Analysis
- max time kernel
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 17:09
Behavioral task
behavioral1
Sample
2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 933KB
- Sample260820-vpcdea1hnf
- SHA256 cc9702a378d75035b91a3657a52c852f7e89f7ff131b2a37e5bb7c1e4c7f1eff
- MD5 c6044adb053e179f5cfd3c51c4ada837
- SHA1 9de462806340c57ada12f0b602fb0427011de645
- SHA512 5a621c9183cc5b8c8c682355f00e97ef4d1fd82d0dd1691346e8041d79f09d90c2353ae4449ae5cd59beda800158b81b238655b5f5b4527307f545f7fbed5fe0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udiw:A3k03kHRJl
- TLSH T1E015AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/4660-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4aa-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4660-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4112-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018992-201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a6c-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-450.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-690.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-771.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-809.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-944.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-963.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1061.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1155.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1287.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1355.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00220000000188c1-1581.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4aa-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x0004000000018992-201.dat aspack_v212_v242 behavioral2/files/0x0004000000018a6c-208.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-227.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-249.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-262.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-293.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-450.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-518.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-609.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-634.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-690.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-771.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-809.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-896.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-903.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-917.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-931.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-944.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-963.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1018.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1061.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1074.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1105.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1136.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1155.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1181.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1189.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1203.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1287.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1336.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1355.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1380.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1387.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1494.dat aspack_v212_v242 behavioral2/files/0x00220000000188c1-1581.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4112 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4660 2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4112 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_c6044adb053e179f5cfd3c51c4ada837_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4660
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4112
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 cc9702a378d75035b91a3657a52c852f7e89f7ff131b2a37e5bb7c1e4c7f1eff
- MD5 c6044adb053e179f5cfd3c51c4ada837
- SHA1 9de462806340c57ada12f0b602fb0427011de645
- SHA512 5a621c9183cc5b8c8c682355f00e97ef4d1fd82d0dd1691346e8041d79f09d90c2353ae4449ae5cd59beda800158b81b238655b5f5b4527307f545f7fbed5fe0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udiw:A3k03kHRJl
- TLSH T1E015AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 962KB
- SHA256 562eb5c49977a64bd7da11b3e6f819a6187d93095c765135c2c449cc509eca75
- MD5 68954cff1a69b3fba2f0950984eff8c5
- SHA1 e3df64c266a84a656142d3b3a17bfaf21de62e23
- SHA512 ae0f1f38faa0eddb90814a4c48fa528696b957e89c5464ff426cbd62ee89306ddeb07d1281c209d1c62834c4f03163496d16919f8d3d4a1302da23db446c7992
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiCP:A3k03kHRJz
- TLSH T1CC25AE13EB9504E9D10AC174AAE69623FB757C56276093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$
- Size 1.4MB
- SHA256 8d36bf4db4ee7931295a4ab073e45754dc22757d5ec0fabf31aa81ba1ce9e6d9
- MD5 9d489299e189f8ef54a0e25aca5b0f9f
- SHA1 ff99abc5a87654b836c7e5006f8eb9137f3195ed
- SHA512 730b8153c3f784c09a909d2fd6be86e407272dd7455c370d13c8f2bd0878f1703c36d0b671b0e0916db9290cacd54ad78a0653f54146d318996d3517aeb59271
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udin86n9kAJ9tA3L:A3k03kHRJoT9t2
- TLSH T17365AE03F7D805E9E01AC1748A968622EA757C961B71E7DF136882252F73BD06F3E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 5c2466513f542de8b7f82b2f9d367ee5dcbaea998cd65443136d859c118c2151
- MD5 3922ba18642216271bb4d50b52be55a7
- SHA1 fcfca7792cffb39224d9961aa8fe3a4d0a708a2f
- SHA512 0e9b43c57f9bc8e57d0af8720df74637597863076fc8f0ffe82b1eb093bacf8b8b0ce8b6f78fb77da571b42925999e8dbd11a0d6128e9c43980791bd2a771c61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiI0Le5ji0hmxNrM:A3k03kHRJhPji0Aj
- TLSH T1AF657C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 957KB
- SHA256 3c691a9ee6081b237ff2b5c8e072f88ac93d3de1c02a8a9636ef12f7b3906d7e
- MD5 2fdb2d49b7d0125850845add70c38ad9
- SHA1 01784315366881d9646483531bb6cf18e94b11fd
- SHA512 fe7909e0810c2cb746daf56b45be31780edb713d745b84ecec17bb834fd268adb8546e5ef64cdadfc55b9ec821c84a455cca57a3d418da3fd9a35b758b005d11
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdisZ:A3k03kHRJF
- TLSH T1B525AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 957KB
- SHA256 ddbdb1420261d81ab24fe8f508d548077959cc8ce12fc35030cd5c6be578b5e4
- MD5 02f480f0cbf651c034a3d0fb0d5ddc31
- SHA1 a8d9209dcb151dae8334738806dafb912e8aa1e4
- SHA512 dd1f0ecee093c2bd4854e8a2532d16317859cb96953106145108d256b8a00e89667179e9f9b1a2da21af5689192d927a49b4dd2e2c0845e739e385993016988c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udij1:A3k03kHRJi
- TLSH T19725AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 8b733f535ba9b07337fa43e9a597486c90f394307d4add8bc579339fc44663cb
- MD5 33f5a9ce58632fb759a8707b9db6c14a
- SHA1 63f2d42bad7f6803f4598c658722c33cf8388488
- SHA512 abf8422ada0fedb558b7bcc506b0ff11c07deb894de9ee3f9f80e1de94fcfda9cb60086cdc0c6e9bfe8f8752d01e26b1a1fbd3e5aef16450862f63ed3ed8ad06
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiD6:A3k03kHRJt
- TLSH T1C325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 957KB
- SHA256 d0be180c60ebaf9193ef49a8bc9a9ceb276d4f5c9cb0d1ab15d69020086dd08e
- MD5 9ee5c9ce03d28f7c518b11e4b8822fe0
- SHA1 12a3d3d4dbabc15327a8a8590e8363110b0fbe10
- SHA512 39b6cf22accfd9ce6d1414ecf4970f71956c8b54e3a8477b21b68252f70449f8b84845bad42379e177b300bfc058fd3088b9cec13fb6bdac493eef78f6e69b37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UditN:A3k03kHRJM
- TLSH T1A125AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 957KB
- SHA256 6c3616417644a0e5f44a8901570b65511e082868ab0aa82d790f3bdae5dbc513
- MD5 57280ffa072e73da5a94bd9d310e136b
- SHA1 c6b268c9d8c5658ef95607ca9b2a2459240128fe
- SHA512 7b153e6418a96e080ed7108d289ecbce3184cae23d14f0c0e54b239daed45bab0aa194b152b4fc7773174e646521d1e197e2d59e29762226957e6fa4d74b3e47
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udibf:A3k03kHRJs
- TLSH T18125AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 957KB
- SHA256 69f076d24891d28ad5dc4f2a5d38345567ec60ae11e074e88b2af1cb4aaab054
- MD5 dc05cd2dfc9c9a798f12f3a5fa2f5313
- SHA1 65e1057e0beed00b80ec1a59aa9eb0d41f1cb78b
- SHA512 3c7f35f331020d0288364cfee24edba0d2692db59fd2ce1a55f972e596d7324d8406115d83c4d0f478fa42e052169d0ccf84de9e33595abcfcf64aed5dcf8433
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiNo:A3k03kHRJh
- TLSH T18625AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 957KB
- SHA256 54cd193a885382841b0551f67a63478b1a7042b1165042885c32f64fbf7db212
- MD5 725c645b1a7db01ebbb23ff3b3284ea0
- SHA1 662dbff5d8cf51afe4d548b580f0307c2b477da2
- SHA512 54d56ae4fdd58a23aa81dd07b605fc13c5e8f003aeb097de9c29d7b126e715dc98f454ced688087062f1c7b9c94d6160126142b90ffe26a8f922c245456a1ac8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiNu:A3k03kHRJz
- TLSH T10625AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 eff4336afd618b3aa610963c14d7d0331df85ba1bd69e905980b572e1646709e
- MD5 75880f4d5d14963751d7f838ae560a59
- SHA1 d3e516dc577ce35e8e0db36d6f7ea290c52bbe56
- SHA512 9f390419132acc84385eccc584fc5a566adc70d679757acc1e04e84a82350efabb44d382895f3d155c93b3999aaf42ef8805b904a7ab46f2aa68fc696a84028e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udij9:A3k03kHRJy
- TLSH T10B25AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 2715b4f4d8b4bb4c2e2cf5d2abd1d185f309b90f8b8f0c76f9d3adea1a3efba9
- MD5 13df27e1c1e5e10fefa3d256fca57ec8
- SHA1 ea57fc285522c75a7032712e46d46db0a570bb30
- SHA512 fe3ac59d365fb181f08c7db1bf152d79dd54d6ea377d734330bb910773198dbefa5a187a1fd5e40793021e79578c938ef247056d0e18a7a742fe822490a603dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiPc:A3k03kHRJf
- TLSH T1BA25AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 adcaa64968b5fbc80dd2382071facea2386df543ff89c85c88e58d1f16297417
- MD5 886394f19516c131ca0830ed592f61bf
- SHA1 5ef21ece386ee5b49b54647d315892385ba22d3d
- SHA512 dbbce25f3f52fd4c0597fa584fab8fdc8871f46e187b54384195d5c51424e00a4d642f260913f0155eb50cec76bac9ffa19af65286fedc6a4c9e28feea87ac05
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiIp:A3k03kHRJ1
- TLSH T1DD25AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 5e4424b808b365cc0231cf2254d61bf74fe8d2b6c41826e1f2b08ef10c885c07
- MD5 99d2c44aed9272c2f7db1f0140cdf752
- SHA1 ba30fa2047f3a31eaa323c83359a3212d6f6ae8f
- SHA512 cd9fc0512114f2b47541c4d377216bf26b16eb75c629c978019fac824bf09585ae5892dfaf418d448ea9a5030991e252b17fc6fbf0edefbea64c172a14470da3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdifN:A3k03kHRJO
- TLSH T1D425AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 0486797248711bcab449a5d3b96797db862200517030f941423b53d2cbdb34ce
- MD5 f8694e770347bab1e20ca09c350bbb5a
- SHA1 205b68e961e153fa9dba1dbc9d6e5ce0203ac01f
- SHA512 e358cc4b12c345d8bd1d1e6982d5705a238626d3fb6574c595be3eb09f3e320f10a78ad9d6dcd191efee13eea43af46cb0beb79076c79911740310d20c8d0e7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdidF:A3k03kHRJM
- TLSH T17425AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 114cb2c28cadc7be7d047bf020dcfb2fc631b38b1bb13de3205aff01050b0e54
- MD5 cb590c711fffcd5ac784a985ab56aec9
- SHA1 4f51073f2fc0d0cc54d4403740fcc165aa618f27
- SHA512 3b5d6d5cb883374425074fd939316abfdc0ef19d386765a0c9575e907c8b6a7f609006d3292f6d2306a4c709b40f6149a542edfc1f27ea131c243a08eaf02826
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiuC:A3k03kHRJY
- TLSH T1C825AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 3eb30223c386f7775a390e173ee2645d4b00170fdccc8b09ead2f69f5176134a
- MD5 961ca5b4c0f06c4531e49eeea5c43786
- SHA1 454710a64e91b02d403f47b3fb688d2e33d37b97
- SHA512 5d05a10f7eae36fb1a5655dd918b8c80bc4bcc7fbae15ecb2fff293b7a0fcb955224c0251eaf05ee100b7e215033211ffcb5fad70f06e54fd23c6c8124d54c68
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udixw:A3k03kHRJ1
- TLSH T1AC25AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 0c83f29053b3470fbc15384ee6fe8ed46d805de625678967773b511e67b59e2f
- MD5 d71d22becd326e564f91434ff8c7d429
- SHA1 35aecbd76dd930d1d07d42881102c75658abd073
- SHA512 684ecec0e567c3d615e4330a0e37e43984a1330a0216593eec67df60fc502a680d7eb1f77e20adfa74a4516fe15b721f071e2eb4e8f7957127983aee307e0893
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiYT:A3k03kHRJp
- TLSH T1B625AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 56260c32e7b71d1fbf6d9c9aa18dd4950ec5171423c2d0dfe762d5f7cfeceee4
- MD5 fa18930d6e0ed14f96cf59c812c47637
- SHA1 6fc5588aaa50da93c5bf35f61116f41b47ddab14
- SHA512 f6354e9cf7dc25f73ba62cfa17e4a09e60298f6d096791930522b2d21cd25875804145d2780917138cf26a21955d865084f0c9ba5c11f6e92fc2e566034523fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udi0u:A3k03kHRJu
- TLSH T1B225AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 a1b8e81b7204176dab67ca97098566c7efed5f099c9fa8a9822600b355a3902c
- MD5 96198b2d92011e9c312f188f0e26612e
- SHA1 1f2dc90ced5b206bf38bd35e22c825fcd8cbd2ec
- SHA512 c9a2c07ac35b70de71aab325579ae623e121053c6874e83fa7949fbe9f1c3401a0f4234eee0c3d56f06b994a352af6d8972c910056ad8502317575e137ed6adf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udiib:A3k03kHRJv
- TLSH T18425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 e11982c072863a1f94bf13720d46e20c399ba940a59eb7e47d09882112e1b096
- MD5 546ed034a572c06145247ef53591ceb8
- SHA1 92735c1be2109373703b373ceccb3b34c74bdd89
- SHA512 724b2baf6800effa003a3df6a0787c1ee22cf5835fe58f321de626d2bf79df96df3a7757c8c3c84428f062299f6b8b8f94fa66b5ef354e5c5f7750a6d582162e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udikf:A3k03kHRJn
- TLSH T1C925AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 fefaff9967d246222d20ed05b3269b42dda69995d416f29813d1668fe20b115d
- MD5 d62cc11c5ba44800ae052cac16797d2e
- SHA1 456c337200c4560100dbcdf0aac75079db47b95a
- SHA512 014a0b271657e4443814f79472595dc850b1ec06df25d97f6a1cdf64bda9c6052f9575f01d5000aa2787af3f730dc87ad76f9ca4a5f5ea593fde92062e982ac0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiBK:A3k03kHRJn
- TLSH T1C425AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 18cc7fd099d95777f02e9d1847fb637024ff238f3ad73370aa464f038ec86bd2
- MD5 a099a86cfe88677678be27fb0fc88915
- SHA1 535a21f63fc0ccc85378bdbfa51f1fab4bc8512a
- SHA512 d912787ad2e7e29e6db05103c2f5eab718efeab7f44a5d885081f197149a7c62781176eec59dfc41b6c18c4a3a2937846d8b60e7a4c87020f7832eb8d37f4bb4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udi6k:A3k03kHRJC
- TLSH T1AA25AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 7757d28d2ee7f28f6e58771b0ae77b41b25b9531ad3ad16e39c5cd00d767538f
- MD5 d80d0596e0182e3ea3118399a9b255d8
- SHA1 765c1e9abe8a6d7379e8c24d3e6db647fba722ff
- SHA512 973b3ee04cb7d97b8c325cf9d4c950de8a93a251bb6dbbb93d5ec4c52bfa7cbec0fd050e46a53ae52bd659c4768b4724ed3a50ac32b1dc1d29cd7e32f093f49a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udif0:A3k03kHRJn
- TLSH T14425AE13EB9504E9D10AC174AAD68A23FB757C56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 745bc37265301bc88c11e30dd79c7a2295ae7d4753ae14ab6101edf9dc1ee190
- MD5 21af47c00fdd069d39d070f17fc4dba5
- SHA1 5cb87c08e8254f33a3f5ef0835ffa3fcbc674259
- SHA512 6b25131d5b39c73e5c68ee39fe2f0a05355cf10ba8aab53b5c59544892f93e1900dffe59073950f69ddbff796fd7da680c538a210ec60b11c8c32b8966882e2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udiug:A3k03kHRJa
- TLSH T19525AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 856cda7e129e8faeb95ba8308cc06b48ec51a023eac21e1f06150c0a1d7ae413
- MD5 df30404fd14211f231accf2e9b635895
- SHA1 7271cf59d287b69bf0d127e79af5ef69270c8bbb
- SHA512 c6ede953f6faca8080781cf54bc31ccb965c5dc817a176b98cbaf851f66335d20ea049bd136e4bd4033e2b1d33fadd05a20d435954604a64afd4224df789a497
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udi3r:A3k03kHRJk
- TLSH T14825AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 a954c4cb8392c52d83e85081baae8219cade1f75799a2bc861f7f9e392975d68
- MD5 07554d1e7571ccbe8a5067a652216bb9
- SHA1 050eb3b5148ebf7a13c13575bccef6abeac20cc2
- SHA512 b76626391f97dbeee28bac885206a04aa1459043e13fb22d73a48e61722154477a4161761ef00248139026141c89d3eb363c8789c5c0b1a7515c23d168562708
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiBn:A3k03kHRJ+
- TLSH T16125AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 0441a91de1a8affe6476b86005c5c126aa8af638b2ea1388f1490c9460935d4b
- MD5 32e6b2c102c579c539cdba6c19dbac39
- SHA1 c9acdb288c68045192b1694643805a154754138c
- SHA512 aa3074533ccd9ae6f9e56fa22e7449bcf9c854805df22638dc53105cf30970d68e943f534b7061b88888c4a7f7486249f6d80fe64b29c0484a92a055574b3d11
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Uditx:A3k03kHRJk
- TLSH T1D425AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 1a04f5214728ec225b5f29296109e937e8cdabb245019d6c780c76d0252e822f
- MD5 714d42297ddddf8b5177e65f5fef1d57
- SHA1 b5205e8c9747d0e007c604e9e5970641ac981c39
- SHA512 915dd94a1a62472a87cd3a0d71e0cb4acd0d64f9c992e2e8bac741f5587772ad854bb974af0dc590f1d586a88fad70c2030797ca55e4b64617f12b947f748884
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdizA:A3k03kHRJP
- TLSH T1E225AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 807691893af89ef2bfb1e9e35433842002ab1f8b2cfd3fd8554313952d56159a
- MD5 71bfc5b1812a04b095ba9a168792e256
- SHA1 32f02795730daafe6d8685e5d2ffde1f32ebbc20
- SHA512 b11cbe65c512caf044da225475522c9acbe446a5e913a90259fe061067abfed3104cb101b0af166cf6f1393265fe65d159bdc4492bb2d2a08f14d65da8d10a10
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiE9Q:A3k03kHRJC
- TLSH T17E25AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 0df9f23d7140961fcbb6f3f4660afe573464c61de90f07bb47a8bd5b1eafde5b
- MD5 e28cb302a18df67384dc099669ab0e5b
- SHA1 84768771a47127956fe2fd9293babdc6d273f830
- SHA512 e22ae31a4840029ee3e93eb1b9083fe1d4be5289f16abdb5598c9a02489221e87eb94e5f768a71bede352973c09231abe0816b9ad0927072ba9c589266bed413
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udid4:A3k03kHRJx
- TLSH T1CA25AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 2e9cc7b9d82281612e2c09cb811c065623374f1766e10f977e440368d31b390e
- MD5 7ed7e8349eaac263852b25332f3caec3
- SHA1 1b7f4681412771e3926f9567d599d8896b330826
- SHA512 b1b6deecf4a64acc50ad317f0c724a0538054bf3cfbcd5a37da6c07d8ce7ad4d86df4930df85ccb0bb75932a062506e493335cfaeec7d293aa46f96e805de574
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9Udi4u:A3k03kHRJM
- TLSH T10F25AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 d94cf36a7c5b0f5001d2f1709a159e5c5ff449eafabf36f85cd9c8001453f61a
- MD5 e343cac650b44c2b35ec01c3e7092bfb
- SHA1 21489f1c24758b7fd512781eeccaf3959df082d3
- SHA512 105275df8c05fe7789b709643d8e9ee13c4ef2b80e9c77bce3b93f8879c38c51cef4ca4eb20694a8849f31099b34a8c0b1727a7532b1d89f9606c33dae69b89b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiZj:A3k03kHRJO
- TLSH T1D125AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 551995e2e40f797bb7a206b9a351afcc31ef6fddc068737b120017e10de83836
- MD5 b44e3be07e1bbf1711f26bf9eee64a82
- SHA1 2401bdb83c501770476a76bd91b71d97914dcffb
- SHA512 34b5980b59391405ed0e8a263f4b45ef5806e2ecbdd9c8f34eef08a84e61d67fdae00b64342c4655e6ecfda9140f2a5442cbb93068164b0e65a8431c911582c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiAg:A3k03kHRJC
- TLSH T10325AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 bc481b0d0467ac5bb5e7eb7a66dd5df12c707b6fc66dae693f96a5963258f44c
- MD5 e20431e35f8e12b18762fe2d8fe38d40
- SHA1 1cc0439bbeb5de4236aca3453b7ff15ab6fcac09
- SHA512 15743cf7b18995b95ac54db9d01401fe9019d4257c2f8e532ea96432b7d32f0998ec8d69a964bba77be606b634c22ad02b366fbeb8327a7665848b539aa06961
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdivI:A3k03kHRJz
- TLSH T1BB25AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 e50bb3245f57e8a4307f3c02bc82501d83a308b178f34b08120c8325755a8e4e
- MD5 ecdca9aa65764196953dfe2f4ec63d65
- SHA1 34b27f69338a03cf117c282ac485d3a6ecdf47df
- SHA512 2bd0ce66d4221ed1be8eb5921f06e1294cb88fe3be72b6ca731216e62829a8a115ba5bb323e24a604b56066afc2e7e7c36f75b31727c3fcc2caf22f4b0efae0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiVo:A3k03kHRJN
- TLSH T1E525AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 e62bf4ef9fee9c386e863d3edf7283641a03064b88202bdc44c3cac622571714
- MD5 2c051dc2d7797833f29b4f909e7113f4
- SHA1 f9fa49a4d73e8df7ecc788d22fecff8999f33629
- SHA512 b714adedeebfa6cf1bf581fe7e5952f94f5682ee634d4352c71716729caa56af68f0baa35303769f5d82d8596a1fc0cdd75e232f334b1e97f5c8f38267a71959
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiG+:A3k03kHRJo
- TLSH T14E25AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 b06f6e0e2f6e8f1b6c0718bfd3d1fd9368a4260461c12231260ea23f41077a2b
- MD5 78c42eaac95b9270493d4f7620d06c6a
- SHA1 6ff447dc48e9cbbe7a6b6ac5e1031de7c9a77f58
- SHA512 d0575e44f311e0ffa14f77205c8753e402646ccb27910d613d844a77ce7fff8cc539161b90b5c6753ff6644e513d4e6626c1445231743b9d6370d2bf83fd1c68
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiGQ:A3k03kHRJo
- TLSH T1AF25AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 b9703a1a267409d68c5eccea8511de5ac08d8e31fa0545132c8d72fc8281c76b
- MD5 9fd9e73be1d93cb119e92a70ae51fa92
- SHA1 971a57ee3f16443c7502eea09980676f35b16331
- SHA512 d230b9b4383e160674b6efd5cffad774d2eef872a0413652721143c62f5f42e07c2395dad8c06f79d8d551e98d638149fb7dab12b539c0ce3c03847f0966b85e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiXX:A3k03kHRJY
- TLSH T12225AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 93071e83c6b06fef6605e91c0c086ad90bff1e7dbf292cfc3e15e3af08a79351
- MD5 12fe62c7b1c557ee32bfffe1b5c1a5f2
- SHA1 6275663bb957e791f496dc39447bdf74f0986d28
- SHA512 d978496942a88b020ad1c5acf02f4dfebc81ff006bf797db0359895e54c7ce9e9c5e1f1d6c8240dd17195bd2a1a0700d15430ad5a7b9b1d7e3614fd3e19506e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiNL:A3k03kHRJq
- TLSH T1D125AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 a2c06fcfd6546e33fefd1c36b5490508050f88d36ef66af2dca4cdfed8d2d3f2
- MD5 2af8dd5bf8f4c6a6bcab57a952752cc8
- SHA1 1f0648a5b0ca9b701a1b708061b1adc0403994be
- SHA512 77eeac77315973cbf94fb63a83746cf8e8d9b5edad6e9b542e644695976956020935f6561c0a4c9214acdc6dfd43191cf43862876e2e76da27d774b74edaf5b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiLM:A3k03kHRJn
- TLSH T16325AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 60c183538250b2f10614b767fe7b0858f05816426cb38e24ba08f545ddb86ec3
- MD5 faac00975a2235eb660efeff40e63931
- SHA1 b5ab38ce13825d3f555b14ef1ab4e67ffd28b137
- SHA512 c17dbac56e1fc96ac08caa91d544f85565ddf35b2cb4589b13329b349168a93bcc2186616c0cf350e46f731dd47ea81343093e8cc77caa40b51f1ba24161ac1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCof9UdiMh:A3k03kHRJZ
- TLSH T1D325AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH