Analysis
- max time kernel
124s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 14:12
Behavioral task
behavioral1
Sample
2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 945KB
- Sample260802-rh7n7avbpd
- SHA256 55afe650c9b88567c200ebe5c61cba43b78b217587048957ec2428207a9fad3a
- MD5 7b8c52d028c5e376777b14d4d903d76d
- SHA1 33f769cf2b3bc4929cff677f621ca915a397e601
- SHA512 2536998c0e55aed57d503280465af06757fe084a475b4c9fe72612cdf36fd30a4d73e08d1b28a6300e833c28f7bb4bb475d45d8edd0dd99c85a412676a35d60e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE:A3k03kB56r
- TLSH T1E8257C03E6940FA4D10FC1749AA64662EA737C125F6097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/2164-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b884-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000016cd6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2164-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5088-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000189a9-201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a83-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019871-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-235.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-406.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-479.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-504.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-595.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-620.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-645.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-832.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-927.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-940.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-960.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1016.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1110.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1360.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893e-1488.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b884-5.dat aspack_v212_v242 behavioral2/files/0x0005000000016cd6-11.dat aspack_v212_v242 behavioral2/files/0x00040000000189a9-201.dat aspack_v212_v242 behavioral2/files/0x0004000000018a83-208.dat aspack_v212_v242 behavioral2/files/0x0004000000019871-227.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-235.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-267.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-406.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-479.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-504.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-595.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-620.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-645.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-730.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-750.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-794.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-801.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-832.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-863.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-882.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-901.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-908.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-927.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-940.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-960.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1016.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1053.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1060.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1097.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1110.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1147.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1160.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1185.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1192.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1229.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1333.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1347.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1360.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1385.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1386.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1393.dat aspack_v212_v242 behavioral2/files/0x000800000001893e-1488.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5088 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2164 2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5088 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_7b8c52d028c5e376777b14d4d903d76d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2164
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5088
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 945KB
- SHA256 55afe650c9b88567c200ebe5c61cba43b78b217587048957ec2428207a9fad3a
- MD5 7b8c52d028c5e376777b14d4d903d76d
- SHA1 33f769cf2b3bc4929cff677f621ca915a397e601
- SHA512 2536998c0e55aed57d503280465af06757fe084a475b4c9fe72612cdf36fd30a4d73e08d1b28a6300e833c28f7bb4bb475d45d8edd0dd99c85a412676a35d60e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE:A3k03kB56r
- TLSH T1E8257C03E6940FA4D10FC1749AA64662EA737C125F6097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 974KB
- SHA256 d6b82049817c87f33f8c4a8ecf5840a1e0ff6bbfc9112b5f743674824ec96f7a
- MD5 80d3522d8579c9a0a0e2bfd7cb2025be
- SHA1 8c813e6358bc97b5d5d0e2885c9bec845ed1ae9f
- SHA512 d3162222293ad7e607eaa6f217bef95561536781711ef5c6ff67cab456e95043dc2ee9e0dd7f5554a80c6fa51ed42afcc27dc962e8491352d2e8de7429458a44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaExP:A3k03kB56rU
- TLSH T177257C03E6940FA5D10F81749AA58672EA737C125F2097DF2354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 51d2ecc0fece03d7169a0a9533286310dd1755cd251f6bd43467755f20f565f4
- MD5 405731360d809aff872895d98aa75afd
- SHA1 43256ffda078cc106da1212bc7e8d33486cdb0e7
- SHA512 acc3a112198777f2517a95f3d52820904290c686f3fe0e0363e153a9117d3dad982fd5f7e20ad74e4699d57cb817745a4fa00e6f34407be86a5ef004c55d3701
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEP0Le5ji0hmxNrM:A3k03kB56r4Pji0Aj
- TLSH T110654A16F6A44B65D02BC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 968KB
- SHA256 d9e38146ded266ec540a706767091bb2f1f39ff998853316c4f8abc93e376544
- MD5 bf11c57c479bb3e8f1b6455e96eadecf
- SHA1 436a3629e7d401637a0903857a58a883dc566788
- SHA512 0b1bd2204ddefbefb85947cba1ee5985afbea0eeafeb6c06eec2b310acdf85192b71696ea8409e7c5463a45ac06733cafc0cd7befca6f50ff83ed650257e14c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEpZ:A3k03kB56r+
- TLSH T1EA257C03E6940FA5D10F81749A954662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 968KB
- SHA256 ad0a1fe499ba33c671c52291e9fe0f4e0b2dc737c08ce98bc87df20047d7a571
- MD5 34dc3982573f98aea8de57bab3eeedef
- SHA1 cbb75274fbca400f4f3b99c31786114af677d88d
- SHA512 6f19f53f460bf6c59de0a346a98e993c8480d996c778efaddb23866c71d1c09c2c163c4ba0f5c078c6f47e8114a083ff850c7ce31d1d9691ce8ce6457358c460
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEC1:A3k03kB56r5
- TLSH T114257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 968KB
- SHA256 a7ac4d29f5caa00d48d1e1bb888f510575bade7add7cef9d064aa349f5be2296
- MD5 1f8fbc7fa35559f222ab56a365b470d2
- SHA1 f2c8a1b557628865af458ca181d1e211ba250a77
- SHA512 aa2f217f343f53ab41573178071c5d04383bb418e50270f8efb2e81e7440acb2322740cd11f25e74c5eb1287465d46564b2122f6d6e2f6c4ce201a6ff4066b16
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEo6:A3k03kB56rm
- TLSH T144257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 968KB
- SHA256 99cd892419973c5fbf7eef7151420aefadadc8ede47f5163e7e3de3dfdf2bb01
- MD5 ddf93beea7a4fd4a3b62dd743f1733f9
- SHA1 e53987f1de52342c73cd95738c717412f9d78772
- SHA512 c976f98e62ce56376c1604259d1b99d7f2d6ae780d817b580f04fee95bcd39df028a77f7f5a63483ce4d5466fc23add10119ea7e3c230f4d3abfe45ec23e3e53
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEsN:A3k03kB56r3
- TLSH T1AE257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 968KB
- SHA256 038b8f08b4282470755cbd33ce052a9960338c91fc87c345bbef5f59637497f5
- MD5 64dd2137677b737b41bb3b1d19b0829d
- SHA1 53ab7e17876b13cd5d0f15b55c88770c6fcb6bb1
- SHA512 e99df85a0dbd2315c8d5ad4280b8a66fd855149ea29aca49f1e08e40cba080090b7d1a0a7eda18cc226b067cb15d4e3c850bb93ec859552011d981d6b63e1fbd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEif:A3k03kB56rz
- TLSH T10C257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 968KB
- SHA256 547cca261ec7765a221364f35d5fa375a39cdee1c0d5e9f5743af2b015070ed5
- MD5 5ce05e24a0f6f5ea37415f862bcb435d
- SHA1 22da7919a8aced8353fc627f87d1c0b40e562359
- SHA512 6ef86b307e1e446b86e9a5f306233d4b32615969fe4debfe57d990e2306ee541e6d4b60be8ee0b16c8d030e34d3fc7e5a31e7e4846461618f7fc1a139ca8ea44
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE8o:A3k03kB56ri
- TLSH T1EF257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 968KB
- SHA256 64943b656762653335506dd154cececfb6589674670032cae6963a4092b220a7
- MD5 690425493cbd2f75093a49437a289a68
- SHA1 c307342a51504ad43a3f9da5d69e89dc1f7deaa8
- SHA512 1f9eb69ca1e677f52eb2e4edf53aaa95dd275bfedcc003d141d06c58cf2e786152f1a2aa85fdf85ed3ad2ef16f75190610e6ddf509878195308ad7c80c633ac5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEcu:A3k03kB56rs
- TLSH T1CB257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 968KB
- SHA256 4c25d41a811f553ad05dd692a275df5bfd5b53d96c1cfd815ac7bcf01bd0798d
- MD5 1c85c625d9c2c4e1b2f7a0a6634c7702
- SHA1 62230c9836a80892eae99fda05a2d1e822a11241
- SHA512 ab29d22d3469f412628783ec5f05f9efb8b47d66217bbeba4a869c415b679e5e11aadd95f34befdd3f56f35ed20d76dc711344a5c9e1f71aec1f99add967f264
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEg9:A3k03kB56rx
- TLSH T1AD257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 968KB
- SHA256 b981df12b33b9e993535138faf0a9033ed6d8a914ee335792286b7ca6d354c2f
- MD5 a6c06001e9716492629bae63a11476ae
- SHA1 7074823adac98249897a6ec5f6d4ec22fcb72d7c
- SHA512 8f62936662d1ff347853b45895d3fbe6ad20f5afe72be96249745ff8910c0a42391e54a744ca1a4af68f4599bb343cee5800db586c486c7d82f7937256b5a8ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEoc:A3k03kB56rE
- TLSH T1EF257C03E6940FA5D10FC1749AA54662EA737C025F6097DF2358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 968KB
- SHA256 c80a7d4f3ab84ccf73f9b4fb16fc27291409f494781e6a23fcd743af27bd1851
- MD5 6646bf5eae8a5f3ecfc7c5a441b6a6ad
- SHA1 f2173c04fdf9a09441b82e32885ccae211840ed0
- SHA512 c32a8fc49369cbc92d6a4fc074799aac2ff6671ee9b55b2931bf38c3cd93fe96c12f66b513eb4aed3afe49eeba6e826f37c14dc7b986ff398903d742c028a24a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEBp:A3k03kB56rS
- TLSH T150257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 968KB
- SHA256 1163407d57a25bc4df5acfccfc75a3af037c05fdb219ecbaef0d29cad5b476fe
- MD5 6d20ec7d41f702d5693629e87dd7f13b
- SHA1 033b24bef4f5b71d58f01255f23034977f108ca6
- SHA512 681a8c2c3ca5641537bf1b6b7213aadd4dd1e92150bcfecc9057a798c43b1534e3c8afe79f598d3d3831a4f7310115fdd3baffe79dd1a7f0f7699f4821e03dc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEWN:A3k03kB56rV
- TLSH T137257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 968KB
- SHA256 1dce5dc83d751506e9665bd9c13dcae289fdafa7883d52c70e82d9944edd153c
- MD5 a76b050af183ce512d539b9234a62eb8
- SHA1 a63810a1e8864af315d870fdec56f7ef2322c64c
- SHA512 a064831b49f78ccf5decb34a6f9a381f3f174d5ad9d95dca917f5ec17086ce3d92e1433313e7eae17e28cde217827b7b097e97b765c330142e6e1c901cdee664
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEaF:A3k03kB56rf
- TLSH T16B257C03E6940FA5D10F81749A954662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 968KB
- SHA256 e0985330afa13f12909dc0efe2f2e560a8e72f51088e356be1cb6a77ee3a89b9
- MD5 3ed4d4364e2a2a4f7cf91ab1fe7c7815
- SHA1 4618995a37fbb7e48f50c20b29303cd0e9e7fa39
- SHA512 f87750b5c8558d424bf255544520c34476ce8b013dadbacbbdb14563caa968c039dd9f2016bb40e09ad28d925cc2c5cb9d29ae9e60248124e6c795b446ff8044
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEvC:A3k03kB56rT
- TLSH T18E257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 968KB
- SHA256 4040d71e3725c734894121df83531454e0665bd2bde26d316ebcb85a8e481713
- MD5 759214b2876fb02a7719a740bf7294dd
- SHA1 342fbc2233f9029bdf69e02eadd070bfe7c0a8a9
- SHA512 6815dc4fadaa079796162d27b1583cf10b1819b05e816d49389784f1d02d9e2784939d7144128e8bfd1a8a8ac1db7b4c89c72fffe17d253236593a3bf7129b75
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEQw:A3k03kB56rW
- TLSH T13D257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 968KB
- SHA256 7e08697b86c49f3e9a1c203051e46a91995bfb5538d6489d1787467c94f30220
- MD5 1451d68648df3b63d9c2eabe360a187c
- SHA1 e6da9a936cefdca910fe95050b0c89fde5450008
- SHA512 cec7d7fd6dcf34491156e6fd1117b1dc948a4a1854eb6cf6abeee882f0b4b921c6826366399a76662346d79724533900859001238d39ef27d5d4408a14c09106
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEvT:A3k03kB56rW
- TLSH T143257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 968KB
- SHA256 f4a0eab44b4c7bd234ed1167e1b4b0b0db5fa9371c5c5758f6a5422bc47cb15f
- MD5 3036a1b31d296b154151686150d3c1fa
- SHA1 2cf332058e9809d6b04366259077e876b75d7a85
- SHA512 1e057468396bebb7639a5379142dca0e8380ca64aa217a9a10cf41cff290825d76f57e004b3280c18a3f468679828c47e3372bc7fb729f05118f6bab7af1f868
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEpu:A3k03kB56rx
- TLSH T116257C03E6940FA5D10F81749A964662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 968KB
- SHA256 6b0125da58c9f3633d002d00a657d54dcb2b6ff4136eebef7d2a2c7f322d0f40
- MD5 d765031d320fe3aa17c25f5cb6d3d59a
- SHA1 0022a95b9bd05af98b127da1421a520fe35129a6
- SHA512 1f0e86725528eda69c9631752bff68704e0de161ed090741a7b36d71e29c9a9ac0451ccf8014c770d1c5781af701440e6efb4c50161a009c9cb2ad9f468b3654
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEhb:A3k03kB56rQ
- TLSH T119257C03E6940FA5D10FC1749AA54662EA737C025F6097DF2358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 968KB
- SHA256 b57122c9cebbdf6fe32efd6efe325be8686e8f7c51d338209212548d82207a9c
- MD5 81b466836decb0aa17ce47592313d95d
- SHA1 b7a21dfacec66858a9c1ac3a2a5a7786c0d20eab
- SHA512 a70cf9ca373b549f6e87d8980a1e248712bb16a7ff5775e8eea0f8c5ab4394ecbb326fcf511a9887decf765790acc38c57183bee334ae4612856ad92128865e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEpf:A3k03kB56rA
- TLSH T1AE257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 968KB
- SHA256 966225b9256d99995ba5f57ce796d415973135329d3d50e98341dc102b2c43df
- MD5 c045ea906eb9240ef9d1fc68adc62e7d
- SHA1 2f7e807451da60a4c7acafe0960aed65cb61d932
- SHA512 11f9a9121685fbedabac99cd6b9a694b0fdcd825a8bf8a765c6acb9bfde78f7317e974a8bfb66eb70e9442c2d19e1077bfe90610dd1f96795ac0d9233d59fdbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaESK:A3k03kB56rg
- TLSH T1F4257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 968KB
- SHA256 d7424893c6678adaec979f622639d68cead4f1bc1c2cd4cd71a3ee1f2a583bb7
- MD5 5da5e89649e83941404c3d8b0c020c80
- SHA1 32246dfa9e3debbb2007c6380b8a03d51d2a7303
- SHA512 1ba40a036be71d2a4c0b0b335df267b314d02f0bd6fc534e8a1a10f9952c8d8c43dd6146ba645f4e608c88f5192e0d3bab3ea8eea4d660584d42db39438e514a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE3k:A3k03kB56rJ
- TLSH T1F4257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 968KB
- SHA256 f1410167eb3592fc40cea690b93e9934d5e965e849efb5af2e46c975e6b83318
- MD5 9dd379a1648dd074c5f97c443c003f89
- SHA1 ff58fb972ea79062203d850d188e4e7749dcf592
- SHA512 8e294a7672777d74dca61e31866ac199f544d7916dde879e5b273aeafac59a3225deaf000ad5f495bc8ae831b789daf51d21a2dbf50a418b09b29a619953fa70
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEA0:A3k03kB56r8
- TLSH T169257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 968KB
- SHA256 6acdf5ac9c94e8aa3148d44ceab22208a5f1ffc22b11153cc2529965e56b7d0a
- MD5 d373e92cf35c54aa9ae944d2708e7650
- SHA1 8a3489c2c68b6877c9de931879bbe873314b1422
- SHA512 9142cd13c46b9d9943788b510368017ce1b5a080b79db205a40f00a18ba06c5b15525fc5d31b6f19f578cf27f06dc8c576ad13e2ee50baf3c5c586a35ee47eb2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEbg:A3k03kB56rB
- TLSH T135257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 968KB
- SHA256 7f743965bf7e2de27622ff0064ab2bf03d0ebba667c7fc872cec149ed4691da6
- MD5 36faa343a09db5baca6c59cbbc6a8266
- SHA1 3bcac50690cda5db0cdac08e13db8d487a7a1cef
- SHA512 c17e924efff1f9e08586dd95b4416d67f24473049a50222dc47415b51b38623c018510da8d3af0e051b08a4f1143f8f23644d74b2572909b23e85b9967e35c64
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEWr:A3k03kB56rr
- TLSH T1DA257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 968KB
- SHA256 edf39a03354e8e95ad8fb91067fa673316abebc521df338b19d536fafd56e798
- MD5 35629ec12840d689829242face32a401
- SHA1 2909ade9e0d8816113a8f767a5b8162a5b2fbf11
- SHA512 8adac0f997ea9dbd85fad9d7f1ad5c32778570e0c5fc0597db018c112c175a1d714a30c9ed624bb9670ea6f8d4378657d2fa057acb134c36ceae8a90ad60fda7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE8n:A3k03kB56rd
- TLSH T136257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 968KB
- SHA256 9dc7806b15874353b000c5b72d0d21f45889b0d1f5de65de511c3eedec78064f
- MD5 0faaaef7e01a8c764d258e981740a4ba
- SHA1 bc28e6942bf28785dab1128a8f64df33137c732e
- SHA512 75471742c53e3af30953e5a97b724685e44d3554c85ebcdd164d3dc359c5d3701c831fbba16bc7f2440584a83e502cd7738c52eaac3f23645e1e92130b8b8419
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE6x:A3k03kB56rj
- TLSH T11E257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 968KB
- SHA256 801be58bb933d9a3f398326dafc13d5f7cde08674b08275c20bdc8c10327954e
- MD5 ed5fec87d5a71231d29fe11fad052669
- SHA1 cbe895458076e4d5c46ecd3cd359b0be42f4b7ac
- SHA512 a4f48073f4a6a834047ab6c68ab68d28dbe3724468b89c44445edee875ddcc84bf7bbc5d2350d03873ea74aac1e3a9abdbf5393683fa8ce5be6286e314ef985d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE8A:A3k03kB56r8
- TLSH T11B257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 968KB
- SHA256 4dcc2d98d80c9ccd6f39f24c3c3740c48f3fa6d36ebde49c68937de8c505abb1
- MD5 f4df85ad2578ffae0d17aeed04668a93
- SHA1 424cf0183e83fc07e10d267f0cd1bd43ef3dc79b
- SHA512 d62d01302160101babd260f43905d9bd586b63e877ed23d33e9aed957c6e0a7efefe6d02e8739fac78b02dcab8c462e94bbb177021317f0a3f1d11d22917a005
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEl9Q:A3k03kB56r9
- TLSH T129257C03E6940FA5D10FC1749AA54662EA737C025F6097DF2358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 968KB
- SHA256 134d6fa256f8ee4961812a1d8acb4d550e38a4ca564345cf0a0d3e6df2b85eb0
- MD5 e858368153f7407b084df30461897bb3
- SHA1 a72f531af8aacedd8a97b66b4cd224bbf1fd1249
- SHA512 4d9b48b598f20a10d2ba5820a390b8ac528ee740aaad0cc5656efc329e26cd99b9d53d69f1683f61d7e476639df73508f17c6a1712ab6788e9d07261927f307f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEQ4:A3k03kB56ri
- TLSH T152257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 968KB
- SHA256 c271552b6ff215d99a0c8cbb263b2210779d8f28dd41c461842890dcb390a21a
- MD5 6d936afbe2e2941c724493ce95d64bc2
- SHA1 eaa27087b369b09e30a19c7d454a8a4aeb4d3acc
- SHA512 f530d2524d12eb560a5ff929591b97e467c881c694f186f2279efb383d1054b3fce301bb2305d9b93ff651c3205783f2c690dfa558fe9bdc0384839982c0d5f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaETu:A3k03kB56rT
- TLSH T183257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 968KB
- SHA256 57089b127218318ac83257012e7a8c9ec26ff4a1668ab4054e2f635f6f170080
- MD5 2dbbe61889348f3ff5031dfd040afe3c
- SHA1 a914811bd97c88b7777a1225fc2f73fe31637055
- SHA512 07654439a91200fe886263acdb65d399322760fcec3c7f59f7d68ba8189ebc14f22f00d7dca50572a13fdb31fe9a63cf6c15b1f53914219dc74e24a934ac787d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEOj:A3k03kB56rd
- TLSH T102257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 968KB
- SHA256 969b2c5413f4ca568ca5f51981f4154911bce078cd6ab6a26a9d62d901b4cc4d
- MD5 b75c1280aac5f34e0bc4d9dceb6a6a6a
- SHA1 7f446259161435bd3701b39d577aefeb10f7c358
- SHA512 16c13753c30c3932110769e0e5233f0a3f064d54e37a26fb10effa169287f1e64bfc0432e454f32700cf660bfafe9bd07ea6a78965d2aed910afe4f99e86a284
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE7g:A3k03kB56rh
- TLSH T1AE257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 968KB
- SHA256 de1f3f22eb1f8b23ef188511068f717173ae33d117262fd4871a73c7e84c0329
- MD5 0026ef90bf279f8b1daabcc84293e309
- SHA1 edc5ae70308f4140b7fdfc006a1099ce5dc6ccca
- SHA512 27bdbcf9c829675501032cee6fd0cf793185fe035743a69796ef91fe64068525ec2042c6720e3f3c9d7b5241be733b0e5665e1fcdeda43e7cbd12e2fbfa1a351
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEmI:A3k03kB56rw
- TLSH T18F257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 968KB
- SHA256 102659c474891f513ac0c16ea75831e2edad93a7f6939aa95754150f28771d53
- MD5 6f604055822ea0a43ea82bb347814cc7
- SHA1 d26d8254c8838c97df53ee773181448279653b3e
- SHA512 b18fa0216cf1fcf3230e196150d4d9f03b72301cb16bf6185c581bc07e22c19207898a2a548c28ec63ebfb191de8103554adad7307e2e6424a69cffa5f726f7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEUo:A3k03kB56rS
- TLSH T1BE257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 968KB
- SHA256 1aa4e2f2e64ebf4c387ae7fc71eea35c2fd414fa0046271771430bba48ba8398
- MD5 1c7e2244fa9a21e57072feec002aab39
- SHA1 8f3f1bfdb86e1a1be1778ad2d22ffa7dfdc58468
- SHA512 05be4d54be1743fd4e76dccc599e9a25f54e5854db8b616b1224e09b1d3b427f579fc3526695ad712229557b14e40da68f5ea983a94dfe03641805065c7dbdb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaE3+:A3k03kB56rX
- TLSH T16F257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 968KB
- SHA256 d6522051be800cff3d32763a43013dc15dfa659eb3323c79e8f065f4698e2536
- MD5 b77b7bab6d0bee59980152e2698ab39e
- SHA1 e89591d58f1031402e25bf7c7f0154dfc22b67d4
- SHA512 f7c89e6b4e7f20530cc64b4b95a77c23995bfb4793c8e63ecd09a7172dbff89d9f96f75b5e1398a65f9f070a4c331a22ccb2d4f365f6fca2c51d296949149852
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaENQ:A3k03kB56rD
- TLSH T1EE257C03E6940FA5D10FC1749AA54662EA737C025F6097DF2358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 968KB
- SHA256 53475e2efc581972dbfe9a332aa1249d838c1285509d282ee281a7af3dc64a68
- MD5 7b5e89b3fbee23c142a9e64bb55d05f9
- SHA1 1e5ba5d0e4643231d78d6b7b60e6e0bbd8a2f4b9
- SHA512 ea1a70348c20ca6f67c3161f8adc061e1a70ee9219817c5eb3914c3acd3154c31c604624845bfae2d49ded973c81968013586284eee945d966ca8cecba742841
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaECX:A3k03kB56rX
- TLSH T1AD257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 968KB
- SHA256 9f4503746dfba60d77396171f6a0e76925ebebcf8b28ebeeffb7ea874ade89b6
- MD5 08831a32e70a8f0fa3e754d22a86143c
- SHA1 8909357b76f8a676311f2cd1cb0982c8f2477a05
- SHA512 5d7c9f2e7c1e38b4614447d664ad9ccc3779c1e4b0b9370c45515c55c2e9eb09fbd53a523a3af20db01c3183c3742918866400a6860a2f6f75176abf38ea6b75
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEkL:A3k03kB56r5
- TLSH T17C257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 968KB
- SHA256 946cb84c056c0d60a5b3248bb1ca27f3c10c58bcdeccaafc8d8279604d41dac1
- MD5 a6ee27149439e08e8844cc2b9073da81
- SHA1 897fa7c7438c76767922a42a34b2c1c6df64c04f
- SHA512 3516d38b44873667d4ad3e3054d22f47ebe4b4af23e733f9431e20e1b631d6e1eee033947abee3a85dbb83f718629566484062f681c39d626e9aba9036eec497
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEAM:A3k03kB56rA
- TLSH T1F6257C03E6940FA5D10F81749AA54662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 968KB
- SHA256 2a15c2d0bfb5e81c944fec45b8053ff8f35cc348052c63b08831e8fcfc4d3cdc
- MD5 21190423f81d70a4f671a6bd0078a6f3
- SHA1 85982a603e65497255695a1a10de1f622a505442
- SHA512 d5f0dfc2643d6abe83bd8dbb968fdbe07fd365c5ceeb2a631eac05a0a8d8f22ab31304ac2eb3bb831fa2d6d06b7454c9d74fd41c750d934b79fd73c53a911d34
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UxDEaEhh:A3k03kB56ry
- TLSH T176257C03E6940FA5D10F81749A964662EA737C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH