Analysis
- max time kernel
77s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 21:09
Behavioral task
behavioral1
Sample
2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
11 signatures
150 seconds
General
- Target 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 948KB
- Sample260528-zzy3dadv9s
- SHA256 5887545c59520e4d5f1b7ad6ce86a7d38c81501f76a9edda75db551b99124c1a
- MD5 a7098c446a20ec43819b792acc296e25
- SHA1 2c894e6736fe1b0c86981fa07689172cd9f3effb
- SHA512 4f57b2977fc560803ea2051bb12cf286acfe2b0770beb83558d3e072dccba6476e8b68049426a06415f5a134cae10ddccb32fc17c74e71955aba1691d76bbe01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lF:A3k03kHRJ1
- TLSH T1B025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 42 IoCs
resource yara_rule behavioral1/memory/4260-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002446d-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2828-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b29-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4260-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2828-60-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000001f271-163.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021219-258.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021222-301.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021223-446.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021225-495.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021224-550.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021227-605.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021226-630.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001e00000001f271-721.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122b-746.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021229-790.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122c-804.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122d-847.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122f-872.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002122e-891.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021230-898.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021231-911.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021232-930.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021234-955.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021233-981.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021235-1013.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021238-1056.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021237-1087.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021239-1106.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123b-1143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002123a-1174.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123d-1181.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002123c-1200.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123e-1297.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021240-1329.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002123f-1349.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021243-1374.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021246-1381.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021248-1388.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000020392-1563.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002446d-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022b29-40.dat aspack_v212_v242 behavioral1/files/0x000a00000001f271-163.dat aspack_v212_v242 behavioral1/files/0x0002000000021219-258.dat aspack_v212_v242 behavioral1/files/0x0002000000021222-301.dat aspack_v212_v242 behavioral1/files/0x0002000000021223-446.dat aspack_v212_v242 behavioral1/files/0x0002000000021225-495.dat aspack_v212_v242 behavioral1/files/0x0003000000021224-550.dat aspack_v212_v242 behavioral1/files/0x0002000000021227-605.dat aspack_v212_v242 behavioral1/files/0x0003000000021226-630.dat aspack_v212_v242 behavioral1/files/0x001e00000001f271-721.dat aspack_v212_v242 behavioral1/files/0x000200000002122b-746.dat aspack_v212_v242 behavioral1/files/0x0003000000021229-790.dat aspack_v212_v242 behavioral1/files/0x000200000002122c-804.dat aspack_v212_v242 behavioral1/files/0x000200000002122d-847.dat aspack_v212_v242 behavioral1/files/0x000200000002122f-872.dat aspack_v212_v242 behavioral1/files/0x000300000002122e-891.dat aspack_v212_v242 behavioral1/files/0x0002000000021230-898.dat aspack_v212_v242 behavioral1/files/0x0002000000021231-911.dat aspack_v212_v242 behavioral1/files/0x0002000000021232-930.dat aspack_v212_v242 behavioral1/files/0x0002000000021234-955.dat aspack_v212_v242 behavioral1/files/0x0003000000021233-981.dat aspack_v212_v242 behavioral1/files/0x0002000000021235-1013.dat aspack_v212_v242 behavioral1/files/0x0002000000021238-1056.dat aspack_v212_v242 behavioral1/files/0x0003000000021237-1087.dat aspack_v212_v242 behavioral1/files/0x0002000000021239-1106.dat aspack_v212_v242 behavioral1/files/0x000200000002123b-1143.dat aspack_v212_v242 behavioral1/files/0x000300000002123a-1174.dat aspack_v212_v242 behavioral1/files/0x000200000002123d-1181.dat aspack_v212_v242 behavioral1/files/0x000300000002123c-1200.dat aspack_v212_v242 behavioral1/files/0x000200000002123e-1297.dat aspack_v212_v242 behavioral1/files/0x0002000000021240-1329.dat aspack_v212_v242 behavioral1/files/0x000300000002123f-1349.dat aspack_v212_v242 behavioral1/files/0x0002000000021243-1374.dat aspack_v212_v242 behavioral1/files/0x0002000000021246-1381.dat aspack_v212_v242 behavioral1/files/0x0002000000021248-1388.dat aspack_v212_v242 behavioral1/files/0x000b000000020392-1563.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2828 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4260 2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2828 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_a7098c446a20ec43819b792acc296e25_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4260
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2828
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 5887545c59520e4d5f1b7ad6ce86a7d38c81501f76a9edda75db551b99124c1a
- MD5 a7098c446a20ec43819b792acc296e25
- SHA1 2c894e6736fe1b0c86981fa07689172cd9f3effb
- SHA512 4f57b2977fc560803ea2051bb12cf286acfe2b0770beb83558d3e072dccba6476e8b68049426a06415f5a134cae10ddccb32fc17c74e71955aba1691d76bbe01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lF:A3k03kHRJ1
- TLSH T1B025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$
- Size 1.4MB
- SHA256 f84c83a5e88e7c45432c2e805503c414bf637ba7c49bc7b50893f9b3757797e3
- MD5 8bcfab8b3b82e0340825733d3d1089c8
- SHA1 177d77e8bab281aa86ed41176607669ac0323076
- SHA512 78d3f3e520eec553db9e9e400f0383dda244d26f990bad5c6ee9d34b9959baf44aa5aab4636fabcecf9a6dea78549a0392157646b1394d4907b1614ec756f5a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4l13Td9CHKy7GZO:A3k03kHRJlTd9CHKyao
- TLSH T16C65AE13E7D400E8E167C6349AA64622EA767C561B70D7CF136882192F33BD0AF3DB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 e10a2b968f575dba5b0cd756aa7ef6b5b3bbaf4995dd0d8c1cf170805e11fc2c
- MD5 35e93f8e1ee43174d1b92d5a85b27cdb
- SHA1 1ddf9ca4df831594af2769b669ed3d369441ff7d
- SHA512 b3a3e8a0c7a9eb917cd45d8012ed2647ccf02569d44adcb44b0b4ecc6a532652c0ebaf764c1486a8022f4c3ca5b908ef93d6c8322911aa170160ceee083beb0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lB0Le5ji0hmxNrM:A3k03kHRJxPji0Aj
- TLSH T1E1658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 962KB
- SHA256 ed1a7f8cf26b660e9ce808d6f5535bc7dc6219c6b59b1a042d259ef6ee5d1ed3
- MD5 cd3e643ff3df798b999c2d9882008cd2
- SHA1 636bc05393bd271f053b39fd461ad7d5a36c02e1
- SHA512 4cee47516c200c00235aea538fe913fdf7fe7d00b9637caa7dae2922804c4705f299858a621ad871788a4918fbe01e139ea54aff6e7097c6ea0ca378de24dfae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lDa:A3k03kHRJ
- TLSH T15925AF13EB9504E9D10AC174AAD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 1.1MB
- SHA256 afa36df89e8159cff84684883765bc17bd88cee7996021ed1950d571633d3cf3
- MD5 a5866b946e9cab259005eb36e0bea39a
- SHA1 141179feb34df12c5bfd012e67ff7015056f7a64
- SHA512 ee39d16eb2df1d0d989698ba140b277f6d41e24ec2d9e35a1b72f148466375b48ac71e40d323627594d1e0535020a39169d9c556290f30cc6a61d0ef0d3bfbd6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lKD:A3k03kHRJa
- TLSH T13B355907E69400A9D10E8174D7954A22FA777C5657E092CB23D8D23D2F72BC06EFA3A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 971KB
- SHA256 f2ed8bc729a467c905791fe537845c120a78817446238251ee523acc88130410
- MD5 80b66618f385bbfbfae6502386faed85
- SHA1 d8379d61b61861e321c3b11d7e8771d0943a72c5
- SHA512 645dc3a243bb149d1941d4f46a08bf7803ff50a58126b1eeb2447dc33717a7a0c24154b82a37ed763badf40daa302afd604b7da511ee2a490d71db3f3481cc68
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4li6:A3k03kHRJ9
- TLSH T17825AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 971KB
- SHA256 f73f9d0fe884cd9875a585e0fd1b83aed82d051feb83fe5b42492d5137b5ac0e
- MD5 48023b71a0e5360cbbc77c2f4ade056a
- SHA1 32ade135698ee1bc870222693c194d6ea13a7fae
- SHA512 e8e9b029cc6b96e38bc90b32931d1648d0222ce561a164e1fac062c1e4ae0a380fec0a5abe9f7dfabb0bdcc5154ac2d0cbd53588654820ed33535789bbbb745e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lC9:A3k03kHRJi
- TLSH T11625AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 971KB
- SHA256 c3fa212f39466eb3ec8a8cad3df6c709a228eaf37fd1107a9961723218363502
- MD5 fe0efb607838babea1d31798bd1d83d9
- SHA1 a3c69a6a6d6a523eb7cd9fee9fb5f3db9986523e
- SHA512 579767e358c9c011f4ad7db6104d614df49509100f2964365cb7820a31c543019c98b8bc68497931b525fd526814cea5ba1326339fb3e3deb1b633b266b6e037
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lCc:A3k03kHRJP
- TLSH T13C25AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 971KB
- SHA256 5aa1e7b283fc7d931ec5ed3dd5e36653b02cb6b0a5ed87670c1de6cfaf60ce03
- MD5 f6794e69262e08fada7df79b1be57602
- SHA1 45b666dedde95f144905fd3291a10ef935aa9121
- SHA512 08c64212d97fa5ed7dc65e1b4ac4f72770ffbd2ad3f958e9b4178c58125a7b826d43f21a837c058de313ee220763e09aa6d4565bf3fddd77a86c2c5226b989da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lLp:A3k03kHRJF
- TLSH T1E025AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 971KB
- SHA256 719f6479cb9304e62af96ac57c89befccdf5bf61c327a6131338d0257f9b8cba
- MD5 44decc95d7c102a9c71e8b089d3efc01
- SHA1 6f6d4835c5e4713d28cc0b9993e9d645639b5be0
- SHA512 eb0d339aeb50c0c341f140f55d819d0820ebcfa655ea14eeadc3bee158513539952c18d85ed8db86a464e32c2b1dae61559814ecf9931cb7cfe4bf6ef3cae9a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lcN:A3k03kHRJ+
- TLSH T1CA25AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 971KB
- SHA256 fb7b9e392e9046dcdee1478b9245f7c54f4e07b624963622cc1b38cb7f397004
- MD5 cc687509958a564a81275442c6749a33
- SHA1 2da8d98016d74fd65f479adca5cba388df5b1486
- SHA512 8ca6aef9482b0a352376f0a16b69d4745c770f79f19facf557b8770f0297505b53b4d3004654b29f711a3befabef680a51f2f18ffc4e20c4f4e7968175b7f607
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lEF:A3k03kHRJ8
- TLSH T14925AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 971KB
- SHA256 1834280bed90a240d504e2fa4c6c8cfc48b302235a82ad4ed0ca60f4a3189012
- MD5 894e55271f50a94ce13ddd9beb3dcc9b
- SHA1 6bb0e4a56276641575ed0cc5475dec2d5a7e3f82
- SHA512 767c8abc4cd7ea38bc2374bed2250c46a1793a03084ae08c4c1bbaf769aaaaca065b32f046a6f8a501d2c38407c5e04dfcd092f924fd8c9cb14d70a99b2314e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lhC:A3k03kHRJI
- TLSH T19825AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 971KB
- SHA256 6cf61ae4b9fcc386b2aa2bc64451b31e3e4706ab4da3d99c6ef16dae7083308b
- MD5 c7c5e59dc71b5c590e21bde62ed3bc5e
- SHA1 80be2fcf97d67bf678455b24e6f0786ce16f9a7f
- SHA512 b9e29bcd1341184d4cce8769d66623c9df5db72ddd609e9cd1cd1142462481a75a7330714d4cd682539139a4cb8d79286d804735746bc22d039fda1758dc2cfb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4liw:A3k03kHRJl
- TLSH T1F425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 971KB
- SHA256 69e8894e78cb8e86237e0dadabed2cb9f094c12de9a30a41394525a0aa1f06dc
- MD5 259e340a35b61879d5ea1a4d93a6f7b2
- SHA1 866aeab6ea6622deb042579763166cbb991d0f6a
- SHA512 6ac7673db14ba9c37756c7138c9ceefe5dde4048e62d48a1d49fa5c074cf49cfc5ab03e4d9aa1f7428ccd7489a0bb1c1bb28cad5b98bd4f5a65fc8ff72b47b02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lpT:A3k03kHRJZ
- TLSH T1B525AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 971KB
- SHA256 378a7236e637d6b180d92e26dde9018672906d4d09df3d35ba8d5fcf4ea79525
- MD5 2883866c191f16af89c88702ee49df6f
- SHA1 c32fb96c8e1b22dd28faa28f9286129f1c799507
- SHA512 f99592d9968021931ea83d0a2da1cc013baba96f46c38773870081e37e94cd35df07fb8f1c424dc52e63ec0a01b8fb27b68d74ad10b58481c416fe49fd32a1fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lHu:A3k03kHRJe
- TLSH T19225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 971KB
- SHA256 0de78ea6a55be54f622f9aa0a429fe03fb0ae133576d8d08ab8290d6e362e991
- MD5 2f07798c5fb6dba01d510c3b55005180
- SHA1 cccd4d1c545e34b93b124f727af7e14d70a8f012
- SHA512 b13f13391bd3b68a6e7ece93532f877ef5a83f31ebbf189ae42ba4569e0a6c0b5ef26bfbd56691edb3cace6b56981b7332d8ed77cb2b305d3a36ae806600865a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lbb:A3k03kHRJf
- TLSH T19E25AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 971KB
- SHA256 ade96b82e4c509e04306b720f0bbbfd2ce15d8a87fa78671a46af821457e34ac
- MD5 85c99c4b902ea888d674cbf083dcc15d
- SHA1 8bdcc0ef13349f565bce901c9b1576c29316532f
- SHA512 a91d1eed88c43c3831a558295b0698196bc606957b67c4f1bc0f3eba0848433f921e4ceb70c122bedb902b166b6a30b211c9bf2c5cb28277967246abc5eab27c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lvf:A3k03kHRJX
- TLSH T1D025AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 971KB
- SHA256 f4f4bc089ec29fbdc30e722358d7995dfacb5651b50e3c8ec3351d7b2539738e
- MD5 577f9a16f2a6957a9587eff9b6a06cda
- SHA1 a3658a539e5c677bb26e41b42c5dfda081ce90f6
- SHA512 cd8ca89052e758e85adfcfc9ff03d3c6b481e5669e7ba64b71e7879f5232058b86f478faf35cd83a1176b3ec4aecc636d7df3fe72d0206bc3455e7e249a10609
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4l4K:A3k03kHRJX
- TLSH T11925AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 971KB
- SHA256 e9a21f1e5c65844eac93db4cbe6a5774cdb48cfae4e44cec30756d462e1d8e38
- MD5 db640d2b81a59a8c7a3b3a609a3f2992
- SHA1 a6d05c3308aa6ef263957fa5455e9a3dc32cc6a4
- SHA512 16081aa150f36084455349654c49be5a14669bb0bffa94cb9d5faeac3d1a7468e176a4143796339edd50c4ce9950aa44cb756628d87d9c8af5cc58855371017f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4llk:A3k03kHRJy
- TLSH T13F25AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 971KB
- SHA256 8bbc95f93cf5766e37a926732eeeee0eb7b3e461cd06e7bb59d35022dddafee9
- MD5 27dc04f290c92aa5f95d869619dcc6eb
- SHA1 8913f0b735020611a68334ef8e106b60acb88fac
- SHA512 d8a299ade0d3f1ca7359e36f6da23147e1434df1eca15ca929832de6f9396370d0453231e7518b80a1b1ffe447f38c8d2504014b0130a2f52094af63ce82fd0d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4l60:A3k03kHRJ3
- TLSH T1C825AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 971KB
- SHA256 a02272d6092b706eabb596bd8f1e786fbd30b7e9b7bd8043f14a9573aa1feaca
- MD5 0ced36b1cffb256b2d6c11cf379a68ac
- SHA1 cdc1a43ed843ef79e7fef3d54d0eed6a1b60d5d5
- SHA512 b8486ceb58eff3e7f66d7e680f3cdd0f8a5a4c7985bb13b040a5895e69b7f16cef83ab8f971f3bdf074656b14aa7ac96901e0740d98be91f89f39742d6b97802
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lpg:A3k03kHRJK
- TLSH T12425AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 971KB
- SHA256 6f092503fc750d81df5350d6c7c0b55e40ef5b8efa428f6d8b58c9d0e48844aa
- MD5 342233f37452d44649179533550f1d7c
- SHA1 9ee5643b2ea5e4fedb982ea5c48dc6c5f3ca84f1
- SHA512 18b0709ab9c4fadc218a8bf49f148f70cc66e237bbfd1f266856b8f4d1af71862e77904d909df6d983092fa78f41dcefff0f780a984da604924e1f2eeaab2ae9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lQr:A3k03kHRJU
- TLSH T1FE25AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 971KB
- SHA256 85956ecb2bee2d9a85a5d6caa9bf815196256adc81655050048b820a4b3dc035
- MD5 45eab6d6063847636a7ea9ca9f5184e9
- SHA1 bc1a2b066f597dbb79328e1484d6bf53ccfe180c
- SHA512 d927caae441e1bccb69dbc72affbbd5e40ac882f1c05c8efc31c32a43e09fa1c40129e4cc2eaf9679fc3a48037a3f138477cb7e64e0a335d84add66e40a8d116
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lOn:A3k03kHRJO
- TLSH T12325AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 971KB
- SHA256 2dc6a76926ba396983e7a1bc226fc9c3b914372d1119569553811d862bba266d
- MD5 0d89e139978e62528f4f94f14f97ef62
- SHA1 644e04f1eda1182e09693bd0f2116dd7c59b8563
- SHA512 ca6fe21bdfbd9ff75808a4c7b8c6c66d6290680fee2c330e21bb23c0ecee3e4d573f280276b2c247fbebae856f4843980d08c1efe212291de6ca392b8faaaced
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lEx:A3k03kHRJU
- TLSH T1E125AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 971KB
- SHA256 8ea8d009ae62ae044f9e052f8d44ddf8eb84be3c9839ab1f8120dd18d1d830a2
- MD5 34da5721fbc2b7fc2ddc4e98d9617f26
- SHA1 1a46becd1863f23738fb6db08a32de44857cd04d
- SHA512 e9645fe17098e93b83b7699544527a66e52f039dd79bc8e6e8bc5aadf13ab969230707b1018addc85abdc018f722f827e33afe852b8ee883328a50de16bdfede
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lOA:A3k03kHRJ/
- TLSH T18225AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 971KB
- SHA256 7aa2869ee3aaab6df75f79d76b8bff77298bcdb45b8595b07d2381afcc41cf6f
- MD5 3e679e4107cb2582e431e1ed2545ac60
- SHA1 fe3c68286194479b2448885912244f77c91b6c0c
- SHA512 68f29d6cfdac00ff07b3c97558a41b331930988eed2de6a88d59209e45665f747e90219cf988d4d15b78ec1e18030d42966f087401f6d99b992b67055368251d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lH9Q:A3k03kHRJS
- TLSH T15C25AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 971KB
- SHA256 68f419edc3191a9352145364637f1917e0ab3f56a0c5fba27fa9dca94abea6f3
- MD5 9bfe7c910229be01aed228b3c6fd9f2a
- SHA1 f4a32f0d270a73ccc093ca642a3af11354b01255
- SHA512 03777a7718c86dbb79eaef1944b53ddcc19c776766c77a2ec9a146840f37854d5c13b05e3a140f502356a5eb684446790b226f273eba0f0d5b044570c0ff836d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lO4:A3k03kHRJh
- TLSH T1DF25AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 971KB
- SHA256 3617ce4e50983dd744d3e945d568392c327bc45e53b800b6b68772df528b0554
- MD5 8ffb558807abfe49222fccc32c12b0be
- SHA1 c9f69d44b376f7025e7c97ddde53655759b39055
- SHA512 d6547017bb9222f3828d40c2050df660d1350cbabf5731a3992014d3e0933b940a116d8d36afbf8e55079db92a42365c4f5dc23f72120e7c830c21bb285d6e4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4ltu:A3k03kHRJ8
- TLSH T18425AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 971KB
- SHA256 1d04a326f5b459e7896e70da5c7a970e89a8e3abf4051291208432d5c121ebed
- MD5 8e9087a4cde2fb5753e45005239ce261
- SHA1 1d286982dcd73c53d351969ab64543759c3d8beb
- SHA512 2e2d5b24c4b6f376c11d1a4e9565481c5c0c7cff95200a2d5781970a2f6558ff5b8743ae3e7429d8bc87e855f770d135455b45ef2a5a817e6080f8e020e9b928
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lgj:A3k03kHRJe
- TLSH T19C25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 971KB
- SHA256 e48d88b4d2d17c28e124d2de92c9139b896783da297dad3b43036b46c056e161
- MD5 a29a3322a16fd853a1b33f5efeafedc7
- SHA1 1d3c3f2193d3cf2eb54896d02fcd4daee528ec5a
- SHA512 05a1aced60c78f3a37fb1543332420a0e3ccb85f6ebc9fa0909a9e5613c4a38a779aaf7ff5b883e8f89283912ef7ab3029a9c504970bbdf8873f4d518ceeb68a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lRg:A3k03kHRJS
- TLSH T11625AE13EB9504E9E10AC174AAD64A23EB75BC561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 971KB
- SHA256 bd2bbd4a23192da94973e7688d9485eb07300de71a8fea310956d32ab9e898d0
- MD5 f14fc3b611f99ffd4d68ac4e806c15ea
- SHA1 b6af9e4756d2360e73da35981c32616a7732e581
- SHA512 e4e76f8c3f554909d5d08374667940e63fa8991074326e9106ae6caacca83741caf5bd1562f845f5109853c505efe3afa116253d668caa630cead0f239afb36a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lII:A3k03kHRJj
- TLSH T14725AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 971KB
- SHA256 d944dfcd633bb80a05d270d580ec6ccd4bc11e3709ff49cf003f4edddef83a2c
- MD5 676bcbbbbb3fde5ba625f9a8c62a88d8
- SHA1 f7e8ad610e440988fb54c5f4c2cc0552bb6156dc
- SHA512 d3ee6f769413718a6fb9499904808459d3a8e1fa97f7e0d6464a5dfbb4dfd8ce8230046e281fe08115f1af7346017fed68880862b35ea849d0c6f77c4825aee0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lqo:A3k03kHRJ9
- TLSH T1AA25AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 971KB
- SHA256 e5296095ce57df82c2e86abec5a561f6ada511a0ea797b186652e6e5f64ec011
- MD5 a5242d72b5b69dc2acad7269acfac6ac
- SHA1 a7f9108c0b91a2c1757fbd268e41e81fffbe9a76
- SHA512 3aa0f38847acd4e2ec1274f2ab976f0f73efd998fbfc777aa598e7004e5dd72a0da5303d29678aadf4fd48078bc2445913b5ad66ab6fcd2c8840b4050e6a12f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lB+:A3k03kHRJ4
- TLSH T1E625AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 971KB
- SHA256 2d132e9c59e9f3ebe8d66abaaaba0a70dccb94dd4cc3a5013627f1bf42cf3971
- MD5 b7f54812d0621b7d4502d188eba99c17
- SHA1 26884c90289890a682ac5ec6e22e830403ea3764
- SHA512 8dc546db8e912b5eeff9f03e1a82389d667d5278a7d1c96c747d9677052aa41c6a5aa1b46dd4bb6ef69295e6f2af14a742e9a06bcfd7186cc855ac36c81501d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lPQ:A3k03kHRJ4
- TLSH T19325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 971KB
- SHA256 5fb12a28011a223e085797e019f2b9a27d42f7b43734522681fa7ceebbf0d5f6
- MD5 8b28cb49fc5d71f87266131e642d819b
- SHA1 bd34cc9599309528884f76cc77da8e97d55260a2
- SHA512 49c35971d21c987c9176009db152f61cc106fe9554987c139e7ee89e4ba6404ce0bdffd27142f689017eda2a58615e5e33b775f60c3acdf455b807bc5a510a8b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lUX:A3k03kHRJI
- TLSH T16225AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 971KB
- SHA256 826676f1f6e6de47803e55e54c4f01ef41caee4c32cd1322144cc8596b5a8a2a
- MD5 fe0deaadaefab87b295e846c1f510518
- SHA1 eebb5fe32b685223bf13ad79efb25c115729b505
- SHA512 9300897ea21936f227d7aa759505deda2cb94d2d42a7e0ec26205b52995a557d83af56e69fba36abf569125cf7867f19daa2bdc9f8d7a1f8606c2094e7db9d99
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lyL:A3k03kHRJa
- TLSH T18F25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 971KB
- SHA256 dfa71371d8898b18c8509db451a327e01d770ef92acf7f7dd87983b766e7dc5c
- MD5 3b26b6dabf16352a4e3776f5908635e0
- SHA1 ce0e6150797621e18b4942d32ccce4f40687e355
- SHA512 dce9c99c16a936a3bde375978f90c602fcad7f6e6b6009daf133f4457a925586039a30960a19d5d60cfef831187ceaa0f2a96894c58e37a073e65b77c84fb886
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lWM:A3k03kHRJ3
- TLSH T15925AE13EB9504E9E10AC174AAD64A23EB75BD561760D3DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 971KB
- SHA256 8f092635cc161fc067b429a76fbc71071c2ed12cff86cd82bc63c81062793f5d
- MD5 7565e50096f23078b87b74a693bdd1b6
- SHA1 23237db7d7e2ff113bebed1020f1da9c1a521238
- SHA512 eb3aa7536d49d2cd41578892af57ec9795fe7dd2cb39e352a2b2958f46944fec20d0474f4df5fa699ac638020d41c6a237ba3169daa868888d8f18c4554fb213
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaohcH4lfh:A3k03kHRJp
- TLSH T1EC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH