Analysis
- max time kernel
91s - max time network
99s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 14:19
Behavioral task
behavioral1
Sample
2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 930KB
- Sample260802-rnalmsvcnc
- SHA256 015e8e23229a355f01baa7a0a1f3e93010d92203fb5fb31cce657cea7b3fa3ca
- MD5 6a55856aa4155b4362e88715f89ec026
- SHA1 5aa73a5aaf8668b589b138de254d44f97b000695
- SHA512 7afd64e1006cf36cca133140be8dc5b1b2282e94a864d2727900e25d1791e8a9094024be49210a69edd701f75ab670440ec0a8f1976bc11889bc7fc2b5fac3c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcC:A3k03kB56r5
- TLSH T196157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral1/memory/2776-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001e000000023750-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000022b94-39.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2776-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/3604-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000023660-150.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b8-257.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202cc-294.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ce-445.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030b-494.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202d3-519.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030d-604.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020311-629.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002030f-709.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020313-741.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00120000000203f0-772.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126d-797.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002126c-828.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126e-859.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126f-878.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-891.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021271-898.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-917.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021273-937.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-956.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021274-1012.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-1049.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021277-1056.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021279-1093.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127a-1118.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127b-1143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127c-1174.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-1181.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127d-1188.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-1227.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-1330.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021283-1349.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-1374.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-1381.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000d00000001b35a-1415.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00110000000168f6-1459.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000001e783-1660.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0008000000020310-1677.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000723-1992.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0012000000000723-2088.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x001e000000023750-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-11.dat aspack_v212_v242 behavioral1/files/0x0002000000022b94-39.dat aspack_v212_v242 behavioral1/files/0x0003000000023660-150.dat aspack_v212_v242 behavioral1/files/0x00030000000202b8-257.dat aspack_v212_v242 behavioral1/files/0x00030000000202cc-294.dat aspack_v212_v242 behavioral1/files/0x00030000000202ce-445.dat aspack_v212_v242 behavioral1/files/0x000300000002030b-494.dat aspack_v212_v242 behavioral1/files/0x00040000000202d3-519.dat aspack_v212_v242 behavioral1/files/0x000300000002030d-604.dat aspack_v212_v242 behavioral1/files/0x0003000000020311-629.dat aspack_v212_v242 behavioral1/files/0x000400000002030f-709.dat aspack_v212_v242 behavioral1/files/0x0003000000020313-741.dat aspack_v212_v242 behavioral1/files/0x00120000000203f0-772.dat aspack_v212_v242 behavioral1/files/0x000200000002126d-797.dat aspack_v212_v242 behavioral1/files/0x000400000002126c-828.dat aspack_v212_v242 behavioral1/files/0x000200000002126e-859.dat aspack_v212_v242 behavioral1/files/0x000200000002126f-878.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-891.dat aspack_v212_v242 behavioral1/files/0x0002000000021271-898.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-917.dat aspack_v212_v242 behavioral1/files/0x0002000000021273-937.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-956.dat aspack_v212_v242 behavioral1/files/0x0003000000021274-1012.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-1049.dat aspack_v212_v242 behavioral1/files/0x0003000000021277-1056.dat aspack_v212_v242 behavioral1/files/0x0002000000021279-1093.dat aspack_v212_v242 behavioral1/files/0x000200000002127a-1118.dat aspack_v212_v242 behavioral1/files/0x000200000002127b-1143.dat aspack_v212_v242 behavioral1/files/0x000200000002127c-1174.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-1181.dat aspack_v212_v242 behavioral1/files/0x000300000002127d-1188.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-1227.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-1330.dat aspack_v212_v242 behavioral1/files/0x0002000000021283-1349.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-1374.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-1381.dat aspack_v212_v242 behavioral1/files/0x000d00000001b35a-1415.dat aspack_v212_v242 behavioral1/files/0x00110000000168f6-1459.dat aspack_v212_v242 behavioral1/files/0x000600000001e783-1660.dat aspack_v212_v242 behavioral1/files/0x0008000000020310-1677.dat aspack_v212_v242 behavioral1/files/0x0004000000000723-1992.dat aspack_v212_v242 behavioral1/files/0x0012000000000723-2088.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3604 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateBroker.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2776 2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3604 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_6a55856aa4155b4362e88715f89ec026_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2776
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3604
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 930KB
- SHA256 015e8e23229a355f01baa7a0a1f3e93010d92203fb5fb31cce657cea7b3fa3ca
- MD5 6a55856aa4155b4362e88715f89ec026
- SHA1 5aa73a5aaf8668b589b138de254d44f97b000695
- SHA512 7afd64e1006cf36cca133140be8dc5b1b2282e94a864d2727900e25d1791e8a9094024be49210a69edd701f75ab670440ec0a8f1976bc11889bc7fc2b5fac3c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcC:A3k03kB56r5
- TLSH T196157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe
- Size 1.2MB
- SHA256 cb683778dc6be7ca854486b9f28e8f4d887896a8edde7688b9f9c366909b38b8
- MD5 e9a2ec782fd054eb6615f2216a09c895
- SHA1 17960d12e4552e94d2ef2165bff8accacb6d3f45
- SHA512 b97813114a3922432daafa3eae2f8af12b00d78008598370a3a297892e19bc91596497fcb5c26c7d73146395e3d216206ad78c1d8351e2d692e30b5d7f31a454
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcc3UNUpEisI:A3k03kB56rHUN+Eir
- TLSH T13F454A17AB584EE5D11F817889968261F673BC110F2197CB23549F2E3F376D06E3A2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 959KB
- SHA256 80e763d761b0c49c6bbe0016cf4b893d720d8ef262dbe0f9ecd57bb6673d4510
- MD5 2219b837d38d951405e1e12b635a599e
- SHA1 f383e80bd0102b22131be5fa373c2773a27e37c3
- SHA512 550ce2c9b67756455895fb4e26224c3b24d4197668fc6043c9708f4a40180d7b13f2e9c780cc1f78af73699357827fa15499c827a87b39bd083edf0a143ea440
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcUP:A3k03kB56rX
- TLSH T10C257C03E6840FA5D10F81749AA58662EA777C125F2097DF1358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe
- Size 1.4MB
- SHA256 28417e4b1e554e15451d47e706f03e4caa1ca364265a80936bf325077ee5003f
- MD5 94003e30cca45fb696f53842957c3ec1
- SHA1 e6cdfa0717df274cdb9bd72aa482595eb6b5d899
- SHA512 b4acb6dfe88bbc5d9c83b48c7b318c68534974386ab3a0febcddecc07e9ef8ece6a792e12ccf36f74743305f44c1f78c116b152ba75d1a81d5770f9317dfd5dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcuUr2d29dBrtpDiI:A3k03kB56rRUidGl
- TLSH T153657B02A6940FE5D01FC1748A968662EA737C560F60A7DF1394AE253F33BD06B3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$
- Size 1.0MB
- SHA256 8dc839c47de73588daabac6e6bef66304e8102d27864aec9cf1d90ec91c9a665
- MD5 e7022b5d436c590004240555b6ef5a1c
- SHA1 7ffb137584d657d8bdde3dde61a2b97aa6a2b1f7
- SHA512 06652daf25edb17dd08ff4fbfc1616c60ccdbc015ea0421a710815feab52b4055fb4022dddfe170afd3bf09af151fa67c85acdf8c48be304c9b320fc536ef3b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc+TjE:A3k03kB56rvw
- TLSH T10C356A03A6940FE4D11F81749A964A62EB737C125F2097DF1364AE153F32BC0AE3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 2da37e5abdccc71b94e84bc2ab49ca4926828a70ce71666dcf3a8a4d4bfc917c
- MD5 3e2190a128d2482dabea27e4d9b498ba
- SHA1 c32d068a59021778b8313776faa21675276a479c
- SHA512 29fcb0197770386587183c690ce4b397d6dd3a76084bd07fe29f29f4682e4703036b7559339d06c3a79b408c222abbd863afd995a9d5a2391c2b25f6a4796695
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcC0Le5ji0hmxNrM:A3k03kB56rlPji0Aj
- TLSH T151654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 944KB
- SHA256 16b8e3794209289b74813357808cb3e4b46ca6b817e89e97bc4c1382531a8495
- MD5 a50051fff471756ceb1f85718e9cc987
- SHA1 9351d045078d90013a01637209159650ca8fb607
- SHA512 73bd3035bb9af21420e6fda93ab955c1b9fce73dce2abfd92d82eb5d6880425c1cf2fbb85f38d5adcd4426efd6262a70b0150ef39a66ed36f081785b10e7a522
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcMa:A3k03kB56r
- TLSH T16D257B03E6940FA4D10F81749AA64662EA737C025F6097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe$
- Size 1.0MB
- SHA256 86d117ed5eeff1fc276c95d084b7a5dd6005fedfe6cdb3f273320c27d4801a9d
- MD5 b9ed9831146fe62c3e0306d67f380841
- SHA1 8781af15e82919f5b21e19b4db7c5b9c086e16f3
- SHA512 5dee2bf92cbef4d963ad81a2d21ca587f75f5e0c6f6b96451d696effce31211d1594d14d42ec0248020782bb076abd9ed52bf4fc169ad77ed607afdd69342a7e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcrD:A3k03kB56r2
- TLSH T170352706E6940EA4D11F8174DB954662F6737C125FE093CB13D4EE3D3F32A80AAEA257
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 953KB
- SHA256 03242f01102c351e2b647479300d730d31868d845c8076512b252e16a4d549a5
- MD5 640dd4b2d876a2245dce54c9478f9959
- SHA1 35460c38b899aff8ebe1a0bc73bebdc5d6f06774
- SHA512 abe1377a84d37696f215bdecb77535c0118be73fefa56ed86e25bec3bd6ab21114bf366827f1d1ab7ed5feb4c3cdf4f0d8ce6d8efdc1d38343e4799f189ade6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcl6:A3k03kB56rh
- TLSH T197257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 953KB
- SHA256 84369cafe1d4b801816f649608bf2143a3395f76fbca19e5481fd37ade6b70d7
- MD5 09128860062555133f3d97d786ac1731
- SHA1 2195dad21371baf158481ad5832e747f3890eed6
- SHA512 f9b566101ee40ffe21b418dd59c94a59a189bc7c2696a6dd020c0e680f5a2354e752e46832c89d489fafd91d70f05efba216d0c6dcba25818777769a6a2a1ef4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcd9:A3k03kB56ru
- TLSH T14E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 953KB
- SHA256 423faa7d773fa7ab8722c97f9eb6a742e83ba162b2ff3978b7e80f5b534cfc9f
- MD5 559182e44c1ad5195b6455a87ef64c48
- SHA1 b34711e62144956e428869b95a9bbe78c26a0635
- SHA512 9c74dfecfd1f001a661c2f70d59e515f7d4727946c6297896612fac3bf9c8cc70689f762acc76d1d44add5ce40a30f323e5644754db7ffc19438a2c7230d83e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc5c:A3k03kB56rD
- TLSH T180257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 953KB
- SHA256 15ac34a71e7e673be543760e9f77a361c2917fcfc1793ab48a961a28ccb916fe
- MD5 36874859c30637637fc056252a78f27c
- SHA1 b4be701dd4c9de8a8bf972680fa46f4a1a096b8b
- SHA512 0ad225480f901861a38b590c888b9ad9b39e2409dbf213493f6ec62021929278f6aa6dbf016774b4c9293de74acca85fdb80b44337fe6b4e0925f977aff9838c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcyp:A3k03kB56rB
- TLSH T145257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 953KB
- SHA256 6e5e9b7d23020920e9540a40006f2cff55de173d7773800ef7d37516a9cadd87
- MD5 7956946101f86ae81fe119fa4639beb0
- SHA1 3da3e01484db51ebcb8af880b78dcab21c70337a
- SHA512 131eeb5f5070c8838bcf874aa52756ce58f596820b8dce6225375c0c11f46aa4cb1a3576c8bf73e7daa41cfc0d68b3fbef75304c1e58fe78dcd91fe368fe1b33
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcFN:A3k03kB56ra
- TLSH T1A1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 953KB
- SHA256 d257ef54a5d23a1dc0afb100afe77844a1f21e6a610f4eb7e1efcfed1004a824
- MD5 65e57e4f2b62a28479acad93495cabd8
- SHA1 024e918f5d2eb1f547671a142c4483e511466aee
- SHA512 d3c761a0819aa595f030a4aba521ac25176855901713be2118a3ba5e841c962b52027e8870dcc2a4b7d26c7d0f8cf3651d2dac9e8ce74209adfe635a4982b2d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcXF:A3k03kB56rg
- TLSH T14F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 953KB
- SHA256 89fb99c552f3d95d5696d2671465b2a35e1cbd13195b74cfdcdac055bac99a95
- MD5 fec0e0d460f80ce49dcf2a0f5dd52822
- SHA1 a683497c302a6dd5d0eeee72ed20bb1136bbc52a
- SHA512 af3cc274adab91e596038c19c7984c352fc4ee6ce6d1d8d76b31f6f01b39e2a03cb8eaa771e4527981e023508bf25e8cadfa196ad4b6419683fdef6b185016e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcoC:A3k03kB56r0
- TLSH T1D1257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 953KB
- SHA256 1935fcdc94f1d0d81fc5cc500678560f9b7037f3cb0c1c0453d86dfe1e18a488
- MD5 0004763d8e2911accaca72a782e384b7
- SHA1 3722ed668006a9817cf8d362acfc98f1739e857e
- SHA512 1a1799185f17533378e80f8d64fe7b98133f0f77f6837850ff5f659775ace46aae503d9c72920e7faa64e3d78c65ce7cba9274b237f2f1d968be007255dc11b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc7w:A3k03kB56rJ
- TLSH T112257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 953KB
- SHA256 916da7ebc45fec917243145942c4d6e2b06fc3c5e58c7f0bc68fd2df21fda3a0
- MD5 d8615bce8dff13530f866a1332935867
- SHA1 5a055e9c4d68433395700e4bd3dca354bc122b6c
- SHA512 9a6ba93df41457b74c49c0218fc16e4e2e33d581636b503430c7d4d430ebd2e3563310342be1fa7f5331bc244f36e183604b096af88f1b270d86e0adaef107d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcCT:A3k03kB56r9
- TLSH T13D257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 953KB
- SHA256 aeea99c5b627d55abaa67e88b14863aa4dd627e38803096991d204a9701d13bc
- MD5 2169072f2a5f6c7290578ca4a759b911
- SHA1 242080c374d631b82dce1e03b9b854e59b367f55
- SHA512 a6ab19bcc407c40638e3126be2f907b5799ebbf6efc0664b8b85ed0b5a4f20c1bdba50ed075484ed66acb484cd70f3d814531f5f0935912041d9943130d1930c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcSu:A3k03kB56rC
- TLSH T14A257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 953KB
- SHA256 122af6d0dfa11388ab16d40b6d61c3689b82d2a371866123621a37732abcbfbb
- MD5 c3994f67693df9aea6bab8a51bfa96fa
- SHA1 8d31d7c25655671932b6508b7a98ab49320856a5
- SHA512 ef12240919814ede21eda384d5641a96403ec7b586e592c3220fa588598fc5a012a03696bc2d485f938b789ed0bc535009e609a167e4502ff5e8ab141213cece
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcMb:A3k03kB56rz
- TLSH T124257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 953KB
- SHA256 4bc2bbbd822d0c9707e9ceea60c571609b5d819b64cb84e70e1c81189aa7d923
- MD5 c2b745e920903b01e680ee323a5937e9
- SHA1 93601bcf1fe4dacc446ee267b7e65e3b9eb9fccb
- SHA512 15ab0dbd311ce925e7d1a63ab6d654b2bccb4f26d85f3952441bafabc18732f2e9534ae56942c3a55ca1341400782b8aebc84f3e007d01b24c48515cefaa4ce8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcyf:A3k03kB56rr
- TLSH T1DB257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 953KB
- SHA256 75e916c0cbf8e553cc20f2ae8c4220148712a8003297da0c9bb97d1fbb3cbd7a
- MD5 b914a4bb006ab2628f7ba8cb7d21f7ef
- SHA1 bfb7196159cf00792b2493e2485432c39f9c1f16
- SHA512 4599b63dcb6187ee44f468b8617fa0e229be1d0561a5c8b9c184c70d6c113cbf3400c6d238b58f65ed9dcc15fe6dcfd1e627804cbf4456538e7be3bc57d5d20c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcfK:A3k03kB56rb
- TLSH T146257B13E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 953KB
- SHA256 840a337b6e128fae59ed68581a5599df6954e206d107fbb97d512af972699b09
- MD5 ebe287104b45d0f4b1ec51d5a9b15388
- SHA1 533c3a70fe188517b0e4a458740e6d9375f35352
- SHA512 2383b0d594f13ddc4a9a7d8a0f8d1d7b097789f9cd53b25d0caffa8508bec20184b09b2d610aa3c98319926a1b07c7f054fd1750c88f9087c24a6d1c50992b27
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc4k:A3k03kB56rW
- TLSH T1BE257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 953KB
- SHA256 3a85a3b18eae77dcb6a3d3a9884f357097f86953f3b808ca53cb50d5f264dc79
- MD5 4a1b7c965b708c3fa6c8d5d6fd60f069
- SHA1 d8a522abb5d6d5551158898e190d3b267b0e8ca2
- SHA512 d8b7207fca55ba70109a688dd58a2528d4b96d6b017b610e1f10964c8382cdb918d0e6c3c32d5479dc185848598248a4e872d7f50f2aec09f23b02a664fa6c64
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc50:A3k03kB56rr
- TLSH T131257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 953KB
- SHA256 72f0bf203bb8ffc16ab88be935d76dc2c1c67398183f56807241858d6b54e471
- MD5 5239a9185ecda57e2d38d749c014db07
- SHA1 4e0f33231eb9a1d4d417333fb2c25703ed369c72
- SHA512 fc1a36707d92f6b9b1a85cc39b8d6694ae87e83839fe58e0f763e6f56f55877753aa8789a971575a3ba5757360f04836842d9af543e2727cec4f301af9d1a5be
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcsg:A3k03kB56re
- TLSH T1B3257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 953KB
- SHA256 38cb384b0a5bf07a0d04ff8f858faa8d10d1f0a9b38907b9bef7bbf4435e76b7
- MD5 d9aba129843aef1caf01d935c599b162
- SHA1 f0efbfe8be9c602e2ab4c16c7b59fdca6190ea56
- SHA512 d82ab53755897644c8110c110cbbdf64bcedc3280656df7109ce2ecb0b331b6dba0432df4f97c3d4497e81ef4e8e6f9929e4185922cb0935783c96725f8ac0d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcJr:A3k03kB56rg
- TLSH T12F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 953KB
- SHA256 cbe598262cb437348593406659dafe54bdcf2bb39d0fa948462f08ca2e0d1af7
- MD5 6cc3d909bcbe36aacfa197c1bcabb630
- SHA1 f85699b7bc3e9a461f9214618fd8e09070c68b8d
- SHA512 0b4227d6c2f3fd9fc45c91c85947e9888c3cf9ca31779e663d3e471c961aa86c3e6a971c7184c6d9f53b5cc562685a36b54fc634fb4a8de5fc7bc3d478ba6756
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcrn:A3k03kB56ry
- TLSH T1BB257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 953KB
- SHA256 09c30d6aef2735e91f24c1b685529b8b740e99d789a1c770024e662b02306e07
- MD5 070f5e52f7dc9d470eca5fd653509312
- SHA1 3dde88b5fdea9721383fffa1b589316e8553ad73
- SHA512 d3be52f556c29202859500fc68393efa77aaddca21050d0625e726bfe1f5945c7087c2f46861f0f79cf420bf0cb24b18729c0b73bd02eae1e4cad4d2847493aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc3x:A3k03kB56rA
- TLSH T1F3257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 953KB
- SHA256 0d23f1ad79e913729bdf81ca22731c69a3a7d908e95b0bab94a02030f0510239
- MD5 3eddac061e6efb38e97b0d43f7195af2
- SHA1 f1a6f6c00404581cc6fef44582cdc04523caf384
- SHA512 666c4fb123b11130d35a42aee85340f2fc34b4d79cbc43f8e9693ce2f82ecf5bb500135f124ea7f00519faf53d08cf29418bb4ea6fa76b7ff6b788cbbe29f6d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOctA:A3k03kB56rj
- TLSH T191257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 953KB
- SHA256 ab78f3eb11ff7ea3bd330d2938ae81c6b87d90d417eeda331311c06897d4d567
- MD5 5c27078f2d1b3d3fa2b1d5625fc64b21
- SHA1 94c3f9e554f61f8734ddf92c75050471f9f1e5b5
- SHA512 dc6877cec833e330ab3ed3cca330bfe29f939066a19972469cdc8f4478e4b7e54593c87101309304de50de611d6f5052d1e198e75c9e1c9a5310ec54f9462de7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcm9Q:A3k03kB56ru
- TLSH T16F257B03E6940FA4D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 953KB
- SHA256 92e3d91f896670bfce217d21f71c6cbe61969827a2e692d8e052b4a87080632a
- MD5 b803714d0421c56d5a79f79c861cb226
- SHA1 43c663b72cf6a8de9a6409636ee4227ec6c15dfb
- SHA512 a9931d359702984068d7d58c4f255a6cefd589161dfa9a4a4d4bde7b4651637d2dbe2a2779a5425499272cb866802c3bc6ab3ef2661fc13e6c16e1dd5171cb5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcD4:A3k03kB56rN
- TLSH T134257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 953KB
- SHA256 f29d2d415c6a9b37796ac3457f768c74e4dd21ac3f1e8764edbc3f7335ac365f
- MD5 95e821430232c7ce2288ca461d3ecd90
- SHA1 cf406bfa425fc4e8fc4079b4ef09e7f0a233bdca
- SHA512 beb5004e22aed08a15721217850ec3082323bb5575d0e5285e29f1013764cf39e5d791af9b035ed803566be0306ab288e22d106b6cc802c2f08216344b3e47ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcqu:A3k03kB56ro
- TLSH T12B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 953KB
- SHA256 d8f59a56aca68181e9741b2ddad2ec4132cd328a7fb6890faaff598cb75bc104
- MD5 7e2e8853400fe8649cfe71f9fec48b82
- SHA1 18669f5855415b7cda2c858b2f25a2c7060ff0d3
- SHA512 957c1aa28eb4d4162d7ef9ce9f3ada0ae56e9a154a3b65a42f27ead403668ffd4ee93244c70099be6e6b58a662cbcef48ac24d62221ced4bfbf01a880a989818
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc7j:A3k03kB56ri
- TLSH T137257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 953KB
- SHA256 f7f0f70c1820075c9cb92a6365804727355f89931d4d9ba7ef9bc58807991352
- MD5 773bccfddecf91ea7889be52e4fa8840
- SHA1 ea673e73ad463117b249d29c2e2148c0e8821483
- SHA512 eb3f863c2829c7fdeabbbc4c1e9059ccb989d855f2c05d211f6fa1892656265758b920e20ef15e9161007b455f1cc0242b4d01dfeb6796779c36bf7efd99c93c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcGg:A3k03kB56rm
- TLSH T100257B03E6940FA4D10F81749A964662EA777C025F6097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 953KB
- SHA256 acb28bcd71ced198154bb74d9838c174fb2d97c5d446ea37654bacd3e87928b0
- MD5 5180853ad345f7e1802969f1debcae3c
- SHA1 b1ce195b14fb331ac34abd722f30564cb48aeb01
- SHA512 16e8d474682ecc1b401cd320c4e2b522f645b2b5a4db5bfd6dcfc33ea830ac7ffabeedb89e887661d23e5d5d9979d0009f23a1a9078b0182bc3a781f37a9defa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcpI:A3k03kB56rv
- TLSH T185257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 953KB
- SHA256 f50c494371428028c8b3cc0333ec70a700c02ac376ccf370dd71e57ac7c7c73d
- MD5 7d5238ac6f68e951ee67d96f20a80eac
- SHA1 7c93c846edd24715750f308afb5254e90d48793e
- SHA512 42ce1821ea6a9609ed0a6546cee75423bc03134da75de1ef9010a1cf40a2d065d209bd66caf4bce76f43d2a4e399cf5bea8300f886e732480bed94b918d7545a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcLo:A3k03kB56rZ
- TLSH T112257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 953KB
- SHA256 456dc887a4c9dd033a4a1d649617b4dc459631aaca5c80a820fb8b298bb207fd
- MD5 475ae981e40ed0859dc98cab403a0e61
- SHA1 dd0584c854e73f4d149ea97d6552bba3eb8a8e0b
- SHA512 a7fe28f2ffcbfe1d96a4cea1d778457d45143d8397677dfd6e5d8556e92a47056cd16976cfb78240ea84f6fee6d71f9ac0734d5bf5b92704f6d33c132bb66dd3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcw+:A3k03kB56rc
- TLSH T1A5257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 953KB
- SHA256 20a3e1374d39f01f840d89ad3176e2ee7137a841ec1316d09c28b47223a81d39
- MD5 5a63e957e982781b3b736319e3b1da13
- SHA1 594377f38a25555158d50993e7d28f4b88153b8c
- SHA512 f81822aa64d7e81eeb4a30193b27c1965473a0b71b12e8518a089083e194693f8be10120a07fb8ff06270cd0c34e886e051f777524250c62ce8235583c6fc5e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcIQ:A3k03kB56r0
- TLSH T124257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 953KB
- SHA256 6ff2515c0427400cd07b1b97c1b377dbb7661ab5f4cb202d44169a95cba4a866
- MD5 fe584c3e7113c714bf7b178879e6c6c3
- SHA1 e65e6356201cdf06f8dc0ca284fa5d8a8303f330
- SHA512 b62127ae399dfdbea07de13f7411ed841127250210cafb672ae16faeae851c4fda161e8b29dd024274bb8672dab77df6a19ac74885ce64946cf34422e3ae5e5a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcBX:A3k03kB56r0
- TLSH T184257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 953KB
- SHA256 9972acb8dc1318f74c06774b3e653fa0fce9870cdf2993267d5a01c7c1cf3b81
- MD5 ba29f6fd7bb2bec8ea85febca0745209
- SHA1 7a2ef109c64a30d5eca3a6d1ac2c431096386fa0
- SHA512 bbbb48867bc919d3ac00409185a591c176496b08793ac2c6d7344546ec39e1651a958763aad99e4a9a809a06b45ef2a3b3918605616a461c759a58a81e423e38
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOc7L:A3k03kB56rO
- TLSH T106257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 953KB
- SHA256 edef1ec79159f7f9f646c7cac59ed9b3cfe2ae9f35f2d339234a7ec28aefc0b0
- MD5 c78eb9bb28f9d5641847adff3ba3a602
- SHA1 8e8b8def9a96b04e1eb0513294e81c1434b510aa
- SHA512 90ec4569aa4cebee8c1417afdba5d4012b55cc2cdebe56066315e88f0cd4ba5f19eb2ea5f52c13fcd1de6ea711384b10392a41c3314563f6ae18886debccccaf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcBM:A3k03kB56r7
- TLSH T11B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 953KB
- SHA256 8c115363351f2c41f2536c65d0f739a961442fb2c03669331902a0bad09d768e
- MD5 e8222fa53c9daa95bd75947e35678df9
- SHA1 be3c6695b34f3db33171d2387ca70c95fadb4837
- SHA512 d828dd8ad160b32440d0d110d11e0a67f22b88b9067635bd53576d601aa89c3e127e03a9d5fb7a2036d2e06de6143922d8bcf5928a33724b62175b33c5d7c2f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcqh:A3k03kB56r1
- TLSH T1FE257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.4MB
- SHA256 ae7064837472545ca9c199343fe19306fabb974f3d6be2534c2522cbad25fed1
- MD5 9b02e43bc394999683548024ca3e0cc8
- SHA1 54a9067794ba5cacbf06a6184c2b6ac1242d64d9
- SHA512 fae40b5954ff479deb631edbac72816a3d43cfeb970fbed0d369b08bb81b28c55a28c367888254d0afc51de650d643fd69c074d32ce577d289f2f1e8b55573b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcJ3npi63iC:A3k03kB56rUXpiMh
- TLSH T1F6656B03A7D84A74E1BF46309AB54662EA777C115F3093CF23946E193F71AC0AA39763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.2MB
- SHA256 cba3f4f8a83dad4b6e4e3b677e0f579d9c16f89c4312d200e9c7c7518d9aaa1c
- MD5 e612fe845c5d9ebd8a6b360a61b51e16
- SHA1 5975377cecb33ca96b34153922015f51cfdc8d90
- SHA512 4f221395c68dda9307b2acbb61f8cbc2fe035f01d65ea8f7af989dd1a63eab9ee4020fd2d642b329f68752d3f23933e9a7e02dc384f1ceb8ba13c33a2892f126
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYDa8AYOcQV+PAk2hMH3:A3k03kB56r1i2WH3
- TLSH T18E459D23A6940FB5D11F81309AE98576EA377C025F2193CF1354AE193F72BD0AA3A357
- MD5 SHA1 SHA512 SSDEEP TLSH