Analysis
- max time kernel
96s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 11:29
Behavioral task
behavioral1
Sample
2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 931KB
- Sample260803-nls4eswcmd
- SHA256 ea4addee656132f99ace7cca08b7d1cecdd7098dbe88b49e9ea8dbab5a0a7967
- MD5 8e55e7b168715f10744fab855dd01f61
- SHA1 2f2dae89ea1df4a861e661fe1032403cc1abc53c
- SHA512 7d76d1c78975d7f315bc62a54a2913d8e97f41f507dd5dec57dd0dec13615f61beab444d79f0c7a533740eb1fdf38e91184845ab8a89eee0c2d80fc666c635ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEc:A3k03kHRJARJ1
- TLSH T142159C03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral1/memory/2096-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024398-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3620-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2096-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bbc-41.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3620-42-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002439c-145.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021274-238.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-275.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001400000001f2d5-390.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-487.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021279-512.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127c-603.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127b-634.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127d-654.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-740.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-759.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021280-802.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-809.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021282-840.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021284-871.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-890.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021285-909.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-916.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021289-936.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021288-950.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128a-969.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128c-1024.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128b-1061.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128d-1080.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-1105.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128e-1142.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021292-1161.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021293-1193.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023454-1201.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021294-1226.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1312.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021296-1348.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021297-1361.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1386.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129a-1393.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129c-1400.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-1401.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a0-1414.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e73e-1473.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002600000001dae2-1572.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021f4d-1674.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024398-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022bbc-41.dat aspack_v212_v242 behavioral1/files/0x000700000002439c-145.dat aspack_v212_v242 behavioral1/files/0x0002000000021274-238.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-275.dat aspack_v212_v242 behavioral1/files/0x001400000001f2d5-390.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-487.dat aspack_v212_v242 behavioral1/files/0x0002000000021279-512.dat aspack_v212_v242 behavioral1/files/0x000200000002127c-603.dat aspack_v212_v242 behavioral1/files/0x000300000002127b-634.dat aspack_v212_v242 behavioral1/files/0x000200000002127d-654.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-740.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-759.dat aspack_v212_v242 behavioral1/files/0x0002000000021280-802.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-809.dat aspack_v212_v242 behavioral1/files/0x0002000000021282-840.dat aspack_v212_v242 behavioral1/files/0x0002000000021284-871.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-890.dat aspack_v212_v242 behavioral1/files/0x0003000000021285-909.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-916.dat aspack_v212_v242 behavioral1/files/0x0002000000021289-936.dat aspack_v212_v242 behavioral1/files/0x0003000000021288-950.dat aspack_v212_v242 behavioral1/files/0x000200000002128a-969.dat aspack_v212_v242 behavioral1/files/0x000200000002128c-1024.dat aspack_v212_v242 behavioral1/files/0x000300000002128b-1061.dat aspack_v212_v242 behavioral1/files/0x000200000002128d-1080.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-1105.dat aspack_v212_v242 behavioral1/files/0x000300000002128e-1142.dat aspack_v212_v242 behavioral1/files/0x0002000000021292-1161.dat aspack_v212_v242 behavioral1/files/0x0002000000021293-1193.dat aspack_v212_v242 behavioral1/files/0x0002000000023454-1201.dat aspack_v212_v242 behavioral1/files/0x0003000000021294-1226.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1312.dat aspack_v212_v242 behavioral1/files/0x0002000000021296-1348.dat aspack_v212_v242 behavioral1/files/0x0002000000021297-1361.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1386.dat aspack_v212_v242 behavioral1/files/0x000200000002129a-1393.dat aspack_v212_v242 behavioral1/files/0x000200000002129c-1400.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-1401.dat aspack_v212_v242 behavioral1/files/0x00020000000212a0-1414.dat aspack_v212_v242 behavioral1/files/0x000200000001e73e-1473.dat aspack_v212_v242 behavioral1/files/0x002600000001dae2-1572.dat aspack_v212_v242 behavioral1/files/0x0002000000021f4d-1674.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3620 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2096 2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3620 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_8e55e7b168715f10744fab855dd01f61_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2096
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3620
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 931KB
- SHA256 ea4addee656132f99ace7cca08b7d1cecdd7098dbe88b49e9ea8dbab5a0a7967
- MD5 8e55e7b168715f10744fab855dd01f61
- SHA1 2f2dae89ea1df4a861e661fe1032403cc1abc53c
- SHA512 7d76d1c78975d7f315bc62a54a2913d8e97f41f507dd5dec57dd0dec13615f61beab444d79f0c7a533740eb1fdf38e91184845ab8a89eee0c2d80fc666c635ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEc:A3k03kHRJARJ1
- TLSH T142159C03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 960KB
- SHA256 683c714b2ba7ac8a3fd3c1edcbdb01059b419bfb51f40500a91bf140f2b75153
- MD5 7f54f7660e65edcfc141ab30faa76ced
- SHA1 4a2cbc942138c2ac134d9da01ed0ecc0039f9f08
- SHA512 70eaed949bc58be08014184de7b4e66714db52d88c9f8af636e4c2c26f1aa1f6698c33f8bff8e579a4413f0ee0765db1d90ef35b32ce890a0e2e2e94ad8c8d97
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEGP:A3k03kHRJARJj
- TLSH T17B259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.4MB
- SHA256 9e2f3d6fdb48a301b1fdc7f2bd5b958d734388f4b4ccc730700f790c3cf6c1d2
- MD5 52e8c03354495885b0ef1b9fe3b45c3a
- SHA1 5ea82df30c4a7b1bfa9f237bab48d7775686485b
- SHA512 82d7cb022f3f6d92046e543beacae5c4dcf2df54d5142d1350b6b99c19420a7976b46fea7c1bf94cf9b8043b2c37943cee0ece65143229029c55b280acab9170
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE43Td9CHKy7GZO:A3k03kHRJARJlTd9CHKyao
- TLSH T133657C13F7D400E8E167C63499A68622EB767C561B30DBCF1364961A2F33BD09E39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe
- Size 1.0MB
- SHA256 a0bb2e1eef679c726740b0fb6ca0ee38ad00b656a5cd39f0738df53d1f0fe421
- MD5 35db91b150b817a5ce1fda580a36095b
- SHA1 854b2706accfbb37bdc91cad1789398687d2e99c
- SHA512 ebd1060f760d3e0ffcf954963d68765694344fb0302c77a56885c1cf08204da381be56fc588c8600bb8c1bd8132c5ec8cc91ccf55f023ddbcab0873fb5cf9403
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE8TjE:A3k03kHRJARJTw
- TLSH T1C2359E03F79800E8D15AC1789A969A22FB76BC66073097DF136486162F73BD0AF3E754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 d3b18249c3de7f48f0e78c1f5384158d4689cb7835a3686ce765e353fd0e6d9e
- MD5 6530d5e3b1ca23a5ef778541c0716017
- SHA1 f0240e80199a2b767647bc8019155ee327f69afc
- SHA512 6b47ace33f0a594d6667d74623332eb91a00aceeb008c59f7c043bd4d9b7ac2d543475dc41421de2dbb4a34ff9ef9936008abff7bdbb8d57cc6d2a1d0d9c7707
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEk0Le5ji0hmxNrM:A3k03kHRJARJxPji0Aj
- TLSH T1ED657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 946KB
- SHA256 5c64f9c94cdf4ac4ebc103e7c38c274cadc28413784c04a15c5a2eb25f734a40
- MD5 4d578f5d757335b0d3385f9dcd007d13
- SHA1 4984f5d00a2b1c2a8cac8c6ff0ef1172e2996549
- SHA512 29748fd7023c23ca4fd7881a2b8c1e32fb0c3fd33ec4242948196e17fc013f50b9c75c795937f8a779ea4c71b2ca65d2ee4c149b8dcfc1f84f0afdac59b6502d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEOa:A3k03kHRJARJ
- TLSH T1A0259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 1.1MB
- SHA256 4cb6274d23aafec5fed80fb28d65b4f4822d2e8734d3b06bfeb62bcd260c934e
- MD5 6775258ea045252f188e2cba79d7c104
- SHA1 93a72612b9223653e8f0d7915e4828f59bb7b01d
- SHA512 4449173dcb9c9ec889775fb19eafe481dbcddf6d76a72c5fb74ef25c21810be991caf18962da12b6b998aa51a488ba3b241301c68c15adb7d4b908b6261972fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavExD:A3k03kHRJARJa
- TLSH T1A3353807E69800E8D15E8174D7968A22F7777C5107E092CB13D4E63E2F62AD0AEFA357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 955KB
- SHA256 9a40d3f355bb1d25fde118f3d2cde12591f3c26fd9f49e962cc4c78682f6b2fc
- MD5 6e1379c5faee5ea21d56ca4c89f3a8ca
- SHA1 22986da128bcd1ff4b03ace67c4167ff7b4d02cb
- SHA512 12fbe3d3b8b11f19ddfd271b519b7943370ba6ebc57e4d9434deff19897ab71b0dea9da5cda075229e150c1082e216828f9ed97f9b173d99d23de36e26acd6ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEv6:A3k03kHRJARJ9
- TLSH T17B259D03F79900E8D15AC1789AA69A22FB757C56173097CF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 955KB
- SHA256 348676e0e5303aa1a64c82c833fcf7802c27a65bcbdd024376331a85ac38cac3
- MD5 2389bf608f63edc9dcbaaf0bdcecd6e4
- SHA1 ddc4ad0a5caa7097a38423a8a838e739ecb1b810
- SHA512 862ae7803ca7d985546779da0a36437e9ba2c19ce12c8eaa637328a12e2bfabd2711632e97a332e2166feaa435c131b8df9ccc6b6e85fb5f62944b115c0e509f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavExN:A3k03kHRJARJc
- TLSH T11B259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 955KB
- SHA256 e56fff7dfe4755b5633ef12083aa876a743b556a8ee4cd14081ec3d0ac8df68e
- MD5 369989aef7179c95e01ad7322be43d18
- SHA1 b424d7c2ea7306ec2984a97cda2f36935c5a883e
- SHA512 b61777212919bfa68c93478d16fab1db715c389e1dbc0695270328471277b2ce9ab3d0e44cf7647690be4896c1d7db5c13e740c48d0186c591d68580a53b98a3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEnf:A3k03kHRJARJc
- TLSH T101259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 955KB
- SHA256 39277242a32be519542e6a6bb965e4abdbf8b8537ce21a49a45ddf9c83b13ea5
- MD5 e211dcc461de4cd354445dddb56316fc
- SHA1 845cabc5af81fa384e3a1207c663b7cfb10409b5
- SHA512 f343f018d5166226472d94bcc2297f1e63f2f5ec5fa83c8599c84fab7a9522b18c5aa912a8dd118f74bd3cc771c12a1b77ebaafe826e74e78075477b6b2220d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEpo:A3k03kHRJARJR
- TLSH T1AD259D03F79900E8D15AC1789AA69A22FB757C56173097CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 955KB
- SHA256 cd2f9759fec02007590bd0be587eb0ecdef475bc69377d11bf0bae1173892fbd
- MD5 cce45e15376e3118c938ee3b92a3f2d5
- SHA1 c24714d37ca58e4dff30d0b62aca39179b73de1d
- SHA512 d067e201d3bb5b6cd9108ece751ead8c5446f0389ee08dc326574b9a821de3cd8231313564a17bb5c69f009416162b3ff4cdbc743be8813b7cd0f7e29f18dcc8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEZu:A3k03kHRJARJD
- TLSH T194259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 955KB
- SHA256 accb51e413e04d920d53691618bfe77cf65d9eb29cbf47f24a956907cab132d0
- MD5 a8667f8dfe316947dcdc38180a338958
- SHA1 7349d3068a5efe568365082cd4b4a71e8c1c8db0
- SHA512 bc335d6f7dcd70c62b301645d84c61a19ce13b37e53efb659c196eee5910fd4313e936aa96eb43d932089efd323c91ea424a2fd7530aa39959818b1a4bd72f70
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE/9:A3k03kHRJARJi
- TLSH T186259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 955KB
- SHA256 7e94d3e52e580cdec730c3546c94ca05a5fb2db8cd516f53ef2a343d4dc163ad
- MD5 1fd886c6e57fb1afddada8ed7adadda4
- SHA1 4e11fd67490228924b88c7d9f7f2a9eaceee0a3e
- SHA512 d0b95d4298175d4e7cc0e17a268a715634cdc47dd8dc675750ae633fd1a9f55a17cef01766fe920f698d379f6621ff122eb47f419ae3c96f3b82a1f6f067ab62
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEbc:A3k03kHRJARJP
- TLSH T112259D03F79900E8D15AC1789AA69A22FB757C56173097CF2364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 955KB
- SHA256 68960a1519708499bd81242aa7b6919ec787b0952376cffd32d50e51c513cc60
- MD5 3ca73469191304fc60bd569186884e4b
- SHA1 ebba0b9d1c974978a9ac51ac3eb8a0995cb9c19f
- SHA512 b5b42242906a9d4dc5314bf6f37d2d7c8044b1acc12ae4195f968881a716278068130a00b12e6db91f731cdfc38a97da1593e22f38e5f9d2dbd9d11d4def4b19
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEEp:A3k03kHRJARJF
- TLSH T1E6259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 955KB
- SHA256 c836dc341077ea88243f735a73e11d67e5491a1674fb3dc13757a16603062923
- MD5 c0361e4a1d48f77116b52a287bcfed8b
- SHA1 ad21ba45d6c93564da06bce13fafb70c7a72757e
- SHA512 20895bf721856bf34bed2c49554bc018d28ef6028c6ec3e2154b35858fc2ff037fb0fe4e5b269af77c769abd4bb99a920506850268b3eca4c524b7b674be1eb3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavELN:A3k03kHRJARJ+
- TLSH T117259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 955KB
- SHA256 2b18d4d4606fd681364f47e40f10be8d69b1803ba7dacf4ea3f20ace988eb5a1
- MD5 35c53d6265f5e6f10a848aac857caead
- SHA1 e3df049d1d6382a8b54a69f5307807c901c54a23
- SHA512 f7d45f65be39958cc59143ca491cb21eaef2e9a941af9cf8cf300c0d1d0daa684659513dc3d5b071a73a0cc54aea64e83051e5a9c89a5ac9f5d1163239c2ea24
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEZF:A3k03kHRJARJ8
- TLSH T1C9259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 955KB
- SHA256 4ef612c18565d6014ba576bfb37833c9abf3c707db58f5d8f83eef60efb85091
- MD5 c8546364847ea7bfe2ae2daed754b3ea
- SHA1 3474ad46a74896bbb3815ed2337672b38f82970e
- SHA512 41aa79debcf2ef9813928d3c1377d5b06bcd408f7a1108bdd86ed920f18ec58d46924f3aae44c792f58603030c78be6cba640d3de5ee6070ea24bb8e5eef2df8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEyC:A3k03kHRJARJI
- TLSH T19D259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 955KB
- SHA256 2527607757bab6721e370466dd67acd769e556554b1ea53dc251d19dc5a3d097
- MD5 5695150a4ff30a40be5f68a271b44ea0
- SHA1 49321aca1f937826cde8e21eed7fcfdbebad8f3b
- SHA512 acf9ed28626869fdb24aa30c1ee1579aacdeb8ae89643a1b67fe8190fd810e11812d55c7e5274dd3fc34d87785661d0a121fce467183f46a255ad6e504e43867
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEtw:A3k03kHRJARJl
- TLSH T197259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 955KB
- SHA256 65b03e4d1953ab177d2d0f914067360a67ba8b1d4fd015355db776cfe38a7ad3
- MD5 01bfb95ed7b17ba6ef98e1b62590ae08
- SHA1 6765d7a27e854fec321b17a73bea6795dbe8fbc4
- SHA512 96205b4a2f2490d42183aef6ed54c7cd5ce205232fb73d0ee47c57f5231848a7e0d8db7d7816637e75c8e7014c18efc01ca21d1677d08a27eb296bbc117ef666
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEcT:A3k03kHRJARJZ
- TLSH T19A259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 955KB
- SHA256 1c63839a22b40e2f82124d2d027636a3ded56f8bcfd77237d0daf0a4c878b8cd
- MD5 141fa62015bba6c2661a0d297d50cdf9
- SHA1 ddf10fd6e61c176223c8b90e83c705e549b5fc2a
- SHA512 ae73b136f6af26cb8dd71ac3746a7eaf07134e54042a686f94b72a0bd408cfd90ebcf5988f94ee55c31ef2c88d3aabb5696c4ed4de854fb26595c28faa3f55ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEwu:A3k03kHRJARJe
- TLSH T1EA259D03F79800E8D15AC1789AA69A22FB757C56173097DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 955KB
- SHA256 0b28bd9e3134526213dd63a23b9cc3973e71377bc6821d55e845bdfc34d32d5f
- MD5 1c09a372a9daa0b395c45d16d3848e4b
- SHA1 bc74ad15f3f2fdd03229d35ba5128f2332e39375
- SHA512 1d6f33c7689975f865badd04f22ac506aae1931753c3aabdc8976f60500fda9fb78c6412c32bcd54682a089cddf938a4238eb37a370e5902031f78ee04253288
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEOb:A3k03kHRJARJf
- TLSH T1CA259D03F79900E8D15AC1789AA69A22FB757C56173097CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 955KB
- SHA256 26903cfd516b2b1e73d33e225a580e941600b2089f42a8accb504788304b1dc0
- MD5 49eaff0646b178e9877df1c510a498bc
- SHA1 5652be878f6906a700b2f11720b0d9454762cf8f
- SHA512 2acc697bbfcaf6c52d89a51252551a72fc0b69d2de6ec7fc3c9002a0143ee8d513e98d78c4d9ee55bfb246c2eaa3ec41e9e94a5022d987f9f464bd6f98c74250
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE4f:A3k03kHRJARJX
- TLSH T1AA259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 955KB
- SHA256 956485340cd44a8cda442a37c7e8837af353fb7dc369a1d1a0adeed04e4564e9
- MD5 9b919ef4965cfce3cd33d52bb476f008
- SHA1 de58581385d818c7eb55329da2e09ca8c97c3eb5
- SHA512 5776e2e46548fd94ff4cf6c9bb9599b8b90bab018184f83fa0ae94a41b163002a8a6ea88611bf35bd52f9c9955bbd00c546baa999f22e79884e706dd9d0ad0d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE1K:A3k03kHRJARJX
- TLSH T168259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 955KB
- SHA256 fa4c80465973ee849243a830582fb58ec095ffa6231b97ce704901413e798c64
- MD5 de6d201bc2253cbecd62f885768f6e2e
- SHA1 ff287b765e85b072926341f1d852a69f3643a8dd
- SHA512 7cac5775da7e8d44c92c1fe334102e10e46b8a8212bde3bc8bb97bdf9bdae0865f6bdff0f32c3aebc976e9277ea6de3b7e7359be446a10b391c2e4d4c1d6a527
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE2k:A3k03kHRJARJy
- TLSH T10B259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 955KB
- SHA256 415c4e565e6b6d51cff54277ea314bd1e7571a27739933c5b3958d6fcc752772
- MD5 ecbc3e053ade3bbe4d552c750b47792f
- SHA1 7dbfe7408a7048d9ca930dd5b21951888717eeff
- SHA512 5635fc30ddf0897a43b88f0a3020c7f565ac161169b5b3b3e007ba1a41658e2e4f2808aceb010d496740746de5ce36d7ec015308a155e65ece4fb85445cd762c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavET0:A3k03kHRJARJ3
- TLSH T102259D03F79800E8D15AC1789AA69A22FB757C56173097DF2358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 955KB
- SHA256 f3c03926fb0e029750dec04f24e998c0092704c238cdb27658827c4464a82a5c
- MD5 9af8cb20cc6c27c8c5fae3ab3fd22875
- SHA1 b01e2e2fef592f546c7b21c55c8e670f4e53c5dd
- SHA512 18e939935048afa7b91275c2a4b1cbc45877930630add81b5154c68d247fd76a37f8a6fd15deeeb049dc19d20a0e4365930b93e03c631ba41802e88363adb8b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEig:A3k03kHRJARJK
- TLSH T175259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 955KB
- SHA256 7f0eda6a34d9dc05077649cfe375926ae173985f7a248465c77d7c2e58ce49ae
- MD5 f86692add9b3586112357f795fd4932d
- SHA1 b14799646e02eff01cfe96733ca0acae5e2b2bd0
- SHA512 ecb1634dcc6cf8a813fc1890760ee2dd1886200062116d3005727598f9000b2bab3ae4cf76f0d5a9409991c31cd1f84cdb43e4473bc6c5d822c72c958750545e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEDr:A3k03kHRJARJU
- TLSH T137259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 955KB
- SHA256 05935cc43779a1ccc7c216ef72332114df6365fa1edeb0fec3dfc051f4a36086
- MD5 5dc1e886c9066d0daed0d63c6d1a1575
- SHA1 3b0a112de50773fe711d1bc9fc69b518455981d8
- SHA512 0f3dae8686af944175f03851cfb9fad114e2d63dda7eed620c4c52c949bd78c1748274c5e35b101523f92f2a94caebcdb52f0dcdb6930ec0432768822d630849
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEln:A3k03kHRJARJO
- TLSH T156259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 955KB
- SHA256 1dfdab3e95484e5cf34ef0d87a1284572ce305487d49725bf72642f132657f2d
- MD5 3847559a9e6a3852f196bb0bbd3930f6
- SHA1 fc4d27c58e6b9cbc77ae1b10ec845e7bce89d8b2
- SHA512 5a6eb4dcc5d9484dca0a7e89176ebbe0edec5aa5989552bda1fd755a7f50e000654ceaf9e35e790ef3fae54d19585371700b13dbf96e70e0845b78934edde559
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavERx:A3k03kHRJARJU
- TLSH T1B2259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 955KB
- SHA256 98f73994d22b142b46c888b4e78046244ffed21f1099561f3a2d0ee8d50045b7
- MD5 3596067e73cd3986e9c425615a9853bb
- SHA1 95a48980f81a54addb5fd5971aa83ae9c272954e
- SHA512 1ce89c88ff25dd08e0aaf0871f7975d422c7c3e463bea714fb1643d263fb59558fca9a0d61a31b760e7169883c821e35730f4ffeedb89c948fb086fc44e57b51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE/A:A3k03kHRJARJ/
- TLSH T1F8259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 955KB
- SHA256 2375b8c319f3719174c0ad7f09973832bb79721a406bcca0ce021a09b4d250c7
- MD5 92766d5dfdd2f07946330ecafe657f13
- SHA1 3adf75651746ced3a8da3bd27b8bfd4c8d1eee72
- SHA512 fd700f642e8108af8516044142f7112b5a3e5aa6794fdc212c09bf854860b07df4ccb165c9b9753563080e682b17008e315977ecf96628e667fbc1427bdb13e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEQ9Q:A3k03kHRJARJS
- TLSH T1F3259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 955KB
- SHA256 c2a89774dab399ef2b4ec329f138b0f269ab71da0647c7d180685cf06d9feca1
- MD5 5543a98daf3a8e4cafcc5f289bdda090
- SHA1 af320c62d20423a7266e63422e77c7f0a690353d
- SHA512 0452f9e19146e26dbff7b00f755aeace130ea4d1ebe12ff20a19450ef76fb95af8245ff26640b8adf71f9cb6f0c4eeb154e0640a32b5c1754fc39d54950902fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEx4:A3k03kHRJARJh
- TLSH T1FB259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 955KB
- SHA256 a567bd39fb0d204dc87d82e7b339200d278c71531e2fbfcd8b95ba4357928388
- MD5 f0657b8f6bd176b2a4e1f7ea16e327aa
- SHA1 4483ac176d63db190aaf12643f269eb73f6b64e0
- SHA512 7b4552a7c18505fdf9b6b536e421ade99d4bc77cf6c2d5a9fc5457d6d4dd3b3a76bcb967535f303ef8d508e2b54d5db40c601705210d6ade47cea6d1d41cedfc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE0u:A3k03kHRJARJ8
- TLSH T135259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 955KB
- SHA256 0dac5824cf86c40c2e25e122a6cdf4edc3e58e983afe091fe19672fcbe8cfd17
- MD5 96a9535860aea5d176eedec43ab1bac7
- SHA1 daa1b840b69f7625498b6f11d40405727e12b3ab
- SHA512 ec02bf872706a6e996e747a3dcd3080936f54a66ee6c39a8b1f19dea476214b6b7231e0b503298114a535d9961a0c058aff3f8e62ec2520a85900a8e673c8129
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEFj:A3k03kHRJARJe
- TLSH T15A259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 955KB
- SHA256 cf1d8936c9a0d85b1c2bb230e4cc7a0e125e3d9aeb0900615910b97041a1672b
- MD5 7f3f0e0e10957e263c79d14b549809bf
- SHA1 a3f361102ba28214f9c6c0f6415c6ca56ba9840e
- SHA512 f11bcf99efe2e6e722ad2ec8831e385695a0223c799abe570e28c11c5b7b2d8267ba11c6d025c47cc4f0eaf00a2208d2df857a5242454a2470a2007decf26992
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEMg:A3k03kHRJARJS
- TLSH T1FF259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 955KB
- SHA256 0a4cb820268ff366fb21fe0fc6b75215b5773a8e1033640f370a1ba4cf64fbd6
- MD5 6ce8b1ee70a666abd14388ee5f013fce
- SHA1 067cd4dc47f1da92b17fd6cf20c7f873f67ee895
- SHA512 d5040343b887757bd71d3bd0d740a08f23f086f676e1f9fbf318729df35f5d96395aeb14c70f737d334dadaac24ed6f610f299d24302657617c7cd03db309a76
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavETI:A3k03kHRJARJj
- TLSH T113259D03F79900E8D15AC1789AA69A22FB757C56173097CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 955KB
- SHA256 6b0b99cad761da69e0d8866e7cb233aa92d71a15298e6787907b22b155b0687c
- MD5 3514eea83f69c1b81bd6e66f9c37560d
- SHA1 83923d06b7853f829e51f616efc8f25b419c424c
- SHA512 e06be6db67f2ee311cc0c6b4283b3f7a44e8afd99d5ce511028d38e8f3fa22130ca2b4349b5a358adcd712d2aba3f3aaf5d0892d46aac576190a7dfd94c7df88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEpo:A3k03kHRJARJ9
- TLSH T196259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 955KB
- SHA256 60a9a2cc9b7e9cf75a491ae172f252cfe4d255cd38f6dd89b7470c75ced55da2
- MD5 8924ddc372f909361eb3e85939bce4ee
- SHA1 6d5c3333430f3f2b3ee653f04d9636b7bd986911
- SHA512 994eb276df2598f249555b657409ce1b525431a0e427591abf603b58645caa9f34438be209959e1d822cf54a6b5d45aa04295b7336e14516a0698d6bc17c0baa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEa+:A3k03kHRJARJ4
- TLSH T14C259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 955KB
- SHA256 d29065775538bea130c172a069cc7a70c3daf3ad2877dd0be4fb87b8c683b84f
- MD5 e80729e31977d51df2d9b09786336435
- SHA1 774b5b4a34e87ddc1eebeaf8b768553512e40cf9
- SHA512 b74cceb540f9f7fd3c84493369673b25742d8587b782550debe0cbb756d01bb0b66acfb5c7f80352e828829696965f89a810b9463f6f45c12bd5cc62b4328908
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEaQ:A3k03kHRJARJ4
- TLSH T10F259D03F79900E8D15AC1789AA69A22FB757C56173097CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 955KB
- SHA256 243d324be42ea13e6fc4e4bfa7678cae2e3a65ed3ceb6630f54287aa12293f90
- MD5 fece5323cd79a53b58340fe65edf939a
- SHA1 293d35f26248efb0ed2b57853d1b2dd27935fa11
- SHA512 dfc2b604997471b71b99bc77b32aff3d00ef6aebaace01779b0a17dd520ac8f4189bd0fdf4d8d146b6aa1dc22c1d0eaa81aec44645482a51c99284ca37e0657c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavErX:A3k03kHRJARJI
- TLSH T114259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 955KB
- SHA256 d2c7d025b4f9cb9300428d177b2f1bb6d92b35aa6c8a045263501d5df5377e90
- MD5 171fd309d7d29bf2142b3c38a3a750ed
- SHA1 c4923c8f0872a97e782e85935c4201818f3a54b1
- SHA512 2a4705dca1db18f66ace1a53eb29de6b759652663a45f7a1755eb211341f7f37b7fbdd6eda47396c24da92eeb79a0fc71c79b8a9d5b8601574bb11cd40fabfee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavE5L:A3k03kHRJARJa
- TLSH T173259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 955KB
- SHA256 d8eb88420c84399c487f73d87fea97bebdfe133124cb56ab63235f19ca4d5378
- MD5 35fbc372d78a3bea65588ab9c7ea6793
- SHA1 0ad29a190ff05ac6062b08f65efd3c9c2303891e
- SHA512 ba3cb2de984092f59afb545e67416d2413226f741b0d9b63af299502208eae389ab38576e8998d26da6c31602e957689c456d1a50c413bf2e1bf586103db3f78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEnM:A3k03kHRJARJ3
- TLSH T13C259D03F79900E8D15AC1789AA69A22FB757C56173097CF2358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 955KB
- SHA256 59e828c867078c18a82a7e2f029f2089006717b0e3dedbac28f180175f28a169
- MD5 8aac233e06c25110e61730438d7f7c57
- SHA1 d536fcbab0d7a2ade151580666cb00be5e11c18d
- SHA512 34cc8d461bc049843ba8182029e6e3509a46da3d2bc5e3cbd26f952fa4e471ae8a18316a4e5bd0943c573d057000a2e0adebb461db91e646d3b33160e6f5f619
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyaavEQh:A3k03kHRJARJp
- TLSH T1D4259D03F79900E8D15AC1789AA69A22FB757C56173097CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH