Analysis
- max time kernel
95s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 17:28
Behavioral task
behavioral1
Sample
2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 939KB
- Sample260731-v2byeaxcpd
- SHA256 8f2d1bb187fd4eb0258989db4c748ab400f8ca3e2c66be2be482fd4d8b097236
- MD5 95a33d45f4e8e1bcd93ed07a2311b9fb
- SHA1 185ab669ce3d60682108674cf6088189fb390878
- SHA512 937a0930137916a8bdb5a93b2c3254db6f58b8cb85c5351d12b082db66c10c4dc4668c3ec885a6a698be562f78aedcaabc74cc51295852f23cf67817c24af206
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sN:A3k03kB56r6
- TLSH T1AF157B03E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral1/memory/4260-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243ec-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/436-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022be9-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4260-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/436-72-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124c-273.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124d-442.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002124b-491.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124e-510.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021250-595.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002124f-626.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021251-705.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021252-731.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021255-763.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021254-789.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021256-825.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021258-856.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021257-875.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021259-888.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125a-895.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0010000000021249-914.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125d-933.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002125c-953.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125e-991.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021260-1040.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021262-1053.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021261-1090.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021263-1103.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021264-1140.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021265-1159.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021266-1178.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021267-1186.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-1223.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126a-1327.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126c-1346.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-1371.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126f-1378.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023190-1660.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a00000001e0b7-1673.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023002-1903.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000001ec09-1985.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000000073f-2102.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243ec-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022be9-40.dat aspack_v212_v242 behavioral1/files/0x000200000002124c-273.dat aspack_v212_v242 behavioral1/files/0x000200000002124d-442.dat aspack_v212_v242 behavioral1/files/0x000300000002124b-491.dat aspack_v212_v242 behavioral1/files/0x000200000002124e-510.dat aspack_v212_v242 behavioral1/files/0x0002000000021250-595.dat aspack_v212_v242 behavioral1/files/0x000300000002124f-626.dat aspack_v212_v242 behavioral1/files/0x0002000000021251-705.dat aspack_v212_v242 behavioral1/files/0x0002000000021252-731.dat aspack_v212_v242 behavioral1/files/0x0002000000021255-763.dat aspack_v212_v242 behavioral1/files/0x0003000000021254-789.dat aspack_v212_v242 behavioral1/files/0x0002000000021256-825.dat aspack_v212_v242 behavioral1/files/0x0002000000021258-856.dat aspack_v212_v242 behavioral1/files/0x0003000000021257-875.dat aspack_v212_v242 behavioral1/files/0x0002000000021259-888.dat aspack_v212_v242 behavioral1/files/0x000200000002125a-895.dat aspack_v212_v242 behavioral1/files/0x0010000000021249-914.dat aspack_v212_v242 behavioral1/files/0x000200000002125d-933.dat aspack_v212_v242 behavioral1/files/0x000300000002125c-953.dat aspack_v212_v242 behavioral1/files/0x000200000002125e-991.dat aspack_v212_v242 behavioral1/files/0x0002000000021260-1040.dat aspack_v212_v242 behavioral1/files/0x0002000000021262-1053.dat aspack_v212_v242 behavioral1/files/0x0003000000021261-1090.dat aspack_v212_v242 behavioral1/files/0x0002000000021263-1103.dat aspack_v212_v242 behavioral1/files/0x0002000000021264-1140.dat aspack_v212_v242 behavioral1/files/0x0002000000021265-1159.dat aspack_v212_v242 behavioral1/files/0x0002000000021266-1178.dat aspack_v212_v242 behavioral1/files/0x0002000000021267-1186.dat aspack_v212_v242 behavioral1/files/0x0002000000021268-1223.dat aspack_v212_v242 behavioral1/files/0x000200000002126a-1327.dat aspack_v212_v242 behavioral1/files/0x000200000002126c-1346.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-1371.dat aspack_v212_v242 behavioral1/files/0x000300000002126f-1378.dat aspack_v212_v242 behavioral1/files/0x0002000000023190-1660.dat aspack_v212_v242 behavioral1/files/0x000a00000001e0b7-1673.dat aspack_v212_v242 behavioral1/files/0x0003000000023002-1903.dat aspack_v212_v242 behavioral1/files/0x000400000001ec09-1985.dat aspack_v212_v242 behavioral1/files/0x000300000000073f-2102.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 436 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\notification_helper.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Maps.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4260 2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 436 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_95a33d45f4e8e1bcd93ed07a2311b9fb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4260
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 939KB
- SHA256 8f2d1bb187fd4eb0258989db4c748ab400f8ca3e2c66be2be482fd4d8b097236
- MD5 95a33d45f4e8e1bcd93ed07a2311b9fb
- SHA1 185ab669ce3d60682108674cf6088189fb390878
- SHA512 937a0930137916a8bdb5a93b2c3254db6f58b8cb85c5351d12b082db66c10c4dc4668c3ec885a6a698be562f78aedcaabc74cc51295852f23cf67817c24af206
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sN:A3k03kB56r6
- TLSH T1AF157B03E6940FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 d282a53f48b8234e28765d7b997a5c605573d47ef80777853a1ecabc6385b281
- MD5 5da29b82fe668d3932e4af5fd63e1184
- SHA1 5bd3a291c5eeefbe11d1a087656db64f48de8371
- SHA512 434cd6f8885414d93fb7c9288710cdc957ebf7f73fe4610b08db2cf45860d12c02fc5f79d2e726601865d466753016854a6dd42423db4dd7fe3288b5e74d5411
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2s1Ur2d29dBrtpDiI:A3k03kB56r2UidGl
- TLSH T12F657B02E6940FE5D01FC1748A968662EA737C561F20A7DF1394AE253F32BD06B3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe
- Size 1.0MB
- SHA256 fa7df9fab335fc63d662a96d9e5020be05cac9254eaf8a6e9e14c5ab62eace59
- MD5 57d8786143d15e339e0bca0795e12da7
- SHA1 c3686ecd0d2475d184af1a0e1ccc858f0b24ef02
- SHA512 523325a560566cd180253a4b01eab47cc871f14a1d707fb94b171147dbacf71bb0cf14ee10b0e03cf04db440f7ec3ec884b0e2c1e67de66984f5b023bc210c1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sHbBPzBAU:A3k03kB56r+BPVAU
- TLSH T120358D03E6940FA5D11F81349A958672EA777C121F2097DF2358AE153F32BC0AB3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe
- Size 1.0MB
- SHA256 254cabd233e215877d8a0e5b8be25a1a84b52bb6939512b28e66b92785101ae8
- MD5 c19b3529e82ac0547e91b366c6919ed6
- SHA1 72f8901b5553149a3835d5711f18c82a04ebd38c
- SHA512 a6d2e3db1d30e93701971938a3174f0d97368f60160f180519ea8cf0f92b7fb6102ab8ed4c9d844266486d0dac8ae2740b143002fb89d3c1ad9e38c208749175
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2s4Gen:A3k03kB56rMI
- TLSH T1E9356A03A6940FE8D11F81749A958662EB737C121F2097DF1358AE153F72BC0AF3A697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 1.0MB
- SHA256 654637e079e6dc0aac0477f4bf9ca9eee99fa341e4efad3f703a3113f733f9fd
- MD5 2d5e2b21f56a1ae7e3b28236af51abf5
- SHA1 a2ce1b8203d7d8875c073254ef9472ccae2a9ed3
- SHA512 0fa41e6641e1cc87e99ee6595b29f78f037575e904a21af3eb74588d2ba90f9ed0c44ce0a41945a39289325713ea1fb1d9342bf4079168a1cf3332d857ce0b73
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2svTjE:A3k03kB56row
- TLSH T1C5356A03A6940FE8D11F81749A958662EB737C125F2097DF1358AE153F32BC0AE3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 7ddb7e6612be912cb0e7ddde541c63f22d7f2d7254a0bf59acbfdfe48caff9f3
- MD5 706c687354a6a11b6a9a5769c37ce83e
- SHA1 5251f85ca9c9ec1b4a8e3d667b4205e3e7a028e0
- SHA512 525eb863bbcf9cebcda3a4dcbbe260387abd3c53fce5cabb9871de5964fdfe5231fde36e85ce79d267b0a310bf9ca0860a3817fa1ce0241eadadca1f24ec2cc6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sZ0Le5ji0hmxNrM:A3k03kB56rKPji0Aj
- TLSH T199655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 953KB
- SHA256 f38b71a83b3e5179b4b8e5485f91278f271a18f62b402753309ba46de9261962
- MD5 5d1486f8f76d82e37b2fd25110ab0bac
- SHA1 0e90a00b41223ac7c7207bea2313c2242f3b33dd
- SHA512 dbaa37ee2a9135e930578a77f701a945bbf6d6c5cd5d838a5f5e0fe3f44515303b6e18e0a7f394238f73725ad43ad969604a97a5ede50aa7915953491beeb6d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sLa:A3k03kB56r
- TLSH T170257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 962KB
- SHA256 3563a20add1f41abab13f417c6f6eb5c86ff67abb74d621d8dbd82e3f20df5bc
- MD5 5afa13038529372293969c49d5210479
- SHA1 97e45527bcab767aad17b3ab43b7900c5aca07c7
- SHA512 f09927163eb67a8e2f46977a7cc46a847c6efdc3203f7913f881d29aa6ff29032bdf44e000d7940fb91dcc074ef0fd83f4b2ebf5be417d4f5b65fd3e0f74873b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sa9:A3k03kB56rf
- TLSH T10E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 962KB
- SHA256 dd29e0b278097ca4fb4e3ab885c9ab9b4bf5fd249b4dab7ff75318ba3d54aae5
- MD5 39eb45c905da1fae868dfbe4c00a8245
- SHA1 a0a019cd17ef18e962f2a968108d403eb97430b0
- SHA512 ffcf481586cb5b1670eed6cad9da5705ba205b774a3603a2999d32085d749ed10314c820531c31032447cac5468285007ea676f49760de16818b369a1201fdca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sac:A3k03kB56re
- TLSH T116257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 962KB
- SHA256 311bf1bbfac3e8bcf2f70c03e460d411747d59940c7610d006262558ee9eeb85
- MD5 ff7eac2a7d136fdd4ccced11e89dd7df
- SHA1 4f37b6c0dde988f8c2673468ab056b8feb52b4dc
- SHA512 c84a21e805aa5e5c22a961c3584ec903c3dbe4d36c4e8a13e578fa8fe148d3d2b550f9791df8c7383b1f9f2830c07b0c46500e4bda161d16b023f604dbe50d97
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sTp:A3k03kB56rs
- TLSH T10C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 962KB
- SHA256 5de778dcdd45b30b5ea36a42a61a97b79aa99c80cd60d9e46ac4209e5216e946
- MD5 b80d54359f4261ada54eebdb85a1a679
- SHA1 f4db8ee26a3b525ff2c7f37e9cae027ea04eb60b
- SHA512 12a3511560a8f735b8ebdfe5a9ac025ca9c48738cd2d61c2d7217ff2d24aa248d87c450f2243a2521c5f77289d01d2ca2a9f8581b5ec8e229f3f36e687c8b402
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2s0N:A3k03kB56rr
- TLSH T18A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 962KB
- SHA256 5080f9dcb62d92949c41e8b2f70035f5fa6d7ce624808622a2e94055c7579557
- MD5 169ca3586105f97f0cf268d942046332
- SHA1 7ae0132cc61ff3401aa8a9608bd5870c071ca75c
- SHA512 d1564be0fb83ce6fa8ea44ab7adc7cd38313bd9e344b8c8e1d8719137b47a034071f8167f47db11a204b5c32ce565427fe2d5f84d9b404f3405946e6d75854b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2scF:A3k03kB56rd
- TLSH T16A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 962KB
- SHA256 3975b599016b0c33fe6946127e327a4674cb730a522199259d9eaae5292a5a9c
- MD5 39d4b911ce8136c9c3614308cfb552f2
- SHA1 df0c5b0b5fbc8c0b722d86e737ddeb6f082f9c97
- SHA512 c0ee513def09e669c6a728551798d8f051ac2ca32ecd9e61891872f9cf348e639b00a84fb2a3864bd718e821186c7d86bcdf36f2b472100412995409bc4f697d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sJC:A3k03kB56rB
- TLSH T12D257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 962KB
- SHA256 01ff8188ec4981f2dc8705ad5677f4797990b76d223ebd9db2b8e554d958082c
- MD5 0b1afe8296cd738b5daf9be5f215491c
- SHA1 5f52e8fded9dc172d338152161bda728d9af5ddc
- SHA512 18db1aa48a4119906cf5a18999554d70ba4646262b378732a92eef61e9fbe058a5f5e3b735705ae1a9d18501d884fa8bf0dc877d7dbf9974fec94d845db0fbfc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sqw:A3k03kB56rM
- TLSH T11A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 962KB
- SHA256 57339ddebc65a405697d6c0e4154fa4b59a9e169ca2ad5703a1722e27c111379
- MD5 ad8c3ab27d52689e7424e2d641ee2652
- SHA1 391b73e182866d07678a5c5c60524bfe405da55b
- SHA512 19c2eae42fdef3fc5613aa4fa59841b725e2f108070e2dbf83ab37a2c4ffad1831c4dbd4d96efc29c4c70ea79456b25e4a57b78fec069bea4217cb5205ed320b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sxT:A3k03kB56r0
- TLSH T19F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 962KB
- SHA256 54e497799bf38b845cb684cda96e0c6de9ccc27fdacf684bf5723e52908b666a
- MD5 05d43443e53d4bd0248a5fdccbac9c06
- SHA1 3a415f447648a35942f351df88194ce754b98e76
- SHA512 b4a20bb5a4b792a6c25256fc5ad2bc9099a119efa94e5f25e4071b5f910b73e9214abbd12308fdbef82e176e055c7265f51f8f465cc29634195e6829b442d713
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sfu:A3k03kB56rj
- TLSH T1A3257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 962KB
- SHA256 6951e87511e75efd0af151fd7c5a2c2fafbfbf98163a16cf26539fd45f425ae6
- MD5 917e658373d29400883eae4a3cc796b7
- SHA1 8b1a71a308fb4de932e64f3bf38adb18f073da66
- SHA512 94dd5546a744a72904f083e5d9e1344841963dd57266c0b2b58d8d97e5ba5346615aa4d4225c1bc4d0a17afc4e72f750f461d4eace62f3d824f35ebda1c1e4e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sDb:A3k03kB56rq
- TLSH T181257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 962KB
- SHA256 e0d9ffb2652aebb74e7929abdc3fa08c42e26ad68aa9914fb1dc5ef22dc8456d
- MD5 e3cebcdf724bc24e56057a15f053fa47
- SHA1 8e92754a0de3fde4149b2a58f911442f82bbcfe0
- SHA512 060c046c27f11ed523771a2bb12a9392fc1af377419d5df8774520732f6caa97e90294510f4223127048853ecc6a9c45fadb0c27ec4b6b789d1979ebac0f553b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sXf:A3k03kB56r6
- TLSH T117257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 962KB
- SHA256 104457550764b8d327fab6c297948946b033a51af86df80097c4e200ef318077
- MD5 f34bd8b413e9100e98bcc9cafeb088f3
- SHA1 a8014d9568d2b3d4c1ac7765160537439d286a4e
- SHA512 64612895813f5fd884cd3044ebed61349dc214ce6aa1a709b0770d90d1363d88ad03a232cffd7756d73042766649fe4dcac902b256a417ce2fd113fbc938c14b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sgK:A3k03kB56r6
- TLSH T1C7257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 962KB
- SHA256 beb5e96b354b323f7dbb2046b19948b1582f8837ea0a394fe0e69a450bfeef7c
- MD5 cacb9fed2a1d9c654a9ea0a21f637fed
- SHA1 a3bde858e5e03a3e70f2dd697284a0b4a423fd81
- SHA512 a4e2839dd07a961b107082076687486b82396af9fd1ab5dd0c640edc1393e848ff701e30c543f5c48de678ccbc91d39a95a216c6d51b5387a12fd6af6a306eb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sdk:A3k03kB56rf
- TLSH T14E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 962KB
- SHA256 05c06477343ead40b06e896b723267acfa057adda2880e0ea902dd73b1f93d6b
- MD5 d91153870761516ed76ddc4cf66d691b
- SHA1 eb1ab78b8359f7aebd34b36f28e2eec9f89a2d11
- SHA512 6b58c9f4a4852a748abe7971c5a638739e93325dfffb436570f311a9e97dc9b00579a84aa45a60bdab71962d1b1384a3cdc39d02690b5572ebdf92649629199a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sC0:A3k03kB56ru
- TLSH T195257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 962KB
- SHA256 302bacae7510b41dc07c54c69d3bc70b57e0819cd83c1c4368d1261b08f61415
- MD5 f55a656974d103cd0aba544deda74f89
- SHA1 b61a7879f6a3f698430550d8c5633c305d9714e1
- SHA512 3848ad0d55648ddee7e9ec1154a1ff88ca82c80241ce5e1d5d326be23c3dafb5997eeac0fb6e3709746b09a18a03ac68a762ac2fec5c0c8f080018f2ce010471
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sRg:A3k03kB56r3
- TLSH T12E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 962KB
- SHA256 038401fe7d6edb3c4ec5eac801990076142e38a349b73bbfef52511cec65ac2e
- MD5 a0128e1d292997ecf8e2716d528c3ffb
- SHA1 0cf9138312980b56377622647131467c3be956f4
- SHA512 ebf3278588da61066d11b66a76bdb5f7b396b7f88a7e0a91449a4c9c9635c6ab116cfbfdd4e23cc4d28ea9ad852afa52a4179eda5880f47fe24ed7c74ac487f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2s4r:A3k03kB56rR
- TLSH T163257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 962KB
- SHA256 ad803c86dd1333378b400c8ce7762189275a24e85ebda423ee82aae123bfa5cf
- MD5 8341efd3340c8f063a7a226cfcfe9a11
- SHA1 009f8a2245a20103527b5754fa0540208a781c9d
- SHA512 d362b184113cf7a77753200ee874576a8c2ad5430fa4e2307ab1798352d3c6938874cfc5ba3105fa98164b833b796eef1711a9699ca6ba64d1307bde7a6815bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sWn:A3k03kB56rb
- TLSH T1C7257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 962KB
- SHA256 bfdf38648361f4238d3bb15016105c746016137f1c6eaa977795b3501af9a207
- MD5 a3b522521ada3941dab0308df055f6fd
- SHA1 d8d03fb11792e886506d37fc84033b71e2ee48a5
- SHA512 acd307b11d494e76f1ab2c7e877ac328a9c3285e6ad8033db28f755f2f474c8346c5d4ca2b4352c9d39edc89a14066f8ee6685e722a5055a111e8d630ce53527
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2s8x:A3k03kB56rJ
- TLSH T1F0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 962KB
- SHA256 f9e9acbd519af7d4ee466df11d9b118a657ded19e01b0537c39965cb2b70e2f5
- MD5 17534e6c4b8dabec233fb35b7f95e226
- SHA1 d26f5e1b6a449050f53f4c8faafdcbb2692d6785
- SHA512 d4956f18e785dc9925007062d6f168a7fe07ae2c11186cb1d2ab85af98eb2993405f3974fe5235d9389c26633fccaefe8f59132d758ca5baab1d6728d2069301
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2s2A:A3k03kB56rW
- TLSH T1A0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 962KB
- SHA256 9349a1bedaf512db822286b256b70c097fdc88be1824f726b17732ce4012583d
- MD5 ea466df9d3dc43adcfd19a3b305e727c
- SHA1 664a1401f1d551d052df1297a0e60c76f132ee01
- SHA512 8f692e82da74ed8b213947256628bf96a6cc9d2294cbe484011c7279a6ffd5af35127a6023129fbe165e2bd05d19311d827eeab8e07a1bfdd77ef7b834e12503
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sv9Q:A3k03kB56rL
- TLSH T1AB257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 962KB
- SHA256 2781ee20053c25356075a9b3f84f3de46b2ac895f9e86925a2de81cd6564d46c
- MD5 79338fb51925aff185d0fd0fc6c352ca
- SHA1 2a2a97a782ca002dec8278c4cdc8e84e5d8b90f6
- SHA512 b12501fa8f808ace9c78e9e4ff1f00c4cb050f30a58528fa82860ed0432db6e9bbf11a37935ceb05386492d0d12130688499be3b93316174d67c96fcd5ad05da
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sG4:A3k03kB56rc
- TLSH T142257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 962KB
- SHA256 c52ae69664fffa55a30fe70f62cdad28481269c8ddb25f05e49c23e7d36e4049
- MD5 661f4f144d01c19bcee0974e6f0f0b92
- SHA1 c4973bc42d017657b34b30afea4a7ddc15fd6376
- SHA512 da1b6869dda7850deb74d47e409d7d782859527ef4380a921d8907efd6267421851143ce5997b7e4d41ab458b19e2fffd36b8acfabda75ecefea68db41c21233
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sVu:A3k03kB56rd
- TLSH T1B0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 962KB
- SHA256 e10c4536c44b6b6eaa77824f628c92e16c5a31f5c371b16b324711f39d0102e1
- MD5 0b4564d612ffe1d4f93c513733f21185
- SHA1 e258da26b94f607992dc3387876fa3989c9f8cb3
- SHA512 5f0e6734821f2d7644433514729366bc38d93249cae5bd37e4390d1a4adbcc451f97be498fac2d331384ffbae68bccd3a241956891c3671e515262110be56100
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sIj:A3k03kB56rf
- TLSH T1E0257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 962KB
- SHA256 de33265d12aea15978e436b9d7d10fa93a51b5479ff97bd5f856a66985bb4177
- MD5 5ace9a5a5d80008e78240b9a528f6f7c
- SHA1 9fa418b3162ca5ddb50b6eb753618cb8c3d9f47e
- SHA512 c4ea6c115c92c33d195dc8dbe123c3e1661add33e752306c75a70c8f3f48a6af96d4fcbc816b3ef2d68bb431cdb1933bd300eebe5ced0170d64ff2e1e1a9931b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2s5g:A3k03kB56rX
- TLSH T1E1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 962KB
- SHA256 882472742207f4bd6d21418c8857c1a7e15ce74d984c37650d03ba1ab8133d29
- MD5 7cba52515a8225cccc02044218a6697a
- SHA1 ba0ef739781a241cc10b25009d81dae32218f2aa
- SHA512 186dea97e2dd2ae9ef8991ef4e26ef39d85d29fcf121a544fe4bc8c9728a9fb7e4224fac6ce17076868c8ea324f29cb1e8e109c986175a6e629f2bef1c13d7f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sgI:A3k03kB56rW
- TLSH T1AC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 962KB
- SHA256 d49c8791c4ee947eb8df4dd6a309e75e074888fccb58f418131608880dcfd7bf
- MD5 1cb35a82d462401a0afab0ef1f16b117
- SHA1 ee35583393d18ed51e049dd6b3e22a297008eba8
- SHA512 d3f3038759ae8249fba847d70844b827349f1fb75de022db6e62a975a8baff2c9c88c9c85d5bfd1ed63be2b5ab777aee3953272ddf8eace86cef22565ec6db42
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sio:A3k03kB56rk
- TLSH T1CE257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 962KB
- SHA256 941003b38d40e003ba634029c1678bcbb98b3ab583c7f6cf09c2f75c657115b0
- MD5 6a0ec3de9a7d5f358246f76ffab15d9f
- SHA1 e9eac232e12d03643090e79fb76d36ddcf73d138
- SHA512 8c90a18f14301f71add0bfac3bb96b7e7d5f6a9c3b089d55e94cb1d6f2b15f0a595caf09e6c2c34076f78dfee4065e885876c1e13eb37061526f5323a491dd11
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sZ+:A3k03kB56r5
- TLSH T118257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 962KB
- SHA256 c566367c75ef01757facafc4bf25db33d39fe70586e9d3ffc4120b5eb126a8ec
- MD5 e0989a52b55f2dda2d478625baf8e3fd
- SHA1 3db1f5eb5bac66fe4fc078f91f8eb0c9889545c1
- SHA512 68383321e2ff8f272b3aec804b86127a5f8a0e12b0318f97b0ece3f17cdfdabb0a1410d92c2d7cb69a0c9fc96a16abf14b3fcc431dbe06c47cef7a74b5c9d0f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sHQ:A3k03kB56rJ
- TLSH T199257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 962KB
- SHA256 00278f69e94194742950f926295d624c5058e5ee3b1e36134605870bf5aff4e8
- MD5 c0f1a78fe959ab6a636713b40fe78c30
- SHA1 114df32ab96724a63ac33e579a1b823b74516670
- SHA512 d961a0e8a37512448bf36b8a9a720697e4ae54ac483b1b8d85ae2ffe3aab8d03e2a04c2a12995d38c4320bd42bfd48e8252c73863a2a6af6421b2f0d842e4a07
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2scX:A3k03kB56rV
- TLSH T1FB257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 962KB
- SHA256 1f0c88ca8c0717cc05f50b09cca25b3b842fb00df586025a9d3e5b613336f125
- MD5 a6633c282201a3e73faf9c8c4f5374e7
- SHA1 48c30cdf19a0e3c56a638f7b6935d3053d6dd1a3
- SHA512 d9ebd1ee02876e4ed97485c45e0ffeca7067c08b37483a5aeeb73434379b11d68b127e394be4ba18ca8a44b87de62b42ae2b799999fea94216b280e3f1bfc04b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2saL:A3k03kB56rH
- TLSH T130257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 962KB
- SHA256 0d6008d1a4024f928f7199561065abf5c96524d6d10c12d8ebcc1484f969ef54
- MD5 a4f3bab2a085f72e412b4f880a68c460
- SHA1 92f56ded583c4baf1fb729fd7d634a5b024b4ec3
- SHA512 b7a86d7585617aa7f13ad5d66e46da1702aac6c0381f91f280b9dee1f7e3c196099f643e74e96ffdd4719f08027e54f861dcb45a4afc936413fa5e8ad18ccd45
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2s+M:A3k03kB56rC
- TLSH T1CC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 962KB
- SHA256 1858f02800a4ab61e2a922f6793d9f50a315ef3ee8266c5618167e781248ac77
- MD5 fb8472d518c870b1ecfe9c3e3665ac75
- SHA1 bce44912155eb26ff876c8abd38652bbcb8873df
- SHA512 1e6b7e58b8f4a3a4b3f14409d35bb233b6911249bbb38ad021cb442a8e057252db6cc369239adbd5234877a1efdf3fb3e19e359ea6288ab9ceb25e4e6c9f68b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2snh:A3k03kB56r8
- TLSH T12A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
- Size 1.2MB
- SHA256 dd4e65328101218ec5e4f8407ecd311c874bf6c7f88bec4bc5ed5503b01cbe92
- MD5 34fc574600035404f31a9c33ff42b447
- SHA1 663317a4b5fa9984b6747f5ad22f96c703c2820e
- SHA512 b6dc825ce6d3763d4e5a7e11a1fc348c0f2a2d259f1d4cfbe5523228e8fa07d312fcf98d5e704c911a04005a022d478eb03a39a0ea3dbd8f289a41002eec6b4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYagsLc2sJV+PAk2hMH3:A3k03kB56rYi2WH3
- TLSH T1D3459D23A6940FB5D11F81309AE98576EA377C025F2193CF1354AE193F72BD06A3A397
- MD5 SHA1 SHA512 SSDEEP TLSH