Analysis
- max time kernel
89s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 06:14
Behavioral task
behavioral1
Sample
2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 947KB
- Sample260802-gzmp8swelf
- SHA256 b2d5034e77935f785e92176bb75a788083418888463ac4fb5d9c6550adb0afd7
- MD5 3d29d8444d81b9f2e59152382094bcd0
- SHA1 07b91fbafb42c70661beb353a87e5f697f9199e0
- SHA512 73437b3f3c0e17582a860302f3caf8b90f47edd46cb92e8339e01af4cdb5004191423242626d0048587cbcab98579f87ab1b5f0ebeeb4f0d77bd520b6f48cbb0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlu:A3k03kB56rE
- TLSH T1C5257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral1/memory/3812-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243f9-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1760-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3812-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022c5d-41.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1760-42-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243fc-125.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202f5-242.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202f9-261.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ed-430.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020301-485.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002033e-510.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020306-596.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020340-622.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020342-677.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020346-732.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020348-745.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023531-794.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000020344-825.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0005000000020424-857.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-883.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a1-896.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212a0-909.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a2-922.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a4-935.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212a3-954.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a6-1009.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212a5-1054.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a7-1079.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a8-1104.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212aa-1141.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ab-1154.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ac-1179.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ad-1186.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ae-1223.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b0-1327.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b1-1347.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b2-1372.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b3-1379.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-1380.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b9-1387.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ba-1400.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000001e0bb-1627.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243f9-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022c5d-41.dat aspack_v212_v242 behavioral1/files/0x00070000000243fc-125.dat aspack_v212_v242 behavioral1/files/0x00030000000202f5-242.dat aspack_v212_v242 behavioral1/files/0x00030000000202f9-261.dat aspack_v212_v242 behavioral1/files/0x00030000000202ed-430.dat aspack_v212_v242 behavioral1/files/0x0003000000020301-485.dat aspack_v212_v242 behavioral1/files/0x000300000002033e-510.dat aspack_v212_v242 behavioral1/files/0x0004000000020306-596.dat aspack_v212_v242 behavioral1/files/0x0003000000020340-622.dat aspack_v212_v242 behavioral1/files/0x0003000000020342-677.dat aspack_v212_v242 behavioral1/files/0x0003000000020346-732.dat aspack_v212_v242 behavioral1/files/0x0003000000020348-745.dat aspack_v212_v242 behavioral1/files/0x0002000000023531-794.dat aspack_v212_v242 behavioral1/files/0x0005000000020344-825.dat aspack_v212_v242 behavioral1/files/0x0005000000020424-857.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-883.dat aspack_v212_v242 behavioral1/files/0x00020000000212a1-896.dat aspack_v212_v242 behavioral1/files/0x00030000000212a0-909.dat aspack_v212_v242 behavioral1/files/0x00020000000212a2-922.dat aspack_v212_v242 behavioral1/files/0x00020000000212a4-935.dat aspack_v212_v242 behavioral1/files/0x00030000000212a3-954.dat aspack_v212_v242 behavioral1/files/0x00020000000212a6-1009.dat aspack_v212_v242 behavioral1/files/0x00030000000212a5-1054.dat aspack_v212_v242 behavioral1/files/0x00020000000212a7-1079.dat aspack_v212_v242 behavioral1/files/0x00020000000212a8-1104.dat aspack_v212_v242 behavioral1/files/0x00020000000212aa-1141.dat aspack_v212_v242 behavioral1/files/0x00020000000212ab-1154.dat aspack_v212_v242 behavioral1/files/0x00020000000212ac-1179.dat aspack_v212_v242 behavioral1/files/0x00020000000212ad-1186.dat aspack_v212_v242 behavioral1/files/0x00020000000212ae-1223.dat aspack_v212_v242 behavioral1/files/0x00020000000212b0-1327.dat aspack_v212_v242 behavioral1/files/0x00020000000212b1-1347.dat aspack_v212_v242 behavioral1/files/0x00020000000212b2-1372.dat aspack_v212_v242 behavioral1/files/0x00020000000212b3-1379.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-1380.dat aspack_v212_v242 behavioral1/files/0x00020000000212b9-1387.dat aspack_v212_v242 behavioral1/files/0x00020000000212ba-1400.dat aspack_v212_v242 behavioral1/files/0x000500000001e0bb-1627.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1760 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3812 2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1760 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_3d29d8444d81b9f2e59152382094bcd0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3812
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 947KB
- SHA256 b2d5034e77935f785e92176bb75a788083418888463ac4fb5d9c6550adb0afd7
- MD5 3d29d8444d81b9f2e59152382094bcd0
- SHA1 07b91fbafb42c70661beb353a87e5f697f9199e0
- SHA512 73437b3f3c0e17582a860302f3caf8b90f47edd46cb92e8339e01af4cdb5004191423242626d0048587cbcab98579f87ab1b5f0ebeeb4f0d77bd520b6f48cbb0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlu:A3k03kB56rE
- TLSH T1C5257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe
- Size 1.0MB
- SHA256 504795f1725f423afe15b2d94a410d9243a661929a37efcacb07fb4f821c925e
- MD5 77333dc042c96c5d1fe095c0682fe0b1
- SHA1 f71e4b49755c6883493ba39efd0248921b53ff46
- SHA512 e61be064617a64b15b961d7758cc7c43d4e0fbe8f6c7650b34feec6c97985ce41d26f549d5a14531e456ce0ac6aaae916e399336fb4858a2cf0d7e72200edab5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlCTjE:A3k03kB56raw
- TLSH T16F356A03A6940FE8D10F81749A954662EB737C525F2093DF1368AE153F32BC06F3A6A7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 ea456d7b386f5e58697b8319b5bd1834bbc1274e4b9304684be2c3656e083d1b
- MD5 37e5fdd0eee52a815f60cb8e9fda0be1
- SHA1 d148826a143cc6b6239bd581db78a36005702ade
- SHA512 0e8fa8ccf4d6c20b1a2623b8cba6196dc055771c048e85ebc5ad1393466d9dab4bd3820294354c49d036dcf2e78f1789e579c519ccad8d7c2ea0a8460dd84474
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnle0Le5ji0hmxNrM:A3k03kB56r8Pji0Aj
- TLSH T1B4655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 962KB
- SHA256 29363770f1e95d1f385d185c2e735b7f26e3f88f673d0719e438523fec0c2738
- MD5 0777e59138356e2fe4a959e9cb21d879
- SHA1 c8f1169bcdeea753430014658e2646e0ab6d1abc
- SHA512 93aebaa9c57e55d59e914504e811f0c480b95e7160d91be6a493a746093ecffa640191c467d880cb4d69707bf82ae54524edce8b0c9dc4b84637bb5aba55330e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlYa:A3k03kB56r
- TLSH T1F0257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.1MB
- SHA256 de7332d4f8f635f595e9fdd5a53442d15e2c32f9a6543dba066df4144ce4b44f
- MD5 94c25c6a0680d3f0bb035bdc78a42f8a
- SHA1 a5ce53867dc07d3d15d09a788c00845b89718991
- SHA512 21b9128ec9867f64aa5aaeea6ad7678d1fb0e441dd45989bd34accef13badfffe0558a4c1679ea0691753d859937646e3f62d475a8e31f29555c656d996d6fd2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlHD:A3k03kB56rR
- TLSH T1F7352706E6940EA4D00F8174D7954662FA737C125FE093CB13D4EE3D3F72A806AEA697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 971KB
- SHA256 0322b2e16dccdb6eb4c96fc6779e880d1e8cf365d560c5c21639fff41dcb17b2
- MD5 19f7e1ea02a6e85365a48c4c2f55fb18
- SHA1 93d8e6651a3d6f9199f88d5e1731b6903f84745f
- SHA512 8cde94d91dab331f58b2c77f8193e9ee61ba8caaebe4d9b2ee3ce45c16972cbecd5775e556758c93a2934b75557a373388200d836261338bb1e1495ccd7e205b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlx6:A3k03kB56rq
- TLSH T18D257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 971KB
- SHA256 9068afa95019a118c592d56832a3c2ddf1ca096620bc929dcb8eb2e5dcc17376
- MD5 5abfae7b1e77d19b98c337cf82d36295
- SHA1 8cfbf3435f1b456e8f67c83e3da4e1ee135f3d50
- SHA512 e09d7a1fb1c1dfcba62b52a6aa0f1815e2cfe3a39c2281a7c9609309007517eeead42efb5cd113eaa122f3d9fcb04d170e0e47d63467269d5fbf77bc35737c8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlXo:A3k03kB56re
- TLSH T14D257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 971KB
- SHA256 3676d991f99dcb0d6519f4a0c5751658bd8ebb8771d3e103d17f85f29d5219a0
- MD5 44a98f702b16e1312b3fe1808a7368b7
- SHA1 7405d457b6f666d25142a40555b3c281d09593e6
- SHA512 c8ff29e3913b6f6677f09c76645b192625a6e039b2bcf11096f8a1d65d3cae448375109a548ac42b16a4cbb20c44554d708487969f9e1583c574d6d7011fd398
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlbu:A3k03kB56rY
- TLSH T103257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 971KB
- SHA256 33ae51c962c147d32aedba1e49ca397d58c501b0208512ef6c37c8b63ca1481d
- MD5 06ede33d004e29735f5ab3092fcb1e1d
- SHA1 7f2e9a3e2739d02e8d8745a6ced49cf2d4adf421
- SHA512 af4ca5d5339645d9bddc1a6b797433e9e163c4d5977d0daa76f0e3a5060dd0c537fdea71cd6f94e21aa8a9f49e61871f3d14dfa6483043a1df05c869f2fbc62c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlJ9:A3k03kB56rN
- TLSH T1E5257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 971KB
- SHA256 ca35feb2334a1d6f3ddd2e0f6f366f2a86f61ed77ee227cf5d6748934b20e722
- MD5 0c5afc28ad64b97d5860c041e56cc5f4
- SHA1 8de3daa5fe5cfadb0bc56387220e8520a4df8540
- SHA512 bd8305ba03fbe83bb986f2ff8379543ecccf12a6ddb6dcebae81af0c372e7a4f0fd7a362abcacb076fe844b72c4c75fdffb1e420dc5ffa9a1e534ffa9babf3bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnllc:A3k03kB56r4
- TLSH T146257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 971KB
- SHA256 ca342db474b1b698875ee9b7b31cda6e3ed025e05e3eb6517a82915856d18128
- MD5 5efaf677895e47f8ed0f1d8cd71e786e
- SHA1 a356ccf337f2c267e523b2fde9da94904abbfc05
- SHA512 3d2f2a90c4a8a198dcdbcdc7b56dad0d4d79319b279b57c14a47723ee754f3dc157c5c61ecefcae9a0baf4915e53be845f191bbc6dc433aab9fba5e7260406ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlep:A3k03kB56ru
- TLSH T190257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 971KB
- SHA256 30d81ef3e7a6bb1e056c54b046e4293ec0d71030683c09d653555f2d2ac23eac
- MD5 375adbb4d9eafe3b29f46c1f697c122b
- SHA1 25b7feb4b96d19c9fc7164e0668c4bdf086a0e79
- SHA512 18ac566298b4f70668efff11d6d2ca35a8ed5ad008c89ed58260f7d19e5190aef0a878ae731277b16151b46a8dbb06f2afe8c022d48b968695bdb3e3cbb576f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlRN:A3k03kB56rB
- TLSH T1D1257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 971KB
- SHA256 6775ab7ddf0ac9dabbd86c823c2feb18f2866a6502819407398537c21727fb53
- MD5 7582d8dbbde3b5be60f619158dcc161b
- SHA1 e6d2ec338e21822bfc253b5dfdf26882a9fa677e
- SHA512 61018b5cd1396861ebf0c25d53272f0d8f1a6110fd8a6ca978dbf8ad9f3a90463b195d982a58efbce36759c5737e5bd9b82ed0660a369dc3fe848982c5f16ecb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlzF:A3k03kB56rT
- TLSH T157257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 971KB
- SHA256 d575ea7c88a22a364c29405c4f46dd37282627ffa5c6c19b5cdad9cd5f5fb57f
- MD5 2f2ded4a9f4391b19350840e9d9a96e2
- SHA1 4dd094e657093f798bfcf77c126d5c4d226dee53
- SHA512 fabf78e24a503fb88a695f815c66776a024441b82d65c227231aae87c4064f0564035a20f379de450b319eed05be32f33270410b884fc4f2575bfdb9e367b790
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlcC:A3k03kB56rP
- TLSH T17F257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 971KB
- SHA256 8c7d9218d68a7bc44288d9ca118e95708d0fc51c1ee4f9cf65664f5f1ae587ef
- MD5 cccb509651788afe196049bd0b5f9fcc
- SHA1 ab3a2be17f34548ea528f634f3eef509722c8aa7
- SHA512 a0082cfd96f80191496597d903cb49b3d92872e881494b3629d58ed0ce32a6b183dee84730e68b89d790c8db4ccf81939bf7a64fab59cd75379992b7682706f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnl3w:A3k03kB56rq
- TLSH T164257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 971KB
- SHA256 c70e5aca3b71db97c3ae469d2f15dd87b868142e08cd39c9beb395bc627ec11d
- MD5 857ac10e84665a1c0679a83a673bfba2
- SHA1 3c01eacefcc4b33421bb09fca60b440caec5c4c2
- SHA512 05d84f87a251b7d131803d5aae667901ac5fda3b6e03e099dd4b99de383afe1edfcf915794e2ef7d8cd1d63665e2d64765b94d777425256eb4f32056a7250fcd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlmT:A3k03kB56ra
- TLSH T1EE257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 971KB
- SHA256 149178f641ba4bf4c9cafa2e7b362964416d626e1cf36fb0817e6649a757ce4a
- MD5 3b59ac417a81d6847ec85c3901f9d4e9
- SHA1 b68db197142b3fa2ee64f4cf179845f958abefaa
- SHA512 050927dbea006c5721cbd0889d6b72f167dc218568b32952ec80754a29873d0dfe6b9930748804cba6b10996f679a4002e787ef5007d0416b4dd965e07dbfbd6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnleu:A3k03kB56rV
- TLSH T1B8257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 971KB
- SHA256 d41412644e69bd84027ba5cdcc8b84ec1f740adcb1251b15871c91ecbb067592
- MD5 a465b89a15ca4ef4b2287eb4449f7872
- SHA1 edea5a4766852154973a6d4e048ff4f09c682003
- SHA512 4b583cffc2d821e0dbb00e1d4b6a470fdee11116470ec00ded1eda7f60bbec41589109127bbfb633f1c866acff22da190d59e76bfc83045e2e8a044de11f14cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlYb:A3k03kB56r0
- TLSH T140257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 971KB
- SHA256 a05f97f4841ba0ef36c777be34499a4eec6b2c165a744e39e9ecaa2453856fde
- MD5 822f7dec12390ffc58102c63be240974
- SHA1 6539bf6ff8120331212c0fd3de206bcfecc9bf1d
- SHA512 f67b3b853ec0b0e9368afcd7c11015b2c14b5efb2c38987c8d3d35a8e67311a168ec2a1fe71eb4de96eb23e9a3ee48e50a2c9c79ab696f547ada1a5aa8c68492
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlGf:A3k03kB56rE
- TLSH T1F4257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 971KB
- SHA256 4f0d15e47ee363bcf21443667e8f1caf869cd9cccc9c7e8d5a39a9e636d566c9
- MD5 a7ad5d9b82905a63e2ade0e4bc25459f
- SHA1 081fadb5a84f253c840f40e0840a51826eac6aaa
- SHA512 a2da1437e7a0526ac8fc72c9cd54f6a3830badaf345a2e2e9331e1e6cf3350c67c39318b59184fbb2ecde3b2dd2ad4031582bbb7bcbc387dd62fd97342f3227b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlDK:A3k03kB56r0
- TLSH T1E5257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 971KB
- SHA256 0d3d20f07612295feea919cbe41f3593d1b8526bae2355920d5ddc29bee634c7
- MD5 1d9792c5fac4eddccd6fb4fbf19abad5
- SHA1 73ac009e46c980784fd93a4cdd253c121b63af16
- SHA512 0164ded0e6c295f4be85e547dbd09c3bfcb88c8c346f4106e1ecbd9fe48bda79528fe55b63b4bdea898db4bbae3986055b16d9879d728c8c9932e3e5ad2df909
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlkk:A3k03kB56rN
- TLSH T1FE257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 971KB
- SHA256 1f2f6387a2cb1e063020309d00a05c55189dff72c0e4a2b310abaa5f4d872845
- MD5 407df059c261cda0320a00f17fda9ec0
- SHA1 df3b5dbd87e8195185200ea59c515e7a137bc415
- SHA512 cc9de5978cb17530323afec0358bd9a466e90a55c69995b5df0f58b5b1c7e5303f77550481609c210419f57fa975c071a83d7264238900d194778b19a7c3e432
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlt0:A3k03kB56rw
- TLSH T116257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 971KB
- SHA256 8fda1e74d2eb9595a6b11949207c53b6d476ca3d45c09a6db5a08192847dcc18
- MD5 8807b311536edc4f2c9208d04bbe7ace
- SHA1 d92b46190b4e01ff1f8f984d5e4714f81bbc9aa2
- SHA512 ee3e9325ff8e07f24fcc3c4f55478c39db3e466d3ee923011ee71ed1e02b380296ae3c566db810c2cc1a7f3f2e655097fccf07c0fbd4b84cefbb95ca819f1e0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlwg:A3k03kB56rF
- TLSH T171257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 971KB
- SHA256 1f23bb174075bfaf2767a57bd226bbf0e2f4a89daf701cef53835b1302b76848
- MD5 afc5d69b3fd7adb8c5a7904ad0fef593
- SHA1 c1b7f479a0d44871757cf10f69d00cc9c5f43f2b
- SHA512 972a43106b6a55acdb2fa2c4fd828d32b0f48ae0c99632f5e15c63d4269af9e0da6736e1fffe542ee147ec250981dab182b82a1b4373957ea1a8ca8b730273ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlFr:A3k03kB56rH
- TLSH T1B2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 971KB
- SHA256 26e360baf5f8c35933ac116b5fbfd97233d86dcbfe46009cfc6671824211936a
- MD5 70f07331c459a793fbd6f01a041317b2
- SHA1 a054b3ba2071f9c60cd7b3d281b4ee78648fa82e
- SHA512 c8552174eab50abbd4cb2c3871f13fcd12f6e5cc5eb92c525c83a7da7307bf2b134a1c7eb333d5d3f36af0261244095c993a105efa6f0dc7614358c14cb0eb64
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlPn:A3k03kB56rx
- TLSH T1E7257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 971KB
- SHA256 081ee69ccbb59b0a306bbbd05cf727afe411e4152a716d54a31470b0049f934c
- MD5 36ca0e339d0c23adab66e1fbcdf197da
- SHA1 30d034f40345dc87157719e435ae00be1581de7c
- SHA512 ae882f5d82cfe88a7da4649ca2c0913c605690cf0276a031758777c80902392f61b4f17a700dd20433195c77680611775428f435fef210c56d1a9f8d77379e21
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnl7x:A3k03kB56r/
- TLSH T199257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 971KB
- SHA256 7e41543a1c671eef3839edf6172b953ee5f4b697e83169f9dc931561c1d0ce5a
- MD5 3915fdacbf5a24c129d8e2590adb6df8
- SHA1 3a5e13792654ed13bc22caf228564b8a6fb69152
- SHA512 b3fc0a873cdfc2cbbe9acbc5008f2954a4c5c508e8dad3dca5483194aea8cc031277e124e5be18c5c75dfdc6f34953495bf1d9e4a930e9aea51251921d9f7da6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlpA:A3k03kB56rA
- TLSH T1B9257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 971KB
- SHA256 074942ebf65c99884998bdbdbef14007d3bddcb3dbb77528fba5f31e03462b45
- MD5 6f093a59c90a6994b2117fba514dbd6a
- SHA1 19351a1baa271a000c8ecf1a7a8710a27e3626e4
- SHA512 b64b50b6fb7d91bbb84a7c79783a389b7b1a1f8ec2b2c0a6cc4994c157d2465ecd9c4824b62077d22f95204af06ddaae4c58636c92159cfea6ed54a1e3440102
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnli9Q:A3k03kB56r5
- TLSH T172257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 971KB
- SHA256 f783a468cb98e4b0d5c083c8c7020892ee3bd709a88f6c5b43cd88718c268dc2
- MD5 818adc35234b6317b4920e3767131038
- SHA1 24de748b1e488be8e77483a3c0b83ee2ff063d15
- SHA512 968d845bb631a74a9ff4f44837ba5dad46a81c9a1445764cc8a9f66485167fd7bba529045fdccfe8a43a3924b70e90b5f9ecf8caea48349d82b2ea37a775fac0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlH4:A3k03kB56ru
- TLSH T158257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 971KB
- SHA256 fcf3e1813efb858b9712679728e93663cabe4c0345fe226b1c51c7535b5f4921
- MD5 f0ef5b34989ff82b3ee8fe9c380666cd
- SHA1 565399e637a7af477bcdf1fad5fad54d8da5dd55
- SHA512 224d175911993cd5c23a4bb36d2292c8139b1bbc62e11ce2c2c3f067b565d5f071a2e35542c6f44538d54166479fae3e1d862c50adf830986a73b0014237880a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlmu:A3k03kB56rP
- TLSH T1AA257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 971KB
- SHA256 f7116425d7b5c10ee7c97501460840fc60a992aa813850ff48c1df00e917b214
- MD5 36229ce85596e43fe9102cbcb09aabac
- SHA1 3eb199b9f742947bf25aec8f5178d505b80beb84
- SHA512 6e7d1cb91ed2bf152a9ebb476a9dcddcd5a2908c010365e2694c47b0d594f93c903610f35da0a6bead0fca1f3fb615c88ecc372ee6801ad2582551d838e77ed8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlXj:A3k03kB56rR
- TLSH T15F257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 971KB
- SHA256 2bee8dffdc01d62a8d3ff67bcb2d358a5dcfd75f9419a622989ea01ec934789d
- MD5 7afa0f06a18aa6aa2059f8c751cc6718
- SHA1 1d2dcc849b1a7757920370eb6cfc480d6085a8d2
- SHA512 f1ae7c3d644abeff93a68fb6b0aaf5d706407d64f53bdf85b04c6103a7994802bbe309afef651ba35a9ee5382bee010cfcefa06036ae95f2fa9f3ff075ff3897
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlCg:A3k03kB56rV
- TLSH T11E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 971KB
- SHA256 f0838bcba3763b3967668a7b0cde17ac5cae3bc4ca403af84c7ba83f4ed6e7c5
- MD5 a972acf500a18804f13d3dda88cf6fbb
- SHA1 1262c5a3740dcc13c69c400f4cecb10b3609c10c
- SHA512 5be7fb366ffb4445ff8ce0f61d78b22517d33f9d6d2a27ad30d26947624eec811aa9d3e8368213d9286466b6a97de240906e59f1978d608949eb3a3db83e70aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnl9I:A3k03kB56rc
- TLSH T1BC257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 971KB
- SHA256 061e85d9884cd1d33b534768ee7031ff4dfa4f7f973adba6aa66314b583d65ba
- MD5 0a71248ab7832778f54e8875d84ba941
- SHA1 f55e42336d07019a4b468bc2b52dfbb0d145ee5c
- SHA512 0ca03d43137b4d6ec10a49e5ac6c61ad776f2c9c3eea4807349b7d85b5c7f3a6149f71fb2ff024105410b39ff690d7cd3e2c0f141ff6c81d9d1ae4355e6a92c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlvo:A3k03kB56re
- TLSH T1E1257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 971KB
- SHA256 2b771c178e587bfa80176ab5cfd3e81797121ee99f5b6691b52d982ab206ca18
- MD5 6044fb0d827ccb08c7bc54abeaad53e4
- SHA1 a92577188a2667019dc209b5ce19873577e505ff
- SHA512 108307d0cc5ca7dbace282a655f0ce2e502ea6bc5cbe0ab79179c96ad166760d5096f8b5fcfce7d5cdd68d6a8747eb94292a686785a428e18c5613f9fe220886
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnl0+:A3k03kB56rL
- TLSH T1B1257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 971KB
- SHA256 31c451101a1dce8462df32c042c9eac3c7aed49175fb506a4dfe28ccd58c498a
- MD5 6daa428e6eba39c651219cd5ebb88271
- SHA1 a2af564768d665081ed4418db825814a67f092eb
- SHA512 20456526401319c0920f2c8e7e4308414cbdcba6c02ce6e17e72253d317f7e342e0104dc58048b8b5d911301d0269f62054ddb215d1dc1bc859ff730defb66f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnl8Q:A3k03kB56rP
- TLSH T196257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 971KB
- SHA256 8f4de5190498dbd2e57d718996fd667b6084af30f00b16fb64b915fce3d3af77
- MD5 15783a76fa529517360587fc103888e2
- SHA1 2741243c07f7232ce5a21a9be1097121f9ffe587
- SHA512 9dc47a249ad3a455cbf66a879837100f9c4007c75859f1ff24114651fd8c844dee84aba93c654eaf95a99b471b4ca9b487053a45eb717f9da0b2066c931d3bcc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnllX:A3k03kB56rD
- TLSH T136257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 971KB
- SHA256 08c1cf66a8d5b07950e4d0b261fdfeb82c5d115e8451937d1362a16b64bc8955
- MD5 91fc44347729303383d950483d885864
- SHA1 d1d9302c8f77f48e8221306917b36d9595104788
- SHA512 4478a1837c337933741ccd9b53eb3b0967e7cbfbf8af0f9595fb62bc7a716e4dd067dd7c395bb6522701604bf08e838cada4b84851e38f22f80c522cab6ee338
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnlHL:A3k03kB56rN
- TLSH T188257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 971KB
- SHA256 2280ff3defd1ad475f38cedbcbded6e0a0e22024cd64ce6a56fdd33ac7d67217
- MD5 2d04c064b1236cf9b790574b60b04c02
- SHA1 d183c3eaf16ce3116a4577924560811263336a6c
- SHA512 bfb68c515d0efcd77adedc01f62799b865ca614c1615207f29cd5ae6fd595a981cbea47026959cb10ab482609b88748e6de8365384c2cb0fa9fd236044c23079
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnl9M:A3k03kB56r0
- TLSH T11E257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 971KB
- SHA256 d94a0f1c91fe0e92849bf10af9b966f27ac14ba9f870734fc93d15008cdb48fd
- MD5 ac3b53a75367119c6706bac207be35b8
- SHA1 f4b6126ee5669588744e7885daa73e35b669bab9
- SHA512 e8408eee7172b4214efa1f1cb7f34bd9b676c0acb385e15aeb035b7f8fd8ba3c1d36eca3dcecab5e1debf6bbbfa93c852fd3028452a1025c76f75b5eb71eea3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagjilnluh:A3k03kB56ru
- TLSH T162257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH