Analysis
- max time kernel
125s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 13:53
Behavioral task
behavioral1
Sample
2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 901KB
- Sample260810-q63vgavyfw
- SHA256 6f7f48860d49960c7bdfeda5b202186c35bda4f2815ab1e7153b87f323b32873
- MD5 5131fa212143e49b311b929514c7dd83
- SHA1 3fe01ec4d60dff80e20bbefb9e3dc1589ec50921
- SHA512 ea04445b9e3214637af725e3048ae3d5aa57d12d8a31c511be3cd19199295b034b3f5fa839eb2b8b20acb225d0f80e92ad61c6490fd1d592defe80ca0ac93c37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbao6:A3k03kHRJO
- TLSH T1D615AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral2/memory/5948-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4e3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3260-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5948-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c87-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188c8-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188ca-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a59-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019842-231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-269.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a56-354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-469.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-555.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-637.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-698.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-754.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-810.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-932.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-964.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1058.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1102.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1115.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1152.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1165.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1190.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1197.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1234.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1359.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001885f-1485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018865-1540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018874-1565.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4e3-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c87-59.dat aspack_v212_v242 behavioral2/files/0x00040000000188c8-202.dat aspack_v212_v242 behavioral2/files/0x00040000000188ca-209.dat aspack_v212_v242 behavioral2/files/0x0005000000018a59-229.dat aspack_v212_v242 behavioral2/files/0x0004000000019842-231.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-244.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-269.dat aspack_v212_v242 behavioral2/files/0x0004000000018a56-354.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-469.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-555.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-611.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-637.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-698.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-741.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-754.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-803.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-810.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-880.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-899.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-919.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-932.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-945.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-964.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1020.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1058.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1102.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1115.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1152.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1165.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1190.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1197.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1234.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1332.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1346.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1359.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1384.dat aspack_v212_v242 behavioral2/files/0x000800000001885f-1485.dat aspack_v212_v242 behavioral2/files/0x0008000000018865-1540.dat aspack_v212_v242 behavioral2/files/0x0008000000018874-1565.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3260 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5948 2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3260 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5131fa212143e49b311b929514c7dd83_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5948
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3260
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 901KB
- SHA256 6f7f48860d49960c7bdfeda5b202186c35bda4f2815ab1e7153b87f323b32873
- MD5 5131fa212143e49b311b929514c7dd83
- SHA1 3fe01ec4d60dff80e20bbefb9e3dc1589ec50921
- SHA512 ea04445b9e3214637af725e3048ae3d5aa57d12d8a31c511be3cd19199295b034b3f5fa839eb2b8b20acb225d0f80e92ad61c6490fd1d592defe80ca0ac93c37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbao6:A3k03kHRJO
- TLSH T1D615AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 930KB
- SHA256 46615769e5c54c7e2eb8db58db37ec1c2d79565f73eacb08b66acc635954f79e
- MD5 631c871f7051df7adb566ad3be1d34e5
- SHA1 8046d83f5a604a144c3f304406940dd807a86e40
- SHA512 988f6ceef2f812502db36e675c0e522da26a655c1606387fb4cbf1d93c64af2aaeb0ef120bb926dc5cf0231dd8cae4bbc94d98b09df836c9e02782b810465de8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoMP:A3k03kHRJ+
- TLSH T1EB15AE13EB9500E9D10AC1749AE69A22FB757C56177093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 947KB
- SHA256 b41300f2a5556963d1e22f18665bc52c82487bc735eec1623f92ba9d29eeca5a
- MD5 429a1503dfb25529d87fbae84717672e
- SHA1 d6ed9e66338927f9a4fe787f099646db403368a9
- SHA512 063cf7a2e6b666a79be01dde9d53bc8539d8a8a3d8bca6483dfbca9aee1544a91887423f7b29e89b4014da88b71b2f82c84d69513119aad016ef9e2d5b939c61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaob0:A3k03kHRJv0
- TLSH T1B025AE13EB9500E9D10AC1749AE69A23FB757C56177093DF2358C2152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 953KB
- SHA256 ce0272485a95bfe813920ba405b9d67621255200ff9ca8f46f2c4b4ed20ff664
- MD5 d867ee6449360bbc23bbb2937e09f6e6
- SHA1 e36148421959f4ed77f8699dd1c1ed29b99a0a57
- SHA512 1f2a61a433e822e36a06593c89078a2c56e70d3a15ddb4c33fd92038a8fae256025b209c8236db43b9019aa02988670a899612e0f71926b916f702519d6cd3fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaotfj:A3k03kHRJhj
- TLSH T17E25AE13EB9504E5D10AC1749AE69A32FB75BC561B6093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 54643852dacc100c27c3bacf024ed4127c0418b010a3292eff92e5061118b167
- MD5 a8e0848a4312aff0ce22833abfd02f27
- SHA1 7ac0165b561585a8585ae64890e3f1e393e18c68
- SHA512 541cb4966d110f24538e87363606d40c9bc331e2ea9d562ec92882ff9c340b48f5e28784f194176eed2f1389322662e94a6350658e17d1901abeb2c3f3d57dc8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoK0Le5ji0hmxNrM:A3k03kHRJ+Pji0Aj
- TLSH T12D658C17F6A402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 948KB
- SHA256 9fb642802a0c20a170adaf62fcb7fdbec3d7a7309cc0ce56a504ad4e57067b72
- MD5 774979e10eab7ade7ab32a4936fd3bcb
- SHA1 db39e901a0df1f095bf5dcd39ad276e53ae32d7c
- SHA512 a04d7d5af8e9a33c91cca974d60fcfc9064a0e2ca4eaadae0ae89eed093a24e38565c2f1b745ab4697b499ff3719ec3c13f5a14155f5abf3c08bb2b6e89ed5b1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoPb:A3k03kHRJzb
- TLSH T1E325AE13EB9400E9D10AC1749AE58A23FB75BD56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 924KB
- SHA256 3c1ee6d3b0876afe49c1ecdde65c88152726919b3bf7823a670c34fb80844bdb
- MD5 b555ebf61a394d8e414488dbde85290f
- SHA1 9bae58b10e19e72752835d038b8b3fa32ad58bdd
- SHA512 37458cf425465a3a593661fb03d5a9fdda34babcb1f5b78ad33b61ee50b02d05a0638d62f1c4e1b676e05f37827f293d7c6a8d2e69f04499fb1a8efd22a3e384
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoeZ:A3k03kHRJM
- TLSH T18D15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 924KB
- SHA256 d9705a91293f682810dc2e8e4c0339ecc2bc32a9eac5e7f1eec05c100087cbb2
- MD5 54e35f2dfce441db23d1b3e6ae826e48
- SHA1 5fe27ce2cd2264b6e7e5da9edba456fd5d179301
- SHA512 5f17d80407a714eea17d2414f6fe5b962c34265373ea5fd9f6018f2aa02fdac7cc7f4910b2fcf74465683b700360d9b660ce3b5ed92805c7537bf72db90fd59a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbao51:A3k03kHRJD
- TLSH T12115AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 924KB
- SHA256 43a857e0006f57dfc095608d9775e1bdb6f8d7bbfd3c5ac50216952a6ca6d83e
- MD5 f1072c8ae3022d6c6355bf35bc73c9e4
- SHA1 2a351e7536f6760e6d0b7e9f9c6dd07ff3205b3d
- SHA512 4d3d6ec41858f9d3c62b83221038fb9b353b4d5578286c1274a2a1b0792c827866453ccc6daebe18c1050b28682c66a582eaea3352e8e2808d1f233342d191ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbao96:A3k03kHRJo
- TLSH T16F15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 924KB
- SHA256 4c05861211b624c934afa45883eadf7466e37b203744ae5bc3848a0d35c58459
- MD5 a80c7f97593c1940d405965c54893d9f
- SHA1 a2c1fca8cf98e0f2d8943ac9ee7a57b5f20dd1da
- SHA512 9214e7a3643ab04e8653d1a063f085a9c700bfb9733075c7494144daf20a1f211daf994446bac609f1894b231ae499bfd4737bd090be7acfc8df448f4ef9645d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoTN:A3k03kHRJV
- TLSH T13115AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 924KB
- SHA256 fbcf50ea8d69ecb7965100e081f35f5604dda07dbd35dfd185e271b36253c8cf
- MD5 9b96d70a58e752b1a0ebc9ab33cbd3be
- SHA1 2342cc6f5fec821c519ca180c1682251c0163464
- SHA512 8b088842da8e512e433ce341d1c4346f5434a11e564522e0e8636d3d1ce2b2e5a50d14cd51972f2b7dca526f0d2ee2c29ef2d2dd2707eab025dbf19397e18f2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaohf:A3k03kHRJN
- TLSH T11A15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 924KB
- SHA256 cd29bf36787cc0eb40562f8ed4ee775e1ba7c7861fff57f7cf65e301b696a1ba
- MD5 4a7abe0c37d2132139ac1988a0063362
- SHA1 df4e87efd8e83e446ffe3b2df876fe52eadbb034
- SHA512 1e47c529dcedd02454da4b74a8ca16f0a32119cbee43af71f05a05e7b6d55cbaab0a6bfb272ed9aa0e257e83ac6f05768016eb539d45eaa56f917ccb85dc4a15
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoDo:A3k03kHRJ4
- TLSH T12615AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 924KB
- SHA256 625071e7927723b0d32d081aaa8c0dd2070da552acbca66ff026ae1130089d26
- MD5 8e7e570f960d2112b2ae98e2a546a8c4
- SHA1 ea81dcbf23b28468b023ac9e4ee3bc9e0c0cda39
- SHA512 071b6a8dfd977e7e1f25f760079b3b2f950bcce5a82a984e097baa66d1fb95f72bfef11c1f3a8aa01c6a189c0bb3faa5c44ad2cb77dc250c44382baa05e2d555
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbao3u:A3k03kHRJK
- TLSH T1D715AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 924KB
- SHA256 7cd5e456680a42e223f2309cbd3405f5a4dcf901176ae4090aa613d6c66f536c
- MD5 a4acd5bd7b193a17e42ff192b53ad6f5
- SHA1 14ec67b0f4c93f078e93fe8e0900c3d4ccc90251
- SHA512 c83121a75b94964b0eda4dd7a678bbcbe4b9360dd0f070804b80172b4fd859b159b20dd0a5b438228528fd4af0c9df97a5106860424ef797fe8fb21cf207526e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoF9:A3k03kHRJr
- TLSH T12215AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 924KB
- SHA256 1c992f5b5f579c6702b78224cc8c4770c0e593be05919416d9dc6fc9b564c8a2
- MD5 7f14b02302cf60fd37ff32c1d72820ee
- SHA1 edce1e1df65e901e5816b4736e24b09e05fc8b4b
- SHA512 603e22dcf1ed4117b322e151e947bc3c5b4eb6958c0104b13c9c30a024364ad8dfa1d13726b8633c504960c58d2c9de399465da53e16ffd74a6a56545fc254d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaohc:A3k03kHRJi
- TLSH T12B15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 924KB
- SHA256 5cf15e97c00e271ee408f132664748bcd48910114f6c6dc5e42267a2db84b140
- MD5 f2f2797f4b9707a31e4be0a5a53e309d
- SHA1 2321149df7cdc52221585221439153b42f74e67c
- SHA512 6671ed43abe51214d91eb0a2fd37bf17e1ee22814d9fc62a00c7a3e40ebb2d9c510b94bc5a30bbeb73510dd617cca2bf01ab53583b3a2a5d027c7a7d73098601
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoKp:A3k03kHRJI
- TLSH T11C15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 924KB
- SHA256 4d33a5c66210c484bf946d321ecdd365d3234f1aa17ebab91e20bedd7321fcd3
- MD5 8ae9c302863ff2b3b628bbb7c51a04f4
- SHA1 e2b1efe93da6846ac817c450f208b402a732db5f
- SHA512 34447c5fc0a1bc3db66359b41918b3ecb9a1d73a4fd2986b31fa364d39ae48323b66237b9673d7bb0bbad3b5659ad68eae938fa6894f343fa2dbbdd629dac359
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaotN:A3k03kHRJX
- TLSH T10D15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 924KB
- SHA256 669c6315e1d2b6380ca916497d9c3c89bb23c57dd579cbdcaccc90cf3be4430d
- MD5 11d7da0613f487494d8d571a77c81e4a
- SHA1 d431f4dd211bbfe3b6fc05753b5cfa2a23cfc48f
- SHA512 9a0029aee9b2404ca0933ec203b549a713fa85bda89513ac86bc5c3b29f254fc883313d25aa1fb53cab7da369f04f23ca41a11a41b72d961b45123dbd7a73ad2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaofF:A3k03kHRJR
- TLSH T19715AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 924KB
- SHA256 c2a34986dbe1cb4b5fa1212c362dadb49221aa01e7f5acc291f29aa5c0e68544
- MD5 8291c9c185d6ac699eb7ffaa5dcb2ca6
- SHA1 3f221b8c49976b9f6219a3a1a8f5782187950527
- SHA512 45609a70603ce53c4604b1a6c1c0937192c4b9d1cd95615862e598e9a33909ca15d3f7fa36d743854f21be68a39db1c2358cc56958d6e3bc330ca0d1b40f81c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoAC:A3k03kHRJ9
- TLSH T15915AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 924KB
- SHA256 1abe0b034d04996556bc19aa3b6f803c2ec1bbeac696523dd4a79913c3407076
- MD5 c13659241dc07f9a2e7f6815d74376ac
- SHA1 40546b89f3da35d0af65a6e4347086b61e2f89fb
- SHA512 476238665a9ed3aa7d26d5790f9d2c194774ef13d289f60ff5d311558b394ec57c1abf277696d2228fa9499398a76e2628893829cd67429c67b4f9678da83b20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoTw:A3k03kHRJA
- TLSH T12B15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 924KB
- SHA256 bae0752496da619d23336714c2784cbdfd6e9d37d7df4c33c4d4ff6aa0da5fa3
- MD5 e9e6b430215a745c1f9063c6a1db67e6
- SHA1 e2b30664472cb617fc2c2aade1bda2b82b47b782
- SHA512 75a742b2e319b071222c0da4126ef3c31b32cf50b1f9cab9169130b965f82a2b1bb2eedfe06d82eff26c49a0a85945ff9531592928d237b87a9785f32efae470
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoaT:A3k03kHRJY
- TLSH T1B415AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 924KB
- SHA256 ced371757ed97468bc25e3508df6ff70dc1fdc75f0aa7caea9f390b9620daa9e
- MD5 8eba89db550adc9601994a7022f7e758
- SHA1 c154f15c43d2e136d7f8a6f451a6c58d5f232205
- SHA512 b5d40c10e1cf50e42b5f6a2f4114aede3c54a9666a0bb59a84788827a16adfea671f230e34dc26a765782cbeae83776f1ab10cd6353c9c2b9d3b2ce252ebd02b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbao6u:A3k03kHRJn
- TLSH T19415AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 924KB
- SHA256 9bb2c7203f7ac31a9f8b71efc2ec8778dea7308cfe17096eca571322a60268b2
- MD5 25b4a61d15868f9e32ae4c47abca72e4
- SHA1 c0161f5fbf7f489196925271da6f858b3f2f2947
- SHA512 3305fefb977295bb6d289da35d08bb61757a4e1d3942e8bf170261b694a5b1891e56b4b90bc01bcb57bf9f8e61ff10a8b3b54a5191a5735b803a2dec00b928a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoEb:A3k03kHRJe
- TLSH T17B15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 924KB
- SHA256 a88f27b26053ad2a610fb83bc7cf906d68202b4b56f431ea0225f5e39d7037f8
- MD5 bd78165a02943ba43d47ae83ee43af20
- SHA1 cb93b0af12fc2c979e2c40c2705260f7edc090d5
- SHA512 166db9880b259fc31a2c9060500f892d13e8717bf35b01f04cc794cae2017977c4e1c2b4a98b644701e75154fadc21b21c4a0bae864f34b86861b3557f4f1275
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoKf:A3k03kHRJ+
- TLSH T11915AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 924KB
- SHA256 074a26017ff0d1126119b32a8398e4192f773b765b408e63537ecdf9de2d24e0
- MD5 21ef80b0d07dae52d77f164b39f1d3a1
- SHA1 c7532a03aa474c1a00904f9889e9d06cdf015bae
- SHA512 5627d46719b51d9209f711026bde2ab4fe287d481030519dbea3ff1058a4c8f3d9fa91061d0ab365bfe7de6b0e66270f8b67667eea1c608a1108751523e3938b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoXK:A3k03kHRJe
- TLSH T10615AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 924KB
- SHA256 b8c735b5f8c7140cf9fd90bcdfbe252230e803658c63d72a4224f1d65b7bf6b6
- MD5 c9f101684548c9e46c8c382a035a3ca8
- SHA1 65eac29483576cda4b1278f8af96a58bb2a5cb63
- SHA512 aa75b02747e7e3f970060eb437490a31c17399de41dd04d9b38898846a6a9c33c22d46a9534c2adefaf4fd18f16299d9fa91a4899079968e6c4679aea3ee8201
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaogk:A3k03kHRJD
- TLSH T18E15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 924KB
- SHA256 bc9cc70ef1f49f4deef0424c01de89cba1f5336e76d44e084030230488058882
- MD5 962afdab20318798b8d2f3627ca21670
- SHA1 01b01b32d0c86dab515fcadb8ed40dd00b2a9fb0
- SHA512 ea3462036d3c0f40bbf5651f903b1d6e83c767dfdb1e92f3805e335ad435e796bff8f48b61f4159fe0525e2df6692dde1f952ad47fad497dd5c9a9f233ba1fad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoR0:A3k03kHRJC
- TLSH T1FB15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 924KB
- SHA256 11ad49fcd7a114a886bb0abce02ada4c440b10083abf232fc73b52f1a5729a01
- MD5 e947f846730696fd5015c283e3de9b24
- SHA1 649490fb6b16caee144278ad403e8b190ef45278
- SHA512 4980a0bcb679ff17480647d18d41404a66eb45711f242013f17c1cff6c59f647f350c9798c4a75bd55030dd4fb2870c01ac36fa67504112082816302d03c1afa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoEg:A3k03kHRJ7
- TLSH T15A15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 924KB
- SHA256 f4b1ad9771a16e10101be2e09a7a8dad7a8f1320b5a7db9a90367edd4faebbc4
- MD5 4363c792ec9e25f2a2f7da6aee563306
- SHA1 f1a84b1b3f2c9e625c6e814c7a3f880579393dc1
- SHA512 1e2a4a709bb23ca65e0e1e5a8bf1bbe04587ce84a5404b4ecd261f66575958d2dbc1049cd7813f608b60a65d8acaed5936bc1ddd81c2ea5698725251cb11c250
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaohr:A3k03kHRJt
- TLSH T14515AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 924KB
- SHA256 b9ca76b17f878b755e27b587d47b295bb7143690d69c2f9b2bd825ae3a26522b
- MD5 6dee85ce80459564024c18e0fd27ca98
- SHA1 4aff204d0f3a2ea48c562ace6d9f4be2a6e69aec
- SHA512 d1be552f0c9ea447f136f68192a6c7ebad4299bb55c5d6450ba53b8fbaaa2be1712ab860ea948f4a4e45c3eb79c1014b7768998167e220e22807c1175ecc8b25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaojn:A3k03kHRJv
- TLSH T1F615AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 924KB
- SHA256 8b3789f993625042cc0a0bfbcc070b40c661b7a6671084ec0c972c2295c48ddd
- MD5 b38c736338c9c64944db495652200f48
- SHA1 877ccbb1762d50ff136cb721df488cd2992c51a1
- SHA512 679b276f7c2f5e07a07903d22fe84656b3dd21017fb07338bed302c2f7d5fba425e2d97ab7534e70d3682b181a770a5cd9cf4785fd0a2abfc50e3ce0ca1d2042
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbao/x:A3k03kHRJV
- TLSH T1C715AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 924KB
- SHA256 b80168079cc029fabf9c66fd2a24573dcc39fab920949d97e0c1692465387790
- MD5 8ebb25f31030e87ff562dfdaf353fb91
- SHA1 a1fa6a33f4aba9bd94dd7929580ba18e50adff04
- SHA512 7332ddbeff3fa5b9f79f884ff96e664a3f850e483c8417b350c14f66f7b96f72f13cff3634077930fd26e12be6e49ee0b66c8ab29291bcc104dd43dcfd4cfa1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaolA:A3k03kHRJa
- TLSH T18115AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 924KB
- SHA256 c4fd6cd491415f28e4c34da67ea3599929c626e2045f3f203991cc03121b8c72
- MD5 bc92a3a7d91e04e3013e7b7419493b1c
- SHA1 77bf2849857d71bd5236505c1ffeb0b33303b6a4
- SHA512 a7e2825f4c3615c95bff67006c607d3fc1c31477e850a2b0df0f79df690726b6996082843c7006202e8b63d970b2c1e10b4be91363ad8597532ae27425aa1816
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoe9Q:A3k03kHRJn
- TLSH T14715AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 924KB
- SHA256 5f056af9c5a08a10dd4e010dbe8d8dbd800cea12c4523de8fbd901d29213f334
- MD5 8d053e36ee9ea4a4066cd316465f63b0
- SHA1 7cb021a138b607203e2ef42683e0a3698a4ee7cb
- SHA512 a218674afc82f0650b9c09eb72d133f69b3532a2fcf50dbb923de220c2952d274ada9cf131947167d029ee2a75fa7ded7c90bb8ef2882371e7709aa7904a93f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoL4:A3k03kHRJ4
- TLSH T1B415AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 924KB
- SHA256 79840f8be2c489ff67400a075583e3898c1b356ccd8c90d20821416e8fbf7ec6
- MD5 eeebcd73b6ab0828493d2ad2423bccc3
- SHA1 6cd4d00c51985b1686cfb614099fedca5c615304
- SHA512 4a1fb2262d64a833e5927b64a5f2a8be6ed84c699c118d89340947da90e0a555813e91d91ffd7d0ab28848f3f9ba9baf2898e670041058928ac459c5f1843ef1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoCu:A3k03kHRJJ
- TLSH T14E15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 924KB
- SHA256 bc8286ce93c6d236703f08b1786d06e40aa449c2d18cdd409ef66be246d9194f
- MD5 75c57d7e776b14857688231ba820efc3
- SHA1 c95eff7bd55b0c2cb37655743ccc2a01a4ea2f34
- SHA512 6dbefd716bc9e271a76fa0821266598cfe3252948063de2c945880f5f7bbf05e5ab40abd63b6b46dd0a85e7a4f95c84fb51399c59a3b02663dead3c302ddc55d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoTj:A3k03kHRJT
- TLSH T1CA15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 924KB
- SHA256 ede523aae6778853cf986f125d7f7d44d647865dd268a891cafe46cd4b4b055c
- MD5 e7950f719bb55b7a6b7e78f590376b36
- SHA1 84dbb24190a8254df403f8c70cee43faf66942ce
- SHA512 0a4655b563152b2b2b9cbb3c2601b5a6c567326398697fccdac77ab9f6a13f0edb3300798f22b665de591be1b7e37c02869fdb157bec61b75c86beb7196852fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoeg:A3k03kHRJ7
- TLSH T1D715AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 924KB
- SHA256 5b5a87faab39b5fc881f20acd4a25ee137a0e5549458f6e7a35f174b9cf7d409
- MD5 0f8773f110999312f416fe9474fce54f
- SHA1 3b5c04af6cfdb787e108b5d8b0cd89ea2d2b5b92
- SHA512 233e04d1fbaac15a726d60ba276788e6d581ed4d4aef6165d3f57d31aac4435448f39e402a02c691ddf6ca7feaee70ff7f03d39ea561bc70501ecbb025bea5d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoRI:A3k03kHRJy
- TLSH T1F015AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 924KB
- SHA256 61feab340318176918336734f4e48abac19213d741ef0649434624dbc63fea20
- MD5 661e075a097ca0176467002dbb5c67ff
- SHA1 9c01c979b5a1722ae53765bb1c1d198bc987cda1
- SHA512 e3bf41007eef7799efb161629d0f7ebd143c1eafa3ba9a394141722066f27710f142185d7bdfbe4d87c54a50ea8d786b680f5b0d04d74fd64df817d244c6fdcc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoTo:A3k03kHRJQ
- TLSH T10A15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 924KB
- SHA256 283a63c23d88de375508883bf8a3aaad1a160f2b8c419a7d4ed7d5e9600763ba
- MD5 dbf49e446acf50a027f308573859f4fc
- SHA1 db93b3dad2678e941976166cecfa486f630a8864
- SHA512 446f36b32c839c6e11b5210866abf201f25cc60f05871068a3a4f74e547497d853203e6145a973d2abe457fa19d2b3c58b95740f07beb2ead7c4824b18235d01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoY+:A3k03kHRJd
- TLSH T12B15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 924KB
- SHA256 6f351cae7100591735b30fbc7ddab8b3dbb167973fdd8f579f29ab5561026f44
- MD5 373a3d8346dd0f563bc5606299f67fe0
- SHA1 1829fadcfc3d4982229a053e5586cf6e193c603e
- SHA512 95b50d935a1870abf6ed8d89d7110d27e5bbcd7a1d9dc623e00e3dbb7bc3c0fa9100fa363de34e4f57110a2930279eda5e2580946babfab3fdd3041edb625b62
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaowQ:A3k03kHRJV
- TLSH T1DE15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 924KB
- SHA256 1368b32738558dd3b635843f0717719a7a4e46eb8d729f132fee4050409dcf69
- MD5 236287e45c3960684961d52b56c345ea
- SHA1 d8e62a095cdf6705a188fc4514a7763d1fe2dc2b
- SHA512 e18ec834852f6634ef1a95ad771dd751fec13b3952b4d29a68d7f68f7686d065b5c94f62721e0292e64b9620ebd58fcb81b77c345642d94f8b269d0a44d88ed0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoZX:A3k03kHRJB
- TLSH T17515AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 924KB
- SHA256 ec27aed65cdc216a8ed9cbd97f6037f9c4a43df41f644793541cdbc493bbb0bb
- MD5 aa21af8eefac071677cc9422f1d82716
- SHA1 06bfd3fbe5535558eb87add594c72565bfd74a87
- SHA512 6e65e05f630ab0836717b2f768bb6984fbeb39921b670ff6be781a1c54ecf0602665e53a1688e59fca31e46a70715314cfc00c79462be3b1522370fd3cb67ace
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaozL:A3k03kHRJL
- TLSH T11315AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 924KB
- SHA256 c49de8165ff35dfab62965d4017c92bc91642c8f3ae703bc8037ed07f177c416
- MD5 42ddcead884235d224f37a295bf9ee65
- SHA1 93feb59d6e578b1d7475d59701221c077f157563
- SHA512 b46f117aeccc430f73ddba7d646373f446fa1fa042a1f8fd3dce90f7c407ecf2e4f4e21d1e13e25dfe88e30819d8e335bbb04589771a2331fcada50211bb218b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoZM:A3k03kHRJG
- TLSH T1DA15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 924KB
- SHA256 92a9c611d1555042f5d6cbf99013fa1a5ef3317664167528fe3582e87d6668a5
- MD5 f3e6612649392258460ccf72f41a90b7
- SHA1 c16905b4cfa74ebcb14d65a5d72af4eeb3368757
- SHA512 795b697d546621ba56e658d15b362dc3911b23ed8fc77c8c4ccb00e038069497b20990f3c1d0ce7a4ee491c66aba8a957175af66d3c4238b83679480938fb495
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSbaoih:A3k03kHRJY
- TLSH T13215AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH