Analysis
- max time kernel
98s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 17:06
Behavioral task
behavioral1
Sample
2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260728-vmv3qs1ble
- SHA256 0375a85bc8abea8a8d41f6147e03a7cb024297b995bb3f23efca328769b002d6
- MD5 8c79a1e102be2a3d32042d25133d3ff5
- SHA1 17242181926799d9c8f9a07276b2553127420c34
- SHA512 3aae7ee29ada2b927fc8d30759950cf85f9ad09daa0adc733173907f240e19fc7fa644121887df0ea5d9e6c7849174fa6f73a4a8fe37d7172532ce7f06b33b0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0N:A3k03kHRJn
- TLSH T10615AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral1/memory/5000-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0011000000024343-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2428-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5000-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2428-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021658-60.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b0-273.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b1-442.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b4-491.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b3-510.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-595.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b5-620.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b7-675.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ba-730.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b8-743.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bb-787.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bc-801.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bd-850.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212be-869.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c0-888.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212bf-895.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c1-908.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c2-927.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c3-948.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c4-966.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c6-1009.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c7-1052.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c8-1084.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ca-1097.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c9-1134.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cb-1153.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cd-1178.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212cc-1185.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ce-1222.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cf-1325.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d2-1332.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d5-1346.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d6-1378.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023192-1796.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023069-1891.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000230f8-1932.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0011000000024343-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x0002000000021658-60.dat aspack_v212_v242 behavioral1/files/0x00020000000212b0-273.dat aspack_v212_v242 behavioral1/files/0x00030000000212b1-442.dat aspack_v212_v242 behavioral1/files/0x00020000000212b4-491.dat aspack_v212_v242 behavioral1/files/0x00030000000212b3-510.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-595.dat aspack_v212_v242 behavioral1/files/0x00030000000212b5-620.dat aspack_v212_v242 behavioral1/files/0x00020000000212b7-675.dat aspack_v212_v242 behavioral1/files/0x00020000000212ba-730.dat aspack_v212_v242 behavioral1/files/0x00030000000212b8-743.dat aspack_v212_v242 behavioral1/files/0x00020000000212bb-787.dat aspack_v212_v242 behavioral1/files/0x00020000000212bc-801.dat aspack_v212_v242 behavioral1/files/0x00020000000212bd-850.dat aspack_v212_v242 behavioral1/files/0x00020000000212be-869.dat aspack_v212_v242 behavioral1/files/0x00020000000212c0-888.dat aspack_v212_v242 behavioral1/files/0x00030000000212bf-895.dat aspack_v212_v242 behavioral1/files/0x00020000000212c1-908.dat aspack_v212_v242 behavioral1/files/0x00020000000212c2-927.dat aspack_v212_v242 behavioral1/files/0x00020000000212c3-948.dat aspack_v212_v242 behavioral1/files/0x00020000000212c4-966.dat aspack_v212_v242 behavioral1/files/0x00020000000212c6-1009.dat aspack_v212_v242 behavioral1/files/0x00020000000212c7-1052.dat aspack_v212_v242 behavioral1/files/0x00020000000212c8-1084.dat aspack_v212_v242 behavioral1/files/0x00020000000212ca-1097.dat aspack_v212_v242 behavioral1/files/0x00030000000212c9-1134.dat aspack_v212_v242 behavioral1/files/0x00020000000212cb-1153.dat aspack_v212_v242 behavioral1/files/0x00020000000212cd-1178.dat aspack_v212_v242 behavioral1/files/0x00030000000212cc-1185.dat aspack_v212_v242 behavioral1/files/0x00020000000212ce-1222.dat aspack_v212_v242 behavioral1/files/0x00020000000212cf-1325.dat aspack_v212_v242 behavioral1/files/0x00020000000212d2-1332.dat aspack_v212_v242 behavioral1/files/0x00020000000212d5-1346.dat aspack_v212_v242 behavioral1/files/0x00020000000212d6-1378.dat aspack_v212_v242 behavioral1/files/0x0002000000023192-1796.dat aspack_v212_v242 behavioral1/files/0x0003000000023069-1891.dat aspack_v212_v242 behavioral1/files/0x00030000000230f8-1932.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2428 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5000 2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2428 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_8c79a1e102be2a3d32042d25133d3ff5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5000
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2428
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 0375a85bc8abea8a8d41f6147e03a7cb024297b995bb3f23efca328769b002d6
- MD5 8c79a1e102be2a3d32042d25133d3ff5
- SHA1 17242181926799d9c8f9a07276b2553127420c34
- SHA512 3aae7ee29ada2b927fc8d30759950cf85f9ad09daa0adc733173907f240e19fc7fa644121887df0ea5d9e6c7849174fa6f73a4a8fe37d7172532ce7f06b33b0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0N:A3k03kHRJn
- TLSH T10615AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe
- Size 1.0MB
- SHA256 d41b60a133eab5e65d2ba242b6da405696a5cf2af8128928ca5d519e41dc3cf9
- MD5 0099eb94b471e2ac8d0e58ecc83c2fa1
- SHA1 cf2117f90bcc3ce0ad877dd3913237735ae9a2dc
- SHA512 82434ed3d9f5db4ba7cf78994cf92f558a774a1e48e78dac99e191ac940f7cd4d775dfe369c7d895cac0f2b9b579d1f6b0d828daeb62baf4eedefd2c59d4b6c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0vTjE:A3k03kHRJdw
- TLSH T1ED35BF13E79500E9E10AC1749AD58A23FB75BC56176097DF2368C2152F62BC0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1023KB
- SHA256 7dfba08aaa3e86a16e44f84e9e41205c2a8988ba0928de2d9137a2a62bced9e1
- MD5 b660913938365f1abef09bff79a2c3f8
- SHA1 0fc8a0f1ec5e8c9ac2a533bd2365a3a7584e3990
- SHA512 19ffdd515af57bfd8383b42bd1e2438a3a664789c1c1a00cd832e57c44f3447dd10c51179b32e9b9ef612fd8dd077300d2110e70abaf3a7cc1ef1f8dcb4b4dd2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0HbBPzBAU:A3k03kHRJtBPVAU
- TLSH T15425BF13E79404E5E10AC1349AE59A32EB79BC52176097DF2358C2152F72BD0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe
- Size 1.0MB
- SHA256 3d5e3c21b61c3bf943eeaad028fc0f50a3c921e2510bf6904e85b0016619646a
- MD5 fed8dd7db79289a23d4b26142db93e7a
- SHA1 6f01d6e01613c3444485a3afc8afc124cdba72dc
- SHA512 5d784cf856a6433a27bc2013eb0aa115f81806b587b2df09749a7a5955e2e6da3a882beb7af328bdc7eab5a53aff042eccfb9c0ac0f990daddc15e32471560c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ04Gen:A3k03kHRJZI
- TLSH T19535AE13E79500E9E10AC1749AD58A22FB75BC661760D7DF2368C2152F62BC0BF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 d3826b1e96690fbe88e6ddc7126c11c9c582156ed6cf573e1a0c7008c7d57828
- MD5 24dcd415d2a993838341076b81bfba94
- SHA1 bc4965a0e66b1151d8ccaa3769a5389a2e641200
- SHA512 03c5073c658ea0b93a55f9adeaecfbcce1a98d0ef96619c2f819ade7b6fc7341f64c5432dee22fef4251b914bc1a0d71fd6a1b9128a676ddd465d137f25f1d9d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Z0Le5ji0hmxNrM:A3k03kHRJjPji0Aj
- TLSH T14E658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 972KB
- SHA256 9ad98bc4b79c27c486a5b380a3a2a0c42912b995708cd1abdb2ff7c7f6f5b85b
- MD5 671e45436f4e7ff550dc07feb3261f3f
- SHA1 a46ce04182705f8daccb59bcbdd78992e0dfaf3c
- SHA512 d8bdf701a9ead5e73b2796156371ef8fb9bc671e82af770caf3b86a9585a2ce56640412a30818b4f2bb89af8606379f8f4be25e4a8151abdd12dda00adcc06cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Ib:A3k03kHRJmb
- TLSH T1DD25AF13EB9500E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 948KB
- SHA256 42fd76d23c7f06613749649a5f0135820e7464bb300c53716778bab1f2518925
- MD5 b47e978282e9c36dc96764484a3c70b3
- SHA1 157d188bea68f365428b12308549e390cd1c0ad1
- SHA512 01fb2e61d7d91acf65010ce08a1d5b0235902e2c2bdb7e8cb65dfef0831eac5c5e5689c5a60a85730ab1215c225825ab03c80f3c6f59ebc5d5e45cd95083ee92
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0a9:A3k03kHRJw
- TLSH T1A325AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 948KB
- SHA256 d781e3f516e05ffcae0e840bb69acff62d44bbbaa1ecf636f14531d9ea3bc088
- MD5 10e33b2d0b3a1b328bdb5a9457875557
- SHA1 d80dbdb349f005d42588a540fd02b2ad437bf4b0
- SHA512 b113af74a90333148459ada94ba2b1f6c0650195269e6371f3c200915f69206ec1f090bf029a37ba70c560d683232a1e433d648f586c40d9cafe03ed83170328
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0ac:A3k03kHRJh
- TLSH T12625AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 948KB
- SHA256 533c43b56b5aa10a34baa0ad5336a3cde94dc984a3984bba2e7c89a748c3e6f2
- MD5 481b50586cef1ed21ffd59851fe328eb
- SHA1 fc08c29f3cf37310e99669861e1de3884935fec6
- SHA512 8bc028b37a2f485d11961ed79864891a80842ce5ee5a7653c23bf7a3e47c6f7e7273724172b6170781adcf453764f9d39696da8304e79b67592dc71a24eeef14
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Tp:A3k03kHRJf
- TLSH T1B925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 948KB
- SHA256 978dc5b59af5b08fcd14bf6b02284cf7fa61aea896cf068a252fb35341c1a48a
- MD5 166b1e8d614d33602cc4c1940b868cd7
- SHA1 6b08d43a2524c92a005446548c990a3c0e86d8f3
- SHA512 a5aad012a18ebf22749895bd26a958301fcc5a04c66d609d07475a8ff473ebf2abdf6bb3c088622f9119127f4a52eccff4f02e24bb8335e7940dcb85d8a0aaa8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ00N:A3k03kHRJ0
- TLSH T10625AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 948KB
- SHA256 5a8d0c790d2c59ee0604d3354c9ba511c946f5a2f488733b6e244ee0feb72c6e
- MD5 9a594bc60cb91ac903486b5e41ba9676
- SHA1 61bf52448e97f93d472c475a67e521c2e29ea7af
- SHA512 050d19dee466e7cba250f0d821ee391ae2684dc49ef1bb3dfe2e2448c9942f9ef69c69a90f642bc78c48cadebab81848a7baa8b8b11baed2c987e634828e56c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0cF:A3k03kHRJi
- TLSH T18D25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 948KB
- SHA256 2bd08e6ae82a5cb3e2dc79446ff2e6772f3626c3a0a7ff861fd158d288268cfd
- MD5 f7091f3d55396b393138362bca1c1bf3
- SHA1 e8ee89765773f12befbb7eab3230d53694598422
- SHA512 8fbeb8e521d84795b17402b845bf8dff1dac67611f65d14a81e9e8c506491b6ba990553a6a1de49107af2e6d692f36e8f9664b7315976b4a495682d849d6d59e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0JC:A3k03kHRJ2
- TLSH T10825AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 948KB
- SHA256 9e5ecd1a4de0cd102db1fdd9746fbf7143690bf37187bc2990c5e2b0a8fa118d
- MD5 125cdf3e032c18b47d25ba578d713432
- SHA1 4664ef0ac1c23b1ca857e2b2053c2d38c23ac1d6
- SHA512 5e958cfc1bc6edae8b096ee7605c726b796ca8d85c99f4b3c0ff44cbf266ac092f6845a3c2bd60194e7585da4d50ebc51b57809e437c527ff99c987dd5b63c20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0qw:A3k03kHRJj
- TLSH T14C25AF13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 948KB
- SHA256 cd16a9c6b0e2eb54969f2d440ac791e22c07ce29776dd2e2f3bb9bd710b34ba7
- MD5 dc4b85226e9eb4dbe594ff6b3a19b5f9
- SHA1 88fc083426b308ccc70afcdc7f026d3211e9ac4a
- SHA512 c1cf0cd169fc8cc242699ff9c3afa0225819662d7eb111d969a0d6cb6c9fc35175227d11939927e4ba95f05cdb741178466c32f466a264ad5e40c1a1b3e2a35c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0xT:A3k03kHRJv
- TLSH T11B25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 948KB
- SHA256 892ca9d253705deaf891a2a55a4ffc661dbcceefc9859d1ad78d81d526caa783
- MD5 9d711f61a2a35ace03e8c04ed2761ee6
- SHA1 c4c0240d3f98f01b35c464ef7a182304c7702142
- SHA512 4d6005c279c3c4732ebf1354724f244d98e00bffc470fbc03390e87ecc4a4be5df23062a19287bcc5db8a108fb39b0aedaa8b150ff963700a567a474fec5793d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0fu:A3k03kHRJA
- TLSH T14725AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 948KB
- SHA256 fbdba76e43841043808f8b9ac84178a3297fabb45ef0897aae03a13a360af2f9
- MD5 4e272dcea91130294d69f5949754170d
- SHA1 25b166d114ba22c0ca29db3d0a26fdbe4da1f365
- SHA512 2e5e41248dcc6d21fff8aceae781a7378ef2e542f3b046547525b0c5af57f78300166e200559efcfe26df30af10230c62d23a2ca8b8583b06c6b6279076b543b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Db:A3k03kHRJ5
- TLSH T11E25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 948KB
- SHA256 63c9536e810d2188aad303be8a1db3eac6eb04e5effde3ae7c23f0c1a33f44bb
- MD5 3303e1435e276b4219ad4a250d65ce30
- SHA1 4dabec09179e3e0f4d62a934373aa50391ff36e2
- SHA512 880bdc1298f714e4dcd8117edb051aa1fd32e08c996e43dd0c710c3953218febe20f27aeb53fdac44530b91da4e5c64ee49c60a97e725fe38faeae6c1da71946
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Xf:A3k03kHRJJ
- TLSH T1EE25AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 948KB
- SHA256 1787119de3ea519a59ab35823054a67d8acc06c2fdded14ba7b55203151b573f
- MD5 360ab49557e9d9a80b36274f48467b23
- SHA1 9992d6cca3105685c7c0a31f19ee8a8c38bcba3b
- SHA512 7e321616b577ecafe846adf4e8adcfce28771d2d3e8943be313a2e0513379a2a23b127c022087c00e7feba927b9d208b79efcc366c86711a423fc877e95279ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0gK:A3k03kHRJh
- TLSH T15F25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 948KB
- SHA256 fe882c7dcd2aa4923d6cbc4b8318c6455a40501abd88ffe4e80c83b86207a9af
- MD5 3a81f7856dc92df8da5544632d18103f
- SHA1 fa6a851c5ca31524fb04dbbc02f92ce73fbd4fdc
- SHA512 b6ab9a8a44e3828a741e21c468ec7bf351ff783ba993ccc20c77972e70734fcf39b92c4d5d2d82f43ee1451cd064deff3c8f20c34d2397b182c0b0058d582843
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0dk:A3k03kHRJI
- TLSH T18425AF13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 948KB
- SHA256 e26f6910be2c90901b0afd979cd485a013cb3ddf3e2efb85a6f631b93fec17bb
- MD5 fce2c0c911fbaeae028430c6032a64c3
- SHA1 80b6f1768759f599c494c9e7cd4581e16dfad7eb
- SHA512 bb13969c357974811f0e84287f10b5d2dd271bdab36aae440cb4fda8742fd140c9f82ac141d4d91fcd213f25e8aad3b984be46f5811035ee97b72b9d87851e02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0C0:A3k03kHRJh
- TLSH T12025AF13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 948KB
- SHA256 049824b56dc1248b73491e87ef8f82c5d0734788de8d26451570afb9aaf5f272
- MD5 fd4a2180ea632d8e1da814c0e3eebd97
- SHA1 b9acb5082005db940e0ef4ba5ba212862b4be8b2
- SHA512 f91e44a077bf74e325ec0db440a6900c9d44e4ae2076cb635fc89361561eb2431a0e6d38978d810101fcc3e86cf31686543bc4d0f46447c8b58fcac3c8dee247
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Rg:A3k03kHRJg
- TLSH T15025AF13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 948KB
- SHA256 fcf919b494dec88515559e6dfa4963146f325970b8aeee7dd7963f5db8bda0f9
- MD5 f983ea2162a4380da84e3c24af814e77
- SHA1 488b789f76776cbf6122036297e41d20e04c7cf4
- SHA512 d375a03228e7e19dc631a150aa29322a34c909c2f1ca31a087c054d7a98a53bdc6148b04d14bf42a16062026bf157a28907c429b785e4eda38eeaf29a616ef29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ04r:A3k03kHRJq
- TLSH T11F25AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 948KB
- SHA256 d1640583e6334a3c9b3596a1f8f5fed90fb2e0a14bd910b2a752ccf0697d24a7
- MD5 44a63ac812535c78b1a443451b9cd072
- SHA1 92d70c135a5d977f3b3e6a338a49b8f7d5c29cdf
- SHA512 2408feec120eef65214c7852b82411040e128b032f63c464f51b894e786c53760f37e7b839272ffeeb0911d262e9a69282c9a478820d62d24e4203896b6ebc93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Wn:A3k03kHRJs
- TLSH T1B625AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 948KB
- SHA256 74182ee1a8462c921ec6e5b1f6b38889834bb93d32a790a500fe4fa7067d2b3b
- MD5 bc1797ed3caa8b8eeffa05f5a3a70a2e
- SHA1 a3a1bf2a5b11c2592bc5f952817584499760b781
- SHA512 213db43a380f22b3418bbeaff3036dce89a5b56189d9dc9ef9d8dbfb8189eb4aea76cf7d57122edfd86a5c28454016816bb89a813e753021f1c22819d5c7962c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ08x:A3k03kHRJ6
- TLSH T18225AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 948KB
- SHA256 4b882334dc85b8c4599159d39a9739759332d337f4c1930990014c83187c3e03
- MD5 2d2a643dc939a74281bc8aa3f29f84d2
- SHA1 bdaaa2dc367e40225550a5b355e7ccd4b7c9d28e
- SHA512 6326654826b02bf4ddad4c1383f67f8cef8c7e3ca823a8744d67aa40335108f20159489ac04934f423c2b7fcac9e46456928e1affe231e6f573b6d2cb94bb129
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ02A:A3k03kHRJ5
- TLSH T1AA25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 948KB
- SHA256 f8472a51128008eeaa968e93bccd55d2caa450bd8fa4ac60238ce62199c764bf
- MD5 bff16ba2a2582d9361368eb5dcc21167
- SHA1 57d7ccb6f2711a7d2717f9a561ebacb4f305e792
- SHA512 281d2fb76027b5c7c8f93cffb9618e645f234958501f5ac56fb26c664d8a374a077cbd47545c7552e51b37041f16df9bbd99f4f37c0b39015d82fda98357764c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0v9Q:A3k03kHRJg
- TLSH T15E25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 948KB
- SHA256 e3c1c75cb8ab773faa8934f34d3d778994c673591794a07ec06ff0da23e1b24f
- MD5 af63d96add9d0347cbf4cbde60522152
- SHA1 8eae2e1b71f0fa61a56065c474ba0818180332e8
- SHA512 8754b616800d500028a0d1585a4f9646ab99cab559952ee257d1dad5ba59ffa5da8ce89784d97440f70865124a461ec6d0539755a5319d98e22e872269a58c77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0G4:A3k03kHRJ7
- TLSH T12F25AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 948KB
- SHA256 d4dad74073ca89adc8f642672cbba02ffb1b228228bc3c3e321d63f4d0289302
- MD5 491ab0d9ef67eb8747db6114f9db912d
- SHA1 cc3fdcbaf68d3de8fdfab8ea99516394c7067798
- SHA512 88650b75cedd65b0e43e3581170dd5278451a940147b6ce4344766206808f92fc74a2168a48a22adf968dfa30f5e3f5ff5449f407bc2f77033d0d41aa36ffb5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Vu:A3k03kHRJu
- TLSH T17825AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 948KB
- SHA256 e03fe3c47158d6dfdffe393b434251d6bb32a898c3b79315d2b489989d49736f
- MD5 faf9a84781ca77f1cb26c8adcd2b97b0
- SHA1 e02c99c666b95a87848111386fb8e1b0a1f3be4b
- SHA512 b7c7fe3f0a164bf03b9c6b51352e5a8753722065be230a3c1abc322d210e73627180e3b7cb6fa67749f17b5c74ca400bf978715142d8ec541b9b1fc7f1c6df63
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Ij:A3k03kHRJA
- TLSH T1A425AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 948KB
- SHA256 dfb1f14242b777a3edcbfb7ab41e232fac1dbd72c64d4e5b6e82b1aff07806b6
- MD5 9f296ac024be5235c50e1a60a583d0bd
- SHA1 2fa7695451a80379b4f0b141eddd4c423da75b4c
- SHA512 e1f0c0af2c41eb824586571bcd674a5c53d4fe3a144d2f88949458275e8bd8e2b5fc74e7e65f7924f02d4e5f1422298cc539abb1cd6d24e2e70b5de9edcbf541
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ05g:A3k03kHRJY
- TLSH T1A525AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 948KB
- SHA256 3947eb02e6549a1819f1846d3152812449ec86e2f910dc63e861cbb07aef003b
- MD5 027208d452bc8700d6b6f9733350b644
- SHA1 37390b046d66d580366d212063b92fbb58d8bac6
- SHA512 e4be3175ce00a1ba070ef094eab6b95784a6639c14ecaea5c409b34182f534f1901b6b84e8f4090cf5b6ba27848fe1adbdd1f25bfab3329f4f4abc6d136a5bf9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0gI:A3k03kHRJp
- TLSH T12E25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 948KB
- SHA256 8e3fdcb2632c4c707cee172ecbac94a5a5d1a10128b4a556430c8358274ac77b
- MD5 d21946964df26b8befd87e5acbefae2e
- SHA1 7464bacd8f0456647449a479da378c8c8c78d1e9
- SHA512 5befef86196bfe56ee230bdfb93150814273c2d65f7bac14314884308613429be4b6e41744fcc77b0de99d2ad468a490649f8e1a349a71d30ee8505480351e29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0io:A3k03kHRJX
- TLSH T1B725AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 948KB
- SHA256 16d304e8afaf3ebd3580808b7a610a27bc5aac847c315479accccd280474c5dc
- MD5 8986ce459b9dc496f02284d6853c3883
- SHA1 37f6e7ff0501b691c1b28dfb2e9402e39957c1bd
- SHA512 1cfa3f186fa26542871a03e5b6dbae64fab3f3477a75691e84ab9dc83b6a90223faef3d665079d3de3404bbc539e568723a76b74172e8e6884ecefe07eb16d82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0Z+:A3k03kHRJi
- TLSH T14825AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 948KB
- SHA256 e35c0e2cccb23d3454eac3f74875658a5047a4c31819c981f9ecb5d461218d67
- MD5 efb9b1a68daee24da6d7c4202963126a
- SHA1 a8976a347ae630f5de0ac30eeb5fc56d9ff7696c
- SHA512 1bdd1a6e1b8c69509dc486f97609e691dd4359648d4417b609058ff8dfd839c4f1e43710848ffc3fbdce94aa00c0727640923943162491bf9fed5d45e217e3f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0HQ:A3k03kHRJW
- TLSH T1CD25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 948KB
- SHA256 109cfab41150c2a79ab050cfc19a9fc987dde7aac43ba4aef43684e6e2b0cdf0
- MD5 bb0dcfdd25530dba852c5892cb4297d1
- SHA1 99fc9ac98823273b306e3aa61a5a5cdc9f2bb7d6
- SHA512 b17e4a8d7c1464fdf75113479f14f5bf7db34316c07cd68548e0c5e8902759e875fc4c7bf7f17bdd3e6ed3b9ee2901c337384934fae21a34b8e795f8b5faeba8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0cX:A3k03kHRJW
- TLSH T12C25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 948KB
- SHA256 0ee9134147724fd057624f2995556d2705111d651186c5952ef3370533eaab37
- MD5 bd6661e177da795212008674a03a0595
- SHA1 2e4194ae1d82625ce8ee370353b919cfcd807f6d
- SHA512 d4ec0841988783e60ddc3931201c5452f92e3bc98f14b256f6d93dedb494f14509b92e6891d71970af0fa317235f718e0aca25d4eff71ed7a58ab437b26578b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0aL:A3k03kHRJY
- TLSH T10725AF13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 948KB
- SHA256 dd38b9551c87f7138eaba73fb1d98542606b930278a31bac453ad309fb826e68
- MD5 6fa350adf3a41f56f3ccae14b4f745dd
- SHA1 10887fa56a0fa8ae5b3007ce11bf2be1ee45a8aa
- SHA512 b8edd46f226b00b31dfd1387c78faba5860a4af1d6bcf1df37aca5f1307c436d9a05416856d9e2ba4b414f2f080500e47fe537960919282744a8e3e20de6f7d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0+M:A3k03kHRJ5
- TLSH T1BF25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 948KB
- SHA256 a20cc7a9e2bf526811ca13a74b7c75b20c3b4c3e83cf75221edd8f5617e2d0f9
- MD5 68fa962582c45ffd930d7d8676091241
- SHA1 7f192b9fb4f3481eba6be87ce058cbd9293ad396
- SHA512 1b2ed8c658b5164796e52847515014719d71197679981f503859dfd61f817c1502c4170c6cdc8332719ae592f9d424c5d8e4a6874282785577eab87a17e569c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsyKaCeiQ0nh:A3k03kHRJr
- TLSH T1C325AF13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH