Analysis
- max time kernel
101s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
22/07/2026, 23:03
Behavioral task
behavioral1
Sample
2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 866KB
- Sample260722-21mrvaal21
- SHA256 6bf817a5ad273ab03ecd7d4a592ada1b6f0b298604b3790306ca3c61210c11d7
- MD5 f48658e340154863d3694c106c4dba51
- SHA1 3a4bd1eccfd823beeb7ebcacf3d6dbe3a4a7ff38
- SHA512 b5d4e3720baa888a84df5533b2d7734705b9066876eb38dbd506a9b07d6792c641a669f5916b417db8da4703d7efa82f667cc21c442942a1621f6a0c8a2128dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERap:A3k03kHRJz
- TLSH T10E15AD03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral1/memory/4304-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244b9-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4916-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4304-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4916-35-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c5d-42.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002163b-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b00000001f2f5-165.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202f9-260.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020301-321.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020306-448.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020340-497.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002033e-528.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020342-607.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020346-632.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020344-687.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020348-737.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020424-751.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-794.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a0-801.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a1-832.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a2-863.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a4-882.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212a3-895.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a5-902.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a7-915.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212a6-934.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a8-960.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00160000000202ed-985.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ac-1017.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212ab-1060.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ad-1085.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212af-1104.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212ae-1141.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b0-1160.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b1-1179.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b2-1192.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b3-1193.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-1255.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b9-1335.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ba-1354.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244d5-1600.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000230b3-1913.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244b9-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022c5d-42.dat aspack_v212_v242 behavioral1/files/0x000200000002163b-61.dat aspack_v212_v242 behavioral1/files/0x000b00000001f2f5-165.dat aspack_v212_v242 behavioral1/files/0x00040000000202f9-260.dat aspack_v212_v242 behavioral1/files/0x0003000000020301-321.dat aspack_v212_v242 behavioral1/files/0x0003000000020306-448.dat aspack_v212_v242 behavioral1/files/0x0003000000020340-497.dat aspack_v212_v242 behavioral1/files/0x000400000002033e-528.dat aspack_v212_v242 behavioral1/files/0x0003000000020342-607.dat aspack_v212_v242 behavioral1/files/0x0003000000020346-632.dat aspack_v212_v242 behavioral1/files/0x0004000000020344-687.dat aspack_v212_v242 behavioral1/files/0x0003000000020348-737.dat aspack_v212_v242 behavioral1/files/0x0004000000020424-751.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-794.dat aspack_v212_v242 behavioral1/files/0x00020000000212a0-801.dat aspack_v212_v242 behavioral1/files/0x00020000000212a1-832.dat aspack_v212_v242 behavioral1/files/0x00020000000212a2-863.dat aspack_v212_v242 behavioral1/files/0x00020000000212a4-882.dat aspack_v212_v242 behavioral1/files/0x00030000000212a3-895.dat aspack_v212_v242 behavioral1/files/0x00020000000212a5-902.dat aspack_v212_v242 behavioral1/files/0x00020000000212a7-915.dat aspack_v212_v242 behavioral1/files/0x00030000000212a6-934.dat aspack_v212_v242 behavioral1/files/0x00020000000212a8-960.dat aspack_v212_v242 behavioral1/files/0x00160000000202ed-985.dat aspack_v212_v242 behavioral1/files/0x00020000000212ac-1017.dat aspack_v212_v242 behavioral1/files/0x00030000000212ab-1060.dat aspack_v212_v242 behavioral1/files/0x00020000000212ad-1085.dat aspack_v212_v242 behavioral1/files/0x00020000000212af-1104.dat aspack_v212_v242 behavioral1/files/0x00030000000212ae-1141.dat aspack_v212_v242 behavioral1/files/0x00020000000212b0-1160.dat aspack_v212_v242 behavioral1/files/0x00020000000212b1-1179.dat aspack_v212_v242 behavioral1/files/0x00020000000212b2-1192.dat aspack_v212_v242 behavioral1/files/0x00020000000212b3-1193.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-1255.dat aspack_v212_v242 behavioral1/files/0x00020000000212b9-1335.dat aspack_v212_v242 behavioral1/files/0x00020000000212ba-1354.dat aspack_v212_v242 behavioral1/files/0x00070000000244d5-1600.dat aspack_v212_v242 behavioral1/files/0x00020000000230b3-1913.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4916 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4304 2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4916 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-22_f48658e340154863d3694c106c4dba51_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4304
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4916
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 866KB
- SHA256 6bf817a5ad273ab03ecd7d4a592ada1b6f0b298604b3790306ca3c61210c11d7
- MD5 f48658e340154863d3694c106c4dba51
- SHA1 3a4bd1eccfd823beeb7ebcacf3d6dbe3a4a7ff38
- SHA512 b5d4e3720baa888a84df5533b2d7734705b9066876eb38dbd506a9b07d6792c641a669f5916b417db8da4703d7efa82f667cc21c442942a1621f6a0c8a2128dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERap:A3k03kHRJz
- TLSH T10E15AD03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe
- Size 965KB
- SHA256 3854b4091939bc1dca81f5f961b8dc7ced456b562d7f0ca75f895d83b7bd89eb
- MD5 835435e4f1ae28a99dfc6388e4938416
- SHA1 fcceca4af72335e72cb3b8b7ebe907881bb7b67c
- SHA512 5d19df61ba797051fd28283edbdc368db0dfe6a1903c0aa96509469767d565882cec406d8883937d55ffdedcf338cf35325c57c3bd1a550c8dfb0ca3183dc389
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERa0bBPzBAU:A3k03kHRJ0BPVAU
- TLSH T19625AE03E79400F5E15AC1349AE69A22FB75BC12176097DF2358D6192F32BD0AF3E399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 981KB
- SHA256 5a3b273c577be2a1f82ca9e1744b7bb8553fd474a195f2a3fabb6480a0d31938
- MD5 5d201b2ff6e1f6f559de7114c44c9f39
- SHA1 e8fe8ba370c82c03d207a330e9ae14dba7f6b6ed
- SHA512 974299805319b795ea4b26caba7524486f876a84e1c292e59f916be5a259f49bc21980d9c6a6dc60590427779f5d273597d7409045c62bd8b81382b6c94a1ac2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERamTjE:A3k03kHRJOw
- TLSH T1EB25AE03E79500F9E11AC1349AA69A22FB75BC62173097DF1368C6152F72BD0AF3E794
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 ed282592553c72dbab093cd0e86de83acfd1359d33b65507be50d0a9cad14b0f
- MD5 170c1d4b3e29c00fcc8c1e416a71ec77
- SHA1 69bdf78a48de06011145a6a6c9373a774afc4e6f
- SHA512 aaaa71d5e4f8f61bed8d9e83a866ce06b37916cea254b35b529a7fe0be7a1416796db76133c28a1aad349746038f0721544c06660964783e9ca22aaf60441f53
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaK0Le5ji0hmxNrM:A3k03kHRJ4Pji0Aj
- TLSH T10D658D17F6A402B5D067C179C5D2A65AFA7138421B308ACF1399C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 881KB
- SHA256 244109909d18c118d231bfaba1a6f440a6e3e3c30e04d01d3d2dde7c0e6b7e28
- MD5 f12fff5095f2c52a864070068261cbb3
- SHA1 eaf93ea131a40404247a3c271f537e341b1e5be7
- SHA512 e70333af8da62b1a627663763d7172d192967348f7cc9a365afeaa3be18a666e7d06df0b5560af4e725a718cf7100ffe34cb5121c3339aaf23a04910fa2d0a03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaEa:A3k03kHRJ
- TLSH T14715AE03E79500E9E20AC1349AE69A22FB757C12176097DF2368D6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 914KB
- SHA256 60e620c9db77356ffa3bb3409c125901e22ed4f724d17883e4082114c74408c1
- MD5 4cf830473a2b0728cdbf4f342897dd39
- SHA1 c6ac73f78edfa8a440b1094068fe160b9215cea4
- SHA512 bd133ed7a1f8df3fb2e0a939ecb56f6286796f8d06b1101a8aa80f074598a62cb85676c99a09f479a93075da253943848bc10af2152f08af6af8749f05d39a9a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaPb:A3k03kHRJBb
- TLSH T14A15AE03E79400E9E14AC2349AE69A22FB75BC52173097DF2358D6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$
- Size 1010KB
- SHA256 ba78a5860b4647534a0243a561bb887e94d1fa9c2c84e46a77bf5183c6b8ff9f
- MD5 b56cd0b08413fee28097110c7760cb72
- SHA1 804989d522cfceaec29a8ab0dbfe2b2df607d0fb
- SHA512 6d0bc41aed615caa56e39ec578843b61c511001d725d5adf5027c81e8ef545ae43ca0e6f0b357e597fed8f708db48dca94f0144eb465259bc02fb4ab7594c791
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaTD:A3k03kHRJl
- TLSH T148254907E69400E8D15E8134D7969A22FA777C1217E092CB13D4E63D2F72AD0AEFA357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 890KB
- SHA256 db1c734c8da477f8fac7f334dc1ac84b4798a7a6ec55fd696593825178647458
- MD5 8fab9fde05931dcfd997878755049d8c
- SHA1 a304d741951337c61fbf73a68fb446ca764bc497
- SHA512 b2e4087785e3e1ea70e3c53c375bb45574941861afba47eea9a145a3b0dcb2801ac33fc5754931e8a64d963ed85e74a4f46f9ebdcfcbc4cdcf16e619206fbcd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERa96:A3k03kHRJm
- TLSH T12E15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 890KB
- SHA256 e5df685d8e9fe6937be6ab133520891feb37b104f46213c0d396808f858ac371
- MD5 310c7d2edd2a0ba6672b954aeac13d75
- SHA1 f1c0c1017bc1cc389fcf9381d390a5dd2d39e0f1
- SHA512 b5ee7afe1d79d6f63c25f24a92266dc5251eb2ed84e6bb988e6e2d9b027bec786e958ca910a69dd107297f21ec7788b3afaa4cb47f3982606ebc5a64b8e000ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaF9:A3k03kHRJx
- TLSH T1F515AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 890KB
- SHA256 9c9b77de76c6632241418e4610be7f329532723873d1c03285ba269594282d3f
- MD5 fd72caf649d9da6aa0ec3ac8cbbee905
- SHA1 cd63db3cf73c903e37875f8b76b211722677ca7e
- SHA512 cd42c3d41d1105f8cc0985edd507bba0bf2074532ce055262fcb8e573f069c3e566e0f4f8ee85c70aaf1881ae49b744a9f3b261946f9846d85e8fd14e97f966b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERahc:A3k03kHRJE
- TLSH T1FC15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 890KB
- SHA256 49bdae165b8295516fc90a7d342857c0f6483e4ea074b6f6d86e9e9ad5aadef0
- MD5 19ae591f643b78ea023224c5503db729
- SHA1 0bf875e63b033e3761ecc6065ce7ecfdf5ed6d7c
- SHA512 4f3b900c246f2ad32e0c71df97dc0a95dfdc2b67de19462514fa3ffb0e6f147fe1a9890cc87d399e73d509d9d19efa58e8d60c42bf750c2fc6c172ca7731e287
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaKp:A3k03kHRJS
- TLSH T16F15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 890KB
- SHA256 17acb3c55902c81f5819be18c885a800269e5abb76273f23d536a235f97ded7c
- MD5 d7c320c0140c41bd77213c609b005bde
- SHA1 753c018901586be4f96ed9a918bd03d7e458523d
- SHA512 a3ac9b0aafc526d6b3ab620c7ad475386dc6ebe17de710d0466f13f4c31a58feaf703eafee23497154da518f43694c366e321b9315e7cb3194534b43843e3ffa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERatN:A3k03kHRJV
- TLSH T15415AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 890KB
- SHA256 f17707ff623ae5a9da9939ac00a615979b07d64cdfdc65c9f9d669478f0d4b47
- MD5 28bd268494f7be7e13f5235b78fac74c
- SHA1 984b3da9e9040e9ca636b6e5438ac402699cac72
- SHA512 63ffa33797ffc60bb60cd2455e0e892e5c4f0aee11601c4298dc10497f6f2c9b47ad14d747fa17a718f1b746217c10cb8894f8ab3b2ea2aa5c8c4a4bba401a48
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERafF:A3k03kHRJf
- TLSH T1CA15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 890KB
- SHA256 58c2782ad364ebabd3c65ebea6a291df4047afa50e722cd12eef28cde506b9aa
- MD5 a33c0c1ae5ff56849dd3ef1656082347
- SHA1 ab5d7e97d144cea69205bd1d35c8fb49c28910a3
- SHA512 b9deb0deefb38000554536d06a0c6526ab7c7174253ba813e2e921429251e0a8d191f99978ca1b30a7b6985dfd6533bdc407ff88363697f6cba667c718fa1374
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaAC:A3k03kHRJT
- TLSH T14815AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 890KB
- SHA256 6317f267d3337cf105ed50bb542fce45f39dba62364c01e51f653eda4bf5efa3
- MD5 444dcae6d08c7ca8608000908940b5e6
- SHA1 40f92df937729bbd2b77c851afebb5ce74e4946e
- SHA512 40029c4a2dd5280eb67726e6f1645911c45a6e569b4e427bb5b0c0ed4e3ddc4e0f044221aec4c8a771f2603773f09d65670013881a6c9fb36e02e0f1313ba73b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaTw:A3k03kHRJW
- TLSH T1D615AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 890KB
- SHA256 4cc1e973ed148cf47ca77354861cdcfd1dba99cc458a78f94ce73a5e1f877f39
- MD5 8204af3eefe9c16577abfeb6dbc61560
- SHA1 8adde47868c04f986cce016a865799e16cbdffd8
- SHA512 551c2624973992b38dac0594d2c0eecbd738c90e90cd2a93ec2b8768e9e73fa53c05f0ef268cc082afb8618a800538801911f336ae416e5612d31f99ce7c15a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaaT:A3k03kHRJW
- TLSH T17015AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 890KB
- SHA256 17409ba5274bd808ebb5d4728104b95b4a5127263a7f48b4192017346b70391c
- MD5 3462478a7e14f6b7b7ffadce018bec7f
- SHA1 b240244d73fd12f28b31a3664df02dfecc11582a
- SHA512 3c0a7c35e7d7aba3ee3b2eeebcb6a5285b43767215e5b0e108098e8df69594fadd74a1f8870bb4c18c21d29c9c6b5e84dd706df6dda08c0033db4cff57b6545b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERa6u:A3k03kHRJx
- TLSH T1D915AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 890KB
- SHA256 65dbf13dd2753e423f1abb7aa6ec0619469408e29a66c7279afff7163ca68cfe
- MD5 2158cb4d8d3c3fe3f8a8ae1b94f20e3a
- SHA1 96790170e56e464a58bb3afb8e9af5bf173ce7e0
- SHA512 e1f363968029d9f198a59cfca91a4733b20a5d7511c56c3541c696240e52c858645f2c76da99fd4f1de182593300fc0c637a3d28cd1edb133405bab35817285c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaEb:A3k03kHRJQ
- TLSH T14215AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 890KB
- SHA256 ccba77a05e4ea63f8501c3e0675662a38e3300787aa5663bc5966bf1cecf1a80
- MD5 0108c2fd9f6da85a8605194f66f6fcbb
- SHA1 0ac3ea2b43b915b421544d1575b2e10bd66303ea
- SHA512 639d96d244b6e81c79f128b29a02049b435ef07056ef7677271a2adf9f77ea72a9bfb263e5467770a75870800fc419307924808e6b104221b5a10e79087c9979
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaKf:A3k03kHRJA
- TLSH T15A15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 890KB
- SHA256 6344ffad7a157db2beac95e5ac1ecfaceb961d32f25dc3c78f18967781135016
- MD5 e7bb704f62c1c870c63dc966909be080
- SHA1 8ce7c3e5b6445afcebe0a7a753b2118bfdf057b8
- SHA512 ab5c28e4a37d3ddc8cfdc4bc907fae3dfa5bcbceb8cf49b97357347d26c3af280229cd4325e15df9fddee92b8a002194f6024a6b0814703a502345e68611a768
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaXK:A3k03kHRJg
- TLSH T17F15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 890KB
- SHA256 b88a4f3d4d2c26b3e94ec1338842f547f9cc7877920ed8c0adc53f6ed9212b7b
- MD5 314c6de3175fe298573e66394f76660f
- SHA1 83918d808f098e2046d21ff00167e350c0a973fc
- SHA512 96522ac2bdd959156e1a1091f98a2e0171e1a4f1f51626d76b99b0aec9280ef7ad1407fbf58c0f7b992ae2dfe97ca5d16fcfd50f2ea97ddd2edd29a81c3a11e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERagk:A3k03kHRJJ
- TLSH T1A015AE03EB9500E9E10AC1749AE69A23FB757C52176097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 890KB
- SHA256 d82a327d1e79e2d41f20a912d49949d5b01ccb876fa1a7446bbf19b640ab6799
- MD5 66b78bba03215f6fd147a2f37d1ed6be
- SHA1 bcb59f625114470189260728a57df88d86a36579
- SHA512 445c439735ebf92bb47ecbc2fd996fc364483121cb43ef642ee7df9d7de051c99a18398e7532aed7715e440d92207aa2128a16b8bfd9c317ce60fb4d60fe43e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaR0:A3k03kHRJ8
- TLSH T1A715AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 890KB
- SHA256 07f6870906ef35b7ae78eed20ceb1c47651ea57efd1e853eeabdd52352244815
- MD5 f0774da52752ee94647fb73885b9c439
- SHA1 288178021dbf865755b5ad83c05fe62dd34453de
- SHA512 e1481a8d07e1e27dfe5f4e4404acd3928ff7b30267fca9e4e1fed8645c56d9356c406f472b23bc93f79d738744565b2babe1a79a4967fbb179fd1ff6fa1ebf5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaEg:A3k03kHRJB
- TLSH T14E15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 890KB
- SHA256 45315537bb2e82b5e4094ed1b188f0e387a4d3529e54ac00d0d27c1adb0b1df6
- MD5 89c4451f5686436a6e34c608a91ccc6e
- SHA1 30d5d4f7d45a0d72dca15558250d7917293c95c9
- SHA512 6a0a7e42a146560bdfe9381ab28336d458dd3d6e40b6eb5378ca11b9bcb69cc094828a431d851f67b5229b7d3e061e0a5fbcbbb73998eceb93755f772a1b857c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERahr:A3k03kHRJr
- TLSH T1F515AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 890KB
- SHA256 d56f5b8c6b88137a1b86238a7a7024888026754562c5be1b75891faff19a0562
- MD5 d0249bb705c05aaa1dd5e0229d9713b8
- SHA1 e9e1ce33854804ed7b13e5d97a42abe9fd5c4d2e
- SHA512 c63318e9a7107c8b4a9ee75acc5e8efdcac5b068b52d688023c47498f8f4cc0acbf4488292294e5de948d7ccd98f01569abdd9439a608713ac1ad157b3c38acb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERajn:A3k03kHRJd
- TLSH T13915AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 890KB
- SHA256 384019ff5acd3b0cdb48049834d72175e13fb57d067b4fcdff79ecfeaf74cf5f
- MD5 f9137f1ab6e0416d0b28680352498ba5
- SHA1 4daa78cc9b9e3666000fcf13289eb2a2dde310fa
- SHA512 98fc7f5a091352e57bf72912225b007d4919825174a1f7c398ca12d7923b20368dcf2adaf306465ea67349da39765de6b1218dcef506ca82e0269f211fbeedf5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERa/x:A3k03kHRJj
- TLSH T15715AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 890KB
- SHA256 39c81279a466036aa95e12bf5eace50843ddb5e4ceb49cf643276d24540ff6f1
- MD5 f4929626fa093101264ebed80d96146c
- SHA1 9bfca438a345ea6ff64acbcee10bee427a3f0ed8
- SHA512 2eb5d7401f61e944b2c3702459dccde62a129db864587e1b11ff2acae75fee67dd94ed18845dac4b7fd2efba3da12e2bf8906353cc9b7a501fb78571bb62c583
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERalA:A3k03kHRJ8
- TLSH T16815AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 890KB
- SHA256 99b53b7cdebe9ec70033a67db2c1fe0f1a0be3e0d47a633c0c60c1ac1db7af1e
- MD5 f4f166edc9ed0772d44de24e6cf1a0fb
- SHA1 f3789c3aada62853286d5f8ceb3fd5866f6cd027
- SHA512 d4d9b634f8d5746f36744e92548482664b707422dcdc7c9cde7c89c7f941726e7ce18428e061327663289b4d76846f945ad2aeea1ce6fcff8fb5d153805943c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERae9Q:A3k03kHRJ9
- TLSH T14215AE03EB9500E9E10AC1749AE69A23FB757C52176097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 890KB
- SHA256 19382fe1bf640d172ee5c3c7ec7ae02dcb042e65f2a9accad3f697174a7e668a
- MD5 426dd308c219735227c885f589eab36a
- SHA1 6c5c0e455553498f01cb53d856372452bfa0b7c3
- SHA512 c85e49f673178084afd698c8fc4b0072e3145539466b41def6b09bda4bb959d461170b70944919d3c45d419fe8cfd52c4ec2b6004ea0c0fbd2d68087563f5bd0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaL4:A3k03kHRJi
- TLSH T1DE15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 890KB
- SHA256 a07eb4bfc884704f6af972ad3b2f976f212958401e1d6a073ba8129719cd23fe
- MD5 041479851f48e344bba58803cfc63e60
- SHA1 02a773312bcb33c81fadc4b55ebfeb100daf038a
- SHA512 16daae31a74cbbcaa2f6b9752399b3a85e4bbc8ae5e2fbc09ad181da226f7f1a60a54fc7de59e0450809a7bb195d828b0d77079612fb802bf5871dbe83ae44b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaCu:A3k03kHRJT
- TLSH T19015AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2368C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 890KB
- SHA256 fadfc9955a58ad88308e67b2b2b8a1a984068942475851d5cc883c966a512d53
- MD5 3101cbc8e8a79764f76e367718ec7054
- SHA1 5a038142dcd39e06a36ec20f3f3feffa5cb0a1d9
- SHA512 89d9811b6ad50a40894d7fd7d250022f0f5f9b5f8181719decd8d2dd8c44dbdc2b5b9f0ed858e879334ca16b84d6ce9f7e9fdb80905907daba17ab6c4b739f20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaTj:A3k03kHRJd
- TLSH T10315AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 890KB
- SHA256 c0fa862fdba8ee94aa70c8b44a48026564417e24c8cd39f862f17a53679e3190
- MD5 954a0f8c3583b1663ffd7ad3bf18ec15
- SHA1 b0e642a5d90ce7bfda8f4b9fa1f2745e739d4dcb
- SHA512 6c4c022c70efed62e15c2ec32e4a8f482b1e9ce398306bde2d3f022bea8b0ce3c3c7e2a8bacf18d8d9f4063f594dedefd84c87a9e91f56d3a40dee13ecee0ff6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaeg:A3k03kHRJh
- TLSH T15515AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 890KB
- SHA256 f3885b0d49dc061c8dcb3cbc1714b09b86c9337f6b521096a4f4b51a08b52f71
- MD5 31f81de53cf6cb08e7efd28e090fe821
- SHA1 1d11585d09c3b0439b926ac201496a28087b6ea3
- SHA512 18337a1f282aeab12a17aaf6ac97a9b7286c7154a623867ca30018a6425c609b5f0f7544a4aa52eaaa42e3903b4e7ae20014638c898a2405a9e70c9dc44afc52
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaRI:A3k03kHRJw
- TLSH T13F15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 890KB
- SHA256 2c240c6efcb218f38c5c460d24f2ebc8afbb8bdc3f02f4d58fefe03cd001fdc7
- MD5 7d74c78a67d5bfc60e43406aaeb9e509
- SHA1 a719697648fa8a7caa6050973b3e973bd64647a6
- SHA512 dbabc240b4ee58b4801e04f4bd1982ebe6d4f5134c79865724615fa4bda280cef5548e43a109b883d4673aed87531aafc943273b53f67dac00ca0e1b7adc0852
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaTo:A3k03kHRJS
- TLSH T1E415AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 890KB
- SHA256 795da7e0bfb9ed5353adbd7fe9019852e641eb1c777fa24ead649324b19fb741
- MD5 59ceccdee4a781f6f137fa6d719ddbfe
- SHA1 185ed79cd9f282993304dc800a30ce4881309256
- SHA512 43dd593a2d84f16bc08210045c7cd58113b7629d9dc36e1bffe31e087de1460466553c893d5996e8bca1b07d4c568a1acb80333b09b49312077bd7eb43f0cdcf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaY+:A3k03kHRJX
- TLSH T1FB15AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 890KB
- SHA256 43e3180c65bd1edb58d0505afed584ac88133af3c0899052edcdecc84e07edfd
- MD5 d5bb1c007032bb387119e09697f9941e
- SHA1 209d1acee5ef36f1733153042c07f8e3552ae401
- SHA512 cbd40ac752ba31c8bb666486ee1fd0cd0b948cce574f5040c2cf937b61c68884d2185363ff03c0be105999ba67b9f31b8bfaad0308be6bbe68271cbf497c3ec4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERawQ:A3k03kHRJD
- TLSH T19415AE03EB9500E9E10AC1749AE69A23FB757C52176097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 890KB
- SHA256 9e43da0bf28f38b695dd8d8d07e68b265e6724b3ecb87ac0c0e67347210d3ac0
- MD5 fdcfbac5e3be8a4a6f4e22ee832ee3ef
- SHA1 5ceed3115e933cc0cbc468cf305270941be1858c
- SHA512 053c7576d28a28759e22951f858ebbfb4ee730b27f5668a11e05a8bc9e5f4a49471d2bac9b6fdf682c44f59f5565b642aa294ead840d07b9b0b33b41c8f7a9f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaZX:A3k03kHRJX
- TLSH T13315AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 890KB
- SHA256 3257ec220da9adca77eb24aaea84ea333d056d2c26daac0cc0e7931aa40ce195
- MD5 a3df32a4cb0b5644d03ad09a425c1faf
- SHA1 66d40ad28b3940fee678891aee788add9731084e
- SHA512 055b86a927d148c45c82572f9d5b9a8da834725580297d0d2284eae0b51599972323d28d92a856adffc27c289fdebbc883d79523782bb911413938165b0cb6ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERazL:A3k03kHRJ5
- TLSH T10915AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 890KB
- SHA256 87e50ee1bc9a85a53daa728da6f89c8998b74a87969a45e5aea959f6c7204f79
- MD5 7394c335168e90a80bb1324053dffdbf
- SHA1 e4555861a7a81cfdf54b4c5845f7d16be5dc2663
- SHA512 10ec7c5bcfa371d06c3d182947c25e2e058e408f4ff0727ade2e8110a62ee9847feafc9da293bd783ca0f6b23f2d5d2d71b0030305ec6fc347324ec1e5942ce1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaZM:A3k03kHRJA
- TLSH T12A15AE03EB9500E9E10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 890KB
- SHA256 fddea9c4c44264cb05d631eaecf84de4bdda7d3c11042d7f9e5d14037ba41ae8
- MD5 810232de3710ebfb1060439f45b61322
- SHA1 786b439ff4a7fabee9dd304a5057bc28009b79a8
- SHA512 a7d657d34c6ce4ad91ffc496c461faa558881d380a0daf6eb851543ee3b0cde9eb19c142b017282f54f376cb5ced2033bab8f062693f3c6ae77d344e0564f9c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFbaERaih:A3k03kHRJy
- TLSH T1E415AE03EB9500E9D10AC1749AE69A22FB757C52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH