Analysis
- max time kernel
124s - max time network
118s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 22:34
Behavioral task
behavioral1
Sample
2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260702-2hadsscw5m
- SHA256 c911cfecf71986a9a26bb34b3f29ba64381884c619f902e78ded790d3eb5e3d0
- MD5 b8327313298ef7367676b12dc8fb0e3e
- SHA1 afb1cb285d68a199d844dc263842408c4c85487e
- SHA512 548cfc9244e888c25410c374f5f36543911938b815990560974033fe6edd6f0b1ed63c15d1b2736fb3f184faa1f0ede730056f576b1883e6d9bc548fc1616d8d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/9:A3k03kHRJR
- TLSH T10915AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/1268-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001800000001c1fd-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c5-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1268-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2332-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c82-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001897b-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a02-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a58-232.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019845-239.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a55-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-297.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-310.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-456.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-506.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-610.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-635.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-690.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-745.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-758.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-814.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-884.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-923.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-968.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1023.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1068.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1106.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1125.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1156.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1238.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1354.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001800000001c1fd-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c5-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e6-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c82-60.dat aspack_v212_v242 behavioral2/files/0x000400000001897b-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a02-211.dat aspack_v212_v242 behavioral2/files/0x0005000000018a58-232.dat aspack_v212_v242 behavioral2/files/0x0004000000019845-239.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-252.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-259.dat aspack_v212_v242 behavioral2/files/0x0004000000018a55-266.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-297.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-310.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-456.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-506.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-525.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-610.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-635.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-690.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-745.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-758.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-801.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-814.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-884.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-910.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-923.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-949.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-968.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1023.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1060.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1068.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1106.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1125.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1156.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1194.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1201.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1238.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1341.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1354.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2332 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1268 2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2332 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_b8327313298ef7367676b12dc8fb0e3e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1268
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2332
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 c911cfecf71986a9a26bb34b3f29ba64381884c619f902e78ded790d3eb5e3d0
- MD5 b8327313298ef7367676b12dc8fb0e3e
- SHA1 afb1cb285d68a199d844dc263842408c4c85487e
- SHA512 548cfc9244e888c25410c374f5f36543911938b815990560974033fe6edd6f0b1ed63c15d1b2736fb3f184faa1f0ede730056f576b1883e6d9bc548fc1616d8d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/9:A3k03kHRJR
- TLSH T10915AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 1e19464ff93d6efc2c56b3100cfaf536b1372e02a6212684ed21125a504df8a3
- MD5 cfd0a5a3e3f4c3f670ee9b9cc92588a2
- SHA1 5fcdbecd7ec81a39389e375cb836850f9d202d04
- SHA512 1f7b093c891a5e7260e7723b1079d1651cefe861eb8747951a95c7edb6d9535a4dd4881dbae7e9bff5d41d0603137e936af43e415a476bf76e969e0aae86f3ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/J0Le5ji0hmxNrM:A3k03kHRJtPji0Aj
- TLSH T1EE657C17F6A402B5D067C0B9C5D6AA5AFA713842173086CF1398C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 720881d2341576745afec11717721b055f6ad16507b005cbbd10b707ce0813e4
- MD5 453c840b916032f5640f251156fc19a4
- SHA1 7e9b01b1b5e58717edc7a02bd877875758e3d8db
- SHA512 fe63b6fb8dd05c769fba9cb0c86e15d09acef4d10d25b23466ce00f4b7adc5cc7dc232e6c7ef9641a86439294fef265c2edb192fe1d10589998c3b4ee11e7b9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/ba:A3k03kHRJ
- TLSH T14915AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 971KB
- SHA256 0a715eb90cbdf11a1358feb7806ee03971e3a94a364805263d48c33be00b9700
- MD5 dd8f33f628f39cbde0204e8b80bf3806
- SHA1 d23b2cc08aa7341aac3f5967ad3e627c7f1c137c
- SHA512 27357651cfb509297e4ce90737ce306ac7cdb2ed25e89667160d6848a9413b254930956736dfae55882df6ad5cad397d8bc617a72dcd143790d51fbc5e51d494
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/4b:A3k03kHRJsb
- TLSH T1B2259E03E79400E9E10AC1749AE69A23FB75BC52176093DF2358D6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 947KB
- SHA256 23898e0c872cccabec1d139c7569349e133184cc080eb149c336d22a356015e8
- MD5 bd342503fc7d7ccfaa586cb3038abccb
- SHA1 88ab1fa4db7beccacb299d2c2562df821635c29f
- SHA512 c73b9b4bffbaca83b47d5bfdf12552d9c1c467d2d2c38b550b154647aa949841f0271bc2f4fdb020060ac6dc70cd23c69625dae1b06ca8bff6aa85e64ecc5890
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/jZ:A3k03kHRJB
- TLSH T10625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 947KB
- SHA256 7caaa33fd3fdb84663a25cba5e9002028b031afdc1534e75a7948ba0a795ee97
- MD5 0d8295f1cf46bc84be0a5f13a32579c0
- SHA1 34a75eb67518176b77adb33e6b341f87ea35d44f
- SHA512 15901c51ded824f5717d310be86ef6447a5868010c55730320c19c7eb56a509c81d6003b85e003d39beeb2df01c1910e4d53c4435691930ca7721acc259e2659
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Y1:A3k03kHRJO
- TLSH T17125AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 947KB
- SHA256 3c124e771e4b61b913af1095a551d445c56bf76317c430529247a736b043564b
- MD5 8014b3d054f0dee116c038608e5de5da
- SHA1 47c66c35443cbfa14dccbdb8669c193d4e52de6b
- SHA512 90ff979606b28dcc59ba772682ecfd9cfeb49c0de27400f14fdf7db6ad8bd54ff1a6401f8b04838fd28586c1b16558da3f3802c97aa1809eb53dc8a712b927c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/66:A3k03kHRJJ
- TLSH T1C125AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 947KB
- SHA256 f844e78f5170e9f6c59215d0b1ad468bd8682ec5ebf0c7d3b26c9d07eac25c2d
- MD5 d6b636c4f003aaf0287835bcdbd94571
- SHA1 e6e2292d68841edfbb714a29f966c99624414185
- SHA512 a3aa897079ff736dcd952ab97de21c275cff8a2eda7c39deeb68aa37f9f4c3204daab7ca9be21265fb3fc2aa64cc130276d776a1f79670557984ae3858de75ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/yN:A3k03kHRJw
- TLSH T15C25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 947KB
- SHA256 a9c0b4ffa98075c5a68f4471230480bafef3294e126797cbae51a2a30ea675d2
- MD5 3bce167f23f51e37d462a44b833281c0
- SHA1 fed0fa24e3f30c35c243e923670491917e1be769
- SHA512 09dcb7f1fd6aebc5e617d62619da497059a26892f6c69b4eebadc221bdc74c633c52c3653e843b86bb03406ec9647c9af34a02367ffd3c615d2faeb22ac41f3e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/of:A3k03kHRJo
- TLSH T1AB25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 947KB
- SHA256 1a32de75860763949e97c289a40bd87d1871e7f3efc5b24471ac9457e37d1d08
- MD5 bee8631483450030f882e7f3e59f3c69
- SHA1 13c782504c4792180615135940f55256622fd162
- SHA512 630f9d0a0af6a8228d645c40eeab604734d3ed1380d280df957ecbda570585ca48123ae339a88048ef30a0aca3cae1fad6564e434d08f1b0c6151ff17da08a50
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Co:A3k03kHRJV
- TLSH T1F625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 947KB
- SHA256 2619f68efc964968643b7bdd7486b0822b4d3af869832b6f36935473e41c9440
- MD5 530f5184275ccf1dbcc361b844fd17f6
- SHA1 442c20d3e7c8c92a5ffbd13ecdcdfd293e07984f
- SHA512 bf7653a92162dafeda814ee3633da711abb2fcf4d021b55e7b5888bbb410d7f77383c1d73738fe498c0bc722e811dfe9d1edff9458bb0983cac90641012bdc7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/2u:A3k03kHRJX
- TLSH T10B25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 ebe37915708c86e4b1fb69c811899418ad594b6a7bb506d03e8bd7b28261cb97
- MD5 d188f803c0f348da57915e7c6d7cd158
- SHA1 00c18cf0f85cd13d9d24bb6e00c364cc6a119a31
- SHA512 eed3954256d1ecac6d7ab372afbdb8df18c312c8a280acd94ae47525ea598515839ac552571e10f6847375596f474b446baa9de11e6855306447b4ceca7cb80f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/q9:A3k03kHRJ2
- TLSH T13A25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 83abfbb035f120872624b11770936a2370a1bac7e64ebbaab907d00ed5363f17
- MD5 e47dc1709ae96296028332d20f361ef1
- SHA1 c37e5ffefadac453a50cb4e4aaf82c60f303756f
- SHA512 2ccda00dbf6359ed0e9c358c43da91c44a00aa31ae0a4f9cbb5344819bee9e40790807d180408ea54936ba8c24d5f68a2670a65e2e436242624cc51c4f4e8153
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/qc:A3k03kHRJb
- TLSH T1CD25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 f4b421cb380b54aa8cdd711ec0907dcc0242d6ccf8533df5c421149a547610bb
- MD5 3738c86584d41750143734bd361047b8
- SHA1 ff82fa8f2488d27ca0dfd9d9a9472f3d7203e9e3
- SHA512 b359e75d1cff27f955ca648d5ce227f0658db6bc2c8a855690d9a98135b2ae5114e75738c3e4f2b3f34616379b78f0617fe413d72947b148e44b02615f7fef82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/jp:A3k03kHRJZ
- TLSH T18425AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 de35eb66ed66679a788405c4ea941cafc0b95269a117efbc92212e85ed6b16b1
- MD5 908ff7650acfb92ef32f60c53b10f73e
- SHA1 71505b4d4d6e45ccd8738ae3c7562c9a9e45a269
- SHA512 fd9442e6171f049455f1b488e0f09ad2c7c0b266734703fd91d8365bfd89837ef4a12892e2600dfdb49f21830b5b65101926e4db909af19af7b79a657c4cac45
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/EN:A3k03kHRJC
- TLSH T16025AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 05ddefe1ced69b9c9d585b21d4fee50596f9603a6e8f50799da8098a94dae47d
- MD5 18e978923f73590aae4b9454efdd7fc3
- SHA1 bf3676a2b537a80a6a849b148ba67a86be622089
- SHA512 1088034ed96c70da75dc9a1471cb2c7d42f4d47eee32d88dd8fff5b2ff36cf18ffd5b8ded6bbf149d7d83cd1bcfe8d21543e0cb998a38647eea3d5b21b61bb86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/sF:A3k03kHRJo
- TLSH T1B825AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 a05260c1feafa51121e63f98615785ecbfa60006b2819bc8153e514a28904558
- MD5 19a3eded22bc3535d6fd0d9da66352a2
- SHA1 f29b8bf90f1eb562527fefaa80021e8db8e9e928
- SHA512 8462b3db88b6f206e66263a539b7e53710a15a1b9b304bf9ff8d1c371ac103aa4eadc32286dd912a727379e99ab63933ddc17836a9406b639ae47aebccf99c8a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/ZC:A3k03kHRJ8
- TLSH T11025AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 f5dccb1b789364e180b85bf8b9ac1ab87a685b21e99188aff197b5d1598480ec
- MD5 373386ee63ff8c0189887cfc0327c8a1
- SHA1 4026010f128d74ecf1773d6eb5d225bcfd8f8f0c
- SHA512 1410aa916fba7a701c68cb3f51f29139edcd93d3685ba20e61c155e819c01c3786f5c73d1b255e9b50284b9aa545e7b03de7b77110018e42753585aa2730f6c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/aw:A3k03kHRJx
- TLSH T13225AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 1b2c239059839b25c7616c5cf47865cc9882ee0a94627a2827d4ce39061416b9
- MD5 a56229c5b067c8684d082681896fbca2
- SHA1 7a1aa8028a7e93f0b659129d9dd7d07502e7a7fe
- SHA512 dd5539b3319d0a1a1c6f0769130aef48ec695cb0d03c143352b162c51f292777b5e71e0d793ac73ab48d1b7ff29765e8082b9863566b8949298500878ce02ffc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/hT:A3k03kHRJl
- TLSH T1F625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 cf07a7811236ea754362127eaee645ed72cc6852fe34f5d8b34ebeb3c1686a77
- MD5 7afd59a63ce0f9ffc4e6779c83269a73
- SHA1 0813d5e40684df371aadf60026c65dca95bbc804
- SHA512 c6f3cb1b6d6ec0c87a9bd7fb3b70935c7e9a94416a9147796023b65938b39d9c3940bcd667d298d48e630219a90cf057da3312fd567045662f6d8b2f9a655c6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Pu:A3k03kHRJa
- TLSH T1D625AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 a8b45e5505244dccf3ea60e49f8f8316e5d809e72bbbb3496d2ebfb2907d3ef4
- MD5 12e2df7d52e7001d0773870584125ecc
- SHA1 8d6eff9a7af1846ab5c95546074ac143993b668d
- SHA512 4f9cd91c16e64ee44660854fe945567d8532a31d35e94de6d9e176ce688e1819a82c12918e8b36f771a7d4682bc6c8c534bebd2388e71daf249440dbbed0ddac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/zb:A3k03kHRJ7
- TLSH T15725AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 059107abb88bccda029cccdf55558587d0f2049ca32c24ad1ae31b9df10ed902
- MD5 83529c92528df8f2246bb33594b0f716
- SHA1 955278b376e7c10eb046c8f4fbcc46a66258010d
- SHA512 83ad3cd12f6887b105d3639508c1681fec1b8243593801a2814e42e43fa3218ee83a0cabded0676a1650aeeec922e300bcd3b39281b66be92cec080af7b49d3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Hf:A3k03kHRJD
- TLSH T18B25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 4f3aa508cc2ceee9cbd79e7a9ee656e75d188272ab657537b244854754d2c763
- MD5 48ff5f9306ffef6a2deed317761ef299
- SHA1 45a0d9722ea13746248f828c6cea6eb0eb676df2
- SHA512 f14c681ebfbab6237081bf4eb2174445c0a7e8e8c7ef0c9b7a38c9bbf08106261f6e6a6bdece2f11d22671e59547cb603dd0213f7dd7ca2c778f44374f87b153
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/wK:A3k03kHRJz
- TLSH T1E325AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 57588c54eacfe7f8f26410bb820d1a1880c4e8c5b2b8d6bda10785e1433f2628
- MD5 766718a3ce0208d4fd6fcd0bc7265703
- SHA1 039d8b6ed30837fec59da1613188e28e6f4bbdf5
- SHA512 fc7eb8dd2977401f9bd5f0315459672cc72f83aceaad2f388023fb9c0bcbe76bcf588885612f3a35bd858eac7851a709c8d15bab96d5e98bc4ded2b668e5c7e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/tk:A3k03kHRJe
- TLSH T1AB25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 99a13629e5e6116b43b91728fca9a5a46cb0ce19f9cc6e10a54facaedea8729d
- MD5 94a89e42e627957a491ab71eecc0df5a
- SHA1 51384dfe086c96f09e40ae62e0095c754b587a87
- SHA512 c38ca52228e4a2934478732d3ada8d022475b31f1f0ef9f5e8e7f88c3d3f78607192226df23b21e88060787de5a60ff06a34decc06214ed4f45ba6dc472d9c77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/y0:A3k03kHRJD
- TLSH T1AB25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 3ed0008774db0dc096758a0fea69a633c38d2c2d767a5aa1304d8f20a620815e
- MD5 0b2e305151c778a50ad536453f402d2b
- SHA1 3a812760303f81f673bbe53d777c2c4ff86848a3
- SHA512 45b284343455f4dd95cca48e617e722a6f3d6c7ceb08d983d3a98524bdf446db2e200b6e04ae378e689a63f9debf3b6f5a859ba4c1638bb71ac097a21a8ea5a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Bg:A3k03kHRJm
- TLSH T19325AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 ace6d6db9a68772600ff99f1b6c08810f0736f5147a99ed167e18daf7ae96cf7
- MD5 92772a7a4fa31f54a1e1fdca9ad7d631
- SHA1 aa4d9854312bbb88279598b6ff12265d797d97c1
- SHA512 b9119890cb8c13720af61359101d21ed31c6dabd093d10326072cb34b4dfae517e530578e0a63d0da7e4df920b269159a66c7ee7fe07ab9b95cc992e55a4e2b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/or:A3k03kHRJo
- TLSH T17725AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 6c0a21fe3dce65711572821da576b87cf059b719ecf85d6ca17cbcc1e7a6fa38
- MD5 2a6546d8f49b94376f9637db0afeedf2
- SHA1 03a76fc28ba11a99446ec258ddb7339975a53d9b
- SHA512 68dce0b7b2cc806298bfc749ff3c7aee17467226b9406702f44b02342c3b21be474f532e4bbff0ea1856ee4e006f4dc02dd298774acc8143c33224353b360e42
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Gn:A3k03kHRJK
- TLSH T13F25AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 8b4aec9bad9705bd83c8e4f544d7c88346be7390de84d209bc8673f35f4f08fc
- MD5 d693b92939d6ee4c42af82dcc96fe908
- SHA1 302b74c9c8a88aea442b08fe9c06b6e00475e8e6
- SHA512 ed1a145eaa4f04195b749310591c4a4904653f33499211ad0ffe01a1525b9a6ef3966e443f69a0ed3051572c142a7be48e63f4765303f431a640963bf6c3c02b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Mx:A3k03kHRJo
- TLSH T1A525AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 3243f9964f3b161d19781f6cc99a16643e9e174a3ca7a44a7e567a597a3feeda
- MD5 b6696e01d8214acb31d528dad16d543d
- SHA1 94193bef823ff7cf82c0198d6272f6f4fbcb68b5
- SHA512 e20f331aac54a271acb03a7d68ad2626eb25ab8fbd77fcf0012bfa752f6a71dbb7d7a67b242a413ab32fb913b85604ee4d5abd50e9c0edbb4180a78687dbc93a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/GA:A3k03kHRJr
- TLSH T1CC25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 cd572cb7ad687cb9762f68b16eca8b5103f949b756fb45cb2371c597c00a2bec
- MD5 14274bf9f0e0972deb46ec7e0b68140e
- SHA1 198e332dbd109e7a6b9b176fd1d81bd24509388d
- SHA512 73e07780404645f0482b90219490c99cae83d0f3478c22d88f32fbaa999e9752c6f63462691a622d5e76030672078728c9cbc13ac602ec2ad2e2db9f4098d539
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/f9Q:A3k03kHRJm
- TLSH T11525AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 2a48a6f1dd8433c04a30a2bb0d607769bfb46e73a2ecc490d1f656b4e8c0a15a
- MD5 e64f664eabcdfba97717035aad561a93
- SHA1 916f2655b97ea6591edcca79d7553c5f01e8b600
- SHA512 c68cff9cdc88b2248cc5ce6c7fffcc21df1447076ed41ae2e4e63d7e81a6ef142d63487311fab6b20f3b390fed49b04be039100eb3c16be5a222c6652a58c070
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/W4:A3k03kHRJ1
- TLSH T15025AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 18c10081c8df84270e027f4fa896664675a3f44697cc3deb0ffec0e76a64f230
- MD5 97c1162d8b514eef752ee570a06ba958
- SHA1 deb3bee3554afaa9ba7c5b71f047e0552731b635
- SHA512 4ab395fd6c4b504199d47ab5a554cbd48b658e0bd60410f707487c8cb8a8bdd3b55f39fafc1ab5134b96589c10de58a9f47955e4815f659336fee0fb259a3c5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Fu:A3k03kHRJg
- TLSH T15525AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 6a43da9b4e23bdc72bbbe9b06228093c84e5182121e2fd1f124936e5320e0998
- MD5 21cb52a4a87cb947e875dd9873d4d65e
- SHA1 b8f78fa97a7d1e555aa35ce3e3cfce3da4503763
- SHA512 9532e2f3c4f955c054e4c2fdb2d714946b11cf02434400cc013de931f7de67831d5ec5184b5efe68fe76fa74b3faee3831ec8100a63f34286250e0bc07ddbcb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/Yj:A3k03kHRJ6
- TLSH T10E25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 5767b95587431f8aa82d51a41e53282937865a799e0090539486798ebb332b7d
- MD5 80eaf051c9de4f4111646d3c981c1457
- SHA1 86b6b966d987860aa4de5b40aab48c325374389c
- SHA512 f994cccf52e04f33d4faf3cc5045d4b6d66122fdd1fb603bae8c4cc789fd944dcb398fbc2f97fcc42f695904283c6de3f04d08dd99034a26785d64d638a102cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/pg:A3k03kHRJO
- TLSH T16125AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 16c45df1bbc85e0ced3a61ce668f1c42bad6eea62a6eb820aea6b65e6650cf91
- MD5 0b00f5a00e79ea381a7402dd416e4f2d
- SHA1 e99718eab62f611cbb0f5df39aef68fcade0af16
- SHA512 7f4e9138882fdaf28bd4946c216aea9cfc4fada2cc80e34b86498974af26c17fe73a7ee318670a15d47e93a532262f9f84337561b1cf453974c96ed54855151b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/wI:A3k03kHRJH
- TLSH T19125AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 8c46a2904b2ce288f6bc7c74682c0aa60a685f6ba991e47b1508d63d965bea1b
- MD5 3135baaba2a4f4903bc722120ac08f4e
- SHA1 e0abf691aac6695582812059f4ef457b1056457b
- SHA512 36bede502c660a4edd80027f79e12add468abf8aa276954927026e8b60820ab30b86e69e78f21da43c4bd1baecc8575641cc47cd686ca366c79018c42ac5c1ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/yo:A3k03kHRJB
- TLSH T1FB25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 473aa7bf89419968f59eed0f3c269a911a7b447698c7b2d73cbd17e29b334f1e
- MD5 0b0bfe73cc3ed9aed2c6c594b11aa38e
- SHA1 2940cff00f9a5306bffcafab599790f9e28e8bfd
- SHA512 5db077f740093635c400864e877d57f7b90dd6a4cc51c767d649c4f987ae777eec8cef89e0fff69917b9ddc81b73bf787e7643f518024ea7cd22d6c88de53a4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/p+:A3k03kHRJE
- TLSH T12325AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 d683664017c350def994b8d48ce174b295aa498f7fdd65c16f10e21ab2f4ac1d
- MD5 786b11489ec4f702c6a79217ce3725b1
- SHA1 6ca179f183c6d44ce2e5a86d2eca3a7872df9b92
- SHA512 1724039991429e56605c794d9c05259daa632532321c84f1d5e181d47c73700a4d8b0039c7fa14533dbae7071750de64e2ff7b2301b0b7b1fe65c8cb2c67800f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/XQ:A3k03kHRJM
- TLSH T11525AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 09183a06a893eb941309b3ebeb4ac681e5b91a4edf25ff257c3aae8a85b8ca0f
- MD5 9487894430e259409a13cc0c67b9c815
- SHA1 1aec0e30253ab85cea08c93d4628af15610ab16a
- SHA512 f3213116ecbfe669dd3a34a2e6b399e086f4c122930547036e249f075e4e5b9ff185aa9a66b21df1c1f369b4a6f997ad2f2d3724f9be1588f40a5f93714bb9f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/sX:A3k03kHRJM
- TLSH T14F25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 d2789bf8e62d48aef905330ba3578ac972c8895933b9c33e5381206d951318f2
- MD5 34696db1054f7b2b60569ba6205c8101
- SHA1 bef30b1f24a6a0fb46e521b676845e1b705aaec9
- SHA512 6ba15d65722fec083634b2ad49a975ea6297ee8844c1333e8494a0e0b4b3d69f981a1f3313c64d9481aa876dbcef53a207abd00bf01c8d5fa78ec3894c49667e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/KL:A3k03kHRJ2
- TLSH T16B25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 9595b2e8b98e1f91e2adc0fbd00374c3fe151388a0b23c88cd8c312fee5fde5f
- MD5 e6b7837e191fc661ab97d2baa877c6ef
- SHA1 07670444cb5f0aca78ce6d65ca6004b303f700b3
- SHA512 59689e8af1fa01b23b5d8552b90bd25fe233705044bfce8d1d986e7e4a3daf4d6209e02a7fe514078c8bc6ca8952f0faad1c36e99f363ea3d91b9779c333d1f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/uM:A3k03kHRJz
- TLSH T1AA25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 f11188f3c65dd264d391b4c196d817384decc95ab88653d8892aadba635c9ba0
- MD5 495eede42348aca0fa7148731c22c038
- SHA1 7e80d9061c56f73403125ba36f38bb0f9470ec04
- SHA512 c65442a95eef4fafcce7a74ef79477a0e0cab7839d8a39b59294a5dd44aca9f47f87e3be902c3ac90e6110f5ad7775d78cde409b5baeabb9597b39d772adb195
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxh/3h:A3k03kHRJt
- TLSH T1D725AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH