Analysis
- max time kernel
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 01:04
Behavioral task
behavioral1
Sample
2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260705-be78jsfx91
- SHA256 fc91b8b9ab5c1adfbcf5aad101bff5c08ae469450384f7b1fe3fc506a47eb68c
- MD5 e8251129a1be930a96fff5a7d09a25e3
- SHA1 3a09b046caa40776f3c3301cc49e6f500fac7c86
- SHA512 827f9a4831d10ecb0bc9b44d37cf1d71886a08794fc075ba83445738c028421abf43a916106c32e768c907336c0f95c3995ce4664aacbdc5ff03b13af5bc9a91
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil31:A3k03kB56rR
- TLSH T1F3157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/6020-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c530-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6020-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5184-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c92-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018989-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000189f8-212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a04-232.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a68-233.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-253.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-290.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-321.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-405.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-418.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-437.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-456.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-463.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-464.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-465.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-522.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-602.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-652.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-743.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-762.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-811.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-818.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-849.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-914.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-978.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1034.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1077.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c530-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b4-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c92-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018989-204.dat aspack_v212_v242 behavioral2/files/0x00040000000189f8-212.dat aspack_v212_v242 behavioral2/files/0x0004000000018a04-232.dat aspack_v212_v242 behavioral2/files/0x0005000000018a68-233.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-252.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-253.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-290.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-321.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-347.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-367.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-386.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-405.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-418.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-437.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-456.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-463.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-464.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-465.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-496.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-522.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-602.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-633.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-652.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-743.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-762.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-811.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-818.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-849.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-880.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-900.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-914.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-921.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-934.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-959.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-978.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1009.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1034.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1077.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5184 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6020 2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5184 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_e8251129a1be930a96fff5a7d09a25e3_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6020
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5184
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 fc91b8b9ab5c1adfbcf5aad101bff5c08ae469450384f7b1fe3fc506a47eb68c
- MD5 e8251129a1be930a96fff5a7d09a25e3
- SHA1 3a09b046caa40776f3c3301cc49e6f500fac7c86
- SHA512 827f9a4831d10ecb0bc9b44d37cf1d71886a08794fc075ba83445738c028421abf43a916106c32e768c907336c0f95c3995ce4664aacbdc5ff03b13af5bc9a91
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil31:A3k03kB56rR
- TLSH T1F3157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 de3e500f86c010c181603963c3fd2471bb67a093e56211f8a26427350261e6ec
- MD5 08bcf7a16e1f1371c3e11fdda850eb2a
- SHA1 7e5b7ce4aecef3cda2e4f737066a9295fb3d7bb2
- SHA512 045335336b5ea1545c7b8e506c7f02ca32a43be486be9e408c5f5aa5e5e433f16be381def2960a109052b5a8011d19f5908711edfa2b0128eaa88777bd2eae1e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3x0Le5ji0hmxNrM:A3k03kB56rtPji0Aj
- TLSH T178655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 6339c0b3f9f069cfa558ee2a28e22bf268490e5ca4fe6bc099af48f29f683ca3
- MD5 fae0344537b44b7889abc906d2394ae2
- SHA1 daacddeb0edd02ab1e319457c474bf83d57d0d5e
- SHA512 49b5b6dc8adfde830925ee130971b9627707c13f0d53498edcdb387294797897c9d9aa788907f9b3206bdab004242c62f1028e43ed186a64faf1d260c66dc9bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Ta:A3k03kB56r
- TLSH T1C7157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 2db731b8d3c46131df6ba06f112b1d6a6ae5a09908985b4f2fa755210dd21adb
- MD5 c2eb82d3c6f5c198d64c4822ea999347
- SHA1 9ce2c2e8c31e58bf3510ef429a8a3ae3b06dede0
- SHA512 3f5fbc4c6b44d3f313cf5392a94efe81517f860a75c03598141a03b110f3fd144c851c2a3aa0f4b03581d6613f0d970d83f8b4dc72bd44e34e294b6278b3248b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Ab:A3k03kB56rsb
- TLSH T15A258C03E6940FA5D10FC1749AA58662EA777C425F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 947KB
- SHA256 64822d70570529d565ef03f63f71fd8dfc4cc506e54845441001404648fb493c
- MD5 452adca148ebdf193f0da2b160a6c968
- SHA1 10ae61e3da2cabad0be7b0f3ad2214a554108338
- SHA512 1ac0027bddb0c9b9784cf398ab0860029b1c587b57001f12fb289d8fb0ee0decd3932f97bc63cc3e674caa69a69c32228d38927331170d82133dbaab92e85181
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil37Z:A3k03kB56rB
- TLSH T110257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 947KB
- SHA256 c1f5b5a7085e096adafc824c927de74db34db88337e6c9f13943d022d7a5d4c7
- MD5 87fdd461142e9e9175048d859f544e8e
- SHA1 cd5a26cb364aad175116021afeebf3f34935af2c
- SHA512 cc5270163abf01c22313e5cd37bfa0e1e709bcc213b910f78e895e77a953c432c85ab865bcede5af33fa01463455d13418fa968a53cee953c6017196435e52ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3g1:A3k03kB56rO
- TLSH T1AD257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 947KB
- SHA256 db11170892181c5111f36930f4db53e80aca8c0d817ea14f7b74901824b4b5a1
- MD5 ada5d700b27b07f7600622e4e1248be2
- SHA1 948ca287923d9d1743a0c9a7d1ca687acc96faff
- SHA512 cae712d6d196b2c5609166e69dc95623e8b23e30db29e42e9e33fe776d72c15571de1bf3b858fe542ad05ad52599bfaac9a45bfdafdef83e5fc94b9c7299e39f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3KN:A3k03kB56rw
- TLSH T1DA257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 947KB
- SHA256 a13e3b432fa27793f00bc811e385d4c51af436365f9195a5cc022cda69158fa2
- MD5 3bfc1ee2899ebac654def9b4874ec39f
- SHA1 f99cb93401e251cf49fc1a87934e912c2197e0f3
- SHA512 2965c2edf1b1db0ecf6197940edfd83bd258088ff05df133e2c019e23c7d6dc03b015842c4c220d7e1093e994de405876c59e28a82a55fdcef00845c96c0bdcb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3wf:A3k03kB56ro
- TLSH T19C257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 947KB
- SHA256 316739c42daf481854f129835e86694a4c8c334d67dc2fd1ad773590d08066a1
- MD5 74720a2681f9a5c1667d1037bec96da1
- SHA1 514a1baea49d263ac2d386649f45456880347267
- SHA512 7e718c6bfb71b54f29d08250b50df6a6daf9d73584f766011253ce2e785695efd92b96e9ea5a8c00b595ca2a4a3658dd5fb5df623ed1bf51844da4acf5a425e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Ko:A3k03kB56rV
- TLSH T1CD257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 947KB
- SHA256 3800a80e6a0ba8af57eaf9ed4347cfc2a8903571d4193b249e1836157b8e116a
- MD5 f358d0e4792af782e30310390d66624e
- SHA1 dde5392f44d0fe5a65f4969c53294dbc67ee4798
- SHA512 30cf3f224c21e4468cb1f38d953d39ee9855c87888f0a54b3afeb550f7ed85ebb97b87e2e9ea5d1a02f03276ab312446292fb33072d43b769eb688c381cf5915
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3eu:A3k03kB56rX
- TLSH T1AC257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 c8235a982d75a85db57a9d13f138af7a4eb030b681fcd3ec092aa79a7c0f4889
- MD5 ec6bc5b53fdcfe183978cee1b4276fc9
- SHA1 fb8bb09fa62dfc50b84ba7f1e4f4ca1fd2d06289
- SHA512 6a54ce8b155c6f5fa57398854827eeadf6c1dfd2f3425c409600896471f820fa57d7f4a12093e520a2526fc6f20f4fbe1b6af103b2c155b32638822dc8fdc325
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3S9:A3k03kB56r2
- TLSH T1BC257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 0410b67f768e603dd98cb17995abe4f9ca99cdbe1e1bc4f51bd7a8ebc715f695
- MD5 e10bc371cf9008137039c62a49c6d746
- SHA1 2b5e165ce8bdc44583bd3516811fc6f9578ec72e
- SHA512 970d8732b27ef7600f630bc76178ee3feda57853b0fe6e5871658ab534d0dbacb3dacd00a73f7eaaebabee8e2d233736b7cd8f1c7a51698a7745544da332f39e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Sc:A3k03kB56rb
- TLSH T1B5257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 e89d29493ea76b9769f6f6dd934b456cc8943be1f309683bf9f79560d2fff41f
- MD5 34a9df2eae519ed7eb8840823aac74df
- SHA1 a57882092cd059554294312aebf179d9aeb97ad2
- SHA512 992981e4be1a6c0d0eda6c5e80b02fef718c93c201c5ab60d9d2d2aaaaaaacc7c9710a0ce58c64a89e985d2fb5dca0684cce981f790e093d172ba6ac39464809
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3bp:A3k03kB56rZ
- TLSH T152257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 b5e1a6b756818b2d59898ce0f1ef7974713e67c872c8e3f600fb88511283c9f2
- MD5 9b39e947829d0dd6692f70035c7e3e8b
- SHA1 29221160aed72e9acff43cd7c5870089c3ebf55e
- SHA512 e52800dbabcbe78f2ce6b75631ea7c888b74786017c545e312a617920083cbcdb2628bcffcd3bde91f003a08c3b55a1a396fa2ce2571d4c86d4e33ddf44c4ef2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3sN:A3k03kB56rC
- TLSH T110257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 175d9ad34e54b09a07799acf6d06307fe6e246569b9741520dcde99379b19d8d
- MD5 c6242d5793b94481e7719232f6073fcc
- SHA1 4abf7c397547ef80426844dd6bf88c28f3a16eec
- SHA512 a95bf294eff39423288a047056dcf60b9e3684d2208bc8b65997feda2c272e5fc7783cf7fe8196b25770b01d2af82e532373d4ef4471b72263078ef910e4c45b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3UF:A3k03kB56ro
- TLSH T115257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 1d69d6329706069ee269e312bd59b7144ecb49ca763a9dad47b258036c47ab28
- MD5 c91615c0d3df32ca34c8803cb234d215
- SHA1 b429c390827094966e7ae4b94f51514cdda11385
- SHA512 958c1867292f261da9da72d7c075e18aee8d72c6a7e802a7ff965f26fc9ed8b9b2b27d1111cfad729920d82aaef19ca151dbdef7ba856dbddf69e16cd0c71fc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3xC:A3k03kB56r8
- TLSH T176257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 80fc7039052e0140dc7e893ff7e39e54a645da797f80824bbbf530867f047f6b
- MD5 f5e8a5bb022075db9487da08241f654d
- SHA1 e9207173f8bedcd26dfa66e81b1d48b9c695f5a0
- SHA512 28b4139aedb53d5b6292fd6d13c920963311df401860c9f1233cf6919e0a085a6e2a8d0cdedf16c740aabd7824690af56ac445174750949a79233cb9c626d1ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Sw:A3k03kB56rx
- TLSH T1F6257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 60e1c101e5e3a02f607594c10766f4eea4bd7c26dea0d8c62ad72650cf852507
- MD5 e0afda357e5182e84148afe90fb68bc8
- SHA1 ee749fd254fd01e50d529d4ceb1266fc5099d769
- SHA512 12169c19211d6e46a5e50489771ef87dc16e1cf0f00a9155f521d58c2ec72adf8be23dae83c0ee137d944f70bde7a8cb8c31aa4e1dedb7b24b0750611d8aefe0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3ZT:A3k03kB56rl
- TLSH T193257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 c5ef356c2ff0f5a2a5d0d0ac565aef46741f6ba2e87c01fab4d049e67d4ec5d3
- MD5 fb720953e9c95cd3e4aa969f83f3e8bb
- SHA1 651e205d83c9fdb754bb1c48e5236aed25e62277
- SHA512 4e38d708d62211bd67302120183d942443b449ec2ac8044c21535e6702a938869eaee00b7cd184bfb260f44eb971c59d4c708b2efcf2caa9a93d5f3b0ba4d0a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil33u:A3k03kB56ra
- TLSH T187257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 d3ff0096f934fb926ba5a7d73b71de59711741bfd3a51c78e433fde9e17633bc
- MD5 0f6e35667b70c1ab109f7d46dcec8d3e
- SHA1 1ab4e811585afc3d4ffe02965499c47f8ced8fce
- SHA512 0594b1019c212abcfe597d220b994c7edb764cbb1325a20ba85aaff538117feff8c2c6ca4f77522b16cafb70306388b51966c75183536a1900c081a1b93f654f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Lb:A3k03kB56r7
- TLSH T1AA257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 5e57651987d9bb64560116e0f06b702dca060d7da57d57e77ce5fe40e30b39f9
- MD5 3ba04d621f4311986a32bfa60ea871c7
- SHA1 ce8dea321043e854e1513446b8dce4f03e44b09f
- SHA512 289923205fdc98905b94c896ef8171d67a023a796306c32ffa4e28f4d5d23f7738c49ba251025ec279d2f32e6ecf2ac25010932940062f903ec43129ce38bd09
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3ff:A3k03kB56rD
- TLSH T1CA257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 1073f60df9e2a7d5e6cbf7ef006fab9d1fae55cae4dd2c0e62445cf102e15722
- MD5 2c75fdc222ee692cec488424cf1c4808
- SHA1 1a9c2e53f942dfef1148e1b4974139d77d521f76
- SHA512 273bebff17aecbbfe51b5137bec939c04aa1631f78a68beb882d21a0998244c373d813e7ec984967ca06a933b410e058a3c68b906879ab6aee5d74edb4bd5ea3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3IK:A3k03kB56rz
- TLSH T1B6257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 60d435893609e8ccd908441d2d86c465d8994ee385e791819effe67936e70f92
- MD5 469523d2cd6700a1f4fef4b67dfd020d
- SHA1 7190dd65bb01793d9b851dfac3a0fba9f29bef45
- SHA512 cb5dde32a5921cefc9d55f4d261dc65adad9c8233dfafd58afda82451d8dac203662840b58cb18a686c52a0cba398ac8c9c52b44ef2e543c7a7f49521139250e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil31k:A3k03kB56re
- TLSH T14B257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 f6975e12bc4196211f536d5503ba9c90c10a4778d378bfad6c1b0b98ad888363
- MD5 1e4adcc5cf80eec248e968af3a8b6093
- SHA1 8889fba8bf0820dc7d2923672df6dcdbfa2ea3f6
- SHA512 3af8be94ca141681d4ae9b59e96f8a37bfd60ab27a2b77d835a616c6629f8a2b46485da9e945152cc078111b9bb7a271f0191f51b82bed610b7f74869ad0c502
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3q0:A3k03kB56rD
- TLSH T166257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 f6f192598d4bf0f2b419e5d36d1f1b2d3e6812130c2f318bc7698b21354e4dc1
- MD5 da1c8905a24e5f3e066450fee177aa55
- SHA1 517590379549c78620edf250494be943c6c09eeb
- SHA512 e3de4433decc3ba617784935532a889b71a48f846883bc91f9008d50625dad31f32e34bc4faa42404379eee64ccb44f91fd16a47a23ddbd86dffe3570b6ec1c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Zg:A3k03kB56rm
- TLSH T145257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 a93d224f83071df8ff344e1bdf0c42b7e3ec4da4e0bdc9316161e9fabcd22469
- MD5 13aeb72a45297f54e0d408b3a968c4d2
- SHA1 7c010f394705de19a2bc1504d97ff03f8005c798
- SHA512 82dbf31d3e9dfeed1d9bd638a32ce6f09339304cf7f5e6776ba457f10055a905cae1659f9fc6267d780392ae957605a28db4d7e9c50fcf187b149ab5ff655f63
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Ar:A3k03kB56ro
- TLSH T10E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 2341d68f1d9991e4299d537f22671d3264298f749b1302bc0e9a7a0f9acad92f
- MD5 a9ffe27734cf082829c95b0d0432e1b1
- SHA1 3504178d967c2175ee2db9a4eede8e9b5912cb29
- SHA512 613c7e562a872666e64d5e44da7bf9714b2a3a4e438d643c72168bcdcf91d45935d39c73aaa007d34cf64300e4787ea5010baacd76d0b5af0fb19d78c8643370
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3+n:A3k03kB56rK
- TLSH T108257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 7b14de2ee13cb223c4da4f8a1e6341b778b6a390ab898309274df96eb4ac788e
- MD5 e09a8f3190c7df597dd6e8a3a1c50bcb
- SHA1 d01c0dd10a48a9fab7d665fb64fa1af97c685714
- SHA512 4323ea1ffbc8eed79632b61dd78029013aa76fca7aa59f918701d00bdddcfad4a6c4af6758c78d1a2317824d934766759aaaee75b7c9aa6e145b4cda8fc48759
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Ux:A3k03kB56ro
- TLSH T1C8257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 2f279d408b21ea281c34319a1de87c31691d33ec6dfe77fe7b3b09b305b58ed2
- MD5 9616088ed202c4f1a039abf4cda6811f
- SHA1 7d37ff0cfe14c82362e9b69182dd59bbc81cc312
- SHA512 f85b87794dc8593f4d4861853939179aa7e07775e0a9fcf3c85020118038422df3d3420083588d613988e4ddbe7821e96408d311e6062863bb913311f2004412
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3eA:A3k03kB56rr
- TLSH T117257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 7926c92bf504c1cf3f0d0b8c1b0e0c5f2c01a2e4bebc1f4532867ff0b790e164
- MD5 2c9082f55fb9b88cf8897bdb3af0f249
- SHA1 b930606e580e08cf400d3bf417d0aa80ab436b6c
- SHA512 f6db7a85428709110bfa874025bf570db6a4544169b25a79ef6974681724be9cf1be7a19ac14383d5565f03ec4fb3cbc2bd4bff19bd3e4c61a39b7c87af894ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil339Q:A3k03kB56rm
- TLSH T1E6257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 d35611b770a5447c3ca24b7696a0dc5055c4ff6ee522b26c69b37cefb42ef9ec
- MD5 117c852a743c98ba1e1ae0076b95d566
- SHA1 2d1f27f0090015c5590f2dfe3677c25081726ebf
- SHA512 701461d330d234e05e97a2e2f5930d56bd30ac4e83219ebaecb08794aa865eb96d59bc8d626f88b2fa8daa13726764aca5d2ce95c74d42feb5479548f31e74ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3e4:A3k03kB56r1
- TLSH T169257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 8a4c27ac65ce4ecab717aa58300075dda1311321f897b5e2a508ddb0639d4ac1
- MD5 9156164126021c4129330e2ed352e011
- SHA1 ce19b70ed3aab42c2e11c871f9e6b381121da61d
- SHA512 dfbfb0445994041c273ce556ff430472676722ccb324019be966286247f8746a1c9bcce1203f85809d5b8c6cd23b1e4c8e141160d87f664e755141325872508c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3du:A3k03kB56rg
- TLSH T115257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 ff1014260aa47e98273b49a2923df67dd174e8eeb0bdce2e16ccb24885006ee6
- MD5 15489d4f0a30d117008988839033f3b7
- SHA1 d3ed19c5777af3b6a582177568ebc6099bae95ab
- SHA512 7f3a55a114e5ea3b216d3cab940c7432621887040b2875327843f92d59b4ee45173488a456a1441a49210177783ae162def19537484a5ae1ab61ef4ce4c92216
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3wj:A3k03kB56r6
- TLSH T190257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 6b4725eb88e8cfe0dd4c59330eead775c75562fe5f0fac9673cd9acb035d2e4e
- MD5 904c023b36d6733a5b57110c0378f221
- SHA1 a640c0514443abc3fd9d435b298603a43b220240
- SHA512 5503848c70a4e5dff63986374f6e46f50f4bb51e62f39d0228f75caea9de8bbbb0a4e1a2c06257349791df48b4c043c6b351abedc31f68e39aca2848fac81ce0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3Bg:A3k03kB56rO
- TLSH T11F257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 7ba80c1ef0586f6d2c62e95b067a217fcc56676d979ecf42a38728d00b5c6dbb
- MD5 15a057e4f6c23863210c63379e5e188b
- SHA1 0b30d2d03d3992988258506ff33c738bcfe6236a
- SHA512 824a41c78ec17a12aeb3b1f63b606b22d7daafcb2e33681464f40cecd492420f76f9bae4950075c13cf4183bec45961379cce6a6b4494cbd94432248088ba939
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3YI:A3k03kB56rH
- TLSH T18E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 c3a127f77165d0ea6939e94b4094fb09382b39bf997976b2753b4aec21510e5a
- MD5 586b8a2c79f5374354995c43b929e07e
- SHA1 33d6627ef47a8b8e585fbb391fdf22cd18836404
- SHA512 97c2c553c5706868827aab9e76821d271eb680e68edc12b0da74f0f4f8ff1353261e46e40fd3c3e7c743adcc0519b83afde88995a748c8dc10ca9487cbbf7619
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil36o:A3k03kB56rB
- TLSH T1A5257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 506e558210e330eee4dc9beaf27e44661c584e3883f7b6197762880b6cbfc6df
- MD5 a9e38ed7e97335b52b837d8c506a0191
- SHA1 ec8d5cee27b95739355d5de8d6f15817baee3bb7
- SHA512 a21292dde51e0f478802c690be3fdf7b7d6555c91bfb4ef8eb6db538c9eba4b351e2ad42f1370de53f50c99ffdf72ec338c55dd2a8bd066f7c84a74585423be2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3R+:A3k03kB56rE
- TLSH T10E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 6d26a831e4958eeb498e175a7d0ca2a903f33e5561cb1252a399d451daf1aabc
- MD5 0587ecaff86a95e961423eb713878977
- SHA1 6d3ef155063157dce2464d70423edecbd38a8d77
- SHA512 e4ef9ae21b1b3d885e9ba081d681de5da622912238d26d241f15631648f2be3c19264007de902d1237a973a6b0bcf7e7b0e766cea96e9e35cba38c4f28fc6c6a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3fQ:A3k03kB56rM
- TLSH T158257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 99e27944e197ee61c9a2adde00db7b2495382a0728df1e021712e7afc6c59a8d
- MD5 9307c93a91ab66054bc7f42192cb9508
- SHA1 ba7b5d78e94d516ffe0a0a9785005d0c262b5183
- SHA512 98949683626d3c96ee475383c06ccf2a6fde1baf174f1c8fec5c3aef7444e195dad1d5d0db780a5914f133cc0ba8c7679b3de14c9474419b21ffcbe7000c92fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3kX:A3k03kB56rM
- TLSH T141257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 53058284a57d9a4cb3584cbef01620ae7ef43dab298afcf50518e895cb8e3387
- MD5 cffc377d4e8c5492b17b9107a79cf035
- SHA1 f9d8035854df2187af2a7d13735cb452b13e2c17
- SHA512 0fc18907d565444ff68878804c813bd3568bd11061607f1e26719ebca11ff4af58ddff689370bdb71644e2d121a6e3cb328095e5de5dac71cdaaa373a8002031
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3iL:A3k03kB56r2
- TLSH T1EC257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 b36113ab2f2bc3d272333102c6c77adaab910affc83f30ba02a1fef6ac62c728
- MD5 e24349599063bb2efd857d9195292eea
- SHA1 583dad42d93d9dfa75c9d95f966f935754fcc321
- SHA512 7f3b314a0b01fa6b24327e6eb1ae9d868f3f41588457587525c3813c79e2f89da92210e9fdcd6ae5e4e60fa88e485c6887bedb3eb2848f7560616f212881090d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3GM:A3k03kB56rz
- TLSH T1E2257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 abfaa8d30154dc4a5e64feb5185aa471a7c5846f7a958920f8e2c24d90bb3772
- MD5 0ff5c5705bdec168e6a21dff72b590d1
- SHA1 09f6610a741bc6d6e38420caeb2eebf763118868
- SHA512 2cda7495d9894fbcba9c4a970333c07a19c0276dd12bb7b5926ce61b8459a04b403a3089acf12d2a8f5cf0e9250a79487f3b61f1972278d9034942015c3d65a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjil3vh:A3k03kB56rt
- TLSH T1B4257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH