Analysis
- max time kernel
109s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:00
Behavioral task
behavioral1
Sample
2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 917KB
- Sample260820-sdps9asycz
- SHA256 49fb620daebc28b4a76c5a30bb25729eae34c1f280ddd6bc0752e113d7912bcc
- MD5 9726ba5bc2227a7fe5db37f86a1fd1fc
- SHA1 4c2f79c2cb11f8ab523eac53eb18bd8cf340f712
- SHA512 8fb04f744306fa2c607b54adadc02f34d8d9c3536a9de2874538f262d3a200ee94435b88f7301cedbfa7ad7f52f97969e2b17b6a6af409a3bd099d98ab771eea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5:A3k03kHRJARJ
- TLSH T18F159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/6856-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c61c-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6856-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4532-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c71-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-280.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-461.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-498.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-589.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-706.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-738.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1088.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1156.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1176.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1349.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1374.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1399.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c61c-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c71-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-280.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-461.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-498.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-589.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-706.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-738.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-800.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-874.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-953.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1008.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1051.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1088.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1137.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1156.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1176.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1293.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1330.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1349.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1374.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1381.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1395.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1399.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4532 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_115171\javaw.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6856 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4532 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6856
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4532
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 917KB
- SHA256 49fb620daebc28b4a76c5a30bb25729eae34c1f280ddd6bc0752e113d7912bcc
- MD5 9726ba5bc2227a7fe5db37f86a1fd1fc
- SHA1 4c2f79c2cb11f8ab523eac53eb18bd8cf340f712
- SHA512 8fb04f744306fa2c607b54adadc02f34d8d9c3536a9de2874538f262d3a200ee94435b88f7301cedbfa7ad7f52f97969e2b17b6a6af409a3bd099d98ab771eea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5:A3k03kHRJARJ
- TLSH T18F159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 14cece0783093a84158b18f52a25ae69490abb6a35cddbe1670b012acc18615f
- MD5 ebaa5abd12811f2a9ae82c750588aa14
- SHA1 2ab14972290e0f952eb775f64a6ca61e6dec6b5a
- SHA512 0ea3014af5bd9296540eb16e5e02a6ab62749b66992d68d5f7e0120e2027c1a65fa966fb9369c098fe73a32aa1805e5ea6e8c6d4ca8593d1adcd766388833da2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5P0Le5ji0hmxNrM:A3k03kHRJARJmPji0Aj
- TLSH T12A657C17F6A802B5D067C1B8C6D29A5AEA713842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 931KB
- SHA256 452f4ccb81acb66e49c18b032729b0d4ee1ee7ffc027ed55d6f1d5eb89232ce7
- MD5 1f9dcee4f155d846f8c974fa26fb17aa
- SHA1 05049e3e9a77320c6f86f62e13256ae629071788
- SHA512 18e1df1db8c280b90e03bff4bd3eefec7a73573802cb2c488c2eed0808102ec3e63235afe217a3c4a4bae09375d60169633452f21bb088f71bbece462965cf03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Ra:A3k03kHRJARJ
- TLSH T1AB159C03F79900E8D15AC2789AA69A22EB757C561730A7CF1354C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 965KB
- SHA256 00ab7b03d1a2effffdf88a77d3d1ba6c4901d21d2b0040443bd3aea14e5e30d4
- MD5 68d57f95bb304b203e90e04dbd6ea569
- SHA1 5e631036ebfdfa09e83df35969dc150978b55b0b
- SHA512 a0d80d820fba2c77aacf3e52c92790ec1d5f6f9e536b0e1ae101e2f5f86ddc381700a3158d578818bfb14164a8adecfbea63fac59786a880f9ff1204f52809ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5yb:A3k03kHRJARJbb
- TLSH T196259D03F79800E8D15AC2789AA69A22FB757C56173097DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 940KB
- SHA256 9e4a6f31705574ba92eb089cc486a37154e87c0fa7388bfa8ebe8554038635dd
- MD5 21ccaab8f677652ac2f50037e2d1369a
- SHA1 46b2da3fabd591516f318ea253e11e20553f8d35
- SHA512 8e6b8d43ba859917c0f7569d5845e44fc379367134e50cf7eb01dd44887e63d062b1f0a3a164d6debbe700db0495c89640927d2132489e7bb6ec716c73af14c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5g9:A3k03kHRJARJz
- TLSH T17C259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 940KB
- SHA256 316abbbd23eadefb31c5ed53e804fbbaa55d003493c84bbb75b223726d84fcbd
- MD5 943d89e7c22b95b06ce4eb7df4688990
- SHA1 d140a5901265cf6573d8c274ac1a7407c9ee2fec
- SHA512 30f48b5c03941a28a76dfcbc9e5f0a7e4e32a65d5ef7b57018c4d531e440634acf1c2e6fe537fdabe22e787a39f08531261561f92f20e3da1f64a29cb92f8123
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5oc:A3k03kHRJARJa
- TLSH T19E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 940KB
- SHA256 537872ab86a703685ca8d38baf166b5b932960ddac70c0ee08730e279d61497a
- MD5 1a34fe361c8c98b4f2e76e56c2745a72
- SHA1 7f63ff48626caeac891a61622dfbb4fe331a9d63
- SHA512 c2f84124b1317e2d9d1457094f9ea347c6c177f24c3da984cb8dcceea496821cbc10eac3eba77be48f751568e8de108e45fb910c06cb2b6a1b1b3dddd3f23084
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Bp:A3k03kHRJARJA
- TLSH T124259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 940KB
- SHA256 63c7ed855aaab44121b236465853500c9f30c859c8a13a341f89e2216eaa048d
- MD5 c94cf0e502951aa72efd718f08874035
- SHA1 b06d475dc255609ebdee5c0d938c757b05f72652
- SHA512 8fff8e2700995229a146b60a0e480fcb1e969ab2939a81787967cbc5961dc88f814c9d9213734c032ba7a47914c9dc58d3cc35f4cee14396eeec7665da99817e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5WN:A3k03kHRJARJ/
- TLSH T131259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 940KB
- SHA256 69f7e43783f0e55d09625908bc34137a37f63214bc3d73b1b39ae5277a43339a
- MD5 3bd6323fabbeb70c0a3741af77e7cf6a
- SHA1 96e8f2a81f1770bb510c65d79bf58d72b1cf364e
- SHA512 0b1ee83792c5145c137db43b83a357af1d016a7e837dd04df11b02f0cf85d60ff0663410887acc5535cd9f8fdc84421fca28c94194e15616525b373eadf704ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5aF:A3k03kHRJARJZ
- TLSH T1B2259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 940KB
- SHA256 c18c054fc41878b96f961d10d42e072f6427704c14ef2809fedd4954ec74533d
- MD5 63300a6e5b9fb6f6ca53cabb0e610df3
- SHA1 4b4320f353bb799f736185af79606f6c2d04882a
- SHA512 2cacec8373acc0e01b276e86f84d4570e31e44542704aae9f648d5d8d09d637264dc47febb289dfddba79aa2c43c72b3aa8195d65570a76428b1a65937270a88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5vC:A3k03kHRJARJl
- TLSH T10B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 940KB
- SHA256 bb841d9d03d2e8b28c998f6df2847c597479c5d27ede8daeed9fc657aff1215a
- MD5 4afb65611955ab21a3d85943546abe99
- SHA1 af547fe4460c0a6c424fdf24fc18ca48df85eccc
- SHA512 21ac6087ba74f4e87180b15ce486eacfb4e4961197d68f813774dbd01d5f3761c17835f48afd10ae3d4368e8e119bbc7878fbe21a32d7b43056ca1523d4d504c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Qw:A3k03kHRJARJI
- TLSH T117259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 940KB
- SHA256 c85c73b96c4ea5c76492b6e61704f56439810f6c285a48f7183ffdd9df499017
- MD5 d1095f4860a319d0a6b6e02759e866a6
- SHA1 82b09845b100ad3d0dd90a6dd63b3e30d639d2ee
- SHA512 9b9b2f6e7c809e2481fd9bd5a3d7c7d76b7bace238a66152bcb2a41431e394bc6a6f9f099f2c077dc08b5282b6bd1de5a7c3c6c1ffd510f4081484d3fa808363
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5vT:A3k03kHRJARJA
- TLSH T169259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 940KB
- SHA256 5d4ca8e34b8a5aaf2d70c24094b7160ac2612f6b447a3080fb47dd121d0f6e05
- MD5 928b36080f26f0d78e8810461f87196f
- SHA1 2cc56203d822cccb702394e931cbb7d99d3043ce
- SHA512 2816a0e2fc5ea4cf48ffd3420b2b44d665206e08c5179cc7423ccea8bcb1d8a0669903b320782a0e4d3a4b5ec3a99985902ad3d132d9a4fa66616d05a67edf78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5pu:A3k03kHRJARJ/
- TLSH T1A9259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 940KB
- SHA256 23ab4540ff81ae469fc3ab70b2b814e03eaedbaafd7b1e45b231602260d48834
- MD5 cad46c51cbdcc978feb1f2a69b88cbf3
- SHA1 9750f5d590ea392193a07d9f952d520aa5d3c5c9
- SHA512 3af2757662f7b5e508c3cc4cee4ec8fe266eb9975fd931cec8c7b2f8ef26cb696803f8c2873e1faddc4185531520a18dca08a18de4644d9ce308b6711c996635
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5hb:A3k03kHRJARJm
- TLSH T15C259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 940KB
- SHA256 831b40c27fc55216f14940ab762b51228f82aaacae06e5a81ec732d6b1297e3b
- MD5 ab042f3a8817dddda425c07588fca98b
- SHA1 371c19bb04f9d9668403fceaf707a0ce0d6c89ed
- SHA512 7cdba6eca1341c1a3a0f78bb195b5e9e2733efad0f703f80e092b9f1aad5a5311a4fceeab63b8c33858c6287c7d226972b793c8872fbbc706166ba87b9663030
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5pf:A3k03kHRJARJ2
- TLSH T164259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 940KB
- SHA256 4529deb5847a0878f83549e4de12dd2d2f3e54d334da5084fddc31bfabc01b4f
- MD5 5b672f8a1abde7715db64e48ca230a55
- SHA1 ca029b58b3d4b99386229a02770c69f725cb5fcc
- SHA512 6e18b033532202771e3ae7619b38a2b8bb6f4eb241d8fdd44a1ec1ef3369d8172dcc8188033c17c072cfe01a5f9ad9f90788b6c381c4a96e37b5c1b3c8c165b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5SK:A3k03kHRJARJW
- TLSH T1CB259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 940KB
- SHA256 2b487aa188a41588714c96125bd311aaa58638822aab0c38234966cd306f09d5
- MD5 e779749cedd73f219e8f5cb0c65fcaff
- SHA1 db20765b1f80813b2a0977f2bb373906f2179440
- SHA512 93b67190b036f8b2997c13d5b15af44d59c701b65578fe8de86bc6bd521b49b8032fc3a580ce3221b8ea760c0de1b75c8ae40242d2491de4385e84aaacda6dc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO53k:A3k03kHRJARJL
- TLSH T13E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 940KB
- SHA256 25399e127e63b3f7b8a70408e1aa7cacc908eab3a2a851f75e0cfe33e3439a1a
- MD5 5b39b9fadd617ac88bb47644e382a0e4
- SHA1 020b9bb07e3c9d6c183e552ee3b8418ea3488a00
- SHA512 6df572643aba3154270091191b0c5ef80baafd7bfa7eb647bf3dacbc1508e7a50fc5b8535139fa111427c0c7da6fc40133ca8af0d1661dfa964efd5e3ca05236
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5A0:A3k03kHRJARJa
- TLSH T165259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 940KB
- SHA256 57ee4a52846451f3a4d8310cd2e7a3f89482554724a160d713f9c6c806d977c6
- MD5 152b950cbe9d7dba221db7436a8cc56a
- SHA1 67e1afec397276307365190aa20f66a06e83024c
- SHA512 81414effe3d2bbfbd6d494cde6da57a2dea48efa4137bb5c1a36f0923fd35d89f76ecc421b428491a2b5eb8d7679889ac219746447ccdc83e13cc8d4a6c09af0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5bg:A3k03kHRJARJj
- TLSH T1CB259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 940KB
- SHA256 2f27b4dd20ff6358c8d54d03e4898c1c7aa631c8a72802e99ec89c4017572de8
- MD5 9be7b3a3ae53fe2ed728587bbc0fc4e9
- SHA1 820266528295a34ca7a392fa16950d352534d0a8
- SHA512 b0992f9235de203c7c4ca3a426b76ddcdd3bb260854d4fdd125ff6f552fb8e5fbfa3d64bc62ddd974b13089ad7034850e086121c619fd30b57c943e919f672fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Wr:A3k03kHRJARJ1
- TLSH T112259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 940KB
- SHA256 3f2230fcc6763f0a1c6a3b469624f34946799504636f49f9b94fa3f5897d96a7
- MD5 a4f88db783a2925354acc20c1d87ea52
- SHA1 317d20d58046733afdfa01136b210942d4ef64d2
- SHA512 2dd3ddd5f3d30007e15beeb9960c95a07b2bfae0727c6e4d8a11fa53f151d9ced21a15bfa96b44966c6725bd471fde0fa9db88fbfa36f050150ce3be1aaf976d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO58n:A3k03kHRJARJn
- TLSH T1A1259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 940KB
- SHA256 e919759f9eb51078c710c5a0781413c9b08b12fd4f9fbdeef8c3efdff8905c73
- MD5 86da776dc8c3709d2def905c7fed0a74
- SHA1 ec2ede23843951ca8476255b10b2f9166ead22cc
- SHA512 86b8fb28c0dce7f70e3dc4559ad3ac4b4efd27fcee923fee2fe9322a9345cd7e9b3897c1f67d075a4e0409a7f202642c1e5ad3a955aac4cf7629770c4cefcf18
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO56x:A3k03kHRJARJ9
- TLSH T1AB259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 940KB
- SHA256 3f6bed8d119ad2f9267bb45cde5db8d68c8a4af8233a63b628684b339e8dc4de
- MD5 f08d65e0693dc72cd2c97ee412891a3e
- SHA1 14a5f39fa7c7643d38c008614b25a57c66a55cfd
- SHA512 48517ef000efb4d222967bfcc59ec0875f20766eb6594755d9fa78ad763b107cb280fc31f7ffb3937a7c91a7b3711a909c07f626584f931acff57cfc02fda1b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO58A:A3k03kHRJARJi
- TLSH T136259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 940KB
- SHA256 5140bdea4fb8fb06f6ea778336c7a643de67bc8617f29472bed0698d00a88814
- MD5 44d8993532aa061cddfaef9abd69d998
- SHA1 982a63faa4ab381efaaa649948b67c49f3929811
- SHA512 15f4378258bce7f982b20fadebc66894efd452303b0cf19a4d60593e166fbf6e7d5c003e33e4ef432eaf45c5bbd199cadf74c6e15416868fd68f0e874dbca2c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5l9Q:A3k03kHRJARJ/
- TLSH T1E3259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 940KB
- SHA256 64e43a3b4712dc77f193ff94f969c68b405246bfe057c3776277216d8c6c52ce
- MD5 4172a167ae81993d8a0cb41c197ea546
- SHA1 fc9d5fa495b6af99b9a37413dd69d817405b3223
- SHA512 80eb293b1236354d0eb7d3f7ef1f20ee9f7cdcf55200b970022105396d9f7fa31d8988d47756838d1749d4312beb5f3cc7b2324b9c193a6173c7b6e12f56cb03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Q4:A3k03kHRJARJA
- TLSH T1B2259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 940KB
- SHA256 553861f8fe87ac6c9d3164afddbc434bc5522d0f0d748dc5d94ebff50130221b
- MD5 db6b1f3f4d13ff9f7033c2079f07f181
- SHA1 91b13fcc6e65d1e4912fd131d5f1b569b2346f27
- SHA512 27df198252a56077ae5844ef007c00dba6bb7f06f1844363af07c24bcadf6a4ae28b2cf2b8a0783400c7c09e2e9b8739968a9be0564627d592557bb2e509b9de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Tu:A3k03kHRJARJh
- TLSH T175259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 940KB
- SHA256 3ffa5acd6f792ac5576150bb8f6680e5c7c42f7e9c2a2aaa7db3d6d0cd491a52
- MD5 86103886f0eb7576726471d33f246984
- SHA1 d5f6a3695c35b339c972947ddb22ef9bf6a09b24
- SHA512 35657b8ec8121370933d0207541fedaf25c5b5ea88fe4796c4f10220b1f514580d3497fe3abbeebc8e2fe82c947d8f200afad941c6be50c3135b51b2ef2fb370
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Oj:A3k03kHRJARJL
- TLSH T156259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 940KB
- SHA256 4887d0fae17b2d081fcf355ac762da9506bb3561989d5de8ecb287b0a7c649ae
- MD5 295b051cb9086aa239b704b8cdd411d2
- SHA1 dcc58e9ba92e4f712ac4b1ffc61deeebf262d1d6
- SHA512 fdefaee9bc3126afa20801340eaff50111e6f284e4492c7b54754fccf80d7ba6ec8f2173c5bb6484f53f516c485959a5f59c413aaff86b7eb5c651489693f8b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO57g:A3k03kHRJARJD
- TLSH T164259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 940KB
- SHA256 fd62e028ba666affe2064f8ac20553ccaa320fec2acd339225f367f58407e810
- MD5 dae2b4b96842a1d54c050b4829458edd
- SHA1 6001ef823901bdaee2d48c3f6dbbb4a22cde45c4
- SHA512 36ed59fcba32d40d5fa82b403d29e81d43170b918c3af7b7f859a81946ff32d0201760b701d4926c70e9d9f1eba54d71ecf87920f2b0ebbfca932603a9e90a46
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5mI:A3k03kHRJARJK
- TLSH T16A259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 940KB
- SHA256 a275546fd070a44d83fe3665c0b8d87ccb8120357ca72a924b33fab7ba6a2917
- MD5 565d935108b203a3ed29e74d0774dfcb
- SHA1 469abae1c41825740b7b7eb9a50d6e1ce7584731
- SHA512 55b8fa6e08375cd602e095c0158b688bf2fc777667a4906f02db9c1fed3a3100c4be2b4daea0ccc1d8d4bb3954064af15f911cce7cf3e7ec8895beaf60642705
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Uo:A3k03kHRJARJY
- TLSH T17B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 940KB
- SHA256 bf834d624c96d2a96e46cbe54a4f922c84e04a30ba71173f1c1f1bb84e8ff625
- MD5 87edaec7a82300fd4fb451cabd3fd084
- SHA1 1c3be9e549dc49c7e5b238598c3276434c186932
- SHA512 33808b042f6baed5abec2fb590df7d1ce8cfbd97b38cd632901188b2e78bb550548a0fc8bc9f38eb82965094123a15e291853e52bc0a3ba974a36f4228dbcfb8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO53+:A3k03kHRJARJl
- TLSH T1FA259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 940KB
- SHA256 e0adab404e89b02f7cf5915f98a73d40f4dc9f1bdd143286b7f5fde1ed9c6eb0
- MD5 87cfc4f35b0aeb86a5c51f1d6bcf98ac
- SHA1 65a49a2f8ef5c547a7e9774482d9de9a0a6b31bd
- SHA512 67cdc9a2aa28ec19dcfd1d1a835febfd4a87f78f67a6fd3fa64ae4e5eee7464e1fa214090cf463e43bd1e9ebf324e02b43f95a5f0c3fb4c7b41c98e4e0a677af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5NQ:A3k03kHRJARJt
- TLSH T130259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 940KB
- SHA256 8052809e7b2d35120d4cc6ae6993b4f2e495716d1a76ab9060f6d74b2ba43c23
- MD5 96f9b605aae8d3b7cb3649ef579d4262
- SHA1 682d56cb35f772ed7189c157866d41c8564349a8
- SHA512 65701b8802a97dfa352783b927e31fba1ecca4cc9981de7e5ec3bfa48615f71e8d25fe9efbbb370ceecc45023a73da43bcffbfb5ada48204de52f1f94556ad7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5CX:A3k03kHRJARJZ
- TLSH T1CF259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 940KB
- SHA256 d55af051471816153a2c8ec8bb9a76a507ccbdda8288d0ab2de85f7a6b13a1e5
- MD5 749298ad34435d1e895e50b9d59224c5
- SHA1 688676360bf98de5a383fa6cb29444a08fb9f963
- SHA512 be666f27ba6136ebc72442e966a08f22795dbb395a1e116f4720e9465fef2290615d5bb05a1aed8ad0c6191d56f2263118ca9dbebb9bcf3408e8e46e6fb714bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5kL:A3k03kHRJARJT
- TLSH T1D7259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 940KB
- SHA256 787029eb8f5d6a07434d1fd76c4fb3e393afe59e4c020657633e473b5e8ad483
- MD5 ba00b6026e32dd90e89a649961729393
- SHA1 a4986ecc70fc58b21aa5e6ff2b834c0fb312d631
- SHA512 00c036b22789daddaea8b99269d892f56065181f105deb52cbcabe4e72bec2b8d682470f700371777122d528c95569f2af710fd7abee9a80d97582c6ec530511
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5AM:A3k03kHRJARJe
- TLSH T1F8259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 940KB
- SHA256 44abbbecb139fcb23f2b97c98c3990889088cbfda247aa1e599f2ce05343a37b
- MD5 d40143e6cc760c8a6b08580c165f00f3
- SHA1 2b3ca3e84719e279c1cd0d7788889399644040a7
- SHA512 27cd000377aca426568bb21a59c50b1c96ec6e83d178f1f9bc2371bf970fb734009093d3253bfd6e12f53d13f2c9b4ac1776bd478486506ee970245853f59f02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5hh:A3k03kHRJARJw
- TLSH T19D259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH