Analysis
- max time kernel
122s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/07/2026, 19:27
Behavioral task
behavioral1
Sample
2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260729-x545gatsht
- SHA256 b10dfef021641a4fb052e1da48015b9fac3315ae325ec15511898bf762b241ee
- MD5 d2e79f0c16131294ed11c9c529628dc0
- SHA1 983844695f7d251cfe22feccd6e89a1178a3dfb9
- SHA512 aa09ad78ee267c3283b6a1d1153db07994d6ddd3e81f19f45873ebba08025a58da5e47d7654a6150acc29c40c2102a88622f78f80c8cd1a43337dd54ee77117c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjw:A3k03kB56r3
- TLSH T1D6157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/4072-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c469-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4072-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2404-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c89-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188cd-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a59-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-289.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-484.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-510.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-615.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-640.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-775.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-813.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-862.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-941.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-967.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1078.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1109.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1156.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001e0000000187fc-1566.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001ae40-1565.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c469-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c89-60.dat aspack_v212_v242 behavioral2/files/0x00040000000188cd-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a59-211.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-249.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-257.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-264.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-289.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-308.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-387.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-484.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-510.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-578.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-615.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-640.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-725.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-750.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-775.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-800.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-813.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-862.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-941.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-948.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-967.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1022.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1078.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1109.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1142.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1156.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1186.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1193.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1200.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1261.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1340.dat aspack_v212_v242 behavioral2/files/0x001e0000000187fc-1566.dat aspack_v212_v242 behavioral2/files/0x000200000001ae40-1565.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2404 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4072 2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2404 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-29_d2e79f0c16131294ed11c9c529628dc0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4072
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2404
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 b10dfef021641a4fb052e1da48015b9fac3315ae325ec15511898bf762b241ee
- MD5 d2e79f0c16131294ed11c9c529628dc0
- SHA1 983844695f7d251cfe22feccd6e89a1178a3dfb9
- SHA512 aa09ad78ee267c3283b6a1d1153db07994d6ddd3e81f19f45873ebba08025a58da5e47d7654a6150acc29c40c2102a88622f78f80c8cd1a43337dd54ee77117c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjw:A3k03kB56r3
- TLSH T1D6157B03E6850FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe
- Size 1.2MB
- SHA256 d98391d9d587c6665f3617b25b5254b4acaff2b238280b1b3d4c25baa2f1e819
- MD5 f3b71a2524301bb92b3c242e251346da
- SHA1 aece3072c823bbf79c58ff27fb2d22f3d0a3afcc
- SHA512 c043efd6383ae8019016a48972c67497974d946e73e9d24bae451a39d246281fb2135212879ceaa3057d83a83efebfcff9abf691eb68e865e955fff40e179e28
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjwdj3wh9+Y6FtLpwCw:A3k03kB56r3djY9L6FtLNw
- TLSH T1D5559D13E6840FA9D55F82749AA99272E677BC112F2093CF1358BE193F317C06A39397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.4MB
- SHA256 81e69c0fab347ce86dc43491c8d616bac1b90322fcad497ff904f4a55329d44d
- MD5 f7909091c2d39b13bf09447218717eed
- SHA1 8e2bafebf1831ea70c0753063a399b82882e47d3
- SHA512 a4fa80c98e8c708e74e78145b60023ba6527824f0264ad90feda5e4e9f11dfd2a53a1c4dd7f8180009e66a0eca7f91388149e6ba86ab4fabe98b9703d8e047d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjM3Td9CHKy7GZO:A3k03kB56r3Td9CHKyao
- TLSH T1DF658C12E7D40EE4E02FC13499A64522EA777C561F2097CF1358AE153F32BD0AA39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 42d7d6f288feecad134c0b9b431ddfbc3749d4e706c379e9e7bcfa43dfd28e7c
- MD5 75de4e038abd903c4cc384beb56c866e
- SHA1 391f0bb17395e9e527fa28ad9dfc22bc89632615
- SHA512 0f74e4a04fa4568905af73b75723ca7b1e7107e78f5a754a076ac564657c6c498dde9d9d15d9362604d96087e819ed20f0e1c9a5786fe2fa3715373ce4022e71
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjI0Le5ji0hmxNrM:A3k03kB56rzPji0Aj
- TLSH T12D655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 b06ff252e9882517cadf04ade65949f49514bdbff3b051f38e93e45a90f9063a
- MD5 29db0153d28140ae9315998b64980fd3
- SHA1 1c2aa9113556e23acd0a21dd4f4c7be831761264
- SHA512 8ed94a9deb492d19175ffce2520b12b24148a82c0b94450e7131b7879537579a3eab1a3e411889a90148d106d11cfe63d714356358521b91735ada661dad33b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjya:A3k03kB56r
- TLSH T1C5157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 ebf3390f20ed8c50e26d788d18a36f3c4fa9af405a74bddd0c1f2fdb0f2d80ef
- MD5 6a042714fa0e411467e2806c215bd3e4
- SHA1 d643f2aa89861a862d7363d482c7dd39fc45d8c8
- SHA512 615b131c61480da5e5cca00931c95ac2deb9f9a3bcc0031248a425f58471904ec2735ade6db1ab014822f6e0b61e98c9e11edaa20646e5d4df25ec4ec139a19c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjRb:A3k03kB56r2b
- TLSH T1E3258C03E6940FA5D10F81749A958662EA777C425F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 947KB
- SHA256 595bdc02fdec4ba14e7dcc0add3b346e283f6a929843557f84aa06aabf0dddac
- MD5 a9d3eec58a04d97bc84a449f2f1c022a
- SHA1 01b678bf7e37e2a38fe7798e8d54d4811f293440
- SHA512 b08a53f6c4de94aabafc6328e7304c685bf4403d8e0d78aa13bcf5d9c6682ade503f6e39744bca7c661523e285097f7813583e4bb48af8a576a43789051f7334
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjsZ:A3k03kB56rn
- TLSH T18D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 947KB
- SHA256 cdb351d3e9efb0ff954ec907ad767b1833f7debbade47dde5915872c67e018a7
- MD5 afd575c60254b24e237c48bdb5833787
- SHA1 ce420f793cb407aaef0019f5ba1645343c811100
- SHA512 7e4e5387662c6994334c312bb06b26ef9befdad95ea7c9f3c657b63eaa8d44481f33588325ea76be5ef16a8638ab7e4794fd5a572fd1f55e129623a04422d985
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjj1:A3k03kB56rg
- TLSH T121257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 947KB
- SHA256 09a2d2eaf3ec86ef617834b45f3fcec181c0a27df227db4bfc5d6073b253c662
- MD5 a1fd2f731632b78666a9928ae5fa9e22
- SHA1 00c72a607f17ba889f481704cf007b75b4018648
- SHA512 d18cf3844729047d0ee7648e509f4e4b859b44bc02191352be1977cb5b259eecded8ea785572c43820b98a15eebad34ad83d1009150cc8e0520266a76b3c7f91
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjD6:A3k03kB56rb
- TLSH T16F257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 947KB
- SHA256 2fffcfb617af019bc3b8a52b81a4c417667fbd69dc26feaff66e3a29b910bf10
- MD5 406c872f1582d258513113f92ba7eae8
- SHA1 3632382fdb8081b7eca19f4940e61044c948a106
- SHA512 3da995979b8409c1b59e2b830dd10d93b389bfbbff223d93c548b2947df8a921a21a45f45963094d1dd77ad6620fd93bac9329b2e4b57e06a7c2f32c101c5785
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjNo:A3k03kB56rD
- TLSH T126257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 947KB
- SHA256 7774d9555e283fe0a96dcb320c24e9ce4ccc21f604ddc60bc5aa787d27c70ee7
- MD5 becfc1bf4ba4371c0f9fe6e878f9d2e5
- SHA1 14bbf55ce4f7184be4ae672dedfa1ad48726fe31
- SHA512 1209733adf2d624a881a635b7d0ec946612884168905a2049f10faf75d78380d8e815b7584848d2e61b3bd76f64f91de8a164a9be7317c0aa582dbf22a660206
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjNu:A3k03kB56rV
- TLSH T1D7257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 05b7fe83ff2a2b629605c6369bff79df240bcc714041b2dd8390a3d72e22b401
- MD5 e9f4867c6f98c65b3c87e5677eee9a12
- SHA1 8de96b87d76dc002198a9c511758d2184f874358
- SHA512 7dd82e0ee19808740694df18f2c7705cf561c28687147adc9246b3346c3b1e8a589d4b83fb6c8d162ffacde76a3ae0f37bc8cc6d590b59238693b61883a92218
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjj9:A3k03kB56rg
- TLSH T122257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 8a53ff4ebc333868ce8d065b6d6a03c6621a1d8c2e2b991dd745f281e0baab6b
- MD5 3f6b412e0391f9c9b4abeb002e8d4f98
- SHA1 3d8904d0656af47372e4317d9d634e78f53befd7
- SHA512 aa09d1c4004093b93611563d30157d9afdc5a5900106580ced044de7878ff7f0f4dca1596de0af13dc72627b07a42ce5418b110e4f737c5ac530e79da8b58646
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjPc:A3k03kB56rR
- TLSH T12B257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 c568f97cdaff49f04f712ced8b8ea9339be2ff0da2885165347a35cca0f245ee
- MD5 f72df105ca92854cb9cc6184f9960b0a
- SHA1 88551f0cadefb130301707d3342b3d6e6f1a6418
- SHA512 9278a3067dd3aaf58943172b4ccab8ed7017a98619b2c2893d98a39ab606665e82e277215e323a880b4b1faf8cae7838ebc85ef38a19b9feb9a6adbc23863d57
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjIp:A3k03kB56rv
- TLSH T11C257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 31f44a1295daf049d643620bf119015e29489565005897c6fe6e69006b599519
- MD5 1d900d721cc3d5a11742fed86ed78595
- SHA1 d7f058c7928399ae19818150c0dcaaea5998bac7
- SHA512 1ca8d851e2bcbcef49f0d7650301afc9176aff242bf14afe523a69093b1a31aa6c7b391058f4169011fafbfcbfa69a4d385d518cb7476bf5e9bb37a0be070d0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjfN:A3k03kB56rk
- TLSH T10D257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 9aa965d4e9a5b7fe9d08b99ce76cb0b3f2a494e5d2b0138807062b64f200d5a5
- MD5 7c1752debd246bad598271b42c81a3e3
- SHA1 3def4a46928ddde4d89913e2805415db570bbde1
- SHA512 87c5f1b0b9e1f08ae6da162a7ce658f4ee98b1f90e3e053b246d05fe9bec043f7972e2d133dc6137c376b1bc91866e5168c777de62a52ad7b08fc27314124337
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjdF:A3k03kB56rS
- TLSH T197257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 b40a30601791d8f098129e08266dae8c76e0baeabb1b866e750ed997bb828cfb
- MD5 a59af12448b6e79ba4ee3dbfe0c50c47
- SHA1 58ad4f8bf0f88ecbd594b6aa6e60f33230de4201
- SHA512 00511f18e7d6a20091a6935764488ac4606d3d6943bd7c290ec30bb2262f1a76c183740f3b07e917c8aef46164123a2421c7e9b05d50cd9598c5ee7704dae048
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjuC:A3k03kB56rm
- TLSH T159257B03E6850FA4D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 7b25369140f7270d253a196be11a4f1be7293a052c84c59cb13f49d7100c16c8
- MD5 4ede34d309bb84cc8b94e7b5635cace8
- SHA1 416121e99e5e8e31a9c46d6e66c5c5daaf4d4620
- SHA512 8331192305802fb03e6f4f2095cfd6300096c70c4320a77cc5c7fd6bece1873bf4da9193f875455cf6f6e26613b9c25142d9c2c0cf1c205563de517f82f473ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjxw:A3k03kB56rT
- TLSH T12B257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 fe661b8aad9973eb939d9510ed4628dcb3a708d4c39f2d11e04c649c93c65507
- MD5 e4688c5e7ac74c87ae2d07db3601fe8c
- SHA1 5ff0208c005f04db0937bec7df81bde76150e5ac
- SHA512 9d5fb59241aeedd69984e2754aa6eef173e0ec2eb90c6256b89daaf18a9c39a37691bf73ee2f60135f29dad3c2c38aa1593325cb3e72215c1e43e977366f3cd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjYT:A3k03kB56rf
- TLSH T1B4257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 4ff7129fe44fa1c1a3122efeed3f3198d6fb901d0ba98bf44391c25fb2ab7e09
- MD5 ac1979bc35015009f21e0ddaf4d5582a
- SHA1 c2a0ead5852966f34bec2740e8c739dedb11b5a1
- SHA512 f0b1e2369bc44ad115a76a022bdf7263780f044c787265d79b9207856e0b9c10bcac1384d816466013c3585989e6ed7aa3c65b67ebeef78c0796a84547783ada
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSj0u:A3k03kB56rw
- TLSH T194257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 a65f3a890fd01af3d94b501bc316b9f851f5767c8fa6494cff07582e65abfcc9
- MD5 6793884246b14fda1b3a6b2e8870157d
- SHA1 2978d6170ba512cbb3d4881ab46b1b6271378272
- SHA512 8b59d57f3c2b2781bfcdf59f5c099723f9573971f92ed9052c36b43f99678fe422e3caef468c34a1cd9628923ea7618040e50985c1a3839c88f5c51f1b1e0547
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjib:A3k03kB56rp
- TLSH T17B257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 3a6665627d274ae49ee3f89e6c97cf2aa2fe9bbbc83cc65cda0b79c407683281
- MD5 bb49fdf48b64ed422c81df2f64c5f79e
- SHA1 d86e867d59d04ba5ffaf9c6064fc9158064fc1be
- SHA512 bd5a0babadbd282cc38190358f7ef10d965ba9075267e04cadd9b1da54fba4ecd7eeaaf752a554d84a17baea92829202c4c21471275ff84ccc5f4c9707e3ea54
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjkf:A3k03kB56r5
- TLSH T119257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 ce1b14b1ce6685733053af0e5a90713fc5d0d7204ee978234bb0633251d9607d
- MD5 8c085cf2e8b64a31e23c89f51c0e88cd
- SHA1 5bad3998b7c502035749e1e95c4e6665aa4b85e2
- SHA512 7dcecf2270105b921ebb8a4b200adfd2011effd1a298180f5c935739db2689b1ae8999a28a35bac4510e533aca4456e9d0758f3c9ea0bee8fa30da8f74b9ba93
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjBK:A3k03kB56rR
- TLSH T106257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 2aa4db734690fcc9add776f7ba3a4df5fd5da066f89551126c34c8df11ab7e41
- MD5 82a274c8bcb0af4c8fdeb7bfa9b5f64b
- SHA1 140cf5dc6b15b65000334448b847eb96a0641989
- SHA512 082a59def0f141e2ad63455a4070dc251f8f6ad2c3471dde79839b06078ad7eb8d3c8439147b2ed92229ccc1fd269e0a34ccc09d8e800b878e3955f65447aaf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSj6k:A3k03kB56r4
- TLSH T18E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 de266d7b73c786f4b13d84354fdde364a98df8afdd0c0fdf384484c5c5d06b14
- MD5 e7665ea6f097d3e075047d87c3b69e85
- SHA1 626e95770cc8f6e15731864cf8b127b6e0134f2e
- SHA512 418137da1d0e96be79552c2529b2ebdd13f07a0843c2394924faf2674399405266243826df874b6a64258f206c6f6e73b73322f3ae05ccffd9bead90fdb4e472
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjf0:A3k03kB56rx
- TLSH T1FB257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 804e9da00e26c0940e15f7cf670c56c1162c083236f2baeeb742ac0836a4d452
- MD5 bed9dafe9b5b33a2b48e051f0aee8918
- SHA1 0b500834c2e793d742b3ae85d8e60f417a19fedc
- SHA512 282ea33f76582c27e7651b8a9506458b4be4f1f28c61a07f87b1aefffc13c89251863e38a0cf0a9264e7c252cbe1bb6b26fa57831948d31612e4f84823759ce1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjug:A3k03kB56rQ
- TLSH T15A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 65ac1e609ac45723241996d5fde5b26738b77bd86e031d0667c40cde108ef86b
- MD5 3c5ddd07476865b8798385b3435028f1
- SHA1 2c21a7d90ce493f9bcb249ae413871df458dd6d5
- SHA512 56486ee550203b595280f0a7b009d3024c8c53f48544910f65b27360a52dd098e9374299b6288dcaa98ee101a4d4a7671f63cb028b6da104db262fe1cc096bfa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSj3r:A3k03kB56ra
- TLSH T145257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 0ae161018b8aa0509bff42c618694e3c5f7818859538ef987c5192f5a8015d11
- MD5 ac2a266ed3160618e8703eb5a015ca2a
- SHA1 55f3c34f4cb04f012539320ed24de01e22447abb
- SHA512 5d7942171a43e3c449399176298a7661c4893efa23d72df36b7e3e2cf64155ab0585a1a64cdf8d0fc34df1e1abad6b6f1bc24f85d7fb5e898c3668685628e11e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjBn:A3k03kB56r8
- TLSH T1F6257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 6fb153968ce08720d126c8a7d78aeaac5cabbbe29a4a8bfc4cc6a11bb7285f12
- MD5 d547536ade95970370a6b15737c8d0f4
- SHA1 13778528134f4b694fc0a6d731dfdce9b6489b46
- SHA512 84b9a44b91177093f413c71709fc6348b9766c3f4918c6525662c769d50820dc046db6e1c07aab831cb378626a2067d1c37ac4ae8b75237d723e59138667fe70
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjtx:A3k03kB56rq
- TLSH T1C7257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 7c71272498db49e753723744da85907ea59da230ae2fc2d294877b93e108b230
- MD5 b7d828e4db5995921e252ce2c7d6828b
- SHA1 b9bdf46c829edcf06b30042d8bd0cd6cfb6db2ec
- SHA512 8e98e7ca0d65743a52e8ffa06870efe4bd85817c4bfcd1c6cb96531f84c46d50756b173e703afbfa5d36ee8e4b012b5f6e6e93799584f6d51a07527ee0af52b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjzA:A3k03kB56rp
- TLSH T181257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 1652a3d60193069f2f4a04a8cc4f7eab28b8dc57bc764e9a021fc58647fd1655
- MD5 aa6f9e3d2bf31dac189249407bbeec0a
- SHA1 4288df765fd37a638409d1cc48c184050087f4fd
- SHA512 7e0e761186adf6f0ee62bff50084ff715109cb91ee1b3fb17005e5d41fe5ae79caedae379986def18f9933ac7599918748c2d14209c0463821d1b1bc7c118e81
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjE9Q:A3k03kB56rw
- TLSH T147257B03E6850FA4D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 5f023ae50281b945c201af97271a95a762532804a5395817100553de7e34604b
- MD5 bb470128b24cd90f5d1ebb2773b29974
- SHA1 92ffff93ef5c03cb982b3a1c1fa9c2f1e9cca42c
- SHA512 7cc5f6a60b63fef6e18e4fbe519a321d9b8076adc78b050372e4467799b6dad4500f284655ae19e1daa8c5e3bf841255742f951b5fb3cdf378ec2bf3659e6e9a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjd4:A3k03kB56rr
- TLSH T1B4257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 df98ae6b6e808787edaf790a2ef6a479f766da13e9ccf0eff1152c47f2b81fef
- MD5 d738bfebc9e1c7cd5322596f77a07f55
- SHA1 8ec8a67ab6602c2a953be5a00497c65e067b0677
- SHA512 55b3007824012979e0560e47453a60a7194b8ff57becf7f4c8aa554d70f04dca4eaa0e2d636d6bc5f7a25ab1199935ad63496acf6e8cdd9cfd9bea9bc29fbb62
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSj4u:A3k03kB56re
- TLSH T14E257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 64c2845ee30002897ff7bb4c771f83c0f5ec29a3b8cf83e028e7c53ea090b647
- MD5 9287883ef6111a226a75016e0a162b9d
- SHA1 e6b5bb738d3ca30429f3a854252f8a073054267d
- SHA512 7aa752c703b5905d065c3d375d0f0755cf5596fc28f9d26d1ca1798a8d4af0a6b3d3c2c5ae9176697ad392e264d90b823c9d4db9dc29bda785163e13f8c35ad5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjZj:A3k03kB56rQ
- TLSH T1CA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 4e0239f4e754f035ca121ced5b39a197f8f2f4c4b9a32dbbf066f58e3c08cece
- MD5 10946368c0580b8384003362e0083cf2
- SHA1 d6d543e289b70140db6727e3d686e14db81c85ea
- SHA512 4e9304d866b014242e6eead3035e29002e50913efbf3bf8e08ebcd75ae2d005a50af27bc510531ab6ab90ff4ca93836ec8a7542fd632843331696b52c02401f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjAg:A3k03kB56ro
- TLSH T1D7257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 e34253a777579b4e1112321ed7818aaab62dd91938d7c94fde3fde646c7a80e6
- MD5 4eb28d0888982443b545fb6244ce8a20
- SHA1 aceb1d801dcd647d0ac6d259f1ea33ac085d5a0a
- SHA512 05858dcfce6c05f7821271f543aeba65f3d966812d35b9ce803b8163a36d7f1c56b7cbcafe1c8fb14e78b024f823dcbae4af0dc0ee2c7595bc38b01e60e04a2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjvI:A3k03kB56rZ
- TLSH T1F0257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 7ffe7bfd7ba4273c31cbf98c1d05bd9be9d933267badbb204b9acd492680d98a
- MD5 1d81a8dafae2a80df0f578e8d9dc071d
- SHA1 b9a5ea3098caf99acf13124c56ea425c9446e52d
- SHA512 d644435646339c4cd2dc60a360351d08b5fb0343e694a8022c9f69a05e92fbe617aea91ace00d40781964a8d81406d90a63855caedf7b06930b22ebbad679b80
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjVo:A3k03kB56rH
- TLSH T10A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 b37be409b671c1f93f94d8f77d47d911e6e4bd5827228d74edb1e40010021c97
- MD5 fb2668c9e3ea0c163a82e4d1e59ad486
- SHA1 4bb89f358e7341fc270efb29503ee7655a3e609e
- SHA512 0b26cce4f607ff258fcda88e925cfb6d6f323efdecc8119a545a09a7c9113d52b14010e136754bb37b1127bffcc31e48a57a6fa3cf1c42a989776a5adc45226f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjG+:A3k03kB56ry
- TLSH T12B257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 daa5a2c6492332ec0fcf9b313ae1789eee8e645ba957c2f7dece0d27afa6a418
- MD5 4440df4e222846d16ee7049ffca079b5
- SHA1 30859c5e2d980c7b1945d66bb5a87fad8e342b4c
- SHA512 396186245a09a635b6ba4174657c28c4935dd8c5f21531cbfb128378c008b76fb9ed733710591b7a9567287e6e348874a123417a22f8c49f6786dbd8ad2022e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjGQ:A3k03kB56rm
- TLSH T1DE257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 750309445c8bd7b8ab3c8e2f9ee3c8f3ef13b4f646cf4a8c84c49d222432408a
- MD5 75fc4383c8f33aee851a7cb652fa7335
- SHA1 72942c9c1f69f29d9d9b1f97aab9f076f9028598
- SHA512 494178b19568eaa4cc8541e3993f0f64e903a293c5d50012f7a4d23c23e8bdc0d46e0898bb651c302b8bfb96b0a78a716488ddc15ff10d54f9d0d733dcc4aaad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjXX:A3k03kB56rG
- TLSH T175257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 5a204f55546ae733bf82cabd93c71c22a85c52b2e29c9c72bdf4c28c0e5a8652
- MD5 3fffdde5926d111948c52fc2b243a23f
- SHA1 453520b403f4fc986a62f705cb2eee351d611ea5
- SHA512 afeff00b20c686af136278736ff10f68e074197d69bc04f18149ebecc73053e311069b0e4e5c148a006e7a7b7ae480c8e37b62d167cdb64ef1478e8348824c93
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjNL:A3k03kB56rI
- TLSH T113257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 d945dbdea5065bb52ebaad166a864f48a22f6db4651d68d9cd940f3871691a06
- MD5 8604b0e0a418f30fd50445bf835a9a72
- SHA1 45c8ad049d1883f809f743ebbf4b33d951c2fab0
- SHA512 a7f081afd8ce9dfa218b72f5107924a097dddb6e596c1017a0c4d77ccebef5a5b2f55962c688a832c12e8ab6353474dc2332ad7264deed05ed86b106999a6be0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjLM:A3k03kB56rJ
- TLSH T1DA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 a448134baa4e856c96f92c47821b7a55b4354cf3cd67498523e79c5e0ceb131f
- MD5 9ffb98a9898d403fa4b82ee67fb4cc8b
- SHA1 0a8a14ea31aaa3fb1c8e7187887316c6cb478e84
- SHA512 a01b827d6e30c8677dd493e3af970ea0b8bb1ed8f08196da22922e6fdd3be50b26668254ca5ae32766bc9eac3675e00a0ad15613b6c15ede6ff085984bb63291
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaSjMh:A3k03kB56r7
- TLSH T132257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH