Analysis
- max time kernel
128s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 16:07
Behavioral task
behavioral1
Sample
2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 940KB
- Sample260817-tktlfsvvct
- SHA256 a0dab59e3c852bc16af2533b81ff78144bdf79d989cde7c383d40ad15ccbe25e
- MD5 3acdf11a6288b50dcd42309bd04b28cb
- SHA1 a64695a68d98a733b91e64766843b274ebd87582
- SHA512 f978f7bec61a3f83fd5993d9e4c849fbd608326ca63001bf39048e82b2cdda964c355885f8e37a29aa37470e94f967538bf26612a86632ca79f36560e380c50a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEN:A3k03kHRJARJj
- TLSH T1CA259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/2128-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c46a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2420-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2128-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018992-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a6c-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-296.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-447.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-533.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-606.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-712.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-768.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-830.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-861.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-984.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1015.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1110.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1360.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1407.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1409.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1491.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c46a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x0004000000018992-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a6c-259.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-296.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-447.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-496.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-533.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-606.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-633.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-712.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-737.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-768.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-793.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-830.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-861.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-959.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-984.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1015.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1060.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1091.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1110.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1147.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1160.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1185.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1192.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1229.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1333.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1347.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1360.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1385.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1386.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1393.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1400.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1407.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1409.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1491.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2420 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\7zG.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2128 2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2420 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_3acdf11a6288b50dcd42309bd04b28cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2128
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2420
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 940KB
- SHA256 a0dab59e3c852bc16af2533b81ff78144bdf79d989cde7c383d40ad15ccbe25e
- MD5 3acdf11a6288b50dcd42309bd04b28cb
- SHA1 a64695a68d98a733b91e64766843b274ebd87582
- SHA512 f978f7bec61a3f83fd5993d9e4c849fbd608326ca63001bf39048e82b2cdda964c355885f8e37a29aa37470e94f967538bf26612a86632ca79f36560e380c50a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEN:A3k03kHRJARJj
- TLSH T1CA259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 969KB
- SHA256 550136365c36b75790f224efdec837c22d999782f6c7c686798c5e53477f6176
- MD5 188e6562bc389048f0a9880dccff7452
- SHA1 a69013701713bdda841ae535b22ec9e9bf8b46fd
- SHA512 c47595dd705684a3f63a1c48188ec6fedcb45e44494554f6326480d1563528c72234c71fdbe04a6369d9d6ca0fb62fce8db568bc7ee1f0936a091c9730c8d3f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEbP:A3k03kHRJARJt
- TLSH T151259D03F79900E8D15AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 b04088a18340394d3bef32ee9a7ee50845ac0c268236a77d7eec94d88d0fc628
- MD5 9d1d7154b06fb3ae586fa309258b538d
- SHA1 76880aa0f77d00589eafe8e48323371734870765
- SHA512 cf5ba11f8cc1eea7d8057298d0a60223f9a76b2efd068800aa78a0aa633e6f9f857c0ce655cd0dbb8cb79eca8c8e871a6856df04e7b229e4065a5e558ebc9e78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEZ0Le5ji0hmxNrM:A3k03kHRJARJfPji0Aj
- TLSH T16D657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 954KB
- SHA256 492f6d7e3a2a40424349b24c4d207dac2732ad6c6c662215428985b9a6272c66
- MD5 505a8c9007847de3c870bcfcb5984596
- SHA1 5fbff2da8ddc6e47cfeda440ebfbb13fffaba9be
- SHA512 dd2a1255764e895ec6d39d5854a2648561aad4fbce0cc261d0ed014cc597169b9a8aa7486064057e474d05d1b6a6cc3a3062ada7afedbd8e414363ad8bc8260e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrELa:A3k03kHRJARJ
- TLSH T11C259C03E79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 963KB
- SHA256 8c352573f13a137f0b521a81dbaa655d6e5aedeee3c30a14fff6313e95fdbdc8
- MD5 16bfbed09449a89708f7ece2d9d95058
- SHA1 962f5d5fadf51706fd2dc4964c3685c0d6567774
- SHA512 afd836db530d1512c945141185d61c4d1aac630a73da1b227dfac860c0c3976df13e4412b69a22f733163ccce197bfffafec1fe7847da1f48edab9ea7a03d70b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEzZ:A3k03kHRJARJT
- TLSH T11B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 963KB
- SHA256 24cc6a8ea7f81c9eba7b015fbe70522f64b6eb3b6003decc8f0a680887e34cb0
- MD5 6de6bc9adcc38ad29ddc9d0c3d2a87cf
- SHA1 934a4719f51f56610ddd32677923b33964608cde
- SHA512 f47c74cb6fce2b37b2ae78491bc43052260d37d68162060a88d00b626595b8183b375ca8bb44af65095250f0a8b6279a14d7da75e76664e5445fdab983092168
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEo1:A3k03kHRJARJ8
- TLSH T1D5259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 963KB
- SHA256 e6b8121781867820d4f69092bc35469a608bd352b1fb499b7ad88593472929ab
- MD5 a91e891fbb27481a3832046568e34830
- SHA1 1e1288bf70b962ae0fadee8625cd6abef3c9d042
- SHA512 4a5722e4a3b4c9e89c1f05604342f90dc3de42d6c2bdcaedf922b31c5ddb2abc3e77b927c229672d77d50ee400ddd239c21c0b0212a1a532913b656076c31ab5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEK6:A3k03kHRJARJn
- TLSH T17E259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 963KB
- SHA256 540324d3a4f24c08fe4124a2d72ac8952fd0a8b1397aebd3f5f91a8340b3a307
- MD5 cde3e779111ce9a072db9e2fb77ef9a3
- SHA1 45144fbd7af5ee37a6d7aa5169377475350853f0
- SHA512 41274195ed8a6c538190d21ac23d87f8e0f81359bf877e5c87ff6289766239438563942b2ef89fc3133f985b4c409d0bfdc81717447477adb934746b3961a18f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEiN:A3k03kHRJARJ6
- TLSH T1FB259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 963KB
- SHA256 9c3d13225c80eb212d0fe4281d4eced152034f749d730f6f345e53ec1019ec5a
- MD5 4da5ed4fd947de3603973e4bc8e6b34b
- SHA1 e26b79a70c1518f8df118e9293304fba46e991aa
- SHA512 fe3de2f8936c100c9fa4910e4ab1c8bea4d14ab9db80d78e51111d9fa0729f2d2dbcc6c72d1ffa7b4c25ab0c508a35c1d6667db0fd1453ea87268cd36f8c8ff7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEYf:A3k03kHRJARJ2
- TLSH T18E259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 963KB
- SHA256 8e07191aa477f78c8aa31e56c8ae4003f090ec842bc0c2ce6b553e71df02adcc
- MD5 8c30e7dd7c457c0d89953df5b11bae50
- SHA1 f567d43bab5e4768a6d40ec07adc30a2a44e3c97
- SHA512 90d60fbf026d3a7e3fd489e2d7a65a6b08e2b194db612f936f3cbe379a690ecd7a169836b981f27e84096948a9b083f26c0e403178f1a2086072614035e2cda0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEyo:A3k03kHRJARJX
- TLSH T161259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 963KB
- SHA256 e2a5f518e1eaa25264654f7f42568904817dae659560885d6719dd93589cc4a7
- MD5 200f6528e73b5816e2e1b530705560e9
- SHA1 b0d7a083e51b7ff026d56b9c95e0bf1a1ebba8b2
- SHA512 26cb6eacb9ddb1314def87b5184185e06b16560a3aef7df1ea912f43d501463d2a9cf313f9199f821c1604143b1314dcfb47fbbaf999c442f78870459dff7485
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEmu:A3k03kHRJARJZ
- TLSH T16E259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 963KB
- SHA256 718c65c3de6be72cf3fabbfbde36658b1e997013e4d55359303bb6d7f2dec58a
- MD5 fb8152aef7226a1399563544217992e8
- SHA1 b4fdb5daf374ef69f5b77efc4091f133634bc22e
- SHA512 9dc3aaf3489eb629d59792c24bc3270726d8856f16af548260676969a11f11e4dbe6fc33d64238f5154be3ca2add1731bf9ed0453f2853dc156606353bf05014
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEa9:A3k03kHRJARJU
- TLSH T14B259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 963KB
- SHA256 6f25a343f3961ed1beb1ced8fd0339bf01c9263e037dd20fe6f41b54f93be6a6
- MD5 20bf9379dbf17ff1d495f9d60e21ee3b
- SHA1 bef5030b762c62655c0181d0429642e79dff7442
- SHA512 bc0ca0cb5e255b7f4585d3f3c382277e446519f0774ba07a8c8dda9427f30400807dda6ede2376a8015d6e25ecbd2a7311ffdf77c81a118cdadfe96801ed0320
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEac:A3k03kHRJARJ9
- TLSH T1AE259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 963KB
- SHA256 9f9d3366a46855f0208ecaf4ea37aff5f17734912f764df11b6afb368086c9ac
- MD5 2f23fece59e0c3a28fedb737686e1ab3
- SHA1 a5e5e0f940685bf1ffc139ef775130d99353d510
- SHA512 d89303d601e8ee97318c03623366cd75988275ec9dcf083d7908234f9dd60a62a707f2a7d80636036ba6233564d2fe15b83d2d3c44eca88e4b005a779fec4e99
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrETp:A3k03kHRJARJj
- TLSH T106259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 963KB
- SHA256 1dc2033e3776f8905959ddca2175a340ea03817362c04f51a874be6581f5b240
- MD5 8beb6087f498a4bd1c38e6e68a7fb581
- SHA1 107c35936f5fb6ee019623cc2e979e735a8e71b2
- SHA512 57ae3ad2dba92c8ec3cf3e3ec84fd75f0eb4179c037f127bbe933c61ff29b2ac4a01ce62692bfb1c2d332f9bd6e4ab1d5d3d1268613163d6b9dbaf0526139daf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrE0N:A3k03kHRJARJY
- TLSH T194259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 963KB
- SHA256 20c68380d447ffb5531d97754b1911d309e5fe1cdcf7246bef15c8c9774ea86a
- MD5 24d9d0d34492cf1d704f1ff784147b0d
- SHA1 17eae9db0e0486a10deaf45f5a2ea2ec505de539
- SHA512 8ed662b9071a40bb2d83753442faa303fc13e74ac2e96a896dc675890b087f149f19ecd29c959726ba081738e21244d80eeda78645808f3b3cbbecafc52184de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEcF:A3k03kHRJARJu
- TLSH T1B0259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 963KB
- SHA256 c785cb79c5ba36113fc5d64a79353a64fba7b93605c0d91ac3a3addcce634a17
- MD5 1b4fba48937518558582d8c4f637f362
- SHA1 49fa9defb096b5a6e7ae35abbe140de0dae248e1
- SHA512 724295518b64e2c3bed8ea5362930e85670c15689e187b23152023df8c5367dc4399c48a6932e6f381e120173311f46a8e16072c054ea6844efc2b8b5bd733b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEJC:A3k03kHRJARJK
- TLSH T12A259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 963KB
- SHA256 d7db25be1e1a09346f64ef81674c7acd3f41b8a2cf29a125db9817c3ae77ed9c
- MD5 defc6856638ccec51407ef8f2603656c
- SHA1 31565be6289d94a5347251dfeb0f3668b45e90e5
- SHA512 72d7301f3d7d7f98c39a38ea02f92e0d2326ecb6c407d21545421789f13cc967772ea36df7d787624a9491d6c84366742f697f4cd31cc0c040ffdacfea95877b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEqw:A3k03kHRJARJf
- TLSH T1B3259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 963KB
- SHA256 854af5ec25126fbe6c3fdb1917c28d99d79a1cb031c585e6892bfdc90af8c1cd
- MD5 6c5b6e183ad3ba9dbf8b27f03bad39a8
- SHA1 4bcd6a86d36533c1bb67e2554a305eb25f7ebc91
- SHA512 343de0e26279ed8f9846f63e5f29853e1c06f5de6d2865324c029b9c14288344b2554c744aef5a98a98fdc24f33dca5172fe394522de640ff393306ad88b3a8d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrExT:A3k03kHRJARJ7
- TLSH T1AA259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 963KB
- SHA256 e8e5875cf7506aed8779fc2495435486d1bba01a3a3a49b18e9aff575216bef3
- MD5 676e09cc1adb45301c7963fc0bb922a6
- SHA1 90abb091abd5fd00188f2009413ab2a9e0f9459f
- SHA512 941f053cab0f4733efe7d9341c0a72144fc05fbcf9f28463bdb6e6c1add13fa81c6c1d9b8e67cd35755b00dfc15e716bb437cba4336173404f3edf9332fab179
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEfu:A3k03kHRJARJ8
- TLSH T1F4259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 963KB
- SHA256 ee87ecd75ef4243af83ae8ebf9168f18d6b06178fa1b29e858d0876ae0a3ce5a
- MD5 728a969bbf7ea156cd7e3dd9d6efc14a
- SHA1 42ad5702c0803f1f778ee3f3bbf2fbb264311bd4
- SHA512 e022958ff850b18667f3e7e0c9a41d12c9535b9330a5dd020bf869be65c0f11841e42fa346030c7d576bd44e39f2b1d2e3ee705734057a13280cf5d84e9d1721
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEDb:A3k03kHRJARJV
- TLSH T101259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 963KB
- SHA256 2eee912f225d69db3afefe9549c708f161a89999f208bb6acdcb3fdc4db7c2ab
- MD5 b481e103c4c932633e4cfe8f496f6199
- SHA1 3f7641d6d273eea64b71a3d3d1837d69bc626a6f
- SHA512 81abcff237e63f93005ca6d44735e1824b0f3fdd6ed5d485da3a8a59248ff7faa1b5f3cb5ccb10a93d6bf0da8f8764ac968e819e6fd9d5150ebdf35185a24089
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEXf:A3k03kHRJARJV
- TLSH T152259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 963KB
- SHA256 a08a66f5d6bfe3209af4149380b190a9e70c18fbe9d21c9e2f50c40ed99ae865
- MD5 e4b4f7333081aac36c3a85986357183a
- SHA1 b2d4599c545144a07dc0a5727ed51c3ee2f3432b
- SHA512 3db6ff86a2c2a045791a9fb66655b276ead7905065b95440f650460bcc029fe1de15dbdd4ae34882d3a3e7a1ba252b4752df2a1b9e5c16b02138462bde24be49
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEgK:A3k03kHRJARJN
- TLSH T12F259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 963KB
- SHA256 186ca7aa123dd8e56271d39e3b9bd6c8ee0a843d0c90bb41a30077f5548884bb
- MD5 73435f87696f9d2be77ba8dd6f940c16
- SHA1 fd124c16b91d7d76ccc7955797a200f078dd1aa2
- SHA512 e7674f4631d27c9349ca646b473daa4f1c5b5769c4fb762b409463237caae865695bae06f524f0e55db0746dc8536bad5abf2be90ce81bb472efabb2444291e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEdk:A3k03kHRJARJk
- TLSH T104259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 963KB
- SHA256 b6fb91b5968ebbcf09b148ab0635fe63515ef6771660929cb6aa3943c0b300c5
- MD5 2eef74acc6f4e3da2b584dcd8500f85a
- SHA1 60ffbd605e4aa511a44ac15be58a0f21bc7365ac
- SHA512 81cf38a3e3f61f1aebf24de4a578e402b00fba73e6d19e17f3d0c056269c67a17cc0d5ea3d9b7744e100be0ba653647e8cc4e022502b4f312e6870148c7f8e8a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEC0:A3k03kHRJARJN
- TLSH T111259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 963KB
- SHA256 cfd96ed3280c1d235e8e19e2b45b75878b63616fd48332e520de735956f85318
- MD5 d64f27718026838daa7637cabec3ed55
- SHA1 bd00cd449d92ebcd97fb0b6a61533e75a4039546
- SHA512 913a97aaee1226a4c13d77c728dc26bda757f93b35305caef9fe18763757ddfcceb2a9dc8af60b14d9d4595ff2930599ac0dcda74b9288a1c2cd6b8ef273f599
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrERg:A3k03kHRJARJ8
- TLSH T19F259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 963KB
- SHA256 4371b7d06cb9d3cbe213e99ffb51357f9676f7ec25db14c211fdbc44575bc311
- MD5 c77db61ece07d90c3b05ba443684ba3a
- SHA1 73c14c10801946e0027a0390fcb6b82ea8777ed2
- SHA512 8bd3877027df3576f316e358635d4343dba1be0076a0da7683628bc48bc9bfa40bf0d1d0717f51cce24f1323059ed0ce54b1e3f624f63601eb430a1ca11d6782
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrE4r:A3k03kHRJARJO
- TLSH T1CC259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 963KB
- SHA256 104ed2ce6b1f2e4c75c3484ab6950e6020d32a959b92283ee2e77c2c6fab0652
- MD5 a9fd40acfab080b3c7119d24add110ce
- SHA1 6d59fe90d9412f5f6cd5d0e22a9fe4356d910e9a
- SHA512 09ce78a3b4396ff5d44add34fa3e7975a24a09208564e70823b339193c9c8a91306f9e58f6a19b1d5c924939c4b48bb925a8ddb8099ee6d0c5e9481a50624ce0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEWn:A3k03kHRJARJ4
- TLSH T1DA259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 963KB
- SHA256 280fc01507004f10c8aa732cf18710270a6f41c6fbd00d9abdf979bcb073244c
- MD5 73448ae19d2eddfe49083edc100147d2
- SHA1 1dac09c5084a42050953f1ea0994390219e6734b
- SHA512 7455365450da12458cc8e3d412173116f519b39830e1ba52226848882d7c2e06eb9f7ef9fedc9678cdccc311f4d50621178fd1d93d454abe14b033d2ce239e4f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrE8x:A3k03kHRJARJu
- TLSH T106259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 963KB
- SHA256 5e93929cfcdcbc09b16888a3c47e3f0b7590227748e3753090c597bf1d190c0a
- MD5 85c22bb87940d42878ab4518963d9331
- SHA1 301c001f1f910adae0f1b75c6401ce65ab8de2d3
- SHA512 92c021561fd10b87d235f97cbb92395ccb524f8985a4c4601742f03de12ef39305bea405f5c679e9d3dd438cb73138a12c6170dc4d357e28e3c6b25020c9da87
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrE2A:A3k03kHRJARJl
- TLSH T143259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 963KB
- SHA256 60a3c01f0f8a5af7e3f7353e8a1fe901e09840c05c9446d29b2c8ff7eb87ba4b
- MD5 b819187af78b323863bd9189e818044b
- SHA1 cf81a467836cb7f7beb327753a43d2fb3c83f215
- SHA512 f926533ba37c6e462559b5a06dd62e39ee712e2923e0af264ce21c922c30300f30a7e7cca41ce26c32b8e5e82d180f92d4fdb17fec12426dae85803510b5826f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEv9Q:A3k03kHRJARJE
- TLSH T100259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 963KB
- SHA256 f7d94e24f74bc4cd0b20f8aae5a5907effc5dd896ac71c26cc563df3df99da25
- MD5 3cc6e035c3e6e29e1876c0662a04caa9
- SHA1 edd9be49ccbeafc4492d93f9cc227babf08f67aa
- SHA512 46355bacdfeca321f0d49a05d8bdc294b9636c40b43164634aa20b23938c2e472956aa2a48e3796db1a4788697a8b1b744e7ee9f675d2a8c966de97289af7ec5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEG4:A3k03kHRJARJv
- TLSH T17A259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 963KB
- SHA256 7677e5bfe7d4190dc6c65167233147b7bd2204beb1a916093720adbe8264ce5b
- MD5 a616a4dff2f53bbdf5812f72789a9f7f
- SHA1 c8f7978622d982d663667f53dc5c738918deb2fe
- SHA512 776b240d6d25e87b86cd2c664d97cd263f36b965eead7ed42a797054ea5953d1f150fd7afc37c5e4a147d6ab6d6142b1e232609371c83e841c43fbb001199364
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEVu:A3k03kHRJARJi
- TLSH T147259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 963KB
- SHA256 7334fcb4225adac45562ff59ba43813560402f6b05477ec67437975af18e707b
- MD5 8e0797475bef574ae7c7a5c06d63673a
- SHA1 8ae045b0e45d15474166455f27699de2e48f6419
- SHA512 f7bcc931764411544520664c16bf9b737aa5496dc3e50da9106ff4de49ea6fdc394539d9f9454a73a54f4393f20521627ee42927e4219e2970dcbd367caf5aa8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEIj:A3k03kHRJARJ8
- TLSH T19D259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 963KB
- SHA256 b09fc439283f992232bf9f74a2f5c4b57ae1fddacf7264f801afd9bf5d89efdc
- MD5 2a1839503471652eb684a6056de2cefe
- SHA1 b76335aefc6c533504524cd7b6e2618465f43f65
- SHA512 448d42049bd81362ef4aaf9eb9b36333387e71ac4d7a458251e1edf2209c46c5c0e67e85527ce42aeef2c4bab03f2ed12f3c147cbc10be483246076c49404d3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrE5g:A3k03kHRJARJ0
- TLSH T144259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 963KB
- SHA256 71043e8749af37c8975f4a43c4107c1fb108321e4145881691b496e29cd7a00c
- MD5 521b2e6a6b809e834e376aa355caa191
- SHA1 9ce9c397d5c641fde1ee4ebba04664cb4a859ebb
- SHA512 67b6a49c766c69aaa356773ecf9103b6cfcb64622d043d504024a49a50c98fd891a6769c3de240359151696abcd07ede9bf39ab82e8021e7e2ab1650b4003ad9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEgI:A3k03kHRJARJ9
- TLSH T1AE259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 963KB
- SHA256 7258aa404c06f6e8e989811c6581ca41d1b63754fa55730b0cacfa05b3cbde20
- MD5 0af9e16b23641c8d2eb7b045ac21d1ef
- SHA1 1e71d3a91533c74c6027589cce79f6acc66cd2af
- SHA512 662b175609ea232495d4417a066f01b67af465e31c4a58a81300a2e6ed609fcb53a4e227e1065edf5bf68c686b3aaa343a677480bf7daa289e3889fc0913933a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEio:A3k03kHRJARJb
- TLSH T11C259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 963KB
- SHA256 aaf844f4818f316a89fec92f4a158758f5224f0ca53fd611e50c32191ca174b0
- MD5 51c7cfbc758bbd423d27d61b8942fa80
- SHA1 38574955dcf32a8c2f592596f7f35efe51c0c6b2
- SHA512 0021a1afbf518bb9af921944cd8731be56fc65567a68de314d0e012a69756756e9dfc67e35034727a85d5b3424efd9e5b1f99b7e10d586479cbb61d4a1ee6943
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEZ+:A3k03kHRJARJ+
- TLSH T179259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 963KB
- SHA256 1616f79d14831296d65ae293d9325cb45bf47c6f6a55306b606d361dbb6e67e1
- MD5 518fb076a6b3b93df6c904e18b7424d8
- SHA1 d36f7c1b6519feeb024c22a2cb82e9209281a3fb
- SHA512 9aba00b912cc3860ff33622c476589bf643e6557a83203326c8383539f59aa90982e4eb9ea5047e350142da0c639f57fc4461da71a199f48264b731770277208
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEHQ:A3k03kHRJARJq
- TLSH T152259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 963KB
- SHA256 552f85cf0b4fc3abbb65da5350522c067ad6a664c0f15fd0c10dd13f436b51a7
- MD5 cfb93a7ed7bd79bb294b5e7488b4a8ac
- SHA1 e3b0da16e96c5e4cb047510887494b067cf74976
- SHA512 104c5671f11373fb7f0ac8a3c40910c4f3ea4b53ae78edbf2eb40466e938869329dd448db09338177d67f0e42daa0f0ccab6d71a734b2a6d561854de24401d3e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEcX:A3k03kHRJARJ6
- TLSH T197259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 963KB
- SHA256 71e8e2a1a79ba654de3aad6b87d3ffaf4c4dfb906d6c0da70d6a87c963166493
- MD5 00a11be657cb5a39967356ac981d3a24
- SHA1 8374b4ce53857cad55c8d9e9b92646102aac0e1e
- SHA512 aabb0fa192153bcebfc34929bc87fc86d649778502f81d7d99874d386ebd821472774a519a2b6bc4c87942b94409a3630854ed8b43786d864e815e57fbe1f830
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEaL:A3k03kHRJARJU
- TLSH T1C0259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 963KB
- SHA256 0f897348cc21933f7f8c1fefa48e7b73215f9516f2ed06314e8fe88f2ac6ea3c
- MD5 1ae6217ca33e04f58a907306567099a1
- SHA1 3405db8b2d1942c9c7b7b329c986e9c8269fc055
- SHA512 ad59ebf5312aa153ae1aad204bf26a8de5b4dc8665f29b07d81ef43d8f996de683c47a35d8a3586dfd8b9e817d52e3cabaff56ca02e885cb865307f209f21547
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrE+M:A3k03kHRJARJ1
- TLSH T152259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 963KB
- SHA256 d0e5a7aef30a20bbaaf56a3d420b8489fc5099a06110bad0e472e48862d8671f
- MD5 945923b2094498db341787e2d00e82ff
- SHA1 36f4a8abe94d0cb0dc4b326174e33321f7a6ac22
- SHA512 febf2e657f1b21a8da5aee6f20532c922c0abe7b59f9630866d1b2d58b6406ab56721750168b06dabd492b4e0eb9ab877c2288ea0c87ed78bcd1f635f27f7be0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFbasyrEnh:A3k03kHRJARJP
- TLSH T18F259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH