Analysis
- max time kernel
81s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 21:51
Behavioral task
behavioral1
Sample
2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 930KB
- Sample260820-1ql7wsbk21
- SHA256 f644ccbb731957dcb447c252818826de75bcb021f995ba833fee1eedbb0650bd
- MD5 60917f56668b6d9c11902aa606f92715
- SHA1 00e6c3c016fd541a60004bb56c2ceae575cdb8bd
- SHA512 05640b1dad9fa06d411bcfa9afa73ea55b7cf465839aa7939a44b5c0aec2701653625b15c6c91963e9d781f23242352b9803269e629701c2ef572b5e617c1904
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35E:A3k03kHRJ+
- TLSH T17515AE03EB9500E9D10AC174AAD69A23FB757C56176093DF2358C2152F62BD0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral1/memory/5360-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000246ab-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1820-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5360-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1820-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002366f-167.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202bc-223.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002366f-267.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c2-382.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c6-479.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b8-504.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202cc-583.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ce-620.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030b-645.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023673-730.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002030d-749.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020311-792.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020313-800.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000202d3-832.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00120000000203f0-863.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126d-882.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002126c-895.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126e-902.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-915.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126f-940.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021271-959.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-990.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021274-1046.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021273-1059.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-1091.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-1110.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021277-1147.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127a-1160.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021279-1185.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000246b1-1192.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127c-1229.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127d-1332.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-1352.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-1378.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021280-1385.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021283-1386.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-1393.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-1406.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000246d0-1622.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000246ab-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x000200000002366f-167.dat aspack_v212_v242 behavioral1/files/0x00030000000202bc-223.dat aspack_v212_v242 behavioral1/files/0x000300000002366f-267.dat aspack_v212_v242 behavioral1/files/0x00030000000202c2-382.dat aspack_v212_v242 behavioral1/files/0x00030000000202c6-479.dat aspack_v212_v242 behavioral1/files/0x00030000000202b8-504.dat aspack_v212_v242 behavioral1/files/0x00030000000202cc-583.dat aspack_v212_v242 behavioral1/files/0x00030000000202ce-620.dat aspack_v212_v242 behavioral1/files/0x000300000002030b-645.dat aspack_v212_v242 behavioral1/files/0x0002000000023673-730.dat aspack_v212_v242 behavioral1/files/0x000400000002030d-749.dat aspack_v212_v242 behavioral1/files/0x0003000000020311-792.dat aspack_v212_v242 behavioral1/files/0x0003000000020313-800.dat aspack_v212_v242 behavioral1/files/0x00060000000202d3-832.dat aspack_v212_v242 behavioral1/files/0x00120000000203f0-863.dat aspack_v212_v242 behavioral1/files/0x000200000002126d-882.dat aspack_v212_v242 behavioral1/files/0x000400000002126c-895.dat aspack_v212_v242 behavioral1/files/0x000200000002126e-902.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-915.dat aspack_v212_v242 behavioral1/files/0x000300000002126f-940.dat aspack_v212_v242 behavioral1/files/0x0002000000021271-959.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-990.dat aspack_v212_v242 behavioral1/files/0x0002000000021274-1046.dat aspack_v212_v242 behavioral1/files/0x0003000000021273-1059.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-1091.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-1110.dat aspack_v212_v242 behavioral1/files/0x0003000000021277-1147.dat aspack_v212_v242 behavioral1/files/0x000200000002127a-1160.dat aspack_v212_v242 behavioral1/files/0x0003000000021279-1185.dat aspack_v212_v242 behavioral1/files/0x00070000000246b1-1192.dat aspack_v212_v242 behavioral1/files/0x000300000002127c-1229.dat aspack_v212_v242 behavioral1/files/0x000200000002127d-1332.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-1352.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-1378.dat aspack_v212_v242 behavioral1/files/0x0002000000021280-1385.dat aspack_v212_v242 behavioral1/files/0x0002000000021283-1386.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-1393.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-1406.dat aspack_v212_v242 behavioral1/files/0x00070000000246d0-1622.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1820 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5360 2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1820 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_60917f56668b6d9c11902aa606f92715_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5360
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 930KB
- SHA256 f644ccbb731957dcb447c252818826de75bcb021f995ba833fee1eedbb0650bd
- MD5 60917f56668b6d9c11902aa606f92715
- SHA1 00e6c3c016fd541a60004bb56c2ceae575cdb8bd
- SHA512 05640b1dad9fa06d411bcfa9afa73ea55b7cf465839aa7939a44b5c0aec2701653625b15c6c91963e9d781f23242352b9803269e629701c2ef572b5e617c1904
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35E:A3k03kHRJ+
- TLSH T17515AE03EB9500E9D10AC174AAD69A23FB757C56176093DF2358C2152F62BD0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe
- Size 1.0MB
- SHA256 a2be4a4883ac9cf6782e90cbfca90ffb355115ae21fbea9663b333064bd59a24
- MD5 7d04aad5310b4343075d53d86797b68d
- SHA1 76f9c100cdb41e2bc42b1e93cabbaecb44237ba9
- SHA512 c64d2859336000ca33f45f977e6a9b04caec08aa44dfc86fa7f66b55761c2bb454ed9676094d97543afcd2efaf608f7ee0315fec0a42a9ab6ad15fc00f041aa2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35KTjE:A3k03kHRJCw
- TLSH T13335BF03EB9500E9D10AC17496D64A23FB75BC561760D7DF2368C2152F62BD0AF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 fbf8cd34d39f9790f6311bad1c1be48972c18685c8f4caf9151a4b2d355b0c73
- MD5 00e13d89776b332c74c19f71ffe47a10
- SHA1 dad0058ace280ec9c6ad09eab6b4893349d70600
- SHA512 984fcbdc488c7735746592892a4b95212e063dc17d98a29eb8fc59bcda56b08520b89d4772bdd5723564aa92667b32b9ca82ab875150e7ee9cecb3fc4db89c30
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35m0Le5ji0hmxNrM:A3k03kHRJkPji0Aj
- TLSH T1DA658C17FAA402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.0MB
- SHA256 86903cee650a2e29f17965c76686f8fb84244135ff23e7fba2c3a1c480b809a2
- MD5 55583109d281fcd2efecb8b5ff1573d0
- SHA1 b6d0c6e6b91ab7f0ea0ce01e813288f980a6edbd
- SHA512 d85220d478cd58d8fc4d283463b5ef274d680bb2d8cf4f1fc43cb5861e2a36e899e9dada5bdaf08913d9b706d83be58d6fc84891cc2135ce61de40f552dcc265
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35PD:A3k03kHRJp
- TLSH T14B355907E69400E8D10E8174D7964A22FA777C5657E092CB23D8D23D2F62BC06EFA797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 954KB
- SHA256 4dbf5c0e5356e27322c9c078091258fc1d7a79a70c08b9773eeb9d593e6ad705
- MD5 48166f1e5fb58150377b8c54e759c21c
- SHA1 9d492495930aff10dd36a0e725dea6b8c4989bdb
- SHA512 af1ea920457a93685d186826b8fe78ea8100b2cca370d7b4c57da2e7c85c9d4bae3bf224b79871d61f788ead6a35196e40a7fa5bebc9c44573d9025b4b3e2f8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35J6:A3k03kHRJS
- TLSH T18C25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 954KB
- SHA256 012e89c05919cebd6552cbcc8a62b7ce4aaf7073d7575ac862e98da808499e0a
- MD5 64374b9807bc1491dac706a55396aedf
- SHA1 7a7ae4c0b22304fdfb20ad09529c9ce89a8fe6b5
- SHA512 19fc339cb32600ce220385c8b8d676c9c06d1976c65ce07d38e115a1b5f4724b5904b0c20c2916d986b11b2830e711ef9340a730864d80a879fe091ae16d7326
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35nN:A3k03kHRJ7
- TLSH T11925AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 954KB
- SHA256 3351c569bde80bd30dfbc55040e8171c54bb2264bad03f092f0f79d9cd709bae
- MD5 de4393c5ecce0e5511e1b0cb9c22007f
- SHA1 e5547c37dcfa74d09bb795c6e7154f0e9a013aba
- SHA512 99cc9785242d3e809e565959924b108c1b960711ebea0061e3ab2469bb324cf81b6bc35655be99bb6a62e8a9f9fdbc997ec764e38a1f086d9505ae4cf6c95e89
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM359f:A3k03kHRJf
- TLSH T18725AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 954KB
- SHA256 8ca09e765efe990dc5f07ff4a1195b7fd0ff902db03e1052593e1a3defd95ef8
- MD5 ed012e7ea2805c1d9269eba916af06c9
- SHA1 c155045b97d295735d2eb5979a12ab82f91274cb
- SHA512 8d7d0d92ffb751f7d2c0fcfd6ea768fb80b9cabc87e6fff9810f3ee56fbe041c2979ea21c9875378443814f6138bdc523bc38ad480a1bab969e56a8132759870
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35/o:A3k03kHRJW
- TLSH T11625AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 954KB
- SHA256 a02a4ca52be51b16dc833920af752b0e4d604f82ba278289a4b37d515e1bf245
- MD5 b2d6a3fcbaddf28dc781c957fc680884
- SHA1 2dba3e019e78da1856b5b2e1ad61098068601375
- SHA512 51c7d968720ce6f7afb7c4702f51833d1e861b8d44b33389301eb58f2082a7bf3167eefb224b919a78f546d4a3583fcf3d9d50e6d2e3a8546a4ca3edfe948f58
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35ju:A3k03kHRJA
- TLSH T17C25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 954KB
- SHA256 985c00b6c196a9a34cbef91264e223ab767aa6d9af96d5e6a68afd433b47633b
- MD5 0f3ba5b5dce5d428693500c3f514b92a
- SHA1 f10f57c23091ac57eaa844d40db328a40ca213b0
- SHA512 80db5fef22b89184e6d433a5efda1a38494fc6331833411b39931acc0921aa033b52bbb4ed72b8caf2284cd38c1a27c93b885fa84dd925e331bfb7c5c514c415
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35R9:A3k03kHRJ1
- TLSH T10425AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 954KB
- SHA256 378cc54a3d3640d07acfeeb1cde01deb3ed1a741deeda9e503773d344eb7ad7b
- MD5 4844958ea970c1176e3d30c365332927
- SHA1 5747cf074989b32d9e40d118f7f40a61a8fdeac1
- SHA512 01bcc41db34b66ff6c45b027ac0bba75cd70c94bb25aaecf303553b24634cecf2aebeb25232305d0b107fc1d6e7bd6f59d4a1a62f341accdbbe69f01365b0d54
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Nc:A3k03kHRJw
- TLSH T1A125AE13EB9500E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 954KB
- SHA256 e16e8a97b5b2e4dfbc84c1ad6de51cab29451e2cb9d9104b6abb2feaf251c01e
- MD5 1663a4e58cfea24447209b9065eb2053
- SHA1 cfc33c09e4f035e2d541c4cb0c97c7ee94edf0be
- SHA512 5cbaad90f110552f2b327ea3b95076926def0a6fe03d5b28056bd9baf2a2e43b7e474f8067c2bf1d626dc8180cad6fefd1a42850f820ffc44fbc53d2e88ef545
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Wp:A3k03kHRJm
- TLSH T1C425AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 954KB
- SHA256 fa67806980cdf3c21e8d1321b3300b10f1349923a7676e4477603373caa0e572
- MD5 8d764dc2838eb9445dcfd2766d66c295
- SHA1 9ce9752d58286584c7577a59b0f4077758782066
- SHA512 20cde9cb657294148a852a14e743512563606f74e26aa71e7b619cc16eeb5666be45bf43fe15bec7ef8f3144a3bfb180e2727c8f5cebbb8cb7c01e683b599319
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM355N:A3k03kHRJJ
- TLSH T15F25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 954KB
- SHA256 4aeff25ecae78cd25fa7a6674a4b1644159bcf2c2d61906af785eeb631e377a3
- MD5 d0a794bea7db72d0e8f2e7d85def03cd
- SHA1 fd9a25c1c613242186d7ce3fe02069e53214a16a
- SHA512 b55bafa0993f91493a3b400165089911e31b570aff8b4c12a30e522df6f25ed6e7da2c082375ea1b069e8682d94cf3a73f7de5c598098e4ad5b08b5978f1d2a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35bF:A3k03kHRJ7
- TLSH T17725AE13EB9500E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 954KB
- SHA256 27affa39e77215bddfabbbc7fa343713f1de62099832449a6be67cc8c2c8ddb7
- MD5 9479bc93ab89ede1a806f4d9656851bf
- SHA1 519cc00cc68c36a8c561756942cfc5d3804b1cd6
- SHA512 18816ee782e930dca2189a25e225a9b937f5a2e56b47c3b91c77ff8260b1852cece47e668916a9279a738b129253276dfd20ff79d83b92afebe1c5df3416bca7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35UC:A3k03kHRJX
- TLSH T1DC25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 954KB
- SHA256 ef86f36e53c68524e1d1297974b671233cab3484a7cc1756cd7530ac950c31dc
- MD5 73e7e10cb554ec781a3479acb55bf3d1
- SHA1 46a9eacd6454bfab9d1ed9ca4fab2359aee55905
- SHA512 57a2fe7fa0bff65cc63471344c91fae019c56153f8860ec2487d0e28122bcac7912333646401aa43d580da7cdf9e5b7868d2bf51ffe6709d13dd62faeac52e57
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35vw:A3k03kHRJy
- TLSH T1FE25AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 954KB
- SHA256 a3967c43356d533a2514316c309a374326f76d93f43b5c42a97b56ecf459395d
- MD5 ced1f4e81a2b616fe7bc63e286a63906
- SHA1 d132b03c8c64e3beeefa89cd1a72995b3bf1d7b2
- SHA512 aa71321e1d660b213b0146ece8cd756b7c2ac76a1fbd1ea9a8a331d49b1ee6d041b17501e87614e15e179111021c7806c30267f6b33a0f9cec2b4fca7aecd90a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35eT:A3k03kHRJi
- TLSH T11325AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 954KB
- SHA256 d52f4f4aa346e5e628df250073e7df927d9c312bbaa0f116fe0b6507b5859f06
- MD5 1d7fbf1ef83ac5f2a908993ebbffae1d
- SHA1 4febf99975a57cd08e2e37544606bcdc44aa00ab
- SHA512 e7779bbbdeb3d102bde12671b47a6f75cedf61fa783045bb00c591df03eb8a6aa896935ecb2bdd547f8b745ac4209cd7cda557f5c1f8615bf59db727eff1b22f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35mu:A3k03kHRJt
- TLSH T17425AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 954KB
- SHA256 7c6ad1eb76516d3bee28954794911eeed266f3a12b16d60d306b5b97147bf6a1
- MD5 79893405f122ce7a06d3c988f5e913e8
- SHA1 117d326260b38e7c46542808c4edc2e51d82b136
- SHA512 da585c483e20c8f924a39cbe5b8d82e11fbb3cfdbe81b0d92ff2769e80775802b8451a1e5a161460bfacee657f1ecde379e6355efb9cb45a5151c446d96b879d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Qb:A3k03kHRJ8
- TLSH T1E025AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 954KB
- SHA256 8f061ab15319f2caf14537c7db76958586153b0735645616a9ebf12b00b49676
- MD5 ba2e4eae3d4b216498b37b1ef80b6c47
- SHA1 76331ecd0587b2c64ff06bcbc1fb1595da9542fb
- SHA512 989fb97c165cf665fbe640a82d7cdc78e46f6f12f8a9fb9421174b5aa8e0aaf92a43ce3049eb826d5e14aa3a84a7a4ac4513fcbd25e62a56c5a6d61451ec39ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35+f:A3k03kHRJ8
- TLSH T14D25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 954KB
- SHA256 fe005f3cfc024c508869d225791e02dc368c11ad8ac68520dd1ab5034b84e991
- MD5 d26085c0e687948a66b08e08cb8f3957
- SHA1 41e83722956245bbfc616dfca7c7e3912c138b12
- SHA512 eb91a5ac7560af8324f409ec5e2227253e0e200df4aed578cff0bd34bbca10a7aab8430e80bcc2090835ea2f29a8c4f4208d7f5508d85aa374de922ff432f028
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35bK:A3k03kHRJs
- TLSH T13F25AE13EB9500E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 954KB
- SHA256 0a61a38ce1b09317b60bfc3608833a9015fa30565f8ccbf1f9ed01d45cb63b36
- MD5 137068c88f2399e9ef857908fc12662a
- SHA1 f3e76f5da6efd1805e34594e2ef9a1eef815381b
- SHA512 681b775861554a80e8e3d13229fbf074521cee141586e98f08f13c9d8d540ce567187c036340ca553a135f8002b2e2181c2b19fa1ee42ae5c0421bd5c54b41d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35sk:A3k03kHRJ1
- TLSH T1B225AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 954KB
- SHA256 d8eda58407e0580c17b7470f9b12262528be4c8da47c76a91d70d63e9367e545
- MD5 4b4600355ae9ebc1dd7880f2c9fdd93f
- SHA1 1b6136a2207361e05abe4de21a52242deaaa6e15
- SHA512 0196ed825b9355c0ff2c5bfe0658cf07fbeedb1e951b40a1061152d76845b3aa8df7fd588ccf21ad9408e7a733f81b05268f981f59683ac99349affcfe4c4046
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35l0:A3k03kHRJI
- TLSH T1AD25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 954KB
- SHA256 32ec90cfcdbe9526ca2bde1ee9078810160c9dbebfdc24088f18a5a4f9986fcf
- MD5 428edd4892f57fbc284eedbce5184a69
- SHA1 41213a550564f894a92a031b94f7b7b4b9638c73
- SHA512 f419840fd2e06c4ed1ae4abd1e6e2a419fc3e40e0f12324ce7472ce07084df3459e0189fc7312fbe57ef21184709effe30b7e24d0bc4d0e5d1d8a404fbbfc14c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35og:A3k03kHRJN
- TLSH T18F25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 954KB
- SHA256 fe08bc951338c5ac5c6a3a5e806fc4e0ceb58def835f68c6363a0279cf7602e7
- MD5 91ae90ecc5a80c880323d58053d4dba4
- SHA1 d411c739f085693ad32531e45e0526e91b91ed2c
- SHA512 eb63409274958a2d3d646507a5ccfacfa3a7d71f64285f9c2ae1518d26b59d5bba83952f96bc49c6a3b87c8228cba7a3b3fc296c36ae91e86927ef5143370863
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35dr:A3k03kHRJP
- TLSH T1A425AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 954KB
- SHA256 94930849228d1355cb4d805ebf2e6b7ed846db254dd5b5053a8cf980cfccc5ea
- MD5 a7665767a9ef83efeeeab94cdfd64cff
- SHA1 7bb395770f365f169acc498b22835e508045cc01
- SHA512 2658b7ed6455872c39fd21d0866420fe86374b3212b47371a3606cd7b99ae0a1eed3b8bd63f0e643c3fee447449ce8d179e8f0c4b35e190ae0e8c76b1f70f571
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35nn:A3k03kHRJp
- TLSH T10A25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 954KB
- SHA256 9c3b626ef0b5ff5e99a8225add24b06b028ebe95947c8495436ec8994823299b
- MD5 ebd0768fc165ec44f0556224ac2fca83
- SHA1 fcd881ede7b9b8da52de2c822b827199ea26368c
- SHA512 d9a4521008c5de4d5de5dc2b16d67b9a9bbb727ed3418bfbfd6cda1d6a8bfcb25badae19063401cb72d552cf0c5dc87ab077665e9856ee9fce363df69f87617b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Dx:A3k03kHRJn
- TLSH T1FF25AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 954KB
- SHA256 56f835283910a8d92c855e3c7f022ed73a68bcdef22dccb6bda560a3b2c0af09
- MD5 6663d64663c5f00d198001ec77b40537
- SHA1 453b9699966e81ecfb94dd45e57ebb7b07493dfb
- SHA512 7be1098430c740398cd5ae2b3b176f4b6cdb983c0f3daa4659d5c86d3b2ce72ebb9da40c51c65ee72f360b3164b81cbde68ada4d8218ea6ac6f12d71ca85bb9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35BA:A3k03kHRJo
- TLSH T14F25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 954KB
- SHA256 6501878459e2380b6d8f044a46d52cbf28283a7068af17b0bd45937b49c1331a
- MD5 9e0741ea54b8c98616a461b2f29d475f
- SHA1 3c53e2fef8d5f98cef9503e40355e871ffc323a4
- SHA512 6333dd709fb1e15f9352b274c13eab41f0288e5ac096e1c1c40b6754a6aa8cd3a7b72a97dec6dd8a2ca2ad8e65cbcc9a641f6491c073780ff8716bcc3d71b615
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35a9Q:A3k03kHRJx
- TLSH T18A25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 954KB
- SHA256 800d604b735b42bd5145e59a1ecc7caf1f21c068247b1d8e19f025764d142168
- MD5 58b23f5eb9e79e138fe6d5c43a1023cd
- SHA1 60ea3a93ed5740138acb0f28ee5b5b66c500f683
- SHA512 64078ed851e06cf02e4c0afb6a02180138e2b6daf9db98401b66f6392984938024cbe1d8ef9c1efbd8c3f8f055d26403733845d2d4f21e1b90ac88c67f304555
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35P4:A3k03kHRJ2
- TLSH T10C25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 954KB
- SHA256 1f3de92e7b3c321a8502be01fb78dab71199b46c226173c5f9bb37a84df2dd11
- MD5 538905658c73e2f1193189b4c095cfcf
- SHA1 1e6af88864f55703bb4b7337510973d8cc2b0f6d
- SHA512 c8de255d7af83a2ccad88bb3bed1d4cb4b405f241c5eb3a7f7d41fe94c24f73b31dbea7dde8b7983652c2ed8cb59a1ded62ede44185d9237f6d1d2eb403f9ef5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35eu:A3k03kHRJH
- TLSH T17C25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 954KB
- SHA256 7520c14476288938292088ad14f2197c4b550c3d455d67677f0af67f372bf9f6
- MD5 5fb9cc8d68cee2c9db2476e28a0124f8
- SHA1 90f3f98d03fa5fcbf9908298cfd79d4b1d8d69a7
- SHA512 b77e2e7a58b835193e0c266d5c36c5475ea1e020dc700a8552bc848f5f09a1e29ab6ba3806d73cce10f7a7b4b2389312e571a381cb1adccae9721fd36b405581
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35vj:A3k03kHRJp
- TLSH T1D225AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 954KB
- SHA256 0c02674c8a6c8bf82a13e432e5ed51c80da4a1450356712446d88eef34304dfe
- MD5 2a5b8c86e63febf8f4f6f6b3db2e3612
- SHA1 149a7c66ba5f730bc9214a75457fe7c75dcb2d3e
- SHA512 d26fcb5a9577cbae05bebf4776ab9953a8f0a39221b0b1151310810c262b5123b7b5f51d0c1127e0e22ce82a684d31539e6acd35d3ecbb2a78f2dc830dd8fea0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM356g:A3k03kHRJ9
- TLSH T1DD25AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 954KB
- SHA256 5d092e85d852eb9fb46b52191055c5c5e3d54f2d54ca4e347b79e47d03c54cf8
- MD5 e8e2dcc9c38aad321a24e1c20c03bfd8
- SHA1 6f63cf289ea854d83f068a2ad24e903f5949f263
- SHA512 409a0d6f3415243402d92dbea491c943bcf46fb2c9ee9d4ea6aa18a259a4eb88835927a353d38c64af44351e093818b742939e6ff2b3f83b0707bb2d2a3eb926
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35lI:A3k03kHRJU
- TLSH T1D725AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 954KB
- SHA256 62f9d72f17ee75727698f1874477ff3f1af75d1aae22315fc124c136cb47c572
- MD5 4fa41915c8cb66d2b4c537be44577118
- SHA1 30e9cc8b7935c5c85846867f6bb931a05bf98777
- SHA512 3f08578216a26ef3b55fe757fe576115fe8bf261be547372f92a9e8306ea527ac8e1ffa464c1663968219bb5c1622927b55b367e907d29733f876bbda19bc800
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Xo:A3k03kHRJG
- TLSH T10025AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 954KB
- SHA256 0e36909315335b1143432d7c298d37199ae3bc803b286a993e39347abc5b48d6
- MD5 62094e575a4a9f91e194ae7edcb87b49
- SHA1 1439dee5cb876cf03b917df1a2277e43ca9f94ca
- SHA512 c51a9e66827513abea1e5cf12c4fe9a13342ca2b1dd46481f42ada4365ca1f0c0da2f5939777bd256c0527a562b346a4ecb8b665632e2cf9c74ee9d64b616caa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM358+:A3k03kHRJT
- TLSH T18325AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 954KB
- SHA256 61a2f572c8dfced31c9e02ab52271328bc0c7d21f54dfbda74649d3df7e20761
- MD5 7807f1b6ed926fa0ce72899a93579258
- SHA1 172dbe58d158255fb36a86384e39175a847fa37c
- SHA512 9387d6dcb56e3f13fedd3031f7602b02a983cef3a7ecb92da445efe42b02f200434a464ce00f249e99b782d1e83b7e0a61923be0fb1d86d77051a820be66dd6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35EQ:A3k03kHRJn
- TLSH T1EB25AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 954KB
- SHA256 3ff84911bbb12eca1909dd368e9dbe7a2f59d7a1ecdf1f35adad6e7c2f475828
- MD5 f4cedf24e5052b162deed82faebf05a7
- SHA1 8243a6e029e2819f7f9e44b292aad0c641ee5839
- SHA512 349e698b390af11b264128b1ccc48e029ef1fa6283419383b553f04d0e021912f25aa9c9a2d411d61168a592b7745825c0874784bd0c5c71450c6845b91e5683
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM359X:A3k03kHRJ7
- TLSH T1C025AE13EB9500E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 954KB
- SHA256 c4453f751b9aa0621d50023715efd4003a6ab3a57c0e1d4db4dd6a5aecaf5c5c
- MD5 31e0934c11f3887f28c5cfa23c07f877
- SHA1 47991717eb46ae70bb7ccaa0c684fa327cbf61ae
- SHA512 770db8c0a41d7decdd178d90b2d01e66ae56297c4ff0e006f2264ee75f694afd2c9e4293c690273f58322d33fdc84d6256b3d539b0de538c094e794f2def5e73
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35/L:A3k03kHRJ1
- TLSH T1CA25AE03EB9500E9E10AC174AAD69A23FB757C56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 954KB
- SHA256 f9c852165d4ce3d930adc9da93c3ac811fe5b05722b2d7f77f89a0cd2ccba3f5
- MD5 957ec9b0cfe3c1a2d1933f0c33ebc334
- SHA1 6084e0f86f5eed0cef0c00e9d58028d5c14510be
- SHA512 9e42149e3caa2aa2db59f137a9d1d0d1138ecabb8fa1d262c96c7e7168eb30da41859143bdb39bfbf455dc5426de198d60632bca5bd1d078935df3d0c43ce1c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM351M:A3k03kHRJM
- TLSH T11025AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 954KB
- SHA256 b6f9b4b28bbc64b162a0b20960449d467b457ee9327f1bfaf38dc7f46d9eeeb3
- MD5 1648f4143e0a201b0171aa1ad31492c0
- SHA1 c12468c5eb4a6fd528bcc8413d6ccf5f821cb57f
- SHA512 8987bb9a32c159fca95f56a5c74a33048880f1d8cacede020359cf125b4236902327ed775ebfbd32dac869421c477fa230765bd55d9385d1adc1a8e91e11e11f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTM35Gh:A3k03kHRJG
- TLSH T14125AE13EB9500E9E10AC174AAD69A23FB757C56176093DF2318C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH