Analysis
- max time kernel
96s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 00:59
Behavioral task
behavioral1
Sample
2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 921KB
- Sample260802-bcajha1set
- SHA256 041da9da4211595fdaa3c2d116e21d04ee56cea0f7d91d8dd8572dc63d215813
- MD5 397c68bd9b0317e872d0279ead7722d2
- SHA1 d5ebb52f1d0dbc57966c112d552f5b2897c11a1c
- SHA512 22093665ce5b7d50bf443dd8da7e465002a9e08e6038a12746845a7213dfa700132a7314cced3ffb1a07c8e1988300b5022855819b7983d650634d83d4b17c57
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpr:A3k03kHRJL
- TLSH T12415AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral1/memory/4916-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024341-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4844-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6e3-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4916-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000001e6e8-41.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4844-42-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002161f-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002344a-162.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021274-225.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023458-269.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021276-396.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021277-481.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-506.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127b-597.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0014000000020409-628.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127d-671.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-732.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021280-751.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127f-794.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-802.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021282-852.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021284-877.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-896.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021285-903.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-916.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021288-929.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021289-942.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128a-961.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128c-1016.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128b-1053.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000f00000002127c-1073.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128e-1099.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-1130.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021292-1149.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021291-1180.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021294-1187.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021293-1194.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1231.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021297-1334.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021296-1354.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1379.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129a-1387.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129c-1388.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a0-1395.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002129f-1408.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000203b2-1467.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000203ec-1504.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000202d6-1535.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000800000002435d-1656.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000231c5-1688.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024341-5.dat aspack_v212_v242 behavioral1/files/0x000300000001e6e3-12.dat aspack_v212_v242 behavioral1/files/0x000300000001e6e8-41.dat aspack_v212_v242 behavioral1/files/0x000200000002161f-61.dat aspack_v212_v242 behavioral1/files/0x000200000002344a-162.dat aspack_v212_v242 behavioral1/files/0x0002000000021274-225.dat aspack_v212_v242 behavioral1/files/0x0002000000023458-269.dat aspack_v212_v242 behavioral1/files/0x0002000000021276-396.dat aspack_v212_v242 behavioral1/files/0x0002000000021277-481.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-506.dat aspack_v212_v242 behavioral1/files/0x000200000002127b-597.dat aspack_v212_v242 behavioral1/files/0x0014000000020409-628.dat aspack_v212_v242 behavioral1/files/0x000200000002127d-671.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-732.dat aspack_v212_v242 behavioral1/files/0x0002000000021280-751.dat aspack_v212_v242 behavioral1/files/0x000300000002127f-794.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-802.dat aspack_v212_v242 behavioral1/files/0x0002000000021282-852.dat aspack_v212_v242 behavioral1/files/0x0002000000021284-877.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-896.dat aspack_v212_v242 behavioral1/files/0x0003000000021285-903.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-916.dat aspack_v212_v242 behavioral1/files/0x0002000000021288-929.dat aspack_v212_v242 behavioral1/files/0x0002000000021289-942.dat aspack_v212_v242 behavioral1/files/0x000200000002128a-961.dat aspack_v212_v242 behavioral1/files/0x000200000002128c-1016.dat aspack_v212_v242 behavioral1/files/0x000300000002128b-1053.dat aspack_v212_v242 behavioral1/files/0x000f00000002127c-1073.dat aspack_v212_v242 behavioral1/files/0x000200000002128e-1099.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-1130.dat aspack_v212_v242 behavioral1/files/0x0002000000021292-1149.dat aspack_v212_v242 behavioral1/files/0x0003000000021291-1180.dat aspack_v212_v242 behavioral1/files/0x0002000000021294-1187.dat aspack_v212_v242 behavioral1/files/0x0003000000021293-1194.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1231.dat aspack_v212_v242 behavioral1/files/0x0002000000021297-1334.dat aspack_v212_v242 behavioral1/files/0x0003000000021296-1354.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1379.dat aspack_v212_v242 behavioral1/files/0x000200000002129a-1387.dat aspack_v212_v242 behavioral1/files/0x000200000002129c-1388.dat aspack_v212_v242 behavioral1/files/0x00020000000212a0-1395.dat aspack_v212_v242 behavioral1/files/0x000300000002129f-1408.dat aspack_v212_v242 behavioral1/files/0x00050000000203b2-1467.dat aspack_v212_v242 behavioral1/files/0x00050000000203ec-1504.dat aspack_v212_v242 behavioral1/files/0x00070000000202d6-1535.dat aspack_v212_v242 behavioral1/files/0x000800000002435d-1656.dat aspack_v212_v242 behavioral1/files/0x00040000000231c5-1688.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4844 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4916 2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4844 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_397c68bd9b0317e872d0279ead7722d2_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4916
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4844
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 921KB
- SHA256 041da9da4211595fdaa3c2d116e21d04ee56cea0f7d91d8dd8572dc63d215813
- MD5 397c68bd9b0317e872d0279ead7722d2
- SHA1 d5ebb52f1d0dbc57966c112d552f5b2897c11a1c
- SHA512 22093665ce5b7d50bf443dd8da7e465002a9e08e6038a12746845a7213dfa700132a7314cced3ffb1a07c8e1988300b5022855819b7983d650634d83d4b17c57
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpr:A3k03kHRJL
- TLSH T12415AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 950KB
- SHA256 33b623d2ed341b9db5a58a4eaec6619cbfe5eff1ef0cdccb0e544b63b22efd6f
- MD5 bdbfc3e326f8d2b373829133894b3ae4
- SHA1 542b26d656ee589f3db55a8629c0a24eb7a6f477
- SHA512 d633bc04b6107893058f9a26c52f3b3a29b04d75157a5ab7c807f8f9fa462abddaa12f27e989eb7b62b5abddadb9a11b72f930aac1709ad2e1c1412c8832dee5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjphP:A3k03kHRJN
- TLSH T1D825AE03EB9400E9D10AC1749AE69A23FB75BC52176097DF2368C6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 968KB
- SHA256 2cb5abc4e0cae40e2ad4ad41adaa129faa726c23fd22394a9d1a14029927b985
- MD5 3e6b0b28a04dcfd5257b1e05aabfb4a8
- SHA1 678a1a98cdedf8d8799aa69ed72a2fb287f483cb
- SHA512 80ffd07c19b05edf79f3d4f87fee283436e959263b98cc0d5ab8dcdbade6ef0e5a75a24a8c663144ebf7a6748b9968dc82c224b181f19e9436605ab464d510ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpK0:A3k03kHRJq0
- TLSH T19A25AD03EB9500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 974KB
- SHA256 34406a3cf90d4e6e4127a52e75eac879ab444af5d91160e23dd97b82f6bc592f
- MD5 8da3f8c099e76c280f3c2635d782974d
- SHA1 08401012a5e2ea7eef5570759b2be5e5378c9776
- SHA512 33ce6801be8d3762f8e6ec7146208044dbba9c0841b29068a3c23928e5d54d6cd9b6b54a78bae6ef8de161c6be311e13c854ca11d8d04cee165defd7ecb4e34a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpqfj:A3k03kHRJgj
- TLSH T11F25AE03EB9500E5D10AC1749AE69A23FB75BC52172097DF1368C6152F72BC0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 f5dcc0f5c41eab9f88c2728611fc19b01c7145aa48246ac7333f4bd2da580262
- MD5 876a542b960fda6ba5b62f194b3d2dec
- SHA1 7b695b8844ac9ce5880fd8f0c82a0fae7c8b0e0d
- SHA512 5fde752bbc5682db5883e5b45060a4b9898ab5903f245cd47ef822a41614b5766c6a7e31a070c6531e33c9ec0644939a728eff72cedf8b3608bc29c8a2148ac5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjprUr2d29dBrtpDiI:A3k03kHRJLUidGl
- TLSH T1CF659E03F79400E9E05AC1748A968622EB767C560B60E7DF13A4D2292F73BD0AF3E755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe
- Size 1.0MB
- SHA256 b14ca72104f041723cfe1beaf6087c4c702f3883d33fb929489d04448f9c08bb
- MD5 49ea04ccf3f396cb4fddb3d7c0a44270
- SHA1 277474437e0da5b864a94723b7115f0bde709f1f
- SHA512 7447b9c161c8af03ec16b774f6aa56db70996ce7701becab4f4dada66207ffe2f96d9c8da988a40f6e8bd6bb7b3710ce9e309b5f725970e1d886c3dbbb7e1aa7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpRTjE:A3k03kHRJhw
- TLSH T14D35AE03E79400E9D11AC1749AA59A23FB76BC521720A7DF1368C6152F73BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 f1b7d95c6af9b80065a88f26b037bf5ee01512020dcf3421d38199f2b6dba307
- MD5 59a4e6671dc8094282fbf1bc3ad69bfa
- SHA1 8db732af073d11369e4a8803c03d3b197a524ffc
- SHA512 98b143641b71e874082b8de830af04457c3b3c5892122294a4de7ce882fa3f3b6754f16d5e7303d737ded460c13b466727b3215e4ac1501063999c3d282b112e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpf0Le5ji0hmxNrM:A3k03kHRJ/Pji0Aj
- TLSH T177658D17F6A402B5D067C1B8C5D2AA5AFA723842173096CF1358C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 936KB
- SHA256 59ed9737a12b662d7efc2e6101819ccb421a80c0d472a67f5dd4ff1bf05d5313
- MD5 077859be4f5b143d7dd3eb8fdd36e870
- SHA1 a81ebae7791b46c7b8e82bcb2cc41aed234e8a0f
- SHA512 0cd58b9ad801a41ee0e3f21bcb90c8ae0dcbc7696b2abe8fccef63350e8420b7bf64c7762d04223d48bbb89c18135359ba9db397f797b4020cccd492e7eeb8f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpBa:A3k03kHRJ
- TLSH T1B115AE03EB9400E9D10AC1749AE69A23FB75BC52176097DF1368D6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 969KB
- SHA256 4780ce8622a155fb78e6811dfbff5d485ba10b68623c5f84d53f0245d3a07177
- MD5 b0271ac69c6c85a30fcb4206762fbef1
- SHA1 e12bf9eca876b4945110e328b7530cdd9c1696f8
- SHA512 2fd92c470e65d5d81abf1cccc3ed1227596aa523cecfe9943eb77828465079e3211011a404814a64498e5e676ee711f8c01353a7a18e550201f65844fc030764
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpCb:A3k03kHRJib
- TLSH T1D425AD03E79400E9E11AC1749AE59A23FB75BC52172097DF2368D6152F73BC0AF3A3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome.exe
- Size 1.0MB
- SHA256 1d554cee984cfeb0c3c68e238885b6c6cda5bf798837f2684102c3f97d032039
- MD5 f9ba8c07377554d8f7de7e002b628263
- SHA1 7e2cf807f3e6522cc04ad37fccdf871c5148a75e
- SHA512 9c366f8606b0adf6d8e52d349aa73a22174652a227deef01f3f07ce339121ce4cf873bef935cdeca38a142b049130734d76058449d245e813203e795185d61b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp0D:A3k03kHRJI
- TLSH T133354803E69400E8D11E8174D7969A22FA777C5217E092CB13D4E63D2F72BD0AAFA357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 945KB
- SHA256 378979c96b16cf4c5c161fe1ea6b62aceab96f1b3a82a2140e3ab1f3a5f540db
- MD5 18c81f86ae70bab85cebc8a422e4ca62
- SHA1 f14b5e640183948d75e2155ec7cda092c74b4d8c
- SHA512 9c4847a8c03d749aa79e8259cb16ee46409c5a1b6fab52c946e683f5e1e091ecd46867744eccb63b4c30136b2bf3aee9b01fcb5e4cdf09964472288b52c5d36f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp46:A3k03kHRJH
- TLSH T14F25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 945KB
- SHA256 3fd0fa2759380b9af3b1ba8eb19eb95f6212900d1906704e737129e408b0d857
- MD5 ee61ac8767f749f081eeabc40743a239
- SHA1 03c3019aff36230671cf338dc4a920372516d2c0
- SHA512 d86545883cd0a73fa3bac6f1fc820a3abab77f0dee5eea2a06a0c5d108a1c373d9d1979a3a9e40aec4a6d23391dd9b72ae4667e6a6beb9efc70e557efbfad98d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpcN:A3k03kHRJa
- TLSH T13825AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 945KB
- SHA256 de263997cf7e9ae533d88e9e655917bb757bbe863c88d9fe55dd10289ec90385
- MD5 eaca1b0fbf8e760cd287acbcc7ded495
- SHA1 5b868315c2981f9ee23f0cfdd8ec98a5823a7a48
- SHA512 b68b52e9265f74c2953ae4e935f5faec4f10bb49cc603c3688cd1265b39d937654ec8fd693538168fd88a900de85d662032a86b6b93064ee4cc54ee633a634b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpSf:A3k03kHRJW
- TLSH T1EE25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 945KB
- SHA256 2c80b0975cf2e08a04269e98a33924deae8fb521c18d6aa73abd34f5a0cb38df
- MD5 1a21a028383826b1f0074530f3ffabd0
- SHA1 95d77f9864b20557aef20a7de98b0f605eeeaea6
- SHA512 176ed19af7f42d0d380d275b4b24970a0afd39bb2b0925f2ee6c17df1167edc0f0c0b6299052c8b7994f0a2663b1e298b9630b4334c3d72f064a25b79adf47f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpso:A3k03kHRJ3
- TLSH T1FF25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 945KB
- SHA256 e2d6763cf87972c12fac3e5d173a6644ad7b76d9ee579cbb78b1844857b1c03b
- MD5 8003c6b5f4d3ff428e30c663b3a547da
- SHA1 3d9298fea282b0ee6c8ce54f332ff3334ce06eab
- SHA512 3fe85b60210bea36cc13f23addf731f6e601d311cf45dc84209bdd3e2ad18d999205063d402ea406542794dc7f66fe61ad98bcc5220e33d8fe5d4d13dc7727a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpMu:A3k03kHRJ5
- TLSH T15C25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 945KB
- SHA256 ef26a4728e3074ad183efc1c267ac4221aa68c705bf26453fa5aef0617b1a76e
- MD5 1cc6e6e2a69694b0ac33f3193a3b533e
- SHA1 5a79d96af9fda63cea34f50a7f0f1c493318c292
- SHA512 a4e0e835d32b0eb4ce00127e5a29e702a60bf5d013c84b94e1cfc7269c80481d00588e4d5fc0415811d4ec05d17b67a382711968354a8acd2e65f19f687cce60
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpQ9:A3k03kHRJ0
- TLSH T14125AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 945KB
- SHA256 865666bdafde6625a125476afad8042b2942c6afc18c7c57754c2d93d93e3ec7
- MD5 f30667173f95473457dee38e6b920647
- SHA1 d4139fd5952d1461b482a1ff5f2c8b186fe48c1c
- SHA512 ecb9363a13b74ce81cb03612ac1f2845d4ebe4884c4707d14e70ccb677dd385b2303192d173184828605e081f244991afa02f1fe7d3059612c0c5abbd4ea2308
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpYc:A3k03kHRJd
- TLSH T1CA25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 945KB
- SHA256 acea8d76c1da6f5b9f3587e97fb6d83a4ebb6ac03f2485934d47396efc331588
- MD5 1d35ff727d45e2fba3a57d65e767afb1
- SHA1 20e074a672aaaaae4fa8cac8ee7e9a6e64f1e1f8
- SHA512 5b4bcfa455a24f4b2d76eec0c5d0f4a2bd27ed1fc443e81e5724e04e1b771207916392d7953a2a52855b18a637cea135c581eff160068d47464ae7bb6cda1154
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpxp:A3k03kHRJD
- TLSH T11D25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 945KB
- SHA256 77d790a2e73ed2f10e7e949a61c2a7242cff65a72005f1a647ef7e9b1e33df99
- MD5 ced70815931465900c5e8df14ce1bca4
- SHA1 4db16fbf1ac14738f16b4b84c0ece727a6b391c5
- SHA512 e3c03c633010213ddde4a5d8747a3b36ec0cb6ad38808e4d63d49e6f0f35432265ab6279c801ea3e7a2a1b1f347509ad97df306744bf8c8bbd26902ec1f2b942
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpGN:A3k03kHRJ4
- TLSH T19C25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 945KB
- SHA256 dcee659e3e2e55221bbb088bf73a0399d6633a7de92293a95a06ee1f7d257fbe
- MD5 6fab3c8417c5bfdde11956023b8cfec0
- SHA1 71ee3b21028ead8cc2a10d0b76905aaf00cc7f06
- SHA512 6b8ac7b7707ab6b30afb8e98ad89c9b57c39b7f3bab67eb7605e4ee19442d4e06cab7a9f746502bbfaa16ccfe17489ccdf7e765f9c8b02c9c950d2a23e23b918
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpKF:A3k03kHRJO
- TLSH T11725AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 945KB
- SHA256 77cbb93364b663f0862ed258fdd0f9e2c09b428610424133a301ad508336672a
- MD5 bf65f01b503b553e2f6737ec5f108911
- SHA1 84bd6884541020cf78e809fecc367373e1d7b4cf
- SHA512 3ae4e828c790a40c326eebda415641dd30c3c562b1bdf5fdbcb8849e493ffd2558b0e0cdda2120bf4f264a396b59cfa7660aa5ae80f9dca55c08fe5df5c6b787
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpfC:A3k03kHRJq
- TLSH T15B25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 945KB
- SHA256 377b5e8fd02f609892097afe3d0dc8365de7380ece40afd6f10c53f86d33b181
- MD5 15e89f3b68b525d1254fdd0c4467a6ff
- SHA1 821e67ca32b457189bd46461b687437851d42494
- SHA512 3a98ea1a806659a1cd23c51c903f6c19802805f3d7bce763f0890fb4d995ca6e67d2e9d6b437653c559932bf6e6f57db99e2caba0ac175de7c1945355106054a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpgw:A3k03kHRJ/
- TLSH T18A25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 945KB
- SHA256 2751b032a7e3a7cceb33ad7c7a3fa67580880b5703dca2f0702d205fea0bf64e
- MD5 835f35ef1cc1321e70b5e0eecb1b249c
- SHA1 dc537c64efd5f40c31a420570f47aa43bde286d9
- SHA512 b70b523e1173639b189e4d1aa2a6669721b2a34895e15ef552a211fb426c2a54a8d029ab87b895cca21670552c6a70c4fb6a49f42f8bf412ba3a1bd990e64083
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp/T:A3k03kHRJb
- TLSH T1B925AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 945KB
- SHA256 11aba57125b0d972aa05dc59b1d7e30dcbf3d6c55ebcf2e4f42de60e15d1a887
- MD5 ea80a0a5a48753c9571e0c7cf2464899
- SHA1 4c60e0c72a8f121f580ed72ba81a09f54456ee73
- SHA512 2a9d4457f4ea755dd96c80100152846d414232ebdd3e38820c554aca561b6671a8f6244ef3fea99bee0e3c8ce148aeaabba6cab4c21634f57ac0cd9ed99264ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp5u:A3k03kHRJc
- TLSH T1BD25AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 945KB
- SHA256 4d61d37b05bd8d4f23543298cca5eef05a1371931cd76c86977142aeecbc8165
- MD5 fa1cb5f278fe478e97008929002a1dc9
- SHA1 f5700fa7d27df1125f05be7846b197d04fd5dfc1
- SHA512 a765289ba569a26e25094fcbf9b40766629924d95c85251dd43c75b5f1db29442adf45a975ecfef238ea51bc9ff6b7c6016b748c9ae7b0d241b838f52614f24f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpxb:A3k03kHRJ1
- TLSH T11625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 945KB
- SHA256 eb25ef46ce020a4abcce97a103e8da77a6907920c16c07610d1a0292c8df63d6
- MD5 7b1befe3ef660569d4c50cb8d511c778
- SHA1 20af7e422473d473d3c503d3c063971f7aa5be54
- SHA512 0635e7ad18b8674ae98c4334654e7c527646aadbc444087a16699a2b10575f8755ca5ddd6029c5fb94e54eb3854f39cdbfbd3ed0b0ac73491f84f2d3e577b744
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp5f:A3k03kHRJ1
- TLSH T17125AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 945KB
- SHA256 095cd9c4fc768f070631cfba53316914a391dcbf1e4321d06198a3817a953d5e
- MD5 f9f05a1a7c597c7f3a826758861753d5
- SHA1 bae0e63e35a93abf352012b6b75fdf2585df7be3
- SHA512 8f308d395e45ddab953c8e0002cd159cfc3301265476643466df4816e3464172da6b4a37a20552f0cd638b6515e0bf7b18ca5e6c2b4af4cd05b8130c931de44c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpCK:A3k03kHRJt
- TLSH T12425AF03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 945KB
- SHA256 e4e0e267901865f450a7ee0bc81dc2020b20730bf9dbd433c59ebcfd5cd55455
- MD5 ec8097611d4565e468e6603b4a1eb7ad
- SHA1 abbd6689231c8d84a16aaba3e9225260d83512f5
- SHA512 9bbb1d636cc8439e9df55ee806ff22205c10dcb8883dd31f3d9b8959a5f008d4b8ff5572ebdc75a605feeeb8b32b7db02ec6dc3dbd944b06cda2c4e81b0df17a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpnk:A3k03kHRJE
- TLSH T18625AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 945KB
- SHA256 6de792dea71a8d7aa9dfa8da1d477bfc1b1381b740d2cbc5bb53a9b2c5be5ea4
- MD5 07f028403c9fe5cc491b4b3228a7ffc5
- SHA1 47dd71e11c61f630de53154c7143536334084778
- SHA512 0e661029079b2e3ebba002d09ae6db10c422c574164f86408be4ca9027d5be0ba30d1c62da972564439e811af931f6ef702d70c74899f656eb724b571781b8eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpQ0:A3k03kHRJt
- TLSH T1E325AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 945KB
- SHA256 02a44367382f83ec6a185b51ca0e80204f60ddca1ba017ccaefdedba8e463887
- MD5 dc66238ead85b903461bff95048a0b1c
- SHA1 abaf442d7e82944d493cf5e58b3416f658e17795
- SHA512 b6a7decdf10638fa649be88e8854a018a96ca2a565ec591fb28137aaace10169e62ff80b84918d90d2b16923e4d0b57cccc606618d2569d4e8790cf0fe3e644e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjprg:A3k03kHRJc
- TLSH T15B25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 945KB
- SHA256 a9768097908da14a76e909aaf2f88e7f0b36f7c9d37af1498a31c5e3e3fcfecf
- MD5 437ab44c12b12cd62f246b1f2c166bee
- SHA1 3f14e6c2a75c2667644273dc77f1324e78349200
- SHA512 4c98154277920d0495859474846f36a3cc8e8d3116b19228d7f09d81ac8df0556f1810e2561210b88dab609ca2be599eae2cccb835b4cec909e3a0696af858f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpmr:A3k03kHRJu
- TLSH T19725AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 945KB
- SHA256 bde1136d92232319e5fcc2e7569cc28a6044e99f988d884295066fe27b5944dc
- MD5 bde1c41dcc3d8401b0bd56d1ac7efe4e
- SHA1 038a341676b4c0c8616d75f972f31881e6852628
- SHA512 d5a08dd8509d3816e7f2098ec3c18c73609b0413dc65f5e7eba788bc64c12b419ac9e5fbf8613556b1764149bf5a418535ce9133e6805d91a55c975846d291eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpMn:A3k03kHRJY
- TLSH T12E25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 945KB
- SHA256 9b66e01fd0b94ef73dfa3b9f8762577d72bb2dc762f77b1ba5d22c9cd790f164
- MD5 690f3a19a879f995ec11e0b79a4209b2
- SHA1 0417f370310686a8aced08b231a422d079110de9
- SHA512 fdfdc8802f37e2273aac05c71e6000b8980ad752aa18842b88b11d6e28fe7e41e4361fc9389806cbfa1b36af63de8965bfb6d713bf3a69d28b1eba3534182df9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpqx:A3k03kHRJO
- TLSH T1A025AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 945KB
- SHA256 b98105873fd483af2c9ae181ef68ec9e21d162564f11aebd64f22c149caa5618
- MD5 982fb1352f14704b6b56baa54a13a53b
- SHA1 b99e796fcff509a6459fe15d5b01b4f31e692467
- SHA512 0ef80fca5718e233e1c7556c2fe267dbbac5bdcaa77d8e88d30a267c81be9f12eaf93833ea892923854f8e41c19537e8abc11e0257f98109111001bc09d3f70b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpsA:A3k03kHRJF
- TLSH T13F25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 945KB
- SHA256 8c15476a2be09d1462f34209efe6ac5f1a2f9eca94b5f4303a9b22d29caf3e68
- MD5 7dce8ce8c10474c89d48b59b6fb2d54c
- SHA1 5be7bd843228ce3a6311f546d93469e04893a579
- SHA512 ca42ce4395ce1b44ade566d86a2c8edfc38deec5bf4bf70a8dd75182f0e487328d786e3c7547412723d74d6601fa9bde8c031cfd2feb73c1c9a4335a35da2109
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp19Q:A3k03kHRJk
- TLSH T1B325AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 945KB
- SHA256 755665e705256bd664f1d41552e20f77931b569b966df4464ced9e4e63345d8b
- MD5 0b0e6e6b8558c6b54fb64d978194c3cc
- SHA1 01823dbbe0375b0627b2abfaf4052df9cb21b83c
- SHA512 641676d4f4e07da8a101389916f0e471215c522f2bb7f035f133ecacc54440e179355f902433cd06fa8ff3b8e2b9b9b0b7e74679327f52d617c4e84aa048c54c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpA4:A3k03kHRJP
- TLSH T1EA25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 945KB
- SHA256 0c7f1edaf6b2d5106216cb0c7ca1706ab9413a9922a1df383a093e67a19e938b
- MD5 cff46ace4157ea32a522b30704c1d877
- SHA1 8204590d7b7a2cc9610e1ae91d6034d65fc5cf96
- SHA512 2b4d2e5ae8c3ec398ca4ea2745a7e3688e7c2b111ad976b1550702b74b92d128e795853940ed99944c3469f985d487e94567c25a9f5dced972ee2a91b7bf6ab8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpju:A3k03kHRJC
- TLSH T17D25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 945KB
- SHA256 d1cd09b3e1366e4c337d2f4e5feeb2b0a28c0f60ab320ec49d7efa68b625bd5a
- MD5 c0b8bba95119fc9f22f177f782c306f1
- SHA1 e0fab409e17ef117be4288abd97c267789fec987
- SHA512 73e737522fe0327e39ca1888194337d15f24d477ab43438dca059ad4c14e39be2016ac0a96cbad1b0dbe584dfe1eda5fff8a203e62235270a30da80217e097d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp+j:A3k03kHRJc
- TLSH T1EF25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 945KB
- SHA256 129b410a19aaf9b42d5f8ff0d3b8525b405d78fa66b9e76ca9616fd686c992a8
- MD5 ad68b22b07ff1ddc7f2bf3dd24471135
- SHA1 b97606a944937de9d8a8f4759de7e4972d013119
- SHA512 358227ef8361cf3f313313ca471fb220eac8552bb5d09d8bb7356a723d6a37abac45f5fb47aabd1f3d00550338ac7f8914113fe740406791ae477ee7146169a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpLg:A3k03kHRJU
- TLSH T13125AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 945KB
- SHA256 632b048b918191e367b178cae859d13714fcbcf27475d3bd5eb752a57c084a06
- MD5 cd546df79c54750c6cf437c62366b6b2
- SHA1 0914af40c8033a436808dc5b4dc53486e1bad87a
- SHA512 4304dd4a8d0cba59b0d578c3366c8908e5edc8d4197fcc2ee716ff96cef45efd371deadafd1a119cd87cb7d1c9826335b245a25b8a2547b4a426630ecdc7abcd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpWI:A3k03kHRJd
- TLSH T16925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 945KB
- SHA256 5edfe31c9ca55d73f13eac44c7fdb24b9f329b5be45fcbcf5cff618dd53b9ed6
- MD5 41d2b92c1217a22f0ed418cb23a29d3e
- SHA1 e3fae1721657ff5e7f26e646fa2290aa8ffadd28
- SHA512 9ba6dca60fdc020932764b976b2c9c475fa4e5d2e7e018f2e4247d7262763bee11efd502138ffe1aa5a035a5fd49f33b477e2faa0670222ca4a91c33ade10445
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpEo:A3k03kHRJ7
- TLSH T11525AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 945KB
- SHA256 964b0983c567b43b9397974be26cdb584d26da8126f43fa221d43c1b642b530c
- MD5 0b8128be9623300878508244fae99eda
- SHA1 cbd9d5366904b17397fcda4b06d858bd2bb51b15
- SHA512 dc4954b40192a614563093ac4e1acafc9ba53d3d119160fd9962723e3e9573fd5247eb21099f836a0cb3d7e3cb980e656896619c595ed4f2a9f029b1ce58c397
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpn+:A3k03kHRJe
- TLSH T18525AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 945KB
- SHA256 63be84c2c29daf5a7ec5d3796362e0d10b23b5df71d77c0a131e47015c67bc47
- MD5 e245fff730b9013e5b0e8515816be608
- SHA1 b16b91de4d2325216066f1194253f0347f3d041d
- SHA512 cd0c8c2c732317a225f4095faa5d903d8a742c9b7797ae85a8948466fa011ec036a9685f8dd3a93fe423e615134c550d422c37e715d5d656d74e7c2c545ac876
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp9Q:A3k03kHRJK
- TLSH T1C025AE03E79400E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 945KB
- SHA256 eb96b273262dcd976fb19eda1fb2c9d742a8215a1fce0094c097cc02c3d17b0d
- MD5 6df6244c5c52c39104d4e52d27321b98
- SHA1 e02b3bc5aa433758d607fef9df99e6a07ad5ef36
- SHA512 7f66ddfd88e309bab7030e7b985111a98a74800932da59f8d1746a9ef3c40e56d7f4ce5c90398a44b1e75ff856cf420fb6b0c1310088862e3983846e642a0dc7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpyX:A3k03kHRJa
- TLSH T16925AF03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 945KB
- SHA256 892cba8390382890ccfe77571b100b1d708c4860829448f90be838a000a77c0f
- MD5 632e6f8af3ae4c2fbf97b01cd9ec6e12
- SHA1 603fd4dc97d2228f8cf980b5143eaf017248e99b
- SHA512 c1c7307f9d79074c53e685a648ae0a8d9608defdf7d318c627f93b11b05392220a59e530491f519865ad60a3d567ce4f58095108d44c71ffe382e5cdf6d9da8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjp0L:A3k03kHRJ0
- TLSH T1A425AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 945KB
- SHA256 960231aa4c3ee5288b30a20be54ad2d64312d760136915c08ef153219da1ee2d
- MD5 8aec3975b470008eebcb10a7a7c07ae3
- SHA1 27ed5e0ad53dd60c1a9fee50db6145956d946fee
- SHA512 a5567434ac77cd88c8ccb5e8381a15c1133bcc951e13e1bec6dd566d01b117d600911d16ea6731752c24f2429b6587a118fee355a1e1a1a5f82fe6f9a7678a00
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpQM:A3k03kHRJV
- TLSH T17B25AE03E79400E9D10AC1749AE69A23FB75BC56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 945KB
- SHA256 cf58fa36c86ef8e43cd4c8b80ac0298d2e3f9337f649efe8092a339a0f311e04
- MD5 a40ace8de4244ffc5d0490c8f791c0ac
- SHA1 21d0f82061171217599c2dc8cb41a0626606144d
- SHA512 288142a962edcfbd7d985fdc75af6eaf69fb614b11886aa422b482a18da763beb07223c93cc319c8874b910d4621c8219f4f92747826bf649503351e2b0c25ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRapxjpRh:A3k03kHRJv
- TLSH T11625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH