Analysis
- max time kernel
120s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 20:18
Behavioral task
behavioral1
Sample
2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 946KB
- Sample260804-y3hdcsgd72
- SHA256 c6ec8af02e4161cbf9e8073c628a43431b71f1dcfbfc29283c023e2bb1aff1f1
- MD5 503759199abd3adc2f4e3363ff0aa71c
- SHA1 5b4c041c15bc3a041463f98c4df41b9afba9c28a
- SHA512 e14bcc0fee4faa1a5818a5a3e52279479815342129dc5f53564db66d3d1e86a8b87ef005288e096747759990e50ab969da28b83b7c76604972d8ffcc476a8b53
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0w:A3k03kHRJARJ9
- TLSH T1DB259C03F79800E8D15AC1789AA69A22FB757C521730A7DF1364D6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/5932-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c3d4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3628-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5932-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018978-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a52-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019844-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a54-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-482.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-592.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-648.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-752.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-804.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-853.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-943.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-962.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1017.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1061.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1087.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1106.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1143.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1162.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001890d-1495.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c3d4-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cc-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f6-41.dat aspack_v212_v242 behavioral2/files/0x0004000000018978-202.dat aspack_v212_v242 behavioral2/files/0x0004000000018a52-209.dat aspack_v212_v242 behavioral2/files/0x0004000000019844-228.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-250.dat aspack_v212_v242 behavioral2/files/0x0013000000018a54-270.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-391.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-482.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-592.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-629.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-648.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-733.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-752.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-804.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-853.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-878.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-943.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-962.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1017.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1061.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1087.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1106.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1143.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1162.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1187.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1194.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1231.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1334.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1341.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1367.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1387.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1388.dat aspack_v212_v242 behavioral2/files/0x000800000001890d-1495.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3628 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5932 2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3628 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_503759199abd3adc2f4e3363ff0aa71c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5932
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 946KB
- SHA256 c6ec8af02e4161cbf9e8073c628a43431b71f1dcfbfc29283c023e2bb1aff1f1
- MD5 503759199abd3adc2f4e3363ff0aa71c
- SHA1 5b4c041c15bc3a041463f98c4df41b9afba9c28a
- SHA512 e14bcc0fee4faa1a5818a5a3e52279479815342129dc5f53564db66d3d1e86a8b87ef005288e096747759990e50ab969da28b83b7c76604972d8ffcc476a8b53
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0w:A3k03kHRJARJ9
- TLSH T1DB259C03F79800E8D15AC1789AA69A22FB757C521730A7DF1364D6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 975KB
- SHA256 24d6bbf3f01303d65fbf47ac3a9e239227cd6ad04264c08e8bf9c019f94cfefd
- MD5 f539852127b9cc6874551a3d6a0ee48a
- SHA1 e146e5251fc0bb8fc1bd00cae8c862b0177eb1ce
- SHA512 2392d93829d24b047a79b9d052974ec15016c9a8a022975933d5ca1512dd14d605709dcde54afd5b59446e6609cb076c5669f34b5338156c56f45f0e67306f66
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0CP:A3k03kHRJARJ7
- TLSH T1C7259D03F79800E8D15AC1789AA69A22FB767C52173097DF1364C6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 83baeb36d898b43ce09e78e773fc57aedd4c398b06ca913b7dc1baf2d32bf97b
- MD5 3ef0df53d5da5595181dfc5b0aa3eeff
- SHA1 85f1ca0293df6afbc772e9f4c3fbf6d1cba4572e
- SHA512 66d2a8f4a89a5d290aaab77521ea9f7562faa6f7d72aeb9d6c192b95c401cbc6b5244f277ff950e34a4f617c313d310dfa356aab664c4929070e911dd75817af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0I0Le5ji0hmxNrM:A3k03kHRJARJJPji0Aj
- TLSH T193657C17F6A802B5D067C178C5D29A5AFA72384217309BCF1394C7292F67BE19F3A361
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 960KB
- SHA256 cc11b6415608d1c582c6c797e38e422eca403cdb1dc9fc6f074d570d6e2f35f6
- MD5 902f97351331e6b55a3496198959416b
- SHA1 e1909d7fe26dafbb3367903b081ab8a4715c38e7
- SHA512 da0a8af4e89aa21e417fd96f3899765ad09878234dc6a8f354bf4fe754061407e1253033f4501bcf9e776d25852226aaa93bd072fc86dcd5c3aba05a408f7e41
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0ya:A3k03kHRJARJ
- TLSH T1F5259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 969KB
- SHA256 9ec025c91cce393ee4de5ceffde8e1052e7a9475e047cebdf53be5335ed269e2
- MD5 9355dc784813e09652a9587b36843abb
- SHA1 0c2bff322778f0541fdb5624a54875f5afd2c97a
- SHA512 263745e074888d9787e3d8f93a8de2269ed9dd8f840e203ad9eef7e65dab977a61bbdd1a2d91ae89b6b12d4c48bc6aad47635e34cfac3c295cebbf9e07185034
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0sZ:A3k03kHRJARJ9
- TLSH T1E3259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 969KB
- SHA256 cc49167dfbb1dd3e3b0ffe31b8a492c8febbc6c450dd100f722391b6d1652921
- MD5 aaca562f539bac9b132167e67149be01
- SHA1 a288431276ff6c96003fa5d3e64ac653074b6b15
- SHA512 23edc0cb018cf83ffdde704758fb101f494b7fc468ff6cd734f820e80bb0327341b93a38170c98ee1e6a51becf61bf9d4a943023a563c58f29473fa85bcaeaab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0j1:A3k03kHRJARJa
- TLSH T1C2259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 969KB
- SHA256 f182f4dd007c3c614a0986fcb4df6dbd38607ef39f94b44432d519ff00ec2bfa
- MD5 3c41e6ada6e8a2a4e00bcdc6ba7e3e16
- SHA1 beb9f0c6b09689d8159b46cb4f6c32441a2cf8d4
- SHA512 70e9bf6f43c12b8650d7ac1a33f089a778887a01f0eeb2bdc6e06b33c5e9c6288e45e13e87716d004345663f961631d8dd44301b5afe569e1b85797854b9e99e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0D6:A3k03kHRJARJV
- TLSH T1D8259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 969KB
- SHA256 537cc16fb92364e7360bd6903ef4696eb60b1ea19babb081af27ec1ad6890227
- MD5 6b9a165220fdbd78e2f481deac5341e7
- SHA1 670e638e11ed26321682a7a9f1d099b53f0dbeb9
- SHA512 5765f9bad6cb6937337102b6697774e6332dab5e17b1e6580d3805b026cc85785e7755185da9217334222ccbd2c714318718a1cccc254cb6efc7929df2c6b206
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0tN:A3k03kHRJARJk
- TLSH T127259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 969KB
- SHA256 c4a569930add2153bfb4daa08bec83a9f48aeebce9fe48895ffc68e4b5d6ff9c
- MD5 6d4cfef9b6f41506ed3916db41b1cd80
- SHA1 4cdb458385683744378453a26cc7be4d2397cfc1
- SHA512 c78fb1c78e4a1cbe71a3513c08a898656122d0e74f7b054853eca31b9e244cc859372c7a52e67e658c249730951ac1c281497e657cb144a9705dc1c43d3f3daf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0bf:A3k03kHRJARJk
- TLSH T137259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 969KB
- SHA256 ff753a168d6eddc7f603f3642d27b9c41686a623a88d3d87f7ddc8ad624dbd55
- MD5 c2b50f9d36468c8e088d2ed98a0206ae
- SHA1 06d90a6ba9268021507154e51ffe0ef0d9592de1
- SHA512 c6f30e51f702fa3ef10d39756ee2c914c9e1a4956bb960e880036c92a55dc0e8b88a439ada98293378fb3bd37219b1a2c9403895c42db592076bdf0248870e9a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0No:A3k03kHRJARJ5
- TLSH T18A259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 969KB
- SHA256 a99cbe0c5c33371e4631c3536863999afddf5573741f7d5caba827e640c8db4f
- MD5 9c397cec92d4227a4e06253176bc64ea
- SHA1 a042741ea7920d6ba629ed99d58fc96665afac9d
- SHA512 99a38e2b2bfa04be7e1f2ceb54e06e4bf9c0048bcf0ce81b3bd3da8386dde861cdffebc109aaf5475ab308c8d07cd95d48edab9cc1f3d9f343ff3f453abc4a03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0Nu:A3k03kHRJARJ7
- TLSH T12F259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 969KB
- SHA256 9ca8f680699d1757e41b38c9be4e08f3152ae1eb702cdd58ca1ad35856f48b68
- MD5 ac572df161ca16a75ef2b137794cc804
- SHA1 448b4eaa9a06c69fc669c650c8b1c4ae73a6b119
- SHA512 bcd164e92ab0fc4946ef36e1c16d00863ccf57a6f89f12c127fa63240110f744be36895503154430c425f07673b0d065c536138ac7f92162a3c612c98d6580ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0j9:A3k03kHRJARJ6
- TLSH T175259D03E79800E8D15AC1789AA69A23FB757C521730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 969KB
- SHA256 7fddfde917737163e78078cc11ca6564f875d991a59c2463de82359debda0a0c
- MD5 c88534e4432d0f111843399da66813dc
- SHA1 90fd54f1f14cea240fcce2a76a13d4c14efc6de5
- SHA512 d43088ba844a4e38854107d4bb52fec26db57c638a5165430b59f0b34bab3b40508c40eeee97242355040299f225cc868b4942fe6fef9cb01bd758c3a69a83bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0Pc:A3k03kHRJARJX
- TLSH T18F259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 969KB
- SHA256 22c5daa9192440833249f2753c5886939849349ed765c1c409b381c533e423fd
- MD5 1f2baf93711e9998bf637e520e0f863c
- SHA1 fba8cca287d81672bea96a0012461d1b964e91aa
- SHA512 f74264ea31953cc1b2354d1941502f1ac7def4cc85f2d414ad74e3143831a5fef42250ebe8479c64787f8e2e7ac54c590bf7e605aa976ca0b0914ffb9ee2c777
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0Ip:A3k03kHRJARJN
- TLSH T133259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 969KB
- SHA256 2423d97f0cb27c68822170d4334ce8946f27994507aa21f655f4e3ba8bd75b97
- MD5 90b323cdb52a17b4d5974b2d8355e08d
- SHA1 f8274e7a997884523b5ab41a7c341d708889789b
- SHA512 e12437351d350db538b51b1af12a914c236ce3ab1fe0ff0bdbaa6b1147b1a193a1f69b31d3411c456bb9045e7f95db8e81473c78a5f16ad4fa0d306feaba7b08
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0fN:A3k03kHRJARJ2
- TLSH T1F0259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 969KB
- SHA256 e4ea6a2cfc63c25d6158b8358133f2eba86c37d9dc6b0a9cf1474ac38a4dca74
- MD5 e53b3a5ec8739dd7a2ee50455649f605
- SHA1 c2f105b8ceb79efee525b9be67c687af94aa2660
- SHA512 fcafc3464b50169cb540397070ebcb05ff24934ef7f8f4782c91a327a767a48a62014143ceeb598032791fbd64da72278fca439ee89b1cdeb2111bc4eb2d7179
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0dF:A3k03kHRJARJU
- TLSH T107259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 969KB
- SHA256 fecf26ad40d41e39b3492583ba3ae780e377cb5484c361c1837db97da50aa480
- MD5 8bb59deecb0288596fc7f025e662c5fe
- SHA1 b933cedd0ec919c6f41d32c7fe1409839d88a2c2
- SHA512 d27458ba38a9bcdc237d66c4f5d216ba96323f02f339caa71b58ab8e9d8aa4dfd5c9a9b17684ed9abca27321958cbfd7712c4e59ed7bc82f4cad20c44efa4b65
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0uC:A3k03kHRJARJA
- TLSH T1E9259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 969KB
- SHA256 14068f2516530726c94200cf5ff6d52b59561ae08f9f9afe92b21303c894a638
- MD5 02362a5813dcc13769e9c6d5419ecbdc
- SHA1 84e7f923c0e8b57cddf9322b1d604b01f9ea6aeb
- SHA512 b73a244757c7236aa505f851b7931027c95c010ec9fd1d4fec0748aa49e49581f502eb42185e9572bf2af1298f8b419f89e8118e126588a1ba53102a276255ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0xw:A3k03kHRJARJd
- TLSH T19C259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 969KB
- SHA256 6e4234d63fd2d53c67af2acac0ecbea63c852ac9ed2fbe722667ab0546c9841d
- MD5 8bcdf8da5b0dbd73879348b4bc38b61f
- SHA1 fd2d19ab01b3961984c5435289a6a09920882d1a
- SHA512 5751f4033f5b71eb656c91e29a665de74543492951b20d935a348d1d9796c68e01c381c4c2b81c40836c324bd053cf6f4ca92b6187ef75b3d18711d3c3e76bd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0YT:A3k03kHRJARJR
- TLSH T151259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 969KB
- SHA256 60bf3ecaddf2305e07aeef9c728b47aad86246ae33ebaf0f0d1f8a94df6f62e2
- MD5 1e1408c999c5c5572bcfa7c69e32fd4c
- SHA1 e693cc9cbba2e5f14ed768041941b0ab943e76df
- SHA512 ad2cf63486720a4ab18925844f42c0b98dfb03975d7ff46e384e5fe6417e810b03759d9d87b9c732e4ecd37a42b0f9002c89c0ffac2c548db1232acdfde4942c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK00u:A3k03kHRJARJG
- TLSH T15A259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 969KB
- SHA256 2d45e15e42e37f70d1ef7cb17e5543433b073e60d34dd59f3ac5987dd1f1eeb4
- MD5 0cf24864762da5852aa15bf196dae17f
- SHA1 91ce335dd1ba82233a479ee7c01c9ad869229e89
- SHA512 75ed84e2e90a15133531a1831a7c315f41abad81bb49b99f7f29eedbe7b44688c3587414fa2b2cf07ac5c006ebee53e410eb7de077c6bce56cb7f4a714e3971c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0ib:A3k03kHRJARJX
- TLSH T177259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 969KB
- SHA256 158cb74f6887a6ed008daf9144c6546574c51ce939ec23b73db607703c7000eb
- MD5 be72366315c8d6aace6a83df39dc2eaa
- SHA1 519a3033a443a8d37d594f6b93b6baac46ee63fb
- SHA512 b05141fecd143110d5af8b683fe8cc4fb70b2aeee34edc38235572433ccd90f27f6459be382cce5bd7b0fcb5d7b186b4235f269100ff17ff0008103f165abe21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0kf:A3k03kHRJARJ/
- TLSH T1FC259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 969KB
- SHA256 b73bef40e10dfde615d1f6b791ba5ebcb45d86a6937713add1e59e060b66d073
- MD5 a222b8e88de39ed0a3f88ae5776332be
- SHA1 485c34acae503001861d266854a6286b488144ee
- SHA512 ad8db086bbdb41b5add3133bd575faf6504fbaaf8832357f1e36c8f1c6aa2dac5bdbb041e86290959587ad59745a11fe26b9082757a89758a55a2d81afd73172
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0BK:A3k03kHRJARJf
- TLSH T1F2259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 969KB
- SHA256 360ca5a5fd0057037d318a276edb396de0475ecb71131b5addb7c9babd497a83
- MD5 db137674fd6b65a3e4f48570af397b15
- SHA1 076cc3ebb90e90bd9bda770686994c68480cbc9d
- SHA512 874cadcede8e13811f46a7acd1407208cfc87d8955fb8eb5c6aa1b631205eebd264eb3180b7740706e8bcfdb9e9d88311823d606a246c148380f88efe3e95806
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK06k:A3k03kHRJARJq
- TLSH T158259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 969KB
- SHA256 006a2994d1b7c6b54e5d3c4d4f2fee953d3b3c7605f422ca570582e44491c6f0
- MD5 37194407d4a867e228725c8c9ba94b4b
- SHA1 0f50d7798898c432483e8c85e0890ea62588cd4a
- SHA512 03f5883b5d872a2526a5d67f9c61d7dce80269d226d2c12e80af7122cadacb81e6a99111e85f084268dd71fcd64ba07b7424619e8f8f3a6ff5d28ea832204d27
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0f0:A3k03kHRJARJf
- TLSH T182259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 969KB
- SHA256 1da0b0803c3548be6f25d2b4d17abf917b679341e7cef380388ed39d5de69ac2
- MD5 513c73cd30929c410a82144645706def
- SHA1 a260fdb031811fc8d46b2c3800baa2382e0a66b9
- SHA512 201db53d4fcbc363359fd0494218152e9bea773e3ebfd4b8bc585f6ff6a496135d198f9fc1b8b91cf8f6b9ecfdf602d168d451bb7d80c91ccbf0d1d6d0a29904
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0ug:A3k03kHRJARJC
- TLSH T114259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 969KB
- SHA256 294f386a474add84cf6d80e0b15396c1797dac35219ef0bdfc2b6d17a17302fe
- MD5 4d4c4218df160459ba9408c6ba727f7d
- SHA1 75f1e886dfbdecd89580164ecd31a86462c15b72
- SHA512 b7b8ec2eb11b7a967ed9bf88ac2c3b5cbfa9e377b7de500fdd7d920da293ff02411922afb57a2bf65e0424b67b9fecf5c99cebb98a24d7701d21f3602a0195d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK03r:A3k03kHRJARJM
- TLSH T1FD259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 969KB
- SHA256 b4916a6d31fbe4bcc21ee1975c8fb6d76b842e2561596d82d0ce1be142ac2f8f
- MD5 972de321b9575115981790029acc331f
- SHA1 cef5f1ca596917438790d75b9a10aafd880302c8
- SHA512 c3625a232c318206e9b2430f24133d5c267c18423be16d46f6ab88691c3af134029c181f0702e779b71a0b9247b2876064123d33083099812f44bc76c76c64cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0Bn:A3k03kHRJARJ2
- TLSH T15D259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 969KB
- SHA256 463c85c68b6139216707ec7c6a1f15eb432ee61a3aeaaa4856911a0181c362f8
- MD5 7f4b77add3139faf6ed6943149097b32
- SHA1 a143ff8c5274664dd9a09db98b626f3880653402
- SHA512 868e42c80afbcdd08a00e3655959a248419f10712bc059615d66ae16e9b8873e90db0c583344ad8d36fa543818ca24502fc764c58daf66989aed059ec85b32ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0tx:A3k03kHRJARJs
- TLSH T151259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 969KB
- SHA256 4b6f34b396e64367576949766274e3915f3999a902fc762a3e55410401b521da
- MD5 fc5e1a14821e6784de09e766646a6ec1
- SHA1 98a3301be5bbc95ba431ecf8e67bef0ddf3da23d
- SHA512 ad5b629c0333d64ab129996d1aaa8752b193603177d031e377378fda0b1ad720c3ff63dc66cf8639b1de5e9bd13fcd8bc4b698ea96eabda78c9462406ec49c27
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0zA:A3k03kHRJARJ3
- TLSH T11F259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 969KB
- SHA256 5bc2b76e8904af9363880daa26bc3fa6f01efe10ca14e71bc5e20f7236dda80a
- MD5 e3f251620012c2749bae2bba7036ba1b
- SHA1 eb70f3e6236a0a0655dc376ae4f3f572b4036f86
- SHA512 adafafb3d4f5429c889355a4f55e7968cba4b90b5841b3d7edaeea24e67599bf6c73e53379d228a1bedfd5e734d36f9df224a8f5e347738acedf2d79bbc342ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0E9Q:A3k03kHRJARJ6
- TLSH T162259D03E79900E8D15AC1789AA69A23FB757C521730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 969KB
- SHA256 2b3770dd6c74a397ffd0b911f7164a24a20f92f89fb8a816e58cc5415412254c
- MD5 ec81ad6bce513a0f43ed73817367a915
- SHA1 872a03d29eface86f7b405d61b918a699b166d3f
- SHA512 7b7e63dbbd0f4b3ff6d41c94cc184279f5aa5df143043478d27d05d2aaa85dc3f5d8bf8fc0c94722c8776c5f6675ef9a30fc6e48b4071d80977c3ed2e25ec7dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0d4:A3k03kHRJARJZ
- TLSH T166259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 969KB
- SHA256 f80d95572b24d87239a3a8d26477aabdd533e947ddc582e7f55de9a9462b5b2e
- MD5 9af0cfe7010e0236b763c9b8bf5f8581
- SHA1 a38471ee7f608f68420f9b7860b08ee0c55481e7
- SHA512 a8fde560848785fcec35dd05f7fca9e904fef49daebee1b49caeb2466efdf4de1ac00bb947f036717540cf40728bce568c396da4ea3df1f9315fd44f754f88fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK04u:A3k03kHRJARJk
- TLSH T118259D03E79800E8D15AC1789AA69A23FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 969KB
- SHA256 f38b0b7cb0962ec32c9eb3d4a9ad5706a1f0e7fc2bdd5b25036d804ecd3f150a
- MD5 9efb482fa730a73b6ff361fb5eca181c
- SHA1 e0af078026b888760c94c21be19c44bc15e2dae1
- SHA512 2c5d2f86c216812230f447a9d7b3ef83ddbb4f4cb78636cb8a32863668962739b5aaa6ba8cb028d7512d7c282ccb76ef21bec936c88f26bc54f39e4815bd368e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0Zj:A3k03kHRJARJm
- TLSH T16A259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 969KB
- SHA256 3b2a2f3673c72bce6f2097f9cdae167d39ef8d6023aeb2f85b89335cc7df4012
- MD5 5e3f52e97273f8fd090508ca9b4584ba
- SHA1 b48a29833d2d3f51395c6cf537c2d86c0753148c
- SHA512 c2160eb7b82c3fbf5ca8aeec0f78cb0e29aa3816f81521b570144d7afb677c031bceba64faa5433ff0554461009285f3028af119c1efb0d71176658b5ea26fcb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0Ag:A3k03kHRJARJK
- TLSH T105259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 969KB
- SHA256 466ae87fddc6b097336a8ccf36756f8053f3e75c66a4ce2ecbcb25fc49614766
- MD5 8a323f1fd8d856582a5cd2501523d644
- SHA1 d39b06ed9d1305256f956f77972c15003d32e7a9
- SHA512 28c7bdd0129c84d614d24f383fd0626640274c02112d85253a522a3a823e0456345e6c22479537a94d929fbc696e5eedb53075d703f8312223dac8ddb7a77f67
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0vI:A3k03kHRJARJr
- TLSH T1C3259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 969KB
- SHA256 9cdf47b30a775fc67ebc3ed3fabbfda732ff53c1f6999da7eb2be162526b3003
- MD5 9b5c1d29d4f7f6f48e1ed9e7dc37e71c
- SHA1 d7d01a24e407543090de80fefe253f0e26145e71
- SHA512 08e087e3809924ef413bf90735190dcae175c7f720cefc7c7876a3140af20e1e01f45f7f0c3f107b44513521c329010f57c963d5367215e1c9ffbcaa8c088757
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0Vo:A3k03kHRJARJ1
- TLSH T1B3259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 969KB
- SHA256 4edc74d9614e9ede3fb87ed3209ab74012e6832e4a24f55a2c8c8b69d344eb76
- MD5 af6dcb2111a5c6fc8407dd91d758ec3e
- SHA1 d5cdff86ee294861269741eeb00651d318d11a95
- SHA512 1ebb787cacd4ca5640391d5f1424b339224f3e22183158289d99f5f4764769d47038f2c9ccfad43bdf0a743a98c5fdc6f42d4c8ba8293af4fb8cc812a97d4607
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0G+:A3k03kHRJARJQ
- TLSH T1AC259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 969KB
- SHA256 3465e1fccbcf22a3f669996b2b18c210bcb5ef51880cf3629350892a523b539b
- MD5 04b92ad257048db2cb38c0c0e4155a25
- SHA1 5dd52a11deb51731bf645fc5cb63548b3143f273
- SHA512 b77e49858be4c223d8a63515389e506723603d60b9fb589aa218aba3788044287db6010a106ea2344d1bfdc26fdc722e7e13471fbc8c68ed1203752d44548870
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0GQ:A3k03kHRJARJg
- TLSH T11B259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 969KB
- SHA256 35e6eb6b1a75a6af2454dac0e9acfd621b0bacf54efe0654038584207567820a
- MD5 4dbb6182e0ba60760fbd4ab5c9c5a611
- SHA1 80d96cc05e536411f735fef0877fcc8fa34a919e
- SHA512 c2546946f33c873679cb18f2d3a17bb6a708dd89d55e70865d9c2519b6352c526038e3a91954ee0dd2d4cd648935598c68ca55924ee9975f3bdb5b732a59ad08
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0XX:A3k03kHRJARJQ
- TLSH T14D259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 969KB
- SHA256 a24f9791baa7ed22ed239dc5511ae022be164962b21eb0f7dc55f3ca182b4eec
- MD5 0efa2c114411f156e094bc1a0ce563aa
- SHA1 652abf6366d6d8a89b72527417f8adc5eb771564
- SHA512 d41c498fff2aabcc6e232e2714ee3f15f90ac07dcc0efdbbf009632fc33b5bba312efc91b21a4c76e201c80c882a68f0544b3119f36647446e563d9faf6fe8cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0NL:A3k03kHRJARJy
- TLSH T1BD259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 969KB
- SHA256 ecfd4aa3098609e91c58cc118d8813d4d980a7c33f22167f9a3232264af18d3a
- MD5 b1b97f5ed837b937de7e413ab0a6ab32
- SHA1 7b10ad09882f2b7d34354c601eba6c6f309155d0
- SHA512 6006c01e8a7e48fe3bddf5b8d6ea0ec206148e8c6d24565599929b5f3db451de5d2be7481455176c5b57cb1dcce1c1ce1573456395eec965fea4925d3a94df63
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0LM:A3k03kHRJARJf
- TLSH T142259D03E79800E8D15AC1789AA69A23FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 969KB
- SHA256 d1b23ce1d8e6d489158243513e3a7cfc6af5b45f1863bfd98ea2c5396f624fe7
- MD5 48b56380f1696f32422d39e6c168ee60
- SHA1 59f5f06e22262aa344151469e748918b4ad5846b
- SHA512 eac814da82c2709d860b5bd2fd72481cf0de389e3f791be658d722b3c04960bb7c1673d92761d954c89a2e9452242cca05ee53e80ec7ff34de5871a4e0350b58
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEacLaEhK0Mh:A3k03kHRJARJR
- TLSH T161259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH