Analysis
- max time kernel
78s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
31/07/2026, 18:52
Behavioral task
behavioral1
Sample
2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 933KB
- Sample260731-xjanqsfa88
- SHA256 ae299934b6933f87cdfc46fff0a2313bce6a8343a3397525c37f5ae3eebbf876
- MD5 2b6b687abe1987e429470e4838b63287
- SHA1 34403259dab4a40e1e2798204960b8122e3821dd
- SHA512 1cddf39ae83c24ad3530d19799cc40ca8fa001f6b823e128c3d3c2c8f7eabdb6e9d751daa17fce0729da6436991af985da6e1ef72de35362248f30923d933d1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiN:A3k03kHRJG
- TLSH T1A615AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 47 IoCs
resource yara_rule behavioral1/memory/4652-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243b7-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1928-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4652-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bbc-41.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1928-72-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000243bb-126.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126f-230.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021273-279.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-352.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021276-491.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-522.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000021277-601.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002344a-632.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127c-663.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127d-748.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-768.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-812.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021280-819.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a000000021272-850.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021282-881.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021284-900.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-919.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021285-932.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-945.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021288-958.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021289-977.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128a-1033.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128b-1071.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000b000000021281-1090.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128d-1121.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128e-1152.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000500000002128c-1177.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-1202.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021291-1209.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021293-1240.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021292-1331.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021294-1351.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1371.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021296-1396.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021297-1403.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1410.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129c-1423.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-1424.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a0-1426.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00060000000203b2-1732.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000243b7-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022bbc-41.dat aspack_v212_v242 behavioral1/files/0x00070000000243bb-126.dat aspack_v212_v242 behavioral1/files/0x000300000002126f-230.dat aspack_v212_v242 behavioral1/files/0x0002000000021273-279.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-352.dat aspack_v212_v242 behavioral1/files/0x0002000000021276-491.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-522.dat aspack_v212_v242 behavioral1/files/0x0004000000021277-601.dat aspack_v212_v242 behavioral1/files/0x000300000002344a-632.dat aspack_v212_v242 behavioral1/files/0x000300000002127c-663.dat aspack_v212_v242 behavioral1/files/0x000200000002127d-748.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-768.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-812.dat aspack_v212_v242 behavioral1/files/0x0002000000021280-819.dat aspack_v212_v242 behavioral1/files/0x000a000000021272-850.dat aspack_v212_v242 behavioral1/files/0x0002000000021282-881.dat aspack_v212_v242 behavioral1/files/0x0002000000021284-900.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-919.dat aspack_v212_v242 behavioral1/files/0x0003000000021285-932.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-945.dat aspack_v212_v242 behavioral1/files/0x0002000000021288-958.dat aspack_v212_v242 behavioral1/files/0x0002000000021289-977.dat aspack_v212_v242 behavioral1/files/0x000200000002128a-1033.dat aspack_v212_v242 behavioral1/files/0x000200000002128b-1071.dat aspack_v212_v242 behavioral1/files/0x000b000000021281-1090.dat aspack_v212_v242 behavioral1/files/0x000200000002128d-1121.dat aspack_v212_v242 behavioral1/files/0x000200000002128e-1152.dat aspack_v212_v242 behavioral1/files/0x000500000002128c-1177.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-1202.dat aspack_v212_v242 behavioral1/files/0x0002000000021291-1209.dat aspack_v212_v242 behavioral1/files/0x0002000000021293-1240.dat aspack_v212_v242 behavioral1/files/0x0003000000021292-1331.dat aspack_v212_v242 behavioral1/files/0x0002000000021294-1351.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1371.dat aspack_v212_v242 behavioral1/files/0x0002000000021296-1396.dat aspack_v212_v242 behavioral1/files/0x0002000000021297-1403.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1410.dat aspack_v212_v242 behavioral1/files/0x000200000002129c-1423.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-1424.dat aspack_v212_v242 behavioral1/files/0x00020000000212a0-1426.dat aspack_v212_v242 behavioral1/files/0x00060000000203b2-1732.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1928 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\Uninstall.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4652 2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1928 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_2b6b687abe1987e429470e4838b63287_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4652
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1928
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 ae299934b6933f87cdfc46fff0a2313bce6a8343a3397525c37f5ae3eebbf876
- MD5 2b6b687abe1987e429470e4838b63287
- SHA1 34403259dab4a40e1e2798204960b8122e3821dd
- SHA512 1cddf39ae83c24ad3530d19799cc40ca8fa001f6b823e128c3d3c2c8f7eabdb6e9d751daa17fce0729da6436991af985da6e1ef72de35362248f30923d933d1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiN:A3k03kHRJG
- TLSH T1A615AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$
- Size 1.0MB
- SHA256 cb337a1285ec7163fb8a73e593bfe0518a5afc15781b7519638e99b76200a7c8
- MD5 9513b114087eed54ae25d9a29c323ee6
- SHA1 e2612868714ad48a9189fe99bb269da78c61465b
- SHA512 e2c0a8284410f640c41430d09519f7f6c6d4a3533c6256f0992127610f2af14f37702409999b20d79e29cb2f8a73a8327c2b8359d4f8ecb209284022157b1acf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgi4Gen:A3k03kHRJII
- TLSH T12835AE03E79500F9E10AC1749AD68A22FB75BC521760A7DF1368C6152F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 72897245b784139ca78f02f5b3e0da64ec1ef4c7fa387bbaf4b974dae9f7a223
- MD5 f9ff5be75f9a7fc386cfc476fb883281
- SHA1 156d370579abd1708c9cb76b5a56ee02f9c075d4
- SHA512 e04d3dfe2a48e4c4e1b499e621751cd79e075a660d0461e67264bf5433b1de4b764a090ffea038196ded48ae34e277774f1cbbda5b220c33c15dc2c25777e560
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiZ0Le5ji0hmxNrM:A3k03kHRJGPji0Aj
- TLSH T1EB657C17F6A402B5D027C0B9C6D6965AFA713882173086CF1399C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 947KB
- SHA256 fda93f0e09571513229fb026bf6c8aeeec42f4a52a305936638a2e07e499effe
- MD5 a9608e0a2e247ed6646b1e30c92bc171
- SHA1 472cee85b6aff25209e7337937786c6a4dce0901
- SHA512 2e61a4fe9289728b19c14b04c0568152d6a617a2ee431b3effdbf1fa12e39950d38e9311242b09dbd9cd1efb134f75efdd68ee1fb009c476271cf380c67aed9b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiLa:A3k03kHRJ
- TLSH T1C825AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.1MB
- SHA256 46639209bc27d4a91ba1e2d0fd3c5cc3a890af2e1fd8c99f52f3b5bb5c85b590
- MD5 10e1be9e7cf7d891771a06a96f56a60e
- SHA1 963238105940d9bf75d11eb8fa35e890180ce3e1
- SHA512 980b561fb4833c2c3e0bb33b42cfee818e862ea614fb2f463d0891e6439cbd6cef6243436cb9091ee0f780d6f9e27d09e9b9e8ec30e32ba87db5fb0e21c58929
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiiD:A3k03kHRJ7
- TLSH T1D5354907E69400E9D10E8174D7964622FA777C5217E092CB23D8D63D2F62BD0AEFA397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 956KB
- SHA256 1863fc7bff8ba9f3320da5ec4c50b4f9b0012e9739b8709fca7b95832d6b5b57
- MD5 df60735a6c423f386a32083fdf4c1ee0
- SHA1 4112666e06e2c13d7372b49c263610415cce93f8
- SHA512 3353239406482c1db9c3aa7870f1be2f94a42cbea56946ebc827b8184c61cfbdbe278935c5d130d4ad1fbeb95043915e5f4313a2f7413e7392813af159d3d385
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgio1:A3k03kHRJ7
- TLSH T1CC25AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 956KB
- SHA256 1935d89144de9c67f98418dde1a6e0ea2bdbcec88449a06dadcb0a4f8dc525ed
- MD5 5db2ee3fbb5c7a3017526241528431db
- SHA1 dd14d7b4a864f6b8789ada01c7069d4ce4a2fe80
- SHA512 1869cd187ce0c4f620368f7e6e1c2d2f065cf58a8e990a129a4d39cb3a223527d5871634aa958c2d1b023f2110b4b30c93de0e5a021a6e7440654426571817e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiK6:A3k03kHRJw
- TLSH T1E425AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 956KB
- SHA256 06f87344fdf8cf83ba562fb43f6803ce5fd16467d2a2f2d3b62895d541a33a28
- MD5 70a02946d0b357aa93895e6fe978b640
- SHA1 0c4a9bf4ea7614fd068e36cec953380cc98db827
- SHA512 05a494b0a91cd9173b2bb82cfb31746e62bd5894f9998c9092b7f33523169f36ec2325bb5605bc74e3e92028050d06692f81278b14ef75b75558f2254e706a67
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiiN:A3k03kHRJt
- TLSH T17525AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 956KB
- SHA256 8611c9249d8d13169ff17b23d6a620dac0c42d144327ba541c95ce411c86c693
- MD5 ec721a82d37ff99aabde3e430f26e786
- SHA1 eef41c2f4c6e270283b7a1041c056e3194045e16
- SHA512 6996f2d5f2b5742948caeee649f8ca2be170c753c181706ac1021b0ebe1e8e7f3c20d266c994339567d6a648a7393018815bfb91cc2e09eac37d4d16e089fba8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiYf:A3k03kHRJF
- TLSH T18625AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 956KB
- SHA256 dc7e47fec6916e113b754fa8c932a7b3ce4f29b0f7960def15b0dddaf2568dc2
- MD5 16f199d5dd7c7bfcd9fe333d91658b62
- SHA1 3f9f9eeb6ced6ef3f95ad2fcb812889eacc14da4
- SHA512 c3ccd80e9f5cabb8d7c7ca21272dce31a46b710bd78984d38b78a7162ae1f43b307a9b7fe797736e84f54e6a006e3906af0b87e158a8b7a66b22ac28840ad9c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiyo:A3k03kHRJQ
- TLSH T1A525AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 956KB
- SHA256 fb5a7e07336dce2885c3eca4c799218805eb6c3d2b5094cb3df1bd1ffbc226e1
- MD5 582d356b68c260ef2241c7d42833fb17
- SHA1 2ac592696da9e77247d56cb680bfcd7bc3c8b657
- SHA512 715445f16102516a9073390f48d8f7ad6c08280b66dae80c40c2ff21f23bad3d8bacd2650d54f6f22f5020c0e2bf99c8af3695a0ff96b9fd7688d7b3fd1516c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgimu:A3k03kHRJS
- TLSH T16025AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 956KB
- SHA256 a8333925e78585da5369fc9e03a709621a3392e8b3b17fc83cae6e4aeaaa75b3
- MD5 cb085233ee08e96a9f3c33b7239181dd
- SHA1 81fcf73a29c8894a0ca3bd958a2849e20da6c589
- SHA512 f888ea64f835bf6d7ce5f25bb2eaf8632a897b650de6f9d6d3fae9f4f5cf1f32728467cde1d55a86fe558150f5ecdbed345b983d841c9e8a4d7b98f88d078ca3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgia9:A3k03kHRJT
- TLSH T14725AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 956KB
- SHA256 c9f4421656dcdc21b335409b883779c72b56eb76f37a900acba7aecbe324dc60
- MD5 4e7fba4ae425a1b1760fb8d1b1b07cf5
- SHA1 31ad90e582551f81a55a1dbd7215a1b37bfe48cd
- SHA512 ea48aa23d4b32f8131958c1f50e526737b6e5b74a72bc7187c482dc5542ef8dd2ada9abdc660ece6e83416fd3b5d61a406818b30b76a5d192489ed631d7c4d20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiac:A3k03kHRJ6
- TLSH T17B25AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 956KB
- SHA256 dcf7c519af7e6f575838f154dde9ab4bbd44e0ea02805d7867ef1edf15d3d0aa
- MD5 a8def631f03366fe3e0c0b16f69b38d4
- SHA1 19349363cfb550ea03cef5a40a17699f18c4d536
- SHA512 406a8b9bf93a09912748e61031544db9e59df04cef235d003e86ad7084fca36f5f53795767fb98812166c902467c3d6ecdb50905fe5368697af4a3bc93b9e0c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiTp:A3k03kHRJg
- TLSH T19B25AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 956KB
- SHA256 c06dc20247c4ca385ab6f61650afa48699516397bf0e4b2c25418eb7f5cef8b6
- MD5 6086531efd832cff28e6dfbbc2eecc96
- SHA1 4029686126fb72fdb207ac87ac40d72832ac1236
- SHA512 f6f6cdffea4064971286950582f4c72e8128c369a2b983791a3220b477081842d0e5104d0b7fea820b373d748a95a1997caccdb22702b58ad3d435ee93578955
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgi0N:A3k03kHRJf
- TLSH T17E25AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 956KB
- SHA256 ebc1fa7e125160af02176fe1b549ea3250e276be68b5184ce9351c765e287c16
- MD5 dd10c0d28ecb5719157ab26f26a6172d
- SHA1 c14d51cf4cd3b16fc0e2b7bb7deac827ea10aff4
- SHA512 45362f12027cd699b259ac44bbccb703bd5bfdd1e779648e83ca9064a567aae6f7b82454acbdfca58fe6a368d79a0efed7548e0d6f2f19dd203d0a4f4f3baf19
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgicF:A3k03kHRJ5
- TLSH T19225AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 956KB
- SHA256 4c36910a3d6136ed63639c4ba0c9637d6b347956b16f3b87590c274ae36eab1c
- MD5 1c2910bf06c17d5027969fb2fb9a9b7a
- SHA1 c4af3f5dd981119a56d073748086c25ca83a5409
- SHA512 b19cd65e12d75f391cfe2c9204c523f40f0da16c145dc94c42fa14ea6360edc4896bc34c94bb45263ca835fc35279cc23da6a08927b3175af026c4b782843fac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiJC:A3k03kHRJF
- TLSH T1E625AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 956KB
- SHA256 89d01d61c7fe33a0d78b264b5d8fa5fc7c2d3f86b9240715cfb8d9ad84f4dcc2
- MD5 0f7464e918d4a6fa7427a8ef85b0584a
- SHA1 4a3163aa09b20b5d34d549faad0682012221cb02
- SHA512 7300587995a4a7c2cde963f9a324f7e5e3882bcd6ba11607e73ea64c237becad3c1efdbfa1010351570a5d5def03cf26938bd0fcfacab27b10ff0509359c0323
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiqw:A3k03kHRJo
- TLSH T1A225AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 956KB
- SHA256 35717c560a1077992507029a903178e10e9af6fd7889a5ced02a93a0a46cdd20
- MD5 09e8ca387969133cb458dfe3dce145dd
- SHA1 613dc87e95548759cf18c7921eb8eee1b66d56e9
- SHA512 d456dbcbfc2e861330eb065ca6e96ac408f000a630aebdc1a721925acba5e4fcd36b4ba723a01d893feafaad0d6ae8d67d7579e9e3802a21d5a65819a3ed7aed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgixT:A3k03kHRJg
- TLSH T10625AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 956KB
- SHA256 e080a61f4dbb9d4f88859c60a903d35e6ffe264cb51f603e2fab21a3e7e2519e
- MD5 be486cc15ba6485584e21249a8eee0c5
- SHA1 92eaab2e22b6edcede935836a0a0be72aa347d78
- SHA512 fe0b5da6c71425027133d386cf362024eacb5dac2e61830c059baf60fe5067425a484c0965edf3871d72833a90d101c4a09d82e8d276649343df74cdd72ec192
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgifu:A3k03kHRJf
- TLSH T12C25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 956KB
- SHA256 fc77d6b114771ad322489257edcece4f18a563d8226b2ea23d4e5744e30d21ef
- MD5 f52f8ccf8db3febf9f3ba9ade6312176
- SHA1 46121176e081432810a9e8af18942b1449192d16
- SHA512 eaf484b9a7e858415aca8ff54de5c34b6fd500341ffb1fad401f99d0144edce6d3e87b4a3afb6cf2a849c28e859fcd28db1640c81e45429730b7864f7857015f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiDb:A3k03kHRJG
- TLSH T18525AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 956KB
- SHA256 ff0b8d8758c01da888c7aab6d4b11d297d09d3d6b60df457950acebef4e300ae
- MD5 12d956abbc43fdf134cb74239ee7dfe7
- SHA1 a715dc1e0d6e033bd7c112ec9701cbe8ef81e130
- SHA512 e8d49ccbdd161703ce06c78cbd50724bdfad32ecae83a1c9f357b4f46461b9edd9eab4b335d3bd6add2947a58d6f1c4aa2c40ec681056d5403c590a161e341f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiXf:A3k03kHRJW
- TLSH T11D25AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 956KB
- SHA256 71e54a65c024f207ffeb4a8d904f058a36871b6efe20a91939f23e3b6c36d9ae
- MD5 10d524bbbfa8d60dfa05774a4f05d4c9
- SHA1 a101401c5c103356e674d521ab78eebc92239948
- SHA512 91aa14a7cdec7e6068d058823f9ac46c45b49cbe3fda73c81b55c213be28e22d939fd5397511ffe9a7fe6ebd4bb8ed6a72d3004b73f7a083e2e22ca765b3a4df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgigK:A3k03kHRJ2
- TLSH T12925AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 956KB
- SHA256 06fff7394d707c7dd8cf73d068e6b32769900cd98955a7d4212fd5a9db107d40
- MD5 5d720fa77a3e630ed900e736ce974d49
- SHA1 667737733c6a6d2a660065571290b3181ba7986d
- SHA512 7c120a69652a65e62ed9e2902f91f69c2ae942d86558e528ffc09d89f15b13dca2ff6e30f4c532bd492da8b215c68ad7b65d0af82defd7bc4a6c64f721fd3207
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgidk:A3k03kHRJr
- TLSH T10525AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 956KB
- SHA256 09e4cc84bdaa41a34387de6814a86c637a0df526085967079aa5173231ef441c
- MD5 024608daa71e5caee66de07577558839
- SHA1 f280a9fd6bb6559548864180007c4e49d6662ad8
- SHA512 451383e699163cc881a731e01c9993384e713570c1d73229e7d8c7b0424feacf06eb96e294c1e7a93e10ed0b322e400415036961ff04a86785c638ae0f91ada6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiC0:A3k03kHRJ6
- TLSH T15E25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 956KB
- SHA256 1f3925ed622dc6d4f31795309b3cb403d8c058025fb9035d7d4368e670ceb2d4
- MD5 671adb3a5e0085cf0ca7fc4d2a4b121b
- SHA1 4c415363fa1e2f0431899b127e02e7828e7a25eb
- SHA512 bc621f40402c106aafcbb47f3ddb0080dd6231408da9f09696fdf689bce6237eca165e11d661f1903c706ac44b29a5d38cdae75e23b5874cd2a672f02d885ae2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiRg:A3k03kHRJD
- TLSH T19E25AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 956KB
- SHA256 992315217a6622a0ca6f1dc8285c04e99b3488a53ddff67aa1fdb860ef7d8d4e
- MD5 dcaae2cea02ddd211f4a4be65a0746f9
- SHA1 6734aeccc29db43bc150484d498e57cdc4d0eb77
- SHA512 a5a2367b2b8a5c414b921e35f60dee0b395e95f5c6bfd5926669d5491d8e539f8c08f9117c7262b15340aeb145cc7f9235ba13e52ced95ad2bdae08f74e8004b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgi4r:A3k03kHRJV
- TLSH T1FA25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 956KB
- SHA256 3444844b98689d0483ba4538c20c1142c9f39b6b504140e89ff6f6133d7893b3
- MD5 be4a63194592dbe734fcb0bd1787aec4
- SHA1 74aab9dc436d711b2e8805f07fcd132079d8f799
- SHA512 10a93b50799b335bb0e0ad456ac643be8e2fac549b38bc3f3b2697d54c14503dd54e99b4b41a5a9ea17e2817ac49b20306b87d3529cb7cbed96a7f55ab4ae338
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiWn:A3k03kHRJH
- TLSH T14325AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 956KB
- SHA256 941d989972e143f0896b20122bc5f030572c335f2231bba9825df1465a7c0ac1
- MD5 f2eb7cbd50b8db72dd150190e4af4e8b
- SHA1 671a0b420a7c0807f7b4e7f1044572cad7efe4d3
- SHA512 761732358abe9096477aeba583fbdd49dedf1b05471a2760c607824b59dfc61c041572710d652021b8e252d33f51d3b2f8c3361ac2f0b91f43538c4c40b8319f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgi8x:A3k03kHRJd
- TLSH T14225AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 956KB
- SHA256 5a009d602af34c677b1d174271947385b7c02371fbdbe0d21dfff6dd026ae24d
- MD5 a57dfc161ceaedd90ce43970c2424ae5
- SHA1 78ccdef3589544cd21769c5e968ab527d348bf32
- SHA512 87a02f3d275ca973299206c64d655cc0315cbaf564a60aa41ce960977a7d2955ad45b39941ce633a5fa2978467d72a1c6c6a450cb04604af59206a5f221434f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgi2A:A3k03kHRJC
- TLSH T1F925AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 956KB
- SHA256 12114520c9fe889e40312c44ac3884bdf7c5f9eace4094365306f61c90c62eff
- MD5 17ba93155eea089bf25722d005a8b71a
- SHA1 5450e32dda25d6a953fa188dbe720e4571feed5c
- SHA512 3e920992c89f9b2d1f3a784ea3cc41553873083144d2473f40bb992fa7cac54bccde654bb5adb0b9531d2bb9de4bfc2eface5d41972ad8b5a7bcca17307abc93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiv9Q:A3k03kHRJf
- TLSH T1AD25AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 956KB
- SHA256 a4056b5a227b32f29b9a1a7a38874b2a56ab21af56e58a35ba7d817c764538d6
- MD5 bb78cc6135fe0933c3d4b89dd49e8315
- SHA1 ed80f1089038f1652604e3ad0a04b0447840284c
- SHA512 7c4bde5eff7f1278b154d29963ba1b25728d5740574d5fa3cc8cb70372f39fb6488e107e49530eb2a66aa51009941a4b8ec738f3487665206c709896a259efa5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiG4:A3k03kHRJg
- TLSH T16125AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 956KB
- SHA256 02885d5a2b6ebb78bb9da95e57af08e9e39bcff457904bb135ce0a73b2d82358
- MD5 c7face6a57935867c30c094f6883eb4f
- SHA1 5feadfc3135ee2428262aa889e23d6f23356624c
- SHA512 ca1fd75d8b6651cc3277f77d8c6a60ffbdfdb96cda2571f87c0319c2949647f39722902cafcd461e81dfd9d373adba092e14ced6a034cd5827d61263a2d7ba15
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiVu:A3k03kHRJB
- TLSH T1C825AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 956KB
- SHA256 db0447d06ee9e3e463c64a3d144730b4318d81a698fec9bea3953d4d83eeb2f3
- MD5 b7df4bb7c5dfa2898eb74c89d70d53aa
- SHA1 59a9b6a0df4c3d277e46eea963b9bed598ee8408
- SHA512 eb5ef16d154416844e842a964ede81d2337f29cb90f5b3e693bf9b0e344ca99334f117fc68c00bd6138e588ea7268dacc56f596b286b062bd099ba4184a227ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiIj:A3k03kHRJr
- TLSH T15025AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 956KB
- SHA256 b5362189c39728ee2d3b48506ddf6349c0f01350360c596bf4107cb0240d334a
- MD5 e51e0a16a0b1b5e291d2192c5bf44f24
- SHA1 3bc67590668bcd140f5612cd3978ccb3a4b0a378
- SHA512 cb09cbbe4746cffeefef5f132c56638e877d7240ae9a75e7fed28168f8bf863246677ca969aaa4434685e56d69b763b7a71e72e4195f91d2931976eefd146e51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgi5g:A3k03kHRJj
- TLSH T1BB25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 956KB
- SHA256 9ab6db75998a4fff3b7cf83fb25d007b732f07b01b976fd8639356a1d2eb7dbc
- MD5 1c91759f6ae7d9250cb9968493bfbb68
- SHA1 ae55cff3033ced648fcb1aa8c28bddc714766a9a
- SHA512 f1a7da17e70cd8744457d7e76be161389ab94e719c43ebab0e5d4ba22630e9653fd266e530e327daba7344fb91a57e788d15d9342328500ea64a4dbe988bbaaa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgigI:A3k03kHRJq
- TLSH T10325AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 956KB
- SHA256 d581e02f9859ba1ce8003e71ec2c5e9d3168df5eb89119a00cfa679b2680179e
- MD5 cdcc9a284d50987bb5cb2230d57cba07
- SHA1 90e1e31704013858191c1c1e07a9e2c267db2db2
- SHA512 c3b87f46f2273623389f8b17b137a8d601680ebc3a1671eb913dd48f85a8b1fb391f5199ca160e85c5cba4e341f7546ca724ca04dd549fc28d881961aa0ea484
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiio:A3k03kHRJ4
- TLSH T15725AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 956KB
- SHA256 8565d1a574d82b049499ac4e5b81a3ba5dbcd727f7d1d6d98daa38c218f67a24
- MD5 ae89e484a4286e57626f67cebb830663
- SHA1 bb2658e766b033306900f3f54337c9d312ce22ea
- SHA512 8353c7b40243dd83b10ddfef9a7f4c89a561e19e17e75cea0222154ec2c2f14522712e846c763cf392e9b3d533949ed5a4725fd4791f0a10c715d6ae3fd6b148
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiZ+:A3k03kHRJF
- TLSH T13225AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 956KB
- SHA256 94f1998afc665e66ba34803ceb7688ad0c1f19e0fd1ecee0c16c988859efbc2c
- MD5 cd8f1086b37fe7c6d8c7439c653ec39e
- SHA1 5a96f81b0ca8a2815fb28f5659b439bf2790da81
- SHA512 bbb0af29e69736bdde57944a8afdd487bffdabab1b10820b81b3a08fa7add60b3919eb82cad9e6c98b12d65726407b68954ce37342e30f4b7e50894d27e08c7c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiHQ:A3k03kHRJN
- TLSH T10825AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 956KB
- SHA256 65eb312391abbf62cc7c39906b5e16bf26004c54385851a5807b39819ca010e9
- MD5 fa28ba15cbe5cc6049951ff92bd1d449
- SHA1 c649865d8240627cef4e53ec339a929dc662d137
- SHA512 91f6d8aac36825bec5e2a26328fe38ffe79fdc34b978bea4d0af3339fc8fe1e20d5fbcf9decd8a1ff528ff8bc3c9473034a1a9636a18098da87b7cbd33c41a5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgicX:A3k03kHRJ5
- TLSH T13925AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 956KB
- SHA256 a0d3f425e96d2883509b81bab14f528dd75bfbc44793070febaa58d03fdd5279
- MD5 9db6c68db72b6ac943b88e3d0ca67059
- SHA1 0fdd45aaed23e1fb3fd7fd4cedbe7815e9faf9bf
- SHA512 eaa2195bd628c3869ac268950420027951cdb9471a9adba7231383897d0ab80e9d07e8c1304ae44c8260596e37efd307201faed300fe17df1add0a3b13ed345e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgiaL:A3k03kHRJz
- TLSH T1DE25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 956KB
- SHA256 fe0dc938497c54f87570d189381b919e0b707b708a3b8a211b9180e660e2265d
- MD5 428a3b3327aac396f488998a47b988b4
- SHA1 56264c7cfebeb78ad6f7c6bed11656f3f9db8f7c
- SHA512 c4effc46f9cd943634ac1ff8558fcba1e3000200d3d35d1826e2b9976cccef70338529bcf6bb56020406310c45fa1daa34a438a2db752e348ec002591d53c638
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYgi+M:A3k03kHRJ+
- TLSH T19025AE03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 956KB
- SHA256 2344803de3d5df28a3c66c73e5b18d72576c65ea15319c8cdadfa395922c6a20
- MD5 b6b1d2a655f2efab585ff391ce287e5a
- SHA1 8078d9294d49aa61af19c4a1ef3a0f854deb069d
- SHA512 523abdcc196dcd1faa46a22e3b7c72f9c7bde27021ba7d9da05b546829681462c872887b6c3e7043603c43589a46a91060e5e0ef01bae2f93a621d41687e3006
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasTYginh:A3k03kHRJQ
- TLSH T15B25AF03E79500E9D10AC1749AD69A23FB75BC56176093DF2368C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH