Analysis
- max time kernel
119s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 15:21
Behavioral task
behavioral1
Sample
2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 948KB
- Sample260817-srkrfscb59
- SHA256 fb0db2595aaa2b5ac9cbc617d8dd7724162829d273615a42e83f4d0099240630
- MD5 a3b7e53fe77bee9c7e9c385f1e16f51c
- SHA1 27d494f3e14fde384b7dc86aeb153a809e805474
- SHA512 df5f4803b652e9e7b12724c0b0c9e46abf3b8f83a22cc99dc4b1c45c6ce5972295c9dd8511abeb995e7d60c490e0c942c1eaceacbdaaae2780ac5a70a21b53cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjp:A3k03kHRJ1
- TLSH T1FB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/4600-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c3df-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000000431-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4600-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2628-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c3-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a56-218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a53-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-474.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a55-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-592.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-840.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-937.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1067.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1131.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1144.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1175.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1403.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c3df-5.dat aspack_v212_v242 behavioral2/files/0x0004000000000431-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c3-41.dat aspack_v212_v242 behavioral2/files/0x0005000000018a56-218.dat aspack_v212_v242 behavioral2/files/0x0006000000018a53-262.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-371.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-474.dat aspack_v212_v242 behavioral2/files/0x0013000000018a55-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-592.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-617.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-642.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-840.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-879.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-911.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-937.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1011.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1067.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1099.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1131.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1144.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1175.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1182.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1189.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1250.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1329.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1348.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1373.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1381.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1389.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1390.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1403.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2628 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4600 2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2628 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_a3b7e53fe77bee9c7e9c385f1e16f51c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4600
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2628
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 fb0db2595aaa2b5ac9cbc617d8dd7724162829d273615a42e83f4d0099240630
- MD5 a3b7e53fe77bee9c7e9c385f1e16f51c
- SHA1 27d494f3e14fde384b7dc86aeb153a809e805474
- SHA512 df5f4803b652e9e7b12724c0b0c9e46abf3b8f83a22cc99dc4b1c45c6ce5972295c9dd8511abeb995e7d60c490e0c942c1eaceacbdaaae2780ac5a70a21b53cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjp:A3k03kHRJ1
- TLSH T1FB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 19fb9ec2705fd117c3ef6d0d22975e69090bab804f54230ca05601065459577c
- MD5 ca57250b9283a01bcd5cff8825004b03
- SHA1 bb641d27d71aab724bb956a7e20b32cd5cd9175b
- SHA512 a9674037f6cda7cc962ab6dbef860b688a54cdcc273e2cdf348dd9b150a3b789784d1eeb0b5b45fc2b6e7754a161cd7c78dd2cb88d0ce2d66c8a9be552b37492
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjV0Le5ji0hmxNrM:A3k03kHRJxPji0Aj
- TLSH T13F658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 963KB
- SHA256 73c5173fe03ba67832e4a2a31a2311eba229be65eacbb3f8bfb4d9125814db77
- MD5 865807c35f873ad4885d7fa47f2e0dc8
- SHA1 a8b598d1f3aae68978bb92c916819d35203e295f
- SHA512 2eb0f66993ac5483f51e0cba1aa4ad027ba9e13fa04df4d2e60bdfde0fee73b4af0191d2d288f61d6b428ddc396d37c1ccd6ed9957c3efd0660b31988ad641cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj3a:A3k03kHRJ
- TLSH T1DD25AE13EB9504E9E10AC1749AD64A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 972KB
- SHA256 bf83c5f841438f2c6d96e2abcb335ff30798f9901748fc88e59ba15dfb71f9da
- MD5 c4c966c2bc23b9149f3d9b0dd67a40ae
- SHA1 7d260d62aaed507c45afc9197486b00f6bf11655
- SHA512 406e4eed7ea395244b29694c10563d9225268a92e7ce1718846ee6ea7a78f1632347c95edd53712427db6bb58930d1951fe2fb3bbb75b7b8ae5420e5101e928d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj26:A3k03kHRJ9
- TLSH T1B525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 972KB
- SHA256 1cc94f44ef016cd0a6eedd88e86e98daa9ab44f6ea135cd008ae4831fe11292f
- MD5 a7bbaa3050f8adf6c131824b3a93c8d3
- SHA1 80a80f078dae543ea0cdb9dc74cb46a9f801b0e9
- SHA512 2d05caa1e8b7698c926499d19a1f83c182bafa9e5becd224430703d5d650922e07e5349a0566b527036aa7550125cc49a9773ec65afd09a0e83ebf7f360c5c6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjmN:A3k03kHRJc
- TLSH T1FF25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 972KB
- SHA256 a3ef65909978b02e2b325bebf78d75b4236e8b8e1b4bd35b3bc97fcb44ff2ee6
- MD5 1f1fcf59333c4f456450e81d7dc1e68b
- SHA1 d97b6ac0a7ee18bc0c1d4747812eb7f879a675f6
- SHA512 08125b2bc734e659a29fb498c394d2abe9a0065ea4c133263bf2cd5231849ce629c2d125008a55a5b06d02d2fa822b5eab51c1149afbf264c14fb3c0d2e05024
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjkf:A3k03kHRJc
- TLSH T18925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 972KB
- SHA256 8ead2c0512ccf14490b7035544e1af19fcb29280d8af92d8ce48957218333af8
- MD5 944aeddb0306c440bd615ca953d5d375
- SHA1 818222ed2df2192878e6e4d0d91e9a38f0211c87
- SHA512 84cd8fe9ed6dfcb1ef4379b1c1903f5d30856cd8bca18aa7262ef084183efd4aa8bcb42f5fb5fa22da0122999175c6c528cf74adc88bce8a86c3b8bc9937cbb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjOo:A3k03kHRJR
- TLSH T14925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 972KB
- SHA256 ccbef4013b6895aca907b5e909214fc23658e3f39a18db3b3a8e121faad843b8
- MD5 15f69651990aca2ec39380dda9e867e4
- SHA1 84f8c8e6145d59b48df0bbb60ac7a006b05cfbbf
- SHA512 ac4761c7c2a9d2d68f91afcad192d3ddcf951c15fe832a03229cdec91eaf91e672ad6c648245acdb1d22beac15a986b93c53505beec00f1e8d0aaf4b4b534592
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjiu:A3k03kHRJD
- TLSH T1A525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 972KB
- SHA256 0140249474b1250fbbf686bc2d2cfcacb9424b629d0eb0dcdbb19efd2545dafa
- MD5 7b1dbe56aa77fc71f84d2a24ccd34b3f
- SHA1 129a820c190cfcec3e9abc663b1c4dcd3a9f0f94
- SHA512 3901b686fae9c46b8ca9c4d3be9c673b0a2c6b609d8972c5c6a4d9233aa8ea0f492065462abeb069f03e8260ec1f535c5fa7ec797be86c2c2ae871f063128798
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj29:A3k03kHRJi
- TLSH T17725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 972KB
- SHA256 9be9355370594ede5c1b673e4ba62bb0163c473ae54c89c162671f82b5668f85
- MD5 5d535ea7fa0336efa4f59c6ff3fc07d4
- SHA1 4ae35ea48225836d2d9ba4f5b91961a69d096d60
- SHA512 85eec392b5e311fbe5c24c36cda4cbf182fe1fa5e0441dfd6bc5fd5192970886f59a4188510c2547b0b71f1559d453e62b784b7c0c057af7749387be90c28c6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj2c:A3k03kHRJP
- TLSH T17925AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 972KB
- SHA256 b1a2b26f3b7cb75ca57dd7e5d1b5eaafba4eef39d21bda405ba56d02889812e4
- MD5 474c367e060588ad5cc701299667d910
- SHA1 7a78025b025b19aa2cf69ecd42bbf54ec0b21575
- SHA512 fdd37bab25e98c6ec89ea1f3597caaf3d75ccbe14fe019e01ab53e4f6c6174118eeb52eed88c43f3fb30a48fdb2dd06d3f3ee12075589d310f9a29a4c6b5410e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjvp:A3k03kHRJF
- TLSH T1A425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 972KB
- SHA256 ad6ac1b10897531deb45c564daadde3dfcab5d00058c80b3f95d54eb60ee8bb4
- MD5 dd9b752670a10b574ca77d6ea9962881
- SHA1 7bb48decc4c224826f84b7ca79ce267044ff5888
- SHA512 8249fdc40c03dbfbb260be47bc91cd61e5e4baac073d5bcd8d0b3b08791556e3dafbecbaa2b3bcef2f55e4f8961dfae61177f6fdee29c886e9d75fed71a28787
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjQN:A3k03kHRJ+
- TLSH T13325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 972KB
- SHA256 1272c38250f0eca1d2dacd7ee8fcd846d232751dc249bead6fccc2736e2f3f3e
- MD5 7d3c6016ad22e521f05be9ad59b4bc5d
- SHA1 d18ed9c4df132b04cdabdb2a27d5abfffeb5a7e1
- SHA512 f1f46c0e13e8f225173fca1c6828ca9975da2176d02eb805f13b5a142b8f71aca873084726dacd56a35c6622aa8f7cb001303d92cc89bc8ba3395b85e4e5627f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjYF:A3k03kHRJ8
- TLSH T13725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 972KB
- SHA256 a2b2e70ba9a370856deae7628fc49ae9ad3db1595c079cc3c574a8114c6bc9c8
- MD5 a2944790cb53f2870a5330013723184f
- SHA1 a72a0b2f45f2b408eaf9f27cdbdcf888cc0f1fad
- SHA512 cf89e656bb3bb1eaa0d41bf623d475700199f6fa138cc9e32cd01b8952ef56723686b4bb450514ea130596323e318a68231783e5447d42488a1eb9520dac140a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjNC:A3k03kHRJI
- TLSH T1E025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 972KB
- SHA256 84c533ad766c75e5e934f84eb6b835cf9aa656d896fd1ecb849d2903531b84d9
- MD5 7ae9b203aeb651dd4da8240a6e837c64
- SHA1 d0384a7f40bf12aef13826d8f1a744f984f78fe6
- SHA512 7006efb0460399ddd94b47928aca2c624c58ff7a7cf58383375204d00fb42b8b7f773c0b510c52fa242b97a5e90973575fc87878d73ddb233ac6d99e8a15d628
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj2w:A3k03kHRJl
- TLSH T1E325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 972KB
- SHA256 2d6f5b732336ba38fa8fdad6c8ede271e8a8c640b76bbc3f7fcfa726e72e138e
- MD5 453f98d7d4d5eeeb3a734e52ad26cbc9
- SHA1 fef356a3119e5acedc8698d67e495ce17b172a7b
- SHA512 9260aaa08ea655a7d3ea90e11ec824477f9263b1b1be9f4c714148a4af3e1dff540e91719baabaabf5828b7404c5f4bc272f84285a74f214684cbafe938d5495
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjlT:A3k03kHRJZ
- TLSH T10125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 972KB
- SHA256 04716915f0934be3e2705fee1cc700fdad00caafb0a3b8f6941dd0728f1f8cef
- MD5 889012fd0e5f74f940b11d47959a0da0
- SHA1 930f4f035005f58a14659850d772c3bbe12a6230
- SHA512 f42db8b4138de560b5ce7ace19476e5c1efa122ed43a9c961c80f02270d5679ef43ab5b41a7cec67141bd60ca3582ce291b8d4bd1f069610162dde46f2036a4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj7u:A3k03kHRJe
- TLSH T1D425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 972KB
- SHA256 529bb82ad739e9de87d7d63115b78fe24a41dc7617f62371f6bc51708b89f823
- MD5 3465aa29494e821d739a4ecf9f048c6b
- SHA1 05ad8b88d343f212ff284924a3b7f6771d61fa63
- SHA512 27b502269e857d393827b0e268dda581bd4e0d10dae2b34a5e8535653cfbdd927bd0745e7e857d20ff5e2a936e65c67f1a5da3849b7fa6e4e424588368a61dbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjfb:A3k03kHRJf
- TLSH T11025AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 972KB
- SHA256 22e11496be06699e751d847e2f922519e6be600dfd72f54ba65f919cc2b5d885
- MD5 4a8d19413b9fb17f700ccca40fd69c6a
- SHA1 cf0c0ca18ceb7731596774e693c6001fbb79d075
- SHA512 7de69ea0868bda9f2ac524c1313b452e9dccd5581658a74c7909dee5bf1aa3190b3d54464b3768a18f001ab93d31142cb5282dee3f617609c2c3d2edcfed5e20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjbf:A3k03kHRJX
- TLSH T17525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 972KB
- SHA256 38f1868e05fec423147836eb173b33494003cc88ca3e354677c35b553a55ebc8
- MD5 88111a995e80797f2af8b9be0bc4991c
- SHA1 d23315927259549381eb0840281a38aaa5f7e87a
- SHA512 1dc92f042d1e433c2ff0cbd4957bafa3ce6d4b5404fc78607d1319453c5162d231c85fd1c74f1e3df22476afcd78d84593a9ffd2c0a6445528b70cfac558e52b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj0K:A3k03kHRJX
- TLSH T1C625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 972KB
- SHA256 f3ea2bc36eeb57c7f7a8db099bbc52c4c8b971663cc8e99d43e7fafbb76a439d
- MD5 6f5783f6c16e84da83cd5f005fc829f2
- SHA1 a915b6471c6b2c513948723d000e434587b1be50
- SHA512 9948b0484408007ea0c77cb4b9a35b4719b93faa47985cae963c0ba67ed9990108ff7631ad2987a1ebbeca10ca54ea11fb984d9532f5eb01d8ae9df63da66ad9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjpk:A3k03kHRJy
- TLSH T18125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 972KB
- SHA256 ffe1654f12cf0edbd34b8b329c0cce7e9401add7cd4d1ff60120517cb3a9adf3
- MD5 795b3c704565aa9e49a87ed0525fe652
- SHA1 925571378df218886523800fa34a5c5b287a22b9
- SHA512 e03fea5bde35241b5fee59b5bfc840bf76922c16fcfa14182bfb3342a7e843f5635550ac0a0879379e2b637f0ec9112daa217f3ea3320a371b6ebfaa69675436
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjG0:A3k03kHRJ3
- TLSH T1C725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 972KB
- SHA256 db693ffd1198f126082c9781ac7a7287668c8082fedfcdbee6934c754464b9db
- MD5 27c9a516a5eab0c79e1c19f91e553d51
- SHA1 d5f34632c23b44859da79f65005cf8101ece3dba
- SHA512 d6fb59195c18827ad2c2342930fef2c56045e6d2823fb773af3ed7cc8396409e01968c761c92de1a063373493f324553eaa2fe9e1e6007a77419ab73957ab469
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjVg:A3k03kHRJK
- TLSH T18B25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 972KB
- SHA256 2287f253d90c29946dce56e6da74e39e26f36e2f353951ce119917ef8554065c
- MD5 0c8b5c1f04d54ebada08b095d1046897
- SHA1 15c2e960ed9910418c52f5388a2e72b824c005c0
- SHA512 565f5b447484634584a91623b8d67afcfb683bf4dd4bab58967f0b43f9f5c2f45836f661d282fc90dc7e120e1c3ae078f5927c867041f2c511479ad6c461d5c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjkr:A3k03kHRJU
- TLSH T17425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 972KB
- SHA256 40573a8ec2e0e153d7989784709a924731c53006340fadd61ce704a19e3df290
- MD5 7b7c5d3558031f3837d48a79c2a9ee66
- SHA1 665a3bcb6776336cab8320afa92a69ba6d467725
- SHA512 36dd05ca72e0b04349862bb7a2075da2a4962ddc1ff5f009eb216a9daf48dcc8892971908075475848debd0506c607acb11bcbc0cb7595819facbf59e4ec2de2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj6n:A3k03kHRJO
- TLSH T1D125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 972KB
- SHA256 8b0c1ef0dded5322d2ee3eb41a28cbd3c061a9cd032efa538894257a856b6ec8
- MD5 69ace4d79810c52e048c178c607a1372
- SHA1 690a82e67e14a8fb42d2f76b127e24fa525ed9ca
- SHA512 bbb0d6f7f54bc3ef0ef3ea3d69ac77b74a08049175e3e41fab263e46f03c5471f6397be69a7bf4b86e731de1483cf71e43ecc02b10d4ac6d45c50627b1620ca8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjQx:A3k03kHRJU
- TLSH T10C25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 972KB
- SHA256 9a59c9e2fec8ec7cc7849fa50a80e3b73dd0075e3ae2a4be97934bb0a44e6a0c
- MD5 e78f3704bd31cdd4e955b229109e7ecc
- SHA1 e231bfcd0a264c4c608f5848b5f4d304f115b133
- SHA512 a62de1ccb58d3e15f6d1f26d3740d0490fb780092401ebd83cf3238df092a26da4700ea3e53d4a5be70fe400d160d804ff09357802e77276a39ef361f0d1382f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjSA:A3k03kHRJ/
- TLSH T10C25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 972KB
- SHA256 73f80ae4f7f0a726a3c3d08e6db33936c3fddb0dedcfc401929a17b1b0162009
- MD5 2fbb2dc586abdc342ac72bf03add8ac3
- SHA1 6269ea0b54db0db53cfe0a8a876e660cad9d89f6
- SHA512 d521934aa8967261bfc93b95fcaffd3839029c17beeed261ec30570efd546e909022cc1e2c4eb3119839a60c07adca899148abf7d02fee0d83a50874bf529b3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjr9Q:A3k03kHRJS
- TLSH T17525AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 972KB
- SHA256 183288f2690519b9743774814c600f05f7f1559e7178a7ea84382096fbccb237
- MD5 3240c649ed4b3197b078400af3290a43
- SHA1 08051722956f63515ea1acf1c806bada5c9644ca
- SHA512 1cbb0560058f8f330290caea4bee897f7e63888d3262b917db820685e6512e2126f9d492e2ff8e7f1d089a05b5abfadb4130b9574e2d5a31fd96a6a677a43624
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqja4:A3k03kHRJh
- TLSH T1E525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 972KB
- SHA256 c9ef9e3054a18a9443af73dcecef8d127e9e72bbadb4f981dbcbc850967747eb
- MD5 cf8a633327ef0fb0c57643f525359c1d
- SHA1 4f7c0f558d65cbbcee340c9462ecdc6af168921b
- SHA512 48373ad1ff0b978685f32e3b28acc9746644da25a42c6fec8185f4afc200d1482866b896f754116b3ffa4bac7d4b926ab49dc81e0f6bf853d7e6068f4bbadded
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjBu:A3k03kHRJ8
- TLSH T12425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 972KB
- SHA256 04872e88fc21399f2565378b37d2712585a7c92f4961c0b902abbf630e9d2752
- MD5 c899a5591a20dcbafdb436e41a80f1fc
- SHA1 2f6afaa462cbb02e3cab91b44f7eaacc08ab30a3
- SHA512 40b0af9a73af64239153f8c4a7ddc841f9ae2d31093348701d158351e09244650634c741e22111e1397a2f45ed1d5b45b07c432cc955907a5f0d4a13be0a374c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj0j:A3k03kHRJe
- TLSH T13125AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 972KB
- SHA256 be7fe3e52392260801c83af2eaa3c3d245cf0191520c9befa3a40da251fb0ce8
- MD5 27701c6bb5e889daf4febd725f23feab
- SHA1 b7fbcee122e29e11b40bbb9e6f75d33f64e24cf5
- SHA512 982db6caa9a4457edf1fb03eb67158a9764be0b87d5d62528c500d236b0ba8b8610db86985eba4968ad40bcf21a5bb97007bc4ad1413ef0e505fb13d1876f94e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj1g:A3k03kHRJS
- TLSH T19325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 972KB
- SHA256 6beed341a10a7e87f45f5a840a8e2f5b686fc0a720aa0eacd9be13fb9eeb27bb
- MD5 8b030a9d40dfaf15787cdcb607cc71fc
- SHA1 39d3285cd7599dffa6f7a5c03889c338f1d234f0
- SHA512 fdb8fdd3225f752d8ce91b2ab07e05d48227089965384501c20bc61960dec91f61599ee69ba006eca98a93cb636e2a5bb6dc1c655030773a948a735cfec655d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj0I:A3k03kHRJj
- TLSH T1A625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 972KB
- SHA256 40c8d177690eb24a349c5574d9f71f9f0cf65831740aa0fa0570b9187db5d547
- MD5 6aa9c0f73d0fd2b538b72dcd3e1fb67b
- SHA1 5145674b167d29eab6a4a1981147ad98f3eb4a7d
- SHA512 d35a01074fb4a64b3112368122ff0d32700517510ba541d756c21c3ba92b09a2014d66f487171682806f9c1c10a77374ee744cb28ec92ff85d7a1e85394b3f47
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjmo:A3k03kHRJ9
- TLSH T1E225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 972KB
- SHA256 01b559e82bd4824dad7ab02b07cfbf946252ec1967257b708fb080c3a23b6bac
- MD5 3154f77cb42433a31f54ee798c1ed9ca
- SHA1 54272a3e3f948647d2b2e5c26bc32d9c54674779
- SHA512 5e0517768938841f89768c0f61c1f0c60d8bf347413727f05e23909a4264a7040aa7ed6f2b65363b465bf5189c53804face5f1d4721670f4c37531b6b2434a7e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjN+:A3k03kHRJ4
- TLSH T1FC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 972KB
- SHA256 b7def4caaec2c6bcb030b0b07d8383e4bbb4202170806fbadaa798bbd48492be
- MD5 ea765a678e8dbe716d4cdf0acea551cd
- SHA1 33f5be793e620c85246e6a0de8a21bcc5c466a83
- SHA512 1264a42c84da4f5bbb8752a1f9da15c9072d30d06175014196ad331e56468084d7f5d06d4d3eac45ea2d70abf3e1e239840e974be972b2a2f33258f435c6b244
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqj7Q:A3k03kHRJ4
- TLSH T1DC25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 972KB
- SHA256 17da10195293694d577b324ea5ae8d05f302027f3f400f7a05d5f5d4e758fa40
- MD5 a54193c5c7b8a0a0b9498803bc5c9d3b
- SHA1 b6e846a880bb77377a61b9779e0459b5e372a29f
- SHA512 2fd23d9376c7573cda67d63b427f97377495a516a4da24c57da7825d279291386459c5d4d326e5798a97338112e6f844e20edc2c34d109b4191f467db9294057
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjwX:A3k03kHRJI
- TLSH T16525AE13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 972KB
- SHA256 0e3e7c040e18167431c86b1c54b3a91faa377c105fae7657409c1c04e04a88aa
- MD5 1e642711525b389cbc3db3c82b725b87
- SHA1 f0ba3c1414314a8335d1cedb1269fa682fd58415
- SHA512 edf555e9dc386c8ee75ed70e4d9ac5d987799d09dac35c455f7c966e1fe895d5b1eb502a063fdafe27be6ad9c55eebbf5af08851cda81d5b2fa3fc62b3d0f913
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjGL:A3k03kHRJa
- TLSH T14A25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 972KB
- SHA256 2b1dd51da823511bd30928bbe9b1cf350e9b3420ba9bb9c3ab4013ffb29f5e5b
- MD5 0ac218494a291d8e27f97ab958d0b14a
- SHA1 25005861993f0e57b7e40868d4c08b7c839be6a5
- SHA512 a2a2a3ff2d548acccbd78fa0de8f72865c51bf89b3ea0b4cc627c2a180db42b530cfd9c33dc624bf9cb1e5dfec6b762720809d31a5d6af2d1ceac08ddda6fff9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjaM:A3k03kHRJ3
- TLSH T1D725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 972KB
- SHA256 1ae649643e60d31e86807830bc3370a29c7bf4ef958e37c30240187be265b238
- MD5 4d86359505756fec3ae65b1ac2f22cfd
- SHA1 571822a8f0799877ac04184ea248b1277dd342cd
- SHA512 d81e0280d101bcd55e3812a90c37305dcb5d5c966228d43b79844a6bf0a7049f857c558a3711e30077d047bd311c372799b91d6d02511d88d7f75a25be519867
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsccTCWaqjLh:A3k03kHRJp
- TLSH T12225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH