd76ec4
- SHA1 4344730d2e30f9cb9a1df7f884e3505dfcd0216d
- SHA512 67c9958e4fc255914e6e0ce0f52909bfdd19c9a5f97a1be127185b99e04c5ec67d15332d9025a0a87e479e794053cc189b81c9ecb85f599539525232132195b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYapf:A3k03kHRJP
- TLSH T15625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 971KB
- SHA256 d7d8e70d227fa290fb29981753103922b8d098eafe7e3c24476303f14b0da732
- MD5 28931b5b1df282e4be46d125461c0d22
- SHA1 7422e02409d45465d5c4312a30630574812d16b0
- SHA512 e00381a5f081a3e4c29034fe882e8b6bd9322cc0ebd5dd18a324d3ccdf44ed827a35eb3ad587efb1decc78b4860642b62eaa542181e91e3f7255b897a60c120b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaSK:A3k03kHRJv
- TLSH T14525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 971KB
- SHA256 4a387ac2c272c90bb88dc029806354af8564a51531766df33d4f9ce0d88bc005
- MD5 6650c478fb21033c6f39d7bea471cbb2
- SHA1 a677c7c82924f6cc46462b87e8d249c143cfeb28
- SHA512 df336a1988f522b3e7ff837da4a3faf0407f544080f3a0583a02812d36b938332c3b985371c2d034c1b06a1ec22a00acbd434c6281a25336f9cb872ae0e9fb77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa3k:A3k03kHRJ6
- TLSH T1F525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 971KB
- SHA256 7562f1e2ff7eb03727bf2e5a8eaa418f74fdc72b2e3b56623b492b9a05e5dd79
- MD5 38bee74a22391dd981df2db9a534846a
- SHA1 c17dfced8d05be64d320cc1aa26d08105bfa0a73
- SHA512 698b75119951322dfcb6e554ddbbef0c8c5d9481f548c06209d7e3ce42898fc5661488be007c07127504e77092e5bf9592272e9119388a52a57e8ff740bc70a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaA0:A3k03kHRJP
- TLSH T1AC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 971KB
- SHA256 89b5975b4b3fa00f71b36bb13b81666a13c1ec10c852f09549958b6937ce35f4
- MD5 7559dd1dd093f5bde3b4f9d739e05744
- SHA1 0a9c20325d3970ef4fae94d58f86164e3d10ef37
- SHA512 b0c130f1d36c45018598a8113cacd8b6872438f6148298a31b07821baf717349821d8cf1c500c50485ac7d07651e6a9187a489343aed35e4fe53b70064978eb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYabg:A3k03kHRJS
- TLSH T10225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 971KB
- SHA256 1ee6e914760633b1ff867e4af26e023003ec0817f1688201dce899a780def943
- MD5 4da711103ce0976725da1fc4ea83cbad
- SHA1 2b50b1ef320185bae074e765a7347c165f94d241
- SHA512 c0e1213b65eb46c7ae31e6b170115f489463aedbf09056092a66979322b777c3ea83eeb4a67772d40d10cac592ba6a6416beb27769c35bb0518e4a0ebbb06c76
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaWr:A3k03kHRJc
- TLSH T16425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 971KB
- SHA256 a40d7d29eaf5a24bdd9e3515ebeb54c02560014d14295bdbf030f3f5ec526394
- MD5 25c3a5576596f460a30f4c5e5f143a41
- SHA1 e9d2d3e941a912361a18d75ca81645a1caf32180
- SHA512 958f179c917834ab59628c26076d967e78b5b43c4a528724c3e56f594db2cb9abbc59bbbbb242b6a3fced3d85e9a71854eb8bfed448ff84338012b651b9eb2e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa8n:A3k03kHRJm
- TLSH T1B125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 971KB
- SHA256 c42e4f375721217bd50d155e7394d29094c2798616816c30b8124e252cca0b53
- MD5 16fde0537fea9fd1cf89591abfb3f166
- SHA1 9947de25d75769ca98dec67220b0c1a714ec8612
- SHA512 8a95baf9d694067c8e1d527bc881231fc2886d7b792e113aeae336b6c469394c75a0be8cc24ce7b0876057b195ff6ec1a9fe0cc509c8a9daf4f19cbdd69dc12a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa6x:A3k03kHRJ8
- TLSH T11725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 971KB
- SHA256 bdd686c725a0dcc8b19e6f98acf18744c3864451063d93187c0b9f6286746504
- MD5 f5d5f8f13514c650ce6eb908a9409c25
- SHA1 56d8a5890560c44d8536f40cf0dc511973c790d0
- SHA512 56c2d2afcc1e750d3a4ab4de3358c2ec33f5b37924cf7dff0ab9b645eec8ab5d04aa8cc9ab0d29167ec5a8915a32a936b4b6c6b8c1404a5d1acdd1106aa1a3a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa8A:A3k03kHRJH
- TLSH T12E25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 971KB
- SHA256 764574403262a208d5c29f9abac039d3bed32b13c2141d7d5623b4f7b73db12c
- MD5 e78fab0032d4134370c89a2d2643ebfb
- SHA1 a3cdc3fbde6fd78930bed8eadd859da5271a9fbd
- SHA512 7309b0b3ee479ff33d373cebf286f5d28b354a4ff75c0d50a9fdbec2870fe71467b9bec339c01ee73496fba7d12c1580765ad539603bf595bf29a3c774448c6a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYal9Q:A3k03kHRJq
- TLSH T1C525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 971KB
- SHA256 a817bd71c48d494957857352d9dccb050354540213049e4165c0128c7fd719aa
- MD5 51ddc16264848e20fdbd9e5ed3ccc367
- SHA1 7eeb39014490220a60c059b1a319d0158f6f7c9e
- SHA512 cedd73f045adbc2d0af14e57339db695eb842f490e9e2f35c56c14d5b0339c316c324ec65e1de34ecf943824a8366abbc255a5a6b076275d88705520996bc1fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaQ4:A3k03kHRJp
- TLSH T18F25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 971KB
- SHA256 dabe0d892b32a8607191a815f6b6877622a352b52d06d6d230c0a1928ede2b49
- MD5 6efe119a545ece50ec9416321e00fc74
- SHA1 3ae44d65ca8b22c2550510e7f0e27f8691e7130f
- SHA512 ccb1634fd76795b13933d298b35cdc0d45b1036a16dffe7f7444c5eb19a7f32d7aa36e9d2813b6d0b7a2a8f46ef00dd8d021540b812d7ffd37ae7eaff67b9850
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaTu:A3k03kHRJ0
- TLSH T19125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 971KB
- SHA256 be86dbc9615ddb7250007cd523e2e0301fdf79c3675fbfaf5378d9b48aef5ec7
- MD5 ab4d35c8c3e3f3d3ca2c4181de470429
- SHA1 65408f9a097526c7da83519538168aa0521f8afa
- SHA512 a263c6a3256fa08d8621d7113055f6982f63f513174aaaa63b3d65321d2366a75b6dd6f8c0681450181ad369e1a4fb2f837ace432a509bb28b5fd0ef478dbee3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaOj:A3k03kHRJW
- TLSH T15825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 971KB
- SHA256 58586b3ca362fd9b86d63c128d9a31e6fefcb040b38ef3342beeb63ba5def93a
- MD5 6036d894d61c3918e5163d523b8321fb
- SHA1 9fe5180121c8ad3d4a357307d9ba0f179511e9ca
- SHA512 ca543861e4d43ceca5ad64f9e18fe4041c9912efabebc39b535233c633a15503b57cd4aa2d655267d04bed4521c0522927516046ec7ede9b05065cfce8e17c63
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa7g:A3k03kHRJ6
- TLSH T1FD25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 971KB
- SHA256 5d292b6b2f5210ba047f75303d32f6521aa52d0b7c54292a254b9133e9353599
- MD5 979d9c58158479d3f5decc0c06c12e06
- SHA1 0aac5f95ee52928832be3976b63e52358d1dfd69
- SHA512 68740863443fd855cfdef13efd82e4b2e1b717e367fa53698f19ed4ab2ba3a98489afc5e7d2cbcfc2731c895f646a36ce0f61285854af63f152f7ed71bbef153
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYamI:A3k03kHRJ7
- TLSH T14425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 971KB
- SHA256 b0c472608deb3b672f66386a1656a7f6a9113a164451f6049bb3724d380e468b
- MD5 12cf6a869af16a5d5be59aae4158c314
- SHA1 0d27315a70fac928f2c6bb56bdc8adf5bee27f27
- SHA512 7ea8626059606a8a819f0543007bb7b28e41f65a1a36a3e04b64415f4acf62acde376247b09fb9dcda08482eb7065c23ad0ad9b430e28cf23e1c61eea8311a33
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaUo:A3k03kHRJF
- TLSH T14D25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 971KB
- SHA256 9b5dab91e3e91d1d28c52625d86508b5fe6b66e1da15de523ff8202b020acb41
- MD5 5efbc53254dec39216c621bc2c20e3af
- SHA1 29a48f6ea41370ae5ae7438c6be9d39c44e4e0fa
- SHA512 79eaad8d8a7296b66c126726e10f0771d09159fdaccde6aa24065f57d3190a51aee62722d770730781f39dd688c50833fb849d41f21e2043bfa97c42f31e8f78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYa3+:A3k03kHRJA
- TLSH T1A225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 971KB
- SHA256 76058afa05fe0a914e90e44c011e3ba15bd25e1055aa25114b1952a1fa98a8ed
- MD5 cf14f322032a13805973e81a7b17fa47
- SHA1 ebd08b8f3b8c446bb9b267cba05b8e605550391a
- SHA512 da00613b5926cd3c3b7b911acc599bb441b59c983ba3d37213ca4a8e6b9e20bad8da7110a89591e16829672cff94a0683ffc0b43c1f676860d0a4f24caae78fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaNQ:A3k03kHRJQ
- TLSH T1F125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 971KB
- SHA256 ece064f4889261c768b26f80765124c518fa9a4d96e5964751afa668df469be6
- MD5 cf4aff3e06fc60a644854b3f65ea8d88
- SHA1 bb3718af82a8237564b2ed6a62bd043a5ca3b6cf
- SHA512 37da7b17317948ec46f196f0d52ae87d81c26f1713966814cc08ca584a79cdf2ace03628a915f82f1fb9711cf6710bfb3789aa77b3223867ec3482c227e4208b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaCX:A3k03kHRJg
- TLSH T1CC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 971KB
- SHA256 11d3ebb19a3ab4bb2bfab3dcd216dc07af5a28cea1b8ff956e8275f0f6959ae0
- MD5 3d75a7c4648fad53757c7d493b76cbc4
- SHA1 0eabcacb3258b2f1842001758bae6a261415e8a7
- SHA512 0ce35fc4055dbfbe1ac1584f98efcb317963af659dd19601c3dbc79eaee2fb0c8d80891f2b11a7e041bbfc38f53dfda8aee3aa767256a5818a607d7cd105745d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYakL:A3k03kHRJC
- TLSH T1B925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 971KB
- SHA256 4463433774e90f39afdd68ce8dadb9f88bf3f5afb52a41446c70ca7bfe3191ce
- MD5 092f8ea6fe6ba826a8bd33e0e41a349b
- SHA1 2ccc9af9d2d1527c9730d90706844b60822ec179
- SHA512 2135de28f1c24a7805cfe63e482909adf948dd1a6ea797875892e519950c89eed1fbf3a808a96a3983eed8bbd1b76c034d65b31119cade51c35aed87eb8e3692
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYaAM:A3k03kHRJP
- TLSH T1E725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 971KB
- SHA256 3d8f2aef17cdeed4e1fc29cd8820ee7bddc10616c78ba6a0d0ccb96086972d75
- MD5 2047c4d124d549b48610e0e292c4acc8
- SHA1 297bf786c78f3124d0dbc84c26a865b64c545835
- SHA512 3ebf0e0374bf560310a07be06a13777747a19561c025703ffb848739d247eeddbc73ebc92d2128e0a22692c62d3359677fa9bed165c651cc110e77a06531ba59
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2NlOYahh:A3k03kHRJB
- TLSH T18D25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH