Analysis
- max time kernel
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 06:50
Behavioral task
behavioral1
Sample
2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 901KB
- Sample260731-hl3d7sed62
- SHA256 55544df83202a651f30bddcd9875a29c4aad03647e1ce52bd624313cfccd7035
- MD5 defb774c306b42c08398fe9f2b41ef2c
- SHA1 a19124acce3e23952cc30494d7d0235be30f0d32
- SHA512 98855d9a0cbf9c15488b7a67376553fffa33039cfec60d2c6e495baead5b93d6197b981430016d3b08b819dd014e6a0f12d039bb7c40c2d1ce146c1e1acc36d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAp:A3k03kHRJ/
- TLSH T1F715AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/908-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c44b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/908-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3324-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c89-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188cd-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a59-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-253.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-297.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-310.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-412.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-426.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-464.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-465.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-472.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-524.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-615.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-640.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-660.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-765.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-815.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-963.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-982.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a842-1067.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac7b-1240.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019e4d-1368.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c44b-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c89-60.dat aspack_v212_v242 behavioral2/files/0x00040000000188cd-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a59-211.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-230.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-250.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-251.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-253.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-266.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-297.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-310.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-329.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-348.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-367.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-399.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-412.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-426.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-451.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-464.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-465.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-472.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-485.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-524.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-615.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-640.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-660.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-765.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-802.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-815.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-828.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-871.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-935.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-949.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-963.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-982.dat aspack_v212_v242 behavioral2/files/0x000300000001a842-1067.dat aspack_v212_v242 behavioral2/files/0x000300000001ac7b-1240.dat aspack_v212_v242 behavioral2/files/0x0004000000019e4d-1368.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3324 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_131343\javaws.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{19C38D80-0C26-4176-9E53-8ABFFD293E4D}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 908 2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3324 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_defb774c306b42c08398fe9f2b41ef2c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:908
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3324
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 901KB
- SHA256 55544df83202a651f30bddcd9875a29c4aad03647e1ce52bd624313cfccd7035
- MD5 defb774c306b42c08398fe9f2b41ef2c
- SHA1 a19124acce3e23952cc30494d7d0235be30f0d32
- SHA512 98855d9a0cbf9c15488b7a67376553fffa33039cfec60d2c6e495baead5b93d6197b981430016d3b08b819dd014e6a0f12d039bb7c40c2d1ce146c1e1acc36d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAp:A3k03kHRJ/
- TLSH T1F715AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 4335e1ccfe1b93c79b85181268bc00fabe2f2dc9400196e1dccb1f9380dd1f68
- MD5 2635152977c492c39a313dba790f92b4
- SHA1 4096223de302fe04ce55617f8c8663b1aee421d7
- SHA512 1f8521f4a5da6cb346871d8e071bac7ca02a09d2622dd447f28d69464d18e169b7a846a625e56a42e33bcdfb6141e00b33431dee4259fb4709f4ff6e694ed8e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAV0Le5ji0hmxNrM:A3k03kHRJrPji0Aj
- TLSH T153658C17F6A402B5D027C1B9C6D6965AFA7138821B3086CF1359C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 915KB
- SHA256 d68175d620a55a64892e49998bfce5ce6a134e67178900cab7e28c06eb61f8ab
- MD5 840eccbb603ab219e787dbe7d01f5146
- SHA1 2de3764aaadc05b449fb2f9217db6c3ce83b58d7
- SHA512 08c7be8ab71d215d82a61d8f279e81a264b2cb0b8802381daede4e369201232b94c899f36bd042c5fe1ae3654e7440e43e1777088044877087d444b71a636d69
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA3a:A3k03kHRJ
- TLSH T17715AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 948KB
- SHA256 3e4e09a870b8d2edab15c5d61ced351d74406b4d66bcd0c9b7c0719e77aae591
- MD5 144daed20e6fa52c4d3c6944b98edc12
- SHA1 8c8e9f795f567b0bbe8195374f2b50cc3a41a47e
- SHA512 d38ef54cdbdf59196bd0ac75c76a79163e1f08c3c9b5425f4b96c4912f7d84a669a7ce4fd80ca5e9c1748ad3a7cce1bdc147bfbfd983d044544079e6e3b52946
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA0b:A3k03kHRJOb
- TLSH T11E25AE13E79400E9E10AC1749AE68623FB75BD56177093DF2358C6152F62BC0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 924KB
- SHA256 6c926032a1103a6007377b79ed8166a5663a95bc94f384a7e25e13cb0951e960
- MD5 5b9953f46a2de466ad601d9a1443395c
- SHA1 d3ac5dbd84e8790ce5e508089f84f17c0530701f
- SHA512 b97b54c28ea808ba67440d795e6f6eb018a6d492d65c44dbc63b564bd12fed2e66a85631c64abfe1bfb0486e69d284e022a804b1533d99b8035006943b7c19fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAHZ:A3k03kHRJP
- TLSH T18615AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 924KB
- SHA256 ac3d8f65303be04e014cd762f2c37ec2811e1dd5e6281c4b70c73618d3e14735
- MD5 3a29ea8852ccf7cd742664c1630d4968
- SHA1 86b88fd5e008ead96ca9562ad9f93279fa2a691d
- SHA512 dd9abcd9342fc6e2153a5eee9e6ae3db9d6493f1254d136ecad5feebcb647e165c6f9b78ef709be2704efbc9373d2097c5129cc23b449c64d94fd3bb479527aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAc1:A3k03kHRJI
- TLSH T1D615AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 924KB
- SHA256 f9dbd8331db4b887a9a9dac316f9fdb75492b6f802bf8c6bbcc1f431a09e4f34
- MD5 5d74ebbd62a8a3d35cb7f092a998b146
- SHA1 bd3d342e95e8bda1d87bfa1bd0ff77ba0a50cdd1
- SHA512 1198bca9a95366d39f33aef56471b3a9c9c1f6236240c6407af2478582fe9918ec0303a6ca6334c8d196aa1d241bcd86104234e7c924c440df0d7359ecbafbaa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA26:A3k03kHRJz
- TLSH T17615AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 924KB
- SHA256 c14c9a5a7d1a0c1bb4bbb8efd5e9e9f3ad21f052913d3cfd18858de18b804091
- MD5 3cf8a1e6940d3c35e8799fc8fc100981
- SHA1 fb0697e1bcae0bb8731b4146255251151cbf6fb4
- SHA512 df88d88c23cdcfba77793fd7da8c5226b2e328391c32663bd103f7a6578906d4cdc3d414a8835aad70f132651a65f85414ec771e1de9a4cd8115348f8ab1f9a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAmN:A3k03kHRJu
- TLSH T18815AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 924KB
- SHA256 8f359d941e6f60b2f3e4850b956dd827d3e409778678b3c0051b8a5cb7f2378e
- MD5 904ff01d4090281c7c8c55f43edf5223
- SHA1 74388c3f39dd1b86bfb43811ee3c15649e289d61
- SHA512 59d5edc453df4f91e8373100062233a9d53918fd000d96aa4a3a002f461b27776240e728d2d839981afc765523c34a5c8fe2905da898f02ee4ccc030a7aa5632
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAkf:A3k03kHRJi
- TLSH T16C15AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 924KB
- SHA256 3890296758070fbbed57c8ab073a2b44f59a8176d916486c709622290ea9467e
- MD5 8578de475c1ffe4ae720bc66ae684962
- SHA1 6d6d414022a48ccab49658476c9b9b0e8778ac5c
- SHA512 6b9d7c086fa282892bc4f9dd85918effee504cf398e7774aecd24bf2c9163c7ded523f5e29dc0d369810b55ee1d3ed93093829af817f20b55b03cad128c0c475
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAOo:A3k03kHRJr
- TLSH T1A915AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 924KB
- SHA256 2cfd0ccb0de69fe7cfa66c1b891af731385666afd6b3602e02aca7dcb41af8e1
- MD5 eeb8b66367fcdaffe7a6aab96f4a1209
- SHA1 15dad9145e42ec4baf3a691af0b8eecd8cd70a78
- SHA512 a33970c2fabe007ba4f57dfb0565dad4a24914fd43730db99cd909881146971f4c0021cb22a7f80f5781fa9879a7b0814418ef0dc2b8e03bd5a45e2f404f07de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAiu:A3k03kHRJN
- TLSH T17415AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 924KB
- SHA256 88ebbc6eb01e5c62b6be6109d9d7e5b2f41f8cbc50b4d6b514c6673d134fb8ea
- MD5 b084975aa7f95b020e3189550f588441
- SHA1 9d9eef199b8a2dd5e2539d5bedc18536c3ac50ab
- SHA512 5fccd8d04741b2837ff049882980bb405c1945bc08d2d2c19c5f8f79d6289ce61142434820b2c2d2bc21ddf0962c826ff5a6943b940e114604eab81bd3ae1282
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA29:A3k03kHRJ4
- TLSH T18015AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 924KB
- SHA256 48aafa81f30ea4ddaa06c95c3781ece6dd2039ee66b225e7b3f05cf5ea6da8c4
- MD5 93ae6717704360b3b7fdd666e5118528
- SHA1 b03cf1f574bd65573474e8d16724a406e4994379
- SHA512 f063aa988586104bd93dd4cafbf7ca62f2906b95ff4a84d1bce92b57f2e776f6930358a79019175cb952606f28840d130e3ae5b8f0ec8f98c1aa25574d796e56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA2c:A3k03kHRJ5
- TLSH T1B115AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 924KB
- SHA256 084916217129f82f11a9af456a6bdabe4bdee6f99a0e9f7ead8f4aa141db7fbc
- MD5 fde6c266645950859386dd6a4b31ddd6
- SHA1 35370bf5c4984ef9a3e70fa52319b3f33f7c3a27
- SHA512 f908fba75ef45989a3e8df43d993024b26313edc444b430a253aa3df32718c8e4a7b8a3049e7c828a10400576530fb01ceb81afa4783b646bf307b05605dde51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAvp:A3k03kHRJ3
- TLSH T18515AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 924KB
- SHA256 bf94f5d24a3b84816aeaaf0b8d80726d328712a319950d0d48026fe76b031f14
- MD5 92a7136552bd47263da293b8adad44da
- SHA1 a8ef71e2f853fa26692f4a77fd5353bc5997d062
- SHA512 2da3250cf05121fd84813874962f51724e1d0cfd4592bbf6d2f8ed49a48c58c7009842636af421f2ef98a0dd81490d0168ee1cf134d89272f09d700c6872cc25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAQN:A3k03kHRJc
- TLSH T16615AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 924KB
- SHA256 f62ae3a4964af440245c5d13eb7c6a837503c3d873f65bffca1db47d2a707952
- MD5 eaabfe0254c98d3aa06179ca172a2621
- SHA1 fc41bc193e9745b977371eb03286e90ce30fa565
- SHA512 61b5c7e0689cee57b2ef39543c672bf352473eec0792ad450dd81d31520715fbca37dc23f2c645a3ce27b50a5c2ef3649c3c1c35cfd2e23f359917359e3158bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAYF:A3k03kHRJq
- TLSH T1E715AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 924KB
- SHA256 8812a1d32a9a7313121fb589f338d17e39204ea377734c88437357307a7888e8
- MD5 0e33cfac7da7561da3f89fb7e8196e05
- SHA1 7b39842201d5d421abbde8cc9d5e34f893eea491
- SHA512 1ef6f5a85a4e5035a931ead7ec77e87875eeefee0e78d76197c84dc01dd5f6ca0258f48778bcade78c7885772c4ddd98ffde237c083184b12af8745e2893a36d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyANC:A3k03kHRJ+
- TLSH T18415AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 924KB
- SHA256 cd26a991f4c2df2ba1b9e14b7579deb9fc14ef88d464798b9b7425d525616081
- MD5 aec9d6f395a755590621890d7150290f
- SHA1 9ab3065fd68d78b2ea4a619023de06272ab99a95
- SHA512 063f318f7294091d988c427a4fdb2753075ade463eb3ad86ab3136e4bd63da4eb0f0a7cc03c454fa342c7d354b6978a63e995e7f703c836b8d2cd3426105b7c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA2w:A3k03kHRJL
- TLSH T1E415AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 924KB
- SHA256 5df033c207a262508975274996f738c23cfc55b7c2d4b954b2a5d723c3f4ad0b
- MD5 d795772acca2778bbfbff32690f425a0
- SHA1 e9ed8623638a6839006cc803c0a1947079db9f6a
- SHA512 0615b3fa47ba69b1ba465933227e8470ebd6ac21425de97046e6cd7ba5ea7a90e394859caffdb8d0dbc394820dd2f1263743aa8e9b5fea1c46ff6e59841472f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAlT:A3k03kHRJ3
- TLSH T1EF15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 924KB
- SHA256 2cecd5be25fe45f432713a7b74f2af209b3220fe0f1e2fd680cfb5eab6df4ff6
- MD5 3ab9b816da07053f4b86d697763e07b5
- SHA1 ab3e634987e2e7a32fcf9a15ff56ad3d225d6440
- SHA512 3cd3441730ae6def41def7fbd768ec243e2e56b53ed9abcbb2a40572ba149c8d1f9ffd5dbeff1b67c3faebdeced8989d96d043ee550e876d8be4b4c6882fe326
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA7u:A3k03kHRJ4
- TLSH T1EF15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 924KB
- SHA256 c5cf56c0da342e424d61112eca92707743a1ecd93464f054fcee2627d49c7f45
- MD5 3eec5b82c5edd8c89fc1073d4eb831b7
- SHA1 6d9e64ea2e89ab2e85c3d4799aa3f578b2e9cd60
- SHA512 0a40d1d9bcbf7ca4be1137db73671a00cd051538f8775690d869a202a25922547d21966988d437303807db96c27c46274f4d01c1dffe2aeeb09e1696d0751b86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAfb:A3k03kHRJh
- TLSH T10315AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 924KB
- SHA256 6b4813012684af659e5f9e957bee7378912f04c23a866087727550f62c19b218
- MD5 d688f0c2416906aa84010b93649a89db
- SHA1 263ae4cc7cd552163dfcc574b86701a9fa2d27ee
- SHA512 7303527116bbd4f3c9fdfc084314abcba431c7354ecea221b9cbb73e76d9f035aa489b2717f8c3d757fdbba2791ba1d12a1e992ac1a0d169edbf3d512b5ed18c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAbf:A3k03kHRJh
- TLSH T14815AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 924KB
- SHA256 7aa41bb89f6fa73b677bff65606dd088320a6f2c83947bc0f7188dbef85ac367
- MD5 f0c2cbb49c89a592d22b0bbff6d068d7
- SHA1 e5e14b0e4f85463a0e4e703faa73184869af01f8
- SHA512 cf5a04a158f12ffaafec531d396365004183e055ae0ed5f9d390dc38ed0be12309524f1d3b65a1ea89f6da2b2441cde50fd21e87ba93b09afb9b4ef39fb0fc88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA0K:A3k03kHRJ5
- TLSH T1BA15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 924KB
- SHA256 120d9a23c3fb83ae2f0c9003eb1d35186357329a7d48a7f1b44bfda600e627f4
- MD5 a581c56f1d7df321fb9f4c257e0f6838
- SHA1 eeefe7d4c871aa67bc761a573ad11aa70d1ccb23
- SHA512 fc5234cd3d21c9811588ee5b20076f56b73689cb2bf918e2e69c7b943ac2ea5188c8918b768350d6023fa5ed28795a9bb69bd7cca2e00aedb2a8dd508120a887
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyApk:A3k03kHRJw
- TLSH T1E915AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 924KB
- SHA256 2dbb01021a08e90d38d6f30c0be03619e336e469e8f5b653d6d692ac2c2f61b0
- MD5 45bd9c869950f4968c233771c90414ff
- SHA1 4471746ae820400ddc06047623003d5215029d09
- SHA512 fe5133de13b20788753240ee4a90dc382249cf4cc643bfb3c543d03aede13c2f0b9caff58de6fce623b7b58acb4262585f62163ae1299c633b2d638b32990e4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAG0:A3k03kHRJZ
- TLSH T10C15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 924KB
- SHA256 0769efcc4078c6d8c54b6096a43b1f0935693f63a8ca517ba87ed927d7cba14c
- MD5 5aff3f5ba086f022968568930f775770
- SHA1 f58f1e974905983a54c28c5bbce4334b199585c0
- SHA512 85139687f210e638f313637db3bb48d2b75cc96d37e60467aa052ea483ea57b38dc1b894c4da492efedfbd721edc3494f781d30e44f15dace86a4aa685d91c56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAVg:A3k03kHRJI
- TLSH T1E715AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 924KB
- SHA256 5401d496e0beacb5732f83f8135ef07e569c177b03ddc2eb86643bf549929e0b
- MD5 cdcc278750adf43cded01b10cca52b79
- SHA1 c1d510d27ae4799a0cae079f0170e08567a63065
- SHA512 bad07d546f7212de5fd2c5f7dcfb644dd1730369fa5b15a8e24203b536794e5da4a6beb5526e3b9fd1867ca53471097758366f4ab0a320c273d5223c61cf79af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAkr:A3k03kHRJy
- TLSH T11A15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 924KB
- SHA256 300532d5f5b18305c19ab4f905fe5a83b5c57d5ec60a488c9a1e3a8367ca8898
- MD5 ca6e7c7c246fbee7bdee359532574cf1
- SHA1 20d91f84b27b919f2d0fd09dee09019614ee487d
- SHA512 e8682f7c8b0ef7d62951a362b112fab2fb0cfc9bd0f950e29c4bf19e228f066beb9728d2173bf8b10b0b13eb01f7b5a17fa3bb43f5ae176c9ff3fa6a33e6740b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA6n:A3k03kHRJk
- TLSH T12715AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 924KB
- SHA256 0cb481503bc335f15b33c42b67c5ef3cfd4eb8960933caf448789b123488bba0
- MD5 845efbf361d87fa62f9c1c65fe654623
- SHA1 996309b86db2141d8774182b3906e023343f5cc8
- SHA512 df98851c73cc858c9bd3ab22e2c90b5ddc9a407c870fa4425ee32719ed1eca0badcdbf3f65ffd237e3dd83158224c95c5abc635446a3627d8c4a244b2dba5ae3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAQx:A3k03kHRJC
- TLSH T14715AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 924KB
- SHA256 120409aba6ab3a461f525574420303a85dc757d93a117b0117eb94301c51fa22
- MD5 e9cc2b15222ecc40e63e499f630786fc
- SHA1 fe7fb8c3d06cd3af23477ba0e2dac4872bec113a
- SHA512 ac6b00b74781bf34a5105bcfdf4cf9ef08fa20cdc3ad3cc39679904b4d3905a09f2ccb695da5f3b00b3063e1b89f5f4bb7f6d212405af0b1e9b4b72a1e19f9e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyASA:A3k03kHRJh
- TLSH T1F615AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 924KB
- SHA256 aba369bc60c1443ace693a2789bc43fd2a0deff4b264e30c9c12f4d2ef58abf8
- MD5 1d6a5c8c334175e4a98f1dfce711449d
- SHA1 f95b9c5430c78b000b8c8869f545e655f7f3b5b1
- SHA512 01f328cd0a00bf96700d1a0739275d547420d0a78faa1f6610d73e1d3df9073d3bb2eb08e8e008202815699dc35ecf391d35e6145e860dfe20da38c2493ae2eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAr9Q:A3k03kHRJY
- TLSH T16A15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 924KB
- SHA256 86db04b34b66859c5853a45a7b011f7ea07a8ce5b515c1a6cc33feb4393542ad
- MD5 88e179e355a1f7de081d8fb76e709eb7
- SHA1 311b2f042f690a0a1d04de58831d67dec10f516c
- SHA512 1b0c208c05206695f86b3c4544606e382329f19c25ee0a4e3c4da53de0a035fb976147fc9adb205afe41c00e45a245b96ed529087883a3885b74843b2a6bc887
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAa4:A3k03kHRJj
- TLSH T13715AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 924KB
- SHA256 cfd42c9daab7a4b0ad45ca24ef9d1dca71ce42ff67b6546c1956503b798880f2
- MD5 5ec50e9a3a6ef603153d03b10e0d620b
- SHA1 ae81ba5a84a0693ea1faf9090e5501b65307ca3c
- SHA512 52b46339b15ce7190b435127b3fac453ea3b055a0b236f234e8e81f81f2109bea1844c347b65bc6d767a6f987ea0b7c8a82a9eb0a5fba9b8f6d6360192dfc244
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyABu:A3k03kHRJG
- TLSH T11215AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 924KB
- SHA256 b958a50a9947ad7607a7ef1fc869724da2d442d204558b3ba79315ccfecd35f7
- MD5 efd1a3bbfe39c00114f9ccf7d787c48b
- SHA1 8bc1844bae6b098acb97c9b988014671871c8a98
- SHA512 71da07bafc6c4024ef1deb1487af8cf36222b7ecbf64cea65b44678fef6ab53390526acdc6cdc066880d875305a9bba9172ff71d1ed0ad9ee687f73e66967ee1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA0j:A3k03kHRJ4
- TLSH T16815AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 924KB
- SHA256 2fc2d31121449e717d05230946721397b172e984faa6423a3955cca7bdfab5fb
- MD5 37bd82005b0d051c39ba06173022bee1
- SHA1 52b7e00f06c760a0cc0d152d1dc6375f042dcdf4
- SHA512 375debf3a1f32c4417c4115bc0eff8ceb03a61e8e85b063be886ab34bbe1fb4f9987a3daf28238eab6cdcf24c0d117f5986a2380ef6382df2fd24536cd775ca8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA1g:A3k03kHRJA
- TLSH T1A415AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 924KB
- SHA256 15ffbf6b30575dba04be93cbd237d2ed47ad842a7604e2022200414ffdfd870c
- MD5 acfaefb48fb0242f08a6c08c76b5354c
- SHA1 dbb825035d8a4c9f22db183b596d8f74f56ce03f
- SHA512 7569893c17333db5f6ed4e1f8a44d328c3da1cbc87270a0a7f5de8b1f13b89ce4d29b116f2bfa0319a4681eb51b2f0460f5aad30a92b6a4b93f92b88401e9053
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA0I:A3k03kHRJB
- TLSH T1E215AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 924KB
- SHA256 c04389f506c63414fcd59452bcda648168044d7af29e3da53ba1c4f5dc9482a7
- MD5 92dae109de1cb2114b148ba6e887e2aa
- SHA1 207bb69ef0494488e57ba11111efc7e941e31c2b
- SHA512 29e798186aef86988c2f5184120a5942aaed1eccf8a57992f0b38993a2a9cf834e8941c5da2c59e892c37c2edd7dd4242139d3bb588c8c0e1b7e778ecd58935e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAmo:A3k03kHRJf
- TLSH T1DC15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 924KB
- SHA256 ab195b849b7f3fd8ff79b4a6fa5ba99e6a65fef736c3ff60e506d7d503da9c64
- MD5 c71b5a7c1dc67667bd81e22fdd098680
- SHA1 78d529a978c370a64d7da1e7cd381b15d24ca11a
- SHA512 93a34363f7c14ed7cac69367cd8f2bc22911d7c7abef5c2b6a953f39c272d57a202aa7d847b0ab1504a8b5650f5a57225ba57c6e2e5cfa206257936fc2f42f3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAN+:A3k03kHRJq
- TLSH T15715AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 924KB
- SHA256 10a1bb6688f5775209b42eb9fb1fd6e9a6fffca308e2922f0cd8b3436dec2901
- MD5 c125656375fc5640d17971e4efde0e9a
- SHA1 9d775453ef73f01a41b1b2aa062eab773fbd69c1
- SHA512 6ae4a4da528aff44f5cb4da9f268888c3495b247b7f6b05bb00d11f66609c4e999949e281f2b1d3f03045a42164b67cc0f85eb46e0d7eea95c85100141bf3190
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA7Q:A3k03kHRJu
- TLSH T17215AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 924KB
- SHA256 489e2c13c7e55f058b1f6fcfe2fe240ee17d15d40b5c8178b59803cd0eb13b7b
- MD5 54b3a0dabb5b47fc67926c3bfc3a78a5
- SHA1 e1b3432fc36327838caa230b54b31b1046066b05
- SHA512 cc917e5de48654be957b99a155a32d769423fdd10a957d6cc573117f324234bad0ec0aafef3e7b529eeb012bf6a5bdfe6a969c31543426c2de5f4e6947e331df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAwX:A3k03kHRJu
- TLSH T1DC15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 924KB
- SHA256 7b277b49e701c450c721fd0e84234989e60b3e0e080565517d07316a03030707
- MD5 cb7ef75dd3c5546991b39872f9db452a
- SHA1 a6d27d372ab491550c9be873282a19f97ba00962
- SHA512 3bbbb19ea6661850d685276cd6735fbb5c57d2b36b56dd7872e9924867262cbd447dd837b26184ed85bd5d75ddb8e9ec79372c6d73ba35f6684b6adb12b316cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAGL:A3k03kHRJA
- TLSH T1FA15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 924KB
- SHA256 3b1ba5a8bbd20223c6ddabb45c24ecb4abee2c6e3630b6b15307a41c4d9991ba
- MD5 4c5dd77d89b2182c98577cd43a744a6a
- SHA1 48720b505cd168f66ff6fbd9a0eaa717c87d44d3
- SHA512 468a9d9f2386a3ab2d2f3b96c72acf003c65bc6f7d12fa65ce08499e3cff24ac0a3685ae82cc9dc4638ffd2fd8afc7237ffca456b23a54f75fe0c1c953d78f0e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAaM:A3k03kHRJR
- TLSH T1AF15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 924KB
- SHA256 fd78df689ceb152db04e063f8d4fc9ce08dd7a5cf1ae2f5e9c38031695d2d78e
- MD5 22302de5f9c4365434d6f2f3e4f529e9
- SHA1 cba5cdf0653d7cc8916a22c59384c4e131ffa9d7
- SHA512 6a98322afd24a935cb762f6296a45c50b386cb88cc1f98e2d9f7d509aad21b236a60aef634a829567915a8c5a1e4cc0384c4ea91a1bafb86539289ef6ad8aac8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyALh:A3k03kHRJj
- TLSH T1EF15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 945KB
- SHA256 fe331d42844ffcf197f1e21a52997a077216e4eb653568f5c88e74693566f27d
- MD5 c41e74475267b926cf762b003022902f
- SHA1 48513c14f4f8eb914638d65fdb09eba7baf384a5
- SHA512 c555a0fb24ffb592e2c6f90b175e45bb99341869335d68aaa3a6fc342985983dd493fe3be061737a234c7cab277eaf1865f6170ca9bf70fa633a57291ec3ede1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyA4wE:A3k03kHRJ8
- TLSH T1CC25AE13EB9500E9E10AC17496E69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 956KB
- SHA256 a91019f3ed079d2ad41e63b003fd7084f4b5049ec46d2ed5a81c36eea2b33c90
- MD5 bbce44d69ea332fae24f6454655fa923
- SHA1 2b4bb92272e3a1a3bb64bd469f1e0f88486f09d4
- SHA512 ec7cc03c66cad8e2bc7bfe172d198d2cf695e73ca92dc48fe4dc2ef7fe3d04346449079a4c842013b4e17a384fb7aaadd8779ddb9703062e5588623ea4c25e0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAP2+:A3k03kHRJo+
- TLSH T15925AE13EB9504E9D10AC17496D68A33FB75BC561B6093DF2358C2152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 962KB
- SHA256 fb1bead59579558bd3f52670b71427cd2eed006c7304877e053ce58a6b2abae0
- MD5 0690a80ab4e69443082e50ab98e98aad
- SHA1 7f318af304c0ec97ffd6f79d0c6eabc821645cd5
- SHA512 caa8ca992a5f6055158f539718427b54a0eaf62ec64ac69a10c164a2063ab4552bf5e1c44024f644932e0f26b6ef34e6997f9373cf0b1f6a823585adf7a064eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qxyAG:A3k03kHRJY
- TLSH T1BA257C23EA9404E5D10A913056998622EB75FC4E176093DF237CCE152F66BF07B3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH