Analysis
- max time kernel
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
04/08/2026, 06:11
Behavioral task
behavioral1
Sample
2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 883KB
- Sample260804-gx3zfaec28
- SHA256 92517973ac2fe01205f409c6d86607e1bd762504123f116ed67fcbee7f796291
- MD5 97c56344090727b935c694cc33492059
- SHA1 4cb8c9f404a43897e2a1a4130cba0324e181222d
- SHA512 1461992f95da3a116c00d220210477a60f0633258e6e58ac7215556b03791014260e777518cca9ee5a870001dce80fd16901eebca4a9f2162e75240a9af65371
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBp:A3k03kB56rF
- TLSH T1D8156A07E6840FA4D10F81749AA68662EA737C125F2097DF1354AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral2/memory/5460-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4ab-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5460-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3840-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9e-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018992-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a6c-213.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-250.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-269.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-420.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-481.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-506.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-585.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-637.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-834.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-865.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-932.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-964.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1020.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1058.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1077.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1108.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1121.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1152.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1190.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1236.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1352.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001892d-1538.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000018934-1564.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000018a18-1584.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893c-1753.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4ab-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9e-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018992-211.dat aspack_v212_v242 behavioral2/files/0x0004000000018a6c-213.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-250.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-269.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-420.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-481.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-506.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-585.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-617.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-637.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-747.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-803.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-834.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-865.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-880.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-899.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-919.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-932.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-945.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-964.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1020.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1058.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1077.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1108.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1121.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1152.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1177.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1190.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1198.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1236.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1339.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1352.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1371.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1390.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1400.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1501.dat aspack_v212_v242 behavioral2/files/0x000800000001892d-1538.dat aspack_v212_v242 behavioral2/files/0x0003000000018934-1564.dat aspack_v212_v242 behavioral2/files/0x0007000000018a18-1584.dat aspack_v212_v242 behavioral2/files/0x000800000001893c-1753.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3840 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5460 2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3840 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_97c56344090727b935c694cc33492059_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5460
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3840
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 883KB
- SHA256 92517973ac2fe01205f409c6d86607e1bd762504123f116ed67fcbee7f796291
- MD5 97c56344090727b935c694cc33492059
- SHA1 4cb8c9f404a43897e2a1a4130cba0324e181222d
- SHA512 1461992f95da3a116c00d220210477a60f0633258e6e58ac7215556b03791014260e777518cca9ee5a870001dce80fd16901eebca4a9f2162e75240a9af65371
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBp:A3k03kB56rF
- TLSH T1D8156A07E6840FA4D10F81749AA68662EA737C125F2097DF1354AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 912KB
- SHA256 50a505d54ff8e823cb05f6fcbc9ccb5e26819d4912ec58ed1e8d13657c8ff58a
- MD5 ec0001e699e10dc3792fcebcc819264a
- SHA1 136223473eafe517f96aa7b001816a57dcf75e95
- SHA512 46010f4492e6ecfc4059d193a6c72a188b560004900337162f17daf9c8344250b63de4152e5d6308dc67de1ad6048ba86dfc6a4d16759460eece478fd4d24b22
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBvP:A3k03kB56rT
- TLSH T1B2157B03E6840FA4D10F81749AA68672EA777C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 929KB
- SHA256 b57c988c60c7613d294cad7de89cf3d0ea66d19b1b2564c1efdaedc2fdc992b0
- MD5 ce9c1fd633bec8b3ec175dd22bf1a378
- SHA1 dbef7aecf499aa71395b9d82db069baa4763447e
- SHA512 355d1019e671b26b9ff8a6ff6edc33025447e76e603e29e77cb7021a5dd4be587462319c61bcecc80e0b94c89999df0e5092c6b7288792c3ad5a641ed0d0c1a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBc0:A3k03kB56rI0
- TLSH T147157B03E6840FA4D10F81749AA68672EA777C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 974KB
- SHA256 84e34b355b396142251493e951a70fdb8bccedb03d0d0c48513c458ebc0a4bae
- MD5 58327af129d9cf180c4c26090fd2bcee
- SHA1 3a4a3360c14bae0bdd7ec531689bb3976e3d4621
- SHA512 29e8436ffd2ba1c059b64b550f08d4daa0086c6cebaaaa63104cbbb74f931ec69eb849dbca12e5fbce90dc36e0f9bfae33777c2046ea0ffcfca38e9079c22a0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB9:A3k03kB56rh
- TLSH T178257C03E6840FA4D10F81749AA59662EA77BC115F2097DF2358AE153F72BC0AB3E357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 967KB
- SHA256 494c145c1d7d7377437db08bbcafbc8da34d0d13ad7893132c602f6c98c438ba
- MD5 b8991d435b5854f9eb208c98fa87e0d7
- SHA1 e57106ac50fd2f218ba47271bb095c67adccfa01
- SHA512 de9fdbc9ff10bef953f92b08ee68e415037bb3bd4666f4eb45048aed23e017b2800ff823ac396abbdec6d463d2c5b484dddda078b021224ed86944f44ca2b580
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB472:A3k03kB56r072
- TLSH T145257B13E6840FA4D10F81749A958672EA777C125F2097CF2358AE253F72BD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 935KB
- SHA256 05d8698eca778b1f3bee9a812779b359fa484592f72206d8a1fcad4e7474594e
- MD5 484c1cff661573441e326abe055e7c69
- SHA1 b4cade7e262ffe053cc73c9d8f5456edf17e6dbe
- SHA512 4f1481cdab89b30f7c191b889c05e1650866ace05bbc49a814e72bbeffc517f330a080b44fa59f950cafd9abd20eb1039e5366aca50d90b1657f96beb0376a02
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB4fj:A3k03kB56rKj
- TLSH T16A157B03E6840FA5D10F81749AA58672EA77BC115F2097DF1354AE153F72BC0AB3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 999e7d399b7cc02d6992599fac0107cfa72e5d6b2b07385b55f0a575676fdfec
- MD5 481c92ff379cfab61fedfdd174d0813e
- SHA1 c1914e9ccc2222432e33674374c4834c2f8d8c23
- SHA512 0dd13989b41581a96e19811d6ff137a54f4c401a11e07350e6b6755dfa955ece009da4a4aa11b71c014e161997b5f13269a2a5d5848cac1c78621bd08dc5d5ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBV0Le5ji0hmxNrM:A3k03kB56rBPji0Aj
- TLSH T1E0654A16F6A44B65D02BC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 897KB
- SHA256 9129d9942086a7ef759fff721786ca5e69bf971300d2e45d785edbed92c26bee
- MD5 faf3601bc33fcde0bd656802d8b7f360
- SHA1 316b93bd3e11aa85fbc049bf8a0a3096f993fb91
- SHA512 7d09087f335dac89896ce0fe182ced40cc6c7d16d574a4bfac294e974bbb245118db2c6c55ae5991ed30d1923518ed23e996e99facab8564b43c51734624a96f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB3a:A3k03kB56r
- TLSH T11E156B03E6840FA4D11F81749AA68662EA737C125F2097DF1354AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 930KB
- SHA256 c698382a10fc47e8cef8b8ce62b859fd84bb7a78fdf2b9b880e676d13b752abc
- MD5 d2b98834e74910b3f70f3b7fbfe591e0
- SHA1 03365446dc488d0aacb16f5bde5109dcd9c87adc
- SHA512 9d103d7f9081902469e05417c173ac174377a5972c7fe073438071633b735352f7f83f9d5f79d0ff191c8aa80ec9dba52dfe7e0877005c8afe8ff13c11f5f77e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB0b:A3k03kB56rQb
- TLSH T1AD157B03E6840FA5D11F81749AA58672EA777C421F2097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 906KB
- SHA256 bec1b8329788d216d3b052b3e39659cffa643e4953fd0a27654f607c3b646626
- MD5 31e5973992316889d79efda34410c149
- SHA1 0e36c6c22d3e7597ad7f47c3525c18c4a15d98cd
- SHA512 2b2bc2aa7e4ee2efe1f0fe17bda1f8158c335c3fc863a582dd087e30bbe49f794aa86f4bbe3173593ba04f62ab037f3878408a5eb59a8ba0080e0843800500ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBHZ:A3k03kB56rl
- TLSH T114156B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 906KB
- SHA256 0b2fec5e29d81b7799980379b6e344a8fcc0c39d572b21cdc2e6a64cc09dea6c
- MD5 483451fa25cf8b2cb3645853e5746171
- SHA1 d951f8050d02dd8d8d76a8b5b69ba0111faca393
- SHA512 e4d80520cdb86a83eb65348a3920894f543847412ab9d652d5d28e266069e64ada0d19dabc03cbb830800b865974256cab731f3d2399cec104714c3973babf2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBc1:A3k03kB56rC
- TLSH T1A6157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 906KB
- SHA256 852bb77b7a8ce28245f9806fb89949c032c2e3d62b37d08906818a2d04047b4b
- MD5 9bcd037b068add457fcc2031edb59eda
- SHA1 09491095451f5d62c1e32e46d9eb19babfebda87
- SHA512 5419cf68400bebeb4a992f8a307a3646553521c9050ef754b7782d085a564963b1d02ad15c0402a519bf837f6a5708d89ed398b0222b4dfdea2a0d6f81734c85
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB26:A3k03kB56rN
- TLSH T192156B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 906KB
- SHA256 6550a5dfe276800287f6d1097001bfb2d2ebfa13ac48ff84e2632e589fa604ce
- MD5 d20db77fb486a016197ba00f822d9128
- SHA1 84cca41c401d496cddd8cfdd9ddfc9557bbb5c9e
- SHA512 d381e430beda83adc4c58d2da228217cd032534e03dd00da3571b97dfc8bcc529059c56c49688b925cb2774e36b530a9015296699cc055e98cadac540072619c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBmN:A3k03kB56rs
- TLSH T194157B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 906KB
- SHA256 4bd5e05ae368bf313a909bb98a96d140484a819624408b71d88dda5c75399f65
- MD5 cc2f49c6be0027765b704d8a6e8d9e1e
- SHA1 92c6b92de74352d779a79c26518bc4c55edf1932
- SHA512 d46707cf74942e5b74062d0a7bba03f76e24add4df147543167993ebe865681d3432f13c0bbd05ef54d01b029116d5b63f5ac162557d51ef62986d868533259c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBkf:A3k03kB56rM
- TLSH T13B157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 906KB
- SHA256 bff82fecbf3253b7fce5286b0c3129a763c6f48af4ece1b7c38aa2c5468edd0e
- MD5 d3301c805b642729ea8fbe5005570f9f
- SHA1 d902e7f43dec26149dfe279b8574ca9f2279f049
- SHA512 a9f68eca0666127a80ee2f9cd2f25ab3e44cf2bf0f943c180c9ca3d714ed967d8684a72eed654d23c27797ae9fa770ccfb5de6a1c0314824e73d7e272b90b5c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBOo:A3k03kB56rB
- TLSH T190157B03E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 906KB
- SHA256 0fc056f10c72e8097ec8d550b5e6d2eecd9cb4f62a4c5fc6b277d955b592030c
- MD5 a09ac0eb43030fb793801473e480287e
- SHA1 0a2bc780b7a41a24f92a790fad9b9f540463c929
- SHA512 02e47834a0c6e9212cdf3f50e62269584b6e6002fd6074331b5458e53b120685181550609078e241fc6a072e4e1524883ec47acb046fc8381de46af5bb4106e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBiu:A3k03kB56rT
- TLSH T1CE157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 906KB
- SHA256 77a6d19521121dde1edda69233e88dc80534e82d790c362f0aca8e9eec4d2f97
- MD5 14e3738f811619add9b668f2a5d2d035
- SHA1 8039c23c3904ddce5d556daa6c569038cb01250f
- SHA512 a209162efdb4135532583308181a11f3b3336dc363b455f49aa5e60a62475c3fff347906890e8642720966ef9667a46d94e6e4594c1f1650232b2f7ba1c541d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB29:A3k03kB56rS
- TLSH T1B7157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 906KB
- SHA256 4ea5cb97fc124553a43faba596aa7beeb70eb97ecda1d53e71b72a0cdcf714e0
- MD5 8ca12b8e91b0da66b15ee714f3f70ca5
- SHA1 89395c34ff400a04f5f1f809c25e1aba12da4d0e
- SHA512 a382980418093f57333e3b3221e8fd200e650449c745a97e152df9ac3946d9032250fd90ea2fa1785aa830c1fd79dae3f383787c1c85aa490bbe6eda121e12dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB2c:A3k03kB56r/
- TLSH T1B3157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 906KB
- SHA256 b4a7dbedf6e4e6057f2ba4584446dfe0d3a509d5eebba0550f87fd75adb9344e
- MD5 34d52f1299df43544fe2c9d1c382cb4a
- SHA1 01d793eb5ed2a51630f74ae4922479030eced76a
- SHA512 a57219c0ec395a3a82d80d2f2205b91fa2400deb1d3db9909cb7b81c95029f102320571e747cf0a3786eca3d4a3649f9273fe71384a484c71d99a6cf0b38c1c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBvp:A3k03kB56rV
- TLSH T1F0157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 906KB
- SHA256 65d45851461d2c5edab46692bc190a3abf1ea3a0df3d825aeb2245df667bfcae
- MD5 532229c76ab50c15b01b5f3905b5f25f
- SHA1 a4fcc452f06dd5bda804c48b52d51ad3d617b2a8
- SHA512 205d471a514f45374e1535eb0ef17c06ad881b507e628d43d1005732cd02f8eb00ec4ef87df67a611776e9fe42b420e1f13d0576daec03f45f04ebb03a1001fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBQN:A3k03kB56ru
- TLSH T11E157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 906KB
- SHA256 0a73573b4ebc1ca64e114471e4a502141b7eb92c0543be1698924b030ec9aec8
- MD5 c5589a108a015d5478aff4a664055c30
- SHA1 df359299c82be9cb63fc1e543ee3b3e26e0dc5d0
- SHA512 77fcf7506944c58c0380dae6b0438f1965fd6c0f89534dc641e1058abc566052e183adf12de973ed12fdbff70de2ee7491058faa412363d78825c61b8ffa2562
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBYF:A3k03kB56rs
- TLSH T1FB156B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 906KB
- SHA256 25cbafd6cc38f1911db27ac4d43d2144cc4d5df03d1ebd50f0f953ad1061125e
- MD5 bfc79a4d217778a71d65f637b6dcea8d
- SHA1 aee38894dcb9b5a89893cdd88cf8faceb1814f9b
- SHA512 1279c2d54d57399cf26dacdd08434eaba1a2606bcce0b3da2f96bb6678f394258580bf1a967b77d77370bd391a31bdf466fb737e168fbb9d77b88ecd85e8a4fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBNC:A3k03kB56r4
- TLSH T1A0157B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 906KB
- SHA256 ffa03fb0d5b37ef3da1c2d8edc23347c765033853b0bc30d0e8e583bd0fb0342
- MD5 73c60f1f46d942c563f53e127208085e
- SHA1 89ca5e404e5d0849b1e1a91e601aafdc596d9adc
- SHA512 07a7460ee8558a6954f1a59dbfcb1900a36ebb573d36b13590722f7e147571571ff0565f62a6479d1f654c54079f3fdb3900d13a9f9fd6237669860c21ae126c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB2w:A3k03kB56rV
- TLSH T195156B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 906KB
- SHA256 a6a652fbc2098c13f7799df27a9ea5034b14477298618e521b15f7a8534b37f2
- MD5 17957625daa12760a4aae2dbabfb48f3
- SHA1 99098e02894a9099493dc7adf7443ec3c1989acf
- SHA512 72369d80559f5565edf07af08124a64caedb331df123ddd366819fbdf1a768bed7afc8476d2d2d73f285d0e9ad1d216251387edd2f083e4ea8a743d693966782
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBlT:A3k03kB56rJ
- TLSH T1FF157B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 906KB
- SHA256 a3835f5205dca446c4cfe754798e88252ab075cebbd7685dfdd9ad76942ab823
- MD5 8808d461d69b08c36056d3339a8419c8
- SHA1 6712c3098fcb42f81ffb2e6fd623fc07aa2fe8d5
- SHA512 333ebb79aacb73c2a6b303ac98c036b5f5c129c2a5181163ac72024dd2482b03e16e56fc1e07f1d792b33935f2591b1bc5e6a5d75464dc61b732a8e3e6094f43
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB7u:A3k03kB56rO
- TLSH T123157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 906KB
- SHA256 3e38e7e8b39e7d277ecc167dc38d45cc7ee7319f520d3bd399443354f59a542a
- MD5 47271e8423a65692a21f0a84b9e07868
- SHA1 079af612df253c9670b375fe46c092837b9fcce4
- SHA512 c8ac39907c184c1ac00940c1f74ce28d5d96cf35e484a14222b4fb8ad02972f9bd77f2c28d0e8c4d8cf0fc8fc6196c844674eec36f3bea2d93cded293d560e6a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBfb:A3k03kB56rP
- TLSH T10E157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 906KB
- SHA256 0fdb4cc0d6a8df04a1c5d1be547632506d3cf1e2866f48e8366da93da994baf8
- MD5 8161a1281dbbe7dbb83083a06b6b8cf4
- SHA1 c1f6cdec0a739f8a1c023e1f97f2b26d8d941444
- SHA512 edb19060d63715699f6bd8c9d36c1301560efc891497e03ed99db5919557a764f73cc640adff6470a143c20d4388bbb05aee2cf0c29f858ccf73ed125c4d31b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBbf:A3k03kB56rH
- TLSH T1A7157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 906KB
- SHA256 20aff17581ae9a044854874055b7f4e4c47dd520a293c179bfc5c5d443ce30d0
- MD5 c22393151b1c9c1920b2541c57f892cb
- SHA1 484217be61f02e60503c3ea640410ba807d73696
- SHA512 44395865bcc0629039e142be04e2d0573bce1fb8f4fa700f30c8c9b767fa8abb5578561c1e5798dec8e35e4198daa3288aa021112dbfa1b6361dd34c0a15d793
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB0K:A3k03kB56rH
- TLSH T117157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 906KB
- SHA256 072efc2d06076b3457eb25429660e08c331b95206b2a4054bdbee4a4af19aade
- MD5 7854cfad821dcd578aeee662fb800660
- SHA1 7bd6e9584690d007157991969c300b555c53fee1
- SHA512 f4f07b7cc86dc0393dce2ae9ed5ca44e0137c398abea9b906095fb89e2a862b039d659802c5ee64fc7ff017214033d5c5bce3e11fab0b0bd6827d406620a961a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBpk:A3k03kB56ri
- TLSH T1C3156B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 906KB
- SHA256 996c45183fdc7a9de34942ea0110ca3837507e410b79fe919da3e9caa5725438
- MD5 47743d76a747d00b0ca8d0249e7ddd9c
- SHA1 914157feff75babd6cd24ba76c7ff46de59a7902
- SHA512 cf01784d0dbc8383f82496c9610865d7a1a403ae5e813e36355cf7b38a94165f897b7e1ff7a9f39658307d328fca6a9d721e91221e87ee274cae436f3095a697
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBG0:A3k03kB56rH
- TLSH T13A157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 906KB
- SHA256 4d0dc3d94aad2e82959c8a0df40671697cbda0cf80fed10ebdca28787ac7aa45
- MD5 8e9dc4d61ac60ed033dc69db6851f181
- SHA1 4f85a34b478d175986c3a715c13b2f14064a8e6f
- SHA512 dec08717419a045c294376ea58104e3fe82d7740971e2da5732959967cbd26ae8c741cec9ddba2dfcefcca8b9f5ba64fdcc34017e4d951754212d80f295e6d20
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBVg:A3k03kB56r6
- TLSH T113157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 906KB
- SHA256 92a7e2037e74e6c4b772b39194f473e10ad1bdc39908cab61eec30d44489c340
- MD5 11e976843c0282e429fd67e18aa4ad42
- SHA1 201497bcadccdb686e98f102ca2ac83ea977849b
- SHA512 a04724526fe0a378222b7a54bb2aee4db7b8644c9ed5a5b0d86e90804675e914f91bbae08a297e2708e678da3257ff1b6b8c69c8bcf9f67b2f9238ac801544e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBkr:A3k03kB56rE
- TLSH T170157B13E6840FA4D10F81749AA64662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 906KB
- SHA256 aa36996b279a7e81e726f93af39156cc1d3d0013f16753dc1db4812d3f11cde0
- MD5 636e6925e4d6a8537d540cb6f601af13
- SHA1 298df439a4fe5abb4bb91349ecb2dfa217969034
- SHA512 ee2a83bb15e7d7448f86c0b544e56b74842e7a2b896bfdc60ab5f86dfc3d8d8e2b342aaf7c120698f86d6e18d9d910e89df1181c92e3e09496f301e7bcbe58ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB6n:A3k03kB56re
- TLSH T191156B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 906KB
- SHA256 b0ccba5e1fdbeed78c080c21e15ae3a5490e5a8b590cbb3ba17a305872ac1b71
- MD5 8865a34ddb7dbdfb178783c9ed2d2841
- SHA1 ccbc08c2aaca3ff7ff3d58f50bb9b4ae326b57b1
- SHA512 85b33f60f6d5ca13d492e75a64e4c8e908a8b26f743e48edeabddf83fda5ed4156fb987b345547b4daffc46d59515b2f463b998f1030a866ede2a451ac845afc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBQx:A3k03kB56rE
- TLSH T195157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 906KB
- SHA256 5b30198980799cecea351e15bff3d1fee7b28aaba9e55289f3e1d2633a91a7bf
- MD5 dae6afb124261fba1651b1a3dd2b3ac8
- SHA1 53120b9bcd03683a3a863519b803130a74f4b04f
- SHA512 8a7d1ec046634296c154d1c052d8acea48a83ff54672f8d9a02155b9cb344663b1a794a84463084985faffa7be06b515047dea46ceaf9513569cae510807f401
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBSA:A3k03kB56rv
- TLSH T151157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 906KB
- SHA256 e92a37f4e0c358da005dd364bd630a63b71706c4d308394f14340eb8b1c07fc9
- MD5 a2c6b9aea165136cb80c7275cfa10f49
- SHA1 c7267024f8955ca5f83602674fa0eff1ab7ab092
- SHA512 59a3b3e753e29c155ae426478a326815860621e545e9831c09c0406ae5c604c2885902023f01b88755c6d0dc9bacee636ae30af66c47b4c54673147a7369ae45
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBr9Q:A3k03kB56ri
- TLSH T195157B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 906KB
- SHA256 fad0e809dd2aedf0d29d6083e2fe55f2bbc20ea131964c86d7610c34c7df36eb
- MD5 8d4354085cd94311335e9f581c1e0c52
- SHA1 0ab157042017c3c31cd26ecb3c38d8693b18bff4
- SHA512 b51ac5cca5918275b89b24e395ab7faa3215914d74a8d5a1daeef26cfe899f9b1dfab23c9e6838068c67df829fbd77417f4980d820054c6168521d60ca47b0df
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBa4:A3k03kB56rR
- TLSH T172157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 906KB
- SHA256 869120794a9720c0fdceb5737bd651aad0a34924991532be138c8da406dae378
- MD5 bbd17e0eacf6ecbdc2a7560e1d6c7336
- SHA1 cd4c1568f475556266051ba36ee3267505ff1efc
- SHA512 7e4b10b15461b72556d62a361583f2672195c1a22b91e5689ac6c28a84b1df3ebfb8ec061b0a989c31f29b9d7da37047df9170cefcb0b0d76051b64b01539854
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBBu:A3k03kB56rs
- TLSH T15F157B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 906KB
- SHA256 3301841e4db0f3ffe29de305043b55c0dd25ea37ea0a8b6cdf57098b3809f47d
- MD5 13ba52c5921a04fbb0d1a0953f85d90d
- SHA1 de9ed561eaaaa1dba32da57cb74e097c7b27228f
- SHA512 bec5b1be6359a793991ebcb5565827ed4761725ed8cd7da2cc0f25f3d7f482b70906d1a85d1a134984021455c24a0cedc4c2a4d9c2a37b8e4cd6ed8dd7362b8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB0j:A3k03kB56ru
- TLSH T117157B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 906KB
- SHA256 1396e44679478465a8ed1ef70ede4a0b4401541382185552fab9624bfdbb56b9
- MD5 e3b91f71cc8c0610d401f60b23c91095
- SHA1 127cd0b304674c7564395e75ecbef9fff49fb7ae
- SHA512 816a0992359c010c91ff8198419937705c002a5aa516d015534a72433cb1a9be580c08f5a234a0b17d6726c161b8beb50609ab827a2aef5781d2532d246d7c6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB1g:A3k03kB56ri
- TLSH T102157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 906KB
- SHA256 16deabc7342789d5cd8c21498de06b93a3ec6339df7014529390b3ad15f72dfe
- MD5 8d6e96a2e0258408ba28d66a9c1b3b61
- SHA1 137855767ed1dc532e9571f5f021ffa9ffe07d55
- SHA512 6ec5797f17fa4df0df2b0010c4adfac0830e3f475573946147c3bdb4c90e3d56e8aec90d4c6e9a82b26d2ee21cfc81ae06bc23c175f6a4d3827d3ee837503a86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB0I:A3k03kB56rT
- TLSH T112157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 906KB
- SHA256 9915798ac0e26b75ee66a4d9a8ae23424766fa406595a1ba6132bb430eb0a202
- MD5 75f0aebaea14ab7dbd57d53c52d7a5ef
- SHA1 456a3d1153cc476d7a07fce80096dd9735f6e0df
- SHA512 e09d48bc01277de34efde82b657528063b24e93cfd1be659e7d747d27afcff377b2d056da796dc7fa6f5f1641412cc3181b6f839eb98d9dbc01f9d620042fd54
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBmo:A3k03kB56rt
- TLSH T117157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 906KB
- SHA256 62fa7c2e1e097ebf036061fe6808ac86c37583b4055caeae156e690f78004977
- MD5 c3c910d1b8bbcbad84c08aa57c229a62
- SHA1 91a1897870dcb149c4600dea621543d6604e670b
- SHA512 df46969c653eb760a39a952d26b784e668604954a44fd615120049b7de441a77b695b0553a8033c0501f3ce6ad6b9c380476b1fd5419db1c5bf72e0609a6fe88
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBN+:A3k03kB56rI
- TLSH T119157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 906KB
- SHA256 fc0d2afb47d9a7ac73d04e7b13151d3c8434df0224868ad5fda65de5fdec36b4
- MD5 5bf0f3db0d5f2cce2eceb2d9b60743bd
- SHA1 a7973aefa36ed3d90d0ba6d01447580157e8d4a6
- SHA512 6ec0c9290ac1becec35659dd85f121267cea40514c10245bff61efbfff3e2d5ee36f19b7bdb2dfce5ef392e5c3e0502f796ec57d794e77f5770e7304ca5dc91d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaB7Q:A3k03kB56rI
- TLSH T154157B03E6840FA4D10F81749A968662EA777C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 906KB
- SHA256 87370ac3e483cb91a57a6d0ecd21a70f61adc2adcb6ade2ef6f72f4d8a6b73f9
- MD5 28e551e5695b99cb4c9a4097dcb0dd26
- SHA1 5a90cb0ecf38db572fdbd344c0a714deaeae6429
- SHA512 3ccdd427b63e28ea94153be7c5dffa2557a889e863ff3218fce8849d7a77d11dcd07100a82048ca69bd6ef251d61d5043766fb4aec9e4f89312db84445cad661
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBwX:A3k03kB56r4
- TLSH T123157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 906KB
- SHA256 47dad6875c1f13bcb2bafbd4a18b788b1d5e2602d0f7137c2b8f6167cfc79d23
- MD5 ecdfdecacbc9599a0cfdb82d65be709e
- SHA1 04f9848e055d401598ad96e1cde44ed926d7685c
- SHA512 ddf729abe0f746eda485bb69c4bc56fa7ca2a03f991deb61c12fe51323475e72cd116c258313f57bd3e45badffd4d232ad2c63a426b7379f04ec06da37ac9421
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBGL:A3k03kB56rK
- TLSH T13A157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 906KB
- SHA256 3f850c9f15cfb93a002678582579ee6e9ef0c2210529d41a6c0a8a6cb507ac23
- MD5 95f4f5e04abc131cec092459939ce514
- SHA1 2e4898e56741bd43a1e0e0de9110e865c6c96347
- SHA512 e5d342087f65eb3668e5f56bee6d2f4fdb7a605fd0c5a1853f8a58e6724d66192264e8086d92629a2015cb878c183cd62e152e3485057c538b4fa53db44893ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBaM:A3k03kB56rH
- TLSH T1B5157B13E6840FA4D10F81749A964662EA737C125F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 906KB
- SHA256 0534a0737d962cf429d407c6b7c56eda682f1747228a61df5d2954a7611d0330
- MD5 46c287ede02df677c7de93b77a00dae5
- SHA1 3c13f98107ee14cb3a53167581429232e1a2ceaf
- SHA512 10e915bd42c69bbaae1a0e6c8843053f7e05621fbc04b7d7462556b84b647e853f6d597df7452d90c2d7af7fdff6485bdeb0f7dcefd5921650f15c9122b18a19
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKaBLh:A3k03kB56r5
- TLSH T1E2157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH