Analysis
- max time kernel
85s - max time network
134s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 17:10
Behavioral task
behavioral1
Sample
2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 915KB
- Sample260728-vpy76sdk51
- SHA256 14f580796432ff87e01812db0fabcd59d9fefb114261a61a64077b38a1555d1b
- MD5 7cfe46991a8e8643b48f248bb0e67f0a
- SHA1 45f389fec654276c5398dfc306bc41941d5bee06
- SHA512 d98f78c5fbdeb549ae73306a7b685914cfea9c2d1dacf7fb6399a04fcadedb922d89af385174c8478deb47f4a3126e960e9b06021fd6a2db6de7ffc6ea48aec2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaif:A3k03kB56rV
- TLSH T171157B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral1/memory/5088-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002450f-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bc9-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5088-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022be1-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/5080-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002163b-60.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002351e-149.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ed-254.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020301-304.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020306-443.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002033e-492.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020342-511.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020340-596.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020344-627.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020348-682.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020346-731.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000020424-750.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a0-788.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002129f-801.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a1-845.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a2-870.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a4-889.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212a3-896.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a6-909.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212a5-922.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a7-935.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a8-954.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212aa-1010.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ab-1053.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ac-1079.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ad-1098.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ae-1135.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212af-1154.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b1-1179.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b0-1186.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b2-1223.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b4-1326.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-1334.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b9-1354.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bb-1379.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202dd-1462.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202e3-1505.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202f2-1524.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001200000000071d-2089.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002450f-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bc9-12.dat aspack_v212_v242 behavioral1/files/0x0002000000022be1-40.dat aspack_v212_v242 behavioral1/files/0x000200000002163b-60.dat aspack_v212_v242 behavioral1/files/0x000300000002351e-149.dat aspack_v212_v242 behavioral1/files/0x00030000000202ed-254.dat aspack_v212_v242 behavioral1/files/0x0003000000020301-304.dat aspack_v212_v242 behavioral1/files/0x0003000000020306-443.dat aspack_v212_v242 behavioral1/files/0x000300000002033e-492.dat aspack_v212_v242 behavioral1/files/0x0003000000020342-511.dat aspack_v212_v242 behavioral1/files/0x0004000000020340-596.dat aspack_v212_v242 behavioral1/files/0x0003000000020344-627.dat aspack_v212_v242 behavioral1/files/0x0003000000020348-682.dat aspack_v212_v242 behavioral1/files/0x0004000000020346-731.dat aspack_v212_v242 behavioral1/files/0x0004000000020424-750.dat aspack_v212_v242 behavioral1/files/0x00020000000212a0-788.dat aspack_v212_v242 behavioral1/files/0x000300000002129f-801.dat aspack_v212_v242 behavioral1/files/0x00020000000212a1-845.dat aspack_v212_v242 behavioral1/files/0x00020000000212a2-870.dat aspack_v212_v242 behavioral1/files/0x00020000000212a4-889.dat aspack_v212_v242 behavioral1/files/0x00030000000212a3-896.dat aspack_v212_v242 behavioral1/files/0x00020000000212a6-909.dat aspack_v212_v242 behavioral1/files/0x00030000000212a5-922.dat aspack_v212_v242 behavioral1/files/0x00020000000212a7-935.dat aspack_v212_v242 behavioral1/files/0x00020000000212a8-954.dat aspack_v212_v242 behavioral1/files/0x00020000000212aa-1010.dat aspack_v212_v242 behavioral1/files/0x00020000000212ab-1053.dat aspack_v212_v242 behavioral1/files/0x00020000000212ac-1079.dat aspack_v212_v242 behavioral1/files/0x00020000000212ad-1098.dat aspack_v212_v242 behavioral1/files/0x00020000000212ae-1135.dat aspack_v212_v242 behavioral1/files/0x00020000000212af-1154.dat aspack_v212_v242 behavioral1/files/0x00020000000212b1-1179.dat aspack_v212_v242 behavioral1/files/0x00030000000212b0-1186.dat aspack_v212_v242 behavioral1/files/0x00020000000212b2-1223.dat aspack_v212_v242 behavioral1/files/0x00020000000212b4-1326.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-1334.dat aspack_v212_v242 behavioral1/files/0x00020000000212b9-1354.dat aspack_v212_v242 behavioral1/files/0x00020000000212bb-1379.dat aspack_v212_v242 behavioral1/files/0x00070000000202dd-1462.dat aspack_v212_v242 behavioral1/files/0x00070000000202e3-1505.dat aspack_v212_v242 behavioral1/files/0x00070000000202f2-1524.dat aspack_v212_v242 behavioral1/files/0x001200000000071d-2089.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5080 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5088 2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5080 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_7cfe46991a8e8643b48f248bb0e67f0a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5088
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5080
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 915KB
- SHA256 14f580796432ff87e01812db0fabcd59d9fefb114261a61a64077b38a1555d1b
- MD5 7cfe46991a8e8643b48f248bb0e67f0a
- SHA1 45f389fec654276c5398dfc306bc41941d5bee06
- SHA512 d98f78c5fbdeb549ae73306a7b685914cfea9c2d1dacf7fb6399a04fcadedb922d89af385174c8478deb47f4a3126e960e9b06021fd6a2db6de7ffc6ea48aec2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaif:A3k03kB56rV
- TLSH T171157B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 944KB
- SHA256 5962077a058cdef5d041b27ac34fdcdcdbf10d9ef2db6750cd5e2ff1bc731da1
- MD5 65b4ba20356619840f60fce49ce64a34
- SHA1 19fc6eadcc4d85f0693e9096c421e5378a2e5584
- SHA512 596bd446b38f55025ac5f6109747eb6606279a1cffb9d4981827b796028ad479b0c53333b84901584448be681e89bff9a7d9b9db95bbd2fd41e52e4d2172e8f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRai1P:A3k03kB56rD
- TLSH T185257B03E6840FA5D10F81749A968662EA777C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 961KB
- SHA256 fcff645f7eb217bf8d2862af0213afa421c9d3ea24e72f1d649c9e1d847c0ca1
- MD5 32e98ddd63c92719bb864adae4cb8483
- SHA1 c6e663cdd1c09f6af8b140274db68675e7a85236
- SHA512 2ff0330ae52bd9fb02ab64250a4b638800254feaec2d3f31e73b2573bb83ed6f995b2b44442893eacb8cf1e80a7c303f76f16c6761f7688839b3fd9a652b1a24
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRai20:A3k03kB56r40
- TLSH T1DF257B03E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 967KB
- SHA256 3e590784092a2f1883d70f317281a4659c6af2ff5e328e58612861581d5efc94
- MD5 d86c208e33b8a6451dc6cc7cf32b9658
- SHA1 b519cfd96bf4a7d54d0c6e71ac2e8b7a6cf707d9
- SHA512 4d21c3c98ff706a8221f5dd529abb131e8a39a5c0cea785fc893a921f551dd50ae747a5d0b5bda241be780cf1a963cffce8fc6b85920c814235343789b8a45ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaimfj:A3k03kB56raj
- TLSH T13D257B03E6850FA5D10F81749A954672EA77BC125F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 51d91ec5cca57287591fdd02e1bc72e1a616b124aab9c1abffa9c735a75d7457
- MD5 c1b38b46f4237225454a175ef65ec1c8
- SHA1 0f0b014ada73a895661695b2be4f783b8231e09d
- SHA512 a33c5f7c69969432ecc626ed7a98c45f0a14220ea6d4c067fa6b289254e46cfb54687d4eaaec34d8e0c8166fe30131deacbe69063dbd3d4962a19bd38d417996
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiL0Le5ji0hmxNrM:A3k03kB56rRPji0Aj
- TLSH T1AD655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 929KB
- SHA256 31f3560d6b0f179ec9a702487ae92175fb16c4abc1c7dbe43885dc467b17c12f
- MD5 79aac84e0be8f66d61a18e85de1a253f
- SHA1 fa97bfc8c9a5fcd60e9e70cf2e85dd70b5ad7616
- SHA512 91ebf2aaff24857ec6adef4289de2c7e7481d0e87b7592eaedd1716262fa2aad283c55cbccc31070fa1664d1a79fc57174d28a9a6c5789d8541a6ec65789f908
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiNa:A3k03kB56r
- TLSH T1A9157B13E6840FA4D10F81749A964662EA777C025F6093DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 963KB
- SHA256 d9d6cbc6cd15a7178277da1bc23da50c7e0004f3a41b5ec638ffae46bcd579c4
- MD5 58741bdd4c4cd588664605546ca1a808
- SHA1 89c5fcdaa4ebf66231e5c1a8a0b7aecdc5192a77
- SHA512 cfdba6909457400c79a355199b91b65a7d083ce54ef02e273e1819ae308e84908f1af1f9a4acce94bea5cb023a6727212fe0e5ee0a400d0cd8c1961d86360710
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiub:A3k03kB56rgb
- TLSH T15C258C03E6940FA5D10F81749AA58672EA777C425F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 1.0MB
- SHA256 29156eda468640abed0413a7840717e55dd6fc0cf483fb7f020aafe5d7f2183e
- MD5 4adf4bb1067db82605f0d2bb83c4f6bf
- SHA1 e80c77febc4b65ecb9ff70a4f86a693cb8935f99
- SHA512 9c32ec0392435b9e250dd42919e28e63ff5d6e45cfdb7d0017007da43bdf9cdf981d0bf1a4c7b306098c975083375c51176a7ace386ba1a0792ce3550a935500
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiAD:A3k03kB56r6
- TLSH T119352606E6840EA4D10F8174DB954662F6737C125FE093CB13D4EE3D3F72A906AEA297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 938KB
- SHA256 37df5681984ace683f82f0aa7226914a48e62e21ab06e52eafa547e0afadcc87
- MD5 77c5217d3fd21cf46a5faceda7ae4401
- SHA1 ac8447932c735786493ac10b68a240cbb019b93c
- SHA512 cc35417ffae00a33bce755c15c5572eb2fc27635041e6f79208bd707f1734450c4fd1b22416a159292bf17e5dfcfc6d9932117f4ea395fa9bcf35222b08337ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiE6:A3k03kB56rd
- TLSH T1D9157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 938KB
- SHA256 c270ef6aeb593452f70bce8de76a53f9d7bccb94e0bf3b497113067bef78cd4c
- MD5 243598150c2cec8b686da5e29f56bf8a
- SHA1 e99e180ff8fbbe047bfaa019bb5fe4a2ed674631
- SHA512 0163f6ea7034d19c08a13798233184ae3c29b271f05ff01d0c1415d5bd4d61ea57833862b989fd41b4c0252913cb4ecaf6afb7afa9ec11222af7c0675bbc7eab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaic9:A3k03kB56rC
- TLSH T189157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 938KB
- SHA256 30c4454dbede238caeddc8f2681fbdc3a85ddeffc933ce4bfa6976b97bbfe7df
- MD5 d994e355482252a2fb17ab529bd7c412
- SHA1 0462943e4a79105bd228cd62af765e22570ff42d
- SHA512 b0ee5d1f5073d6e8625f1a337c9ecf8c922cc938766b13e6b8e3ba76af2a4b85cc02f146255e27e6dcb8624fafb93c992808eaa349d7c289844e4785960d1e03
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiEc:A3k03kB56rv
- TLSH T1EC157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 938KB
- SHA256 7a2fcd1018a8ec1c38bac79a212a699be94bbf295cd39051f1f8b5c6a62426e1
- MD5 564149d21bac29569cabf4a025ed6112
- SHA1 72f9cbd027f359f6e771f1e1cee008bd716868a6
- SHA512 ea9bf71ea18a6ab06a434c8385ca385d934e603c4e5e7b357463134ee9653b024859f3939d7f8ddb0e306f780ad4f91e615a31f3803f8f058f9b60891bc5b68c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaidp:A3k03kB56rl
- TLSH T12F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 938KB
- SHA256 ae476b7c97bc1caf3ce138a1bd87813da0eae13813a912c58639b786b32eb442
- MD5 b03843791201317666abca4bde45773d
- SHA1 308a74aa5a9dda05712f5b521e40c162ba04f120
- SHA512 b9a767699a076d867c660e7d6d79e928373fb0c43d23d093b24749456ab8b761945fe61400cbcc11ffb295793819a76007d6fae69bb8f1d86244218af7947595
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiiN:A3k03kB56re
- TLSH T1A5157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 938KB
- SHA256 242832e8263bb2d91b8a9677c14bb42ff878bb74fee88e31f3af2ffcd58c882d
- MD5 3a3b5ad4b65e773327dfd4dfb34c4da0
- SHA1 9c0a0c188b4720b0e299acc7830f624bd141a7a3
- SHA512 c5f12c02018cfe12368dd2534fc915cddc5b01a91b7418b3c6d3bf12f8a042945319971edc4d3494e0f1b01521eace54b4223b84eb6f201bed13b37fd365f73b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiGF:A3k03kB56rc
- TLSH T1FA157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 938KB
- SHA256 0c6d8583c62f1b5aae95eeb8b79900eba71539aea81343c749769213375250fc
- MD5 1aa2d601f52e425bc7a190cf994904d0
- SHA1 b1de6883e7a882ad7454ac5d0aaf372f4a0bdbc8
- SHA512 980708f75ba6c48222718d7e1beba8d58203c7e07042e3ed7accc783018037ea1bf117d289a01ee488b2471b0f88139c4c94d03effd8fd2c11775fe49988a775
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiTC:A3k03kB56ro
- TLSH T13C157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 938KB
- SHA256 d1ad824cb2e2447f313a9ef186b152986f1843493a6ca9301acf63e427c54211
- MD5 ed95dae99d7626b2e8a28c8797367e89
- SHA1 d1d684a4d2ce0a78d8076a562bfacc72cc36bbf0
- SHA512 8e1e1a4b7686ef029b940721735dfd03b1cb6ba733050510e19fe97a40c8b2691f7fc22e521d920b77a5e705ad8678a13f07370397acd1c12d03915d9adeb3da
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaicw:A3k03kB56rF
- TLSH T19F157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 938KB
- SHA256 64ae14923222ecf8e2dfd671387859b8edba5a5de094fd55fb3ecb08f0c0ec8a
- MD5 7004b9ca9a0e2c4408174fe08df4ac7a
- SHA1 4430d461f61090c1ff7191e1046b07677bbeff9a
- SHA512 69887e86293a7521cb9d4a84e3f92089acd2687af287d98a79eebdd22a4e1f774df7aa599d82b0d482b9722bc5b69e0f7cebb996bc2de9fd9ec415a9c191f86c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiTT:A3k03kB56r5
- TLSH T1E1157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 938KB
- SHA256 e9436e8f7f80c96575c67468fe9d678b4b04cc2f8996998ecb2f8666e7f925e3
- MD5 ac85c50e45f818da3d08fa3bf0924ec2
- SHA1 a065d7962432430e85469e5408d5f6ebb049a17c
- SHA512 65a146fb2effc360b324968d026400a8eb966d69f8a90ec5c7f5efeb6cbff919703dc06423e2291e9f316ca6a1a29e615f90a8e277e9edfc885de79e2cc01fc0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRailu:A3k03kB56r+
- TLSH T1AE157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 938KB
- SHA256 c359aa5ca5ba27add938249ccee39bd89a30742e1f9c76bb2a8aff87cfa514a0
- MD5 bfe867f02d5ad5c94907b28cd4e610ba
- SHA1 28737e49b539ddec7c4029dcb2a59e25b03bdb89
- SHA512 256f274750a3f20f5498822d7271f1f2a507607367d5f0b17455348d98f91a185186e1c8b0b9527f4b93d109fb8332608ae629228b62fbea62bd4eb6e813a260
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaitb:A3k03kB56r/
- TLSH T160157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 938KB
- SHA256 bef77f1e6a738f5c42f29a8d2ef3c67dad71329f0b9faef7887296b34f6f69b5
- MD5 512661aceaeacaf17b92c058a0dda7b0
- SHA1 081f03a9b8e43d264033e0d4e427e632f084dc5f
- SHA512 d6a74cf815d418d9dcc632c3f5cda6d4940ace73bc0c0db388a17f7b5c53461fcee587ee926d25e0bedfc839f79170ed3f885577b110cf34246f224e0f49e2ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaidf:A3k03kB56r3
- TLSH T184157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 938KB
- SHA256 e02227f461301bc8fe38fd590137ee6586d583607d22f441c3c9566bdc22b5a2
- MD5 59476d8b48930e47b46cfea1f4d03e19
- SHA1 10beee1f4e24ce54d64ca6ba0ac5cd38aeea532a
- SHA512 a9dc96f60c6fd94d40a3ac8f9f923c4428b09480c70f44c930147c586b3208746b55bff39ebdf04bac042db057b92224cc7a83c91a0a922c64325c5036cc039a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiGK:A3k03kB56r3
- TLSH T185157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 938KB
- SHA256 f841374764be96057766dca863c11450c00c377877f1b1a88c282199fa6ac13b
- MD5 9121fb4704aff0ce6cca470bd035f0d6
- SHA1 80ca285e2a205a0f0dfcdb74b12f6f14d24674ad
- SHA512 2073ef9c3722d05f186ac576e0f3da1047bf11da29efafdff6b8476886939671b562f2a287dbd098b14a226e93b8175ef5ea6d620540f4d07ff16ebd5db26738
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaizk:A3k03kB56rS
- TLSH T162157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 938KB
- SHA256 47f323ea24d48794e5abf87c05f5d06e925e00c29e0960bf65017a682bc10312
- MD5 b80d53d0967c3e9d772ba571763eae5a
- SHA1 1931b2fcb82a169556e570388d49c57bf828eed4
- SHA512 0395180ce4cfe6bdf26eae5f84542b7633938a0ae8e0d8fba1bfa49015ef68ab5dc53fe996706b7941e492751b06da42aeb1aa758b58c68c543de7f66b719f88
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiE0:A3k03kB56rX
- TLSH T17B157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 938KB
- SHA256 b10b149a70ba41fcad1b11e20a54d69a92b19e055c1ef4cc47e7df3b37da3153
- MD5 0cb7a2ebf34e6198085ddfde4960cbbf
- SHA1 a1984e29d30db3a596245d5658a408319985bedb
- SHA512 b75f4c869104b9da70891a44c2497afc9ebc9587c62da55c01b796839aab9891bd41ca06b627c07711c58558ef3f324d3dad66292860aca65913fd6684537d83
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRai/g:A3k03kB56rq
- TLSH T144157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 938KB
- SHA256 ae89940d7699242319ebd3cf58e54b2a187e3839c26945baca81f90d0d8ad8dc
- MD5 23d24b7c73d255ffce2a52abdf3ccc54
- SHA1 aa3146548435e979831832598b5715eb1c042730
- SHA512 d4f80786f702e0bf38526c4c67441dcbf680c6102f0026da921ae278284bad69bae1b559529a0625d5cb2f391626bfda144c3c75cc11bf77c7a1398a5408e987
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiSr:A3k03kB56r0
- TLSH T11D157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 938KB
- SHA256 5642d9b548fdade13f28dee73b5be7876c6dd5bd7e43c6b5062db2b241f7e68d
- MD5 a812f76742fa23c0480f8721882f870b
- SHA1 dfc5cc4b26004407732dc78cb6ed82fe2f5dfd3f
- SHA512 184984c0e95f5459153a960066381378a0f2c2664b8919d069f68a1fa2a834e804a0be740aea22591b53435ef82133afabd56372d701b52eacb05b72f2585556
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiwn:A3k03kB56ru
- TLSH T149157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 938KB
- SHA256 f6669e098aab87302dea3de2694842248444cc9eb3d535f75960545d9479176a
- MD5 29ae54462cc394c40749489d552cd723
- SHA1 5dd54a31419ba030a74d51f470ca97953102a440
- SHA512 f428a94426df1071bd769625f0db9517a4d0ff65d7ff29541573d09c9c8d60a26b737a9e6724c9bcf45d6a8d4a81769d2adda18a3767210a84bd813bb07b8a51
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiOx:A3k03kB56r0
- TLSH T1EE157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 938KB
- SHA256 8d3771ff702080093161d2164023cb320179d6bcee3762c44c7e554b89f9485f
- MD5 7809d389ee6f7ea9d504af9afe58207b
- SHA1 b933bfaba92ae1189c8c422b69d239d9c3ef8e3c
- SHA512 90532d77303c375443d80bfa0409a6caa295ac78825a6fd12c84251188bacc99cd2150d3fc5c8ab9f1f12aae9254ea2de46b361c30fc4424470fc0c8348b3d88
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaioA:A3k03kB56rf
- TLSH T1F7157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 938KB
- SHA256 caa2354dc0cbba30c0d2292ec313c0b20887918416db41cc7c0453a1575cb9d7
- MD5 2f8633487ab4aa407a462c6312958cb8
- SHA1 45abb0e1339033ccfa02422a81a7f776dd4c48bc
- SHA512 8be70c845a4b77182b735d1761c931067ede0aad8d8ef6f8cd5018af31042cb4f9924165cd662c598f5c6b1321eac7b0a4d46c0d5292260366d88fbd43ad2a80
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiB9Q:A3k03kB56ry
- TLSH T174157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 938KB
- SHA256 63097c0a0f040a642f854074707987c95dcb3bbdf9a8e5e83090c091a251df22
- MD5 1b238f5a016ddcccf6de7d8e701810a0
- SHA1 abdf61152a942c77ed66d1f8b0475f51caa928a2
- SHA512 e93edd1540a7ac484c4148c3bc52a73d5e569b974aae2f2839efb9e66f1058d1ccc313aabad7bf1ad174c42a37785e0325c620515d87cb28ed7b9eb2dc798194
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRai04:A3k03kB56rB
- TLSH T1E1157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 938KB
- SHA256 1a318ccec2c18344e1915baa6d5dfa2c05ae6870dafa0010051284e6833c37c2
- MD5 ed2781dfac1dbae24b50d34a97b1f513
- SHA1 7f20cac2f09c1c14b721b1f21754b65ffd354f9b
- SHA512 22df45320def158fea76fbde63dfecabf90ac890f3b93c7926bf9c6824788669671c4b0070cb103d2b4da5d51162bc9991641568c0e38f8a5ab22ab1daa28ab6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaifu:A3k03kB56rc
- TLSH T176157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 938KB
- SHA256 98f937bb4795d6ec21bc8ab9763d4aa6c17bf77fbbde7e4ba978c1bb15ffc366
- MD5 4bbef1ae8a49f67e3827d1f7be6bc40f
- SHA1 cb2b27740b6bf68126e7676fa36e09e2d9d7f764
- SHA512 5349dd99c93998d27df3c0af82ca49d4a3e33dfbdea2ba256ff712e76c9ef62076b60e82e3b3551360d036a4e5009e67b70ec3d3146634a92d02ef2acc39cb42
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRai6j:A3k03kB56r+
- TLSH T123157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 938KB
- SHA256 17e7999de814b1b05532e1c176fe6ca68f556ddfb012399f9af14634aea774b8
- MD5 27186d810d16b450f57cfb82ee9df767
- SHA1 15e33ac4a3454a72b9809feae03e2dc6fd8e2553
- SHA512 62ef14546db5c3ff966e3b6a0bd9aae4cdada0508a0b19936a595566ca29b8cf3c3208d3be35f94b9881c9e25b96c1518f286abf3eb732b78d460d9588b8ef03
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaing:A3k03kB56ry
- TLSH T1C5157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 938KB
- SHA256 f89237608a0fb678c2b126fd9ff02225bb94b75cc7d68977c4f285d92ff797d8
- MD5 1d9871ed9d75cbfdf08ff54ed5155ac5
- SHA1 cac8159671b9c05ee3378d8351eac787377d726d
- SHA512 6a190a606e119c640eba0c260c0a2f8e6aa5fbca121573f0d31ae06c903fd6ce96f3df1942a4aa78ded7d097398b748230a7ef5cc03ceb7831f94c06a9f3f6b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRai6I:A3k03kB56rD
- TLSH T146157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 938KB
- SHA256 8105dfa28261621a838f02930feb3a10a9e1bcfaabee0b0b6f5982d69c8dec11
- MD5 36a43fc9cb958f722add66299d566428
- SHA1 97083649bb0d88984657930f39f4aa43a06455bd
- SHA512 04a402d14adf8fab6ab893399365911b20a1092f196bdfc419e802df16d4f94ad919f801970eea68b4e3787bb6eeaa6d4581fb8cf3458d9a657be5448d7dea29
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRai4o:A3k03kB56rd
- TLSH T15C157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 938KB
- SHA256 b26095dbe5f71b47ccfe0bdd3a09be4a9e2941769cef810ecdd9525221eab779
- MD5 67fe4edd01af9effa6fdc77bcac1698e
- SHA1 4be38d3121409206b0b0de937bdb49406191eef2
- SHA512 e7f718f63c3b729f6047d2004cc5a7b66756e424c7fca48b72635df22c8f0a201087126ca8b39fbd416f588b90d07b6c430d769dfb1cb34eb426d25d2e60e229
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiL+:A3k03kB56rY
- TLSH T1C0157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 938KB
- SHA256 bad56ce92c8724d7ec9bf6615c35ec61006bb9416032e928746d332425dc37f9
- MD5 d65073abd53f9b231ed93168fc03416c
- SHA1 33fcd1fdd1c0c17aaab6bdb6c4fc8a17c50a1822
- SHA512 b8618cd8293d45e941c6dd582442e89a8068b9a7a02b5548b33f0a4ccd8cef2e7e32010d9ac139d4e1281c74645f01e8fccefee19ae3e8bfe7525310cf8567f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiBQ:A3k03kB56rY
- TLSH T15E157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 938KB
- SHA256 33f305a5448a98062c8938c5924b2a98d3c4680665ddc28a56236afb538fffef
- MD5 5a825e04c86a5602bc84dc7db082cd87
- SHA1 8ab10260dac32a111050f51698545bdab1e7e2f9
- SHA512 16f3c26e7a9ecdd7aa2b6b0c05d47633db0e145f5ab56e27f29e16d87e18945952ffaa883d24558b923e233c6eface470cfc1ee519d6a013cf64a153d172c6fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiGX:A3k03kB56ro
- TLSH T199157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 938KB
- SHA256 b6ec5ff4e1157e6a3200de5a17f88c8768f57b6e19e4bebef02e8f3962645232
- MD5 8689ece2f606bb59d98eb4a184ef0de6
- SHA1 5c4bb88e712f0102aa3c52b812ba517f20566d58
- SHA512 99d3c31c51922b2b664bdbb8ea794bd605d723d59f5ec3aa23ed49ebfccd16a4222a67fd60eeee804f4fb9ec99c609327fa3b69fe40ec20f8bec86c1802164d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiAL:A3k03kB56r6
- TLSH T16C157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 938KB
- SHA256 a867744ce9b388bcfd42999b6f4404bb05fe8adcd8e10d3098b1dacc275f26eb
- MD5 1a5ce214ab59f9948f9205ccefc41bf2
- SHA1 f476f261e7f791054f4382049e398fb92b7b4f57
- SHA512 d9baa5ce56273479931071af6e57e9a8a99fcf719fde3e92537d8ce5c67b7b79116cbc3ce7cd02bb0f2c1070811ea751488d336b405a950ebd346c37eca49b94
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaisM:A3k03kB56rX
- TLSH T154157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 938KB
- SHA256 f4442b629005b69f4b8bbfe10ec02e542db24ef4fdefc05504ab17b0264d82bd
- MD5 f139eba20fcefb81e3636430e64dec3c
- SHA1 d2a1d698217417b23000e58f87ef4e345053429d
- SHA512 77f8093c8a7c43be74f303645bef458743d78dab9fb274774c41891b231b87e3f65897d0ac2a053670287c2b08b2e43fdece5329f737de135201a7b15fd0fd6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRai1h:A3k03kB56rJ
- TLSH T164157B03E6840FA5D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.1MB
- SHA256 db448c08159758f14af3358f59f9152fd87597fbe1a6da7f8bbd6f5cb14b2de9
- MD5 dfaf6673b018cbb11c5c586f3d90e03f
- SHA1 c7a98d0ce39a9f71756150da9eb80b5da20447ed
- SHA512 b78915095de061b5d3c8df9ba984822c9dfbdc1b096a4d381b318af1cf064288c179991754d80932b48525246481933f867161e1766614e477b8156557dda3dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyry0LaRaiHV+PAk2hMH3:A3k03kB56rhi2WH3
- TLSH T175459D23E6940FB5D11F81309AA98576EA377C025F2193CF1354AE193F72BD06A3A397
- MD5 SHA1 SHA512 SSDEEP TLSH