Analysis
- max time kernel
73s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 01:44
Behavioral task
behavioral1
Sample
2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 939KB
- Sample260807-b54caadd89
- SHA256 d044e2e1f0c3a873bec5d5936176b628a385a094d44aa3a023954c93b10e8b14
- MD5 cb33bfd88eb1d68727ae2dec93686ee0
- SHA1 ae6d583aa9d8155c9ba159145eebb847f4a1b7f8
- SHA512 911a56489287a343f1e75a0db88f2f76c3f2f5526fdb2f7cbeddc4f050c27e0421cf60bf023900a6bc9235722d399d0c6e19b4654b3002d5d9e63e2f5525f607
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOu:A3k03kB56rV
- TLSH T193157B13E6940FA4D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral1/memory/1080-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024210-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-11.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1080-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2032-28-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bbc-41.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-243.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-269.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-444.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127c-488.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127d-512.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023458-597.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127e-628.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-701.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-732.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021280-758.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021284-789.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021282-803.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021285-846.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-871.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-890.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021288-897.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021289-910.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128a-923.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128b-936.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128c-979.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128d-1011.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128e-1054.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-1086.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021292-1105.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021291-1136.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021293-1155.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1180.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021294-1187.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021296-1224.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1327.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021297-1334.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021299-1354.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129c-1380.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-1381.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a1-1388.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000203df-1607.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024210-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-11.dat aspack_v212_v242 behavioral1/files/0x0003000000022bbc-41.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-243.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-269.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-444.dat aspack_v212_v242 behavioral1/files/0x000200000002127c-488.dat aspack_v212_v242 behavioral1/files/0x000200000002127d-512.dat aspack_v212_v242 behavioral1/files/0x0002000000023458-597.dat aspack_v212_v242 behavioral1/files/0x000300000002127e-628.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-701.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-732.dat aspack_v212_v242 behavioral1/files/0x0003000000021280-758.dat aspack_v212_v242 behavioral1/files/0x0002000000021284-789.dat aspack_v212_v242 behavioral1/files/0x0003000000021282-803.dat aspack_v212_v242 behavioral1/files/0x0002000000021285-846.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-871.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-890.dat aspack_v212_v242 behavioral1/files/0x0002000000021288-897.dat aspack_v212_v242 behavioral1/files/0x0002000000021289-910.dat aspack_v212_v242 behavioral1/files/0x000200000002128a-923.dat aspack_v212_v242 behavioral1/files/0x000200000002128b-936.dat aspack_v212_v242 behavioral1/files/0x000200000002128c-979.dat aspack_v212_v242 behavioral1/files/0x000200000002128d-1011.dat aspack_v212_v242 behavioral1/files/0x000200000002128e-1054.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-1086.dat aspack_v212_v242 behavioral1/files/0x0002000000021292-1105.dat aspack_v212_v242 behavioral1/files/0x0003000000021291-1136.dat aspack_v212_v242 behavioral1/files/0x0002000000021293-1155.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1180.dat aspack_v212_v242 behavioral1/files/0x0003000000021294-1187.dat aspack_v212_v242 behavioral1/files/0x0002000000021296-1224.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1327.dat aspack_v212_v242 behavioral1/files/0x0003000000021297-1334.dat aspack_v212_v242 behavioral1/files/0x0002000000021299-1354.dat aspack_v212_v242 behavioral1/files/0x000200000002129c-1380.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-1381.dat aspack_v212_v242 behavioral1/files/0x00020000000212a1-1388.dat aspack_v212_v242 behavioral1/files/0x00050000000203df-1607.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2032 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Microsoft.Msn.Weather.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\WindowsCamera.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1080 2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2032 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_cb33bfd88eb1d68727ae2dec93686ee0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1080
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 939KB
- SHA256 d044e2e1f0c3a873bec5d5936176b628a385a094d44aa3a023954c93b10e8b14
- MD5 cb33bfd88eb1d68727ae2dec93686ee0
- SHA1 ae6d583aa9d8155c9ba159145eebb847f4a1b7f8
- SHA512 911a56489287a343f1e75a0db88f2f76c3f2f5526fdb2f7cbeddc4f050c27e0421cf60bf023900a6bc9235722d399d0c6e19b4654b3002d5d9e63e2f5525f607
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOu:A3k03kB56rV
- TLSH T193157B13E6940FA4D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe
- Size 1.0MB
- SHA256 a2037df90d743fea2ac632d776827e95675275e900140ffbc2a376ebb8e2e726
- MD5 512feaedc14a79758caae596a8f11c04
- SHA1 3e940c3e0f8a33f00ea7fcb160f20ebba4751696
- SHA512 7de8b535fbdc564d670c193314de1949faef603f80cc90d52b5cfab093a2f9ac1a0f5d951f0814aa191583e6e632dc0c9c3269549fbb46de72b1faf8fc72f1c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOCTjE:A3k03kB56rzw
- TLSH T1F2356A03A6940FE8D11F81749A954A62EB737C125F2097DF1358AE153F32BC0AE3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 59bc315ac61bb0b102df5efc0b0ccf77923f867d2ff4ed572841b0b729167e67
- MD5 0e11e4b87e643d79312e374d6c63ba9b
- SHA1 e7e02c682b35ba90849e18fdbf7c853261dc4490
- SHA512 50492f81c0d075ad53f66da2f5c483f1299b0f3b612fcfd6f9749cb4b4f5c3f3aa51a0b9d46361b1e14636ff10fc5973208d6fa8eeb3a889fbe635a3f49f477b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOe0Le5ji0hmxNrM:A3k03kB56rRPji0Aj
- TLSH T19A655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 953KB
- SHA256 77bc18ad8f10da2dfba3bfcd86706e9ee2bf238f09affa0b92f012a6402ee662
- MD5 498329984f72028770496c360bfe6a30
- SHA1 b6a2ac652418928f58c4e39f78da068b6865a83e
- SHA512 720d8201f574b604c720791059b0eccaca66653e09dda22e4893ac1db277cba676630cfb32727b426bc94c9b3f563f12c84056d88e4d611534463e156213b5aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOYa:A3k03kB56r
- TLSH T174257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 962KB
- SHA256 9aff9adf0cc3b4b722869d017af482db44dbefb08578a391e7099dc38117a375
- MD5 632c5e613e794e9909a078881902bd6a
- SHA1 4d5e70bde2f82633b7ef01c5391dc6293bec1efe
- SHA512 5bdfa639f51e0f63d37014574e3590a2a6a189aacf7fa4f102769965e485924f7f46809e89af972a4ac64798eaa3e50c3e1bb194aaa57168078b7bbe59aa5d59
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOx6:A3k03kB56rd
- TLSH T1FE257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 962KB
- SHA256 472016cdf33c2b05b1c64739e69c49445b9f841b4cd599a1fee601179d1650a2
- MD5 60dbcdc1557f39813790ecf449724aed
- SHA1 35317fe73ac244d1cd1065a0c0afffc629d644a5
- SHA512 a2123a78e8cf3ee1b0bfebc11563781947300afb6c989717c330392bb3544980b0c26fa40e654fe99a6a07d7b9615eac4d6ce3f462b11120a3a8ab4b34bd19ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOXo:A3k03kB56rx
- TLSH T165257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 962KB
- SHA256 40614f0e56dac57cba102df9370560223c4d301fa65a149bed2727476886fa3c
- MD5 6f66b06a86d988f060ceb8c716c6901b
- SHA1 c6b040704a0089bea32616992da6ec762c67a2c5
- SHA512 590ca2e9a75c0d862a2b67b3743f21358ff465de12e4c1d4accc9c7acd26e15f30c449ce0812788424f261cda7ca6dc08a54bbb6e8f6b515b0f197cd8524a090
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcObu:A3k03kB56rj
- TLSH T1F2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 962KB
- SHA256 bd6ea3db739f1cc77e5f1d5410d87e4cfeea10ae2df4a6a6f70fb6e448b712b6
- MD5 86a9982996c43353e051cbd757887558
- SHA1 6b39cf766c7d42a75be0f47e79261fae2091a9f1
- SHA512 a9db92ec087152e6df8b8eccb205980bbfc5e002aa827f6ec29f1088aabfaca611841e54417d39f46460013b6ab9c213c85d895bd277e3e74f901fb11013080a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOJ9:A3k03kB56rC
- TLSH T19F257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 962KB
- SHA256 4113e74b1c033a8cd6fb5955d2f59661cb281dc4ac609149810712ef5aa33841
- MD5 35513a9dcbfd7bcf9a5fa3a226a8979a
- SHA1 a92590b5267243ae9dced6b73bd55df06268d0f4
- SHA512 f95bd24e8dbbef059522861a5f3a263d4b53ffeb334dc3654e099109d128d83eebcb47a261ebb6a672c440dbf1a72896424b610a5b4dc29ca120acdc95ab6bdf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOlc:A3k03kB56rv
- TLSH T1B9257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 962KB
- SHA256 1b9512cd0f5c57e27afb6f93d6036703d5dc4cf355021f9c54ff7aab3f160df7
- MD5 35e9ccdd561871692787a5de390a3c86
- SHA1 a5d809dd38ba50c4a1a30c14f6df1d87ddb6323d
- SHA512 7f202d364f4de967936fd3acf073eebcec99c65df780b91dcc6a279cdfc4914606132718fcb436bf9d84337838030f1378e46b6d569f67cd0a05e56ad391ad22
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOep:A3k03kB56rl
- TLSH T1C1257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 962KB
- SHA256 270cc0c521dda65f2b152c4f94e97ee1ecae679685419dcb1882981551639498
- MD5 bfc06c2c8696ed03237604d76704a3de
- SHA1 c247f30feaccf90774518c824909841ead4d9c78
- SHA512 a17906a72f756123ac5258492982d02f5daefb3aefb66b809fa2352de03d62f1cc3f392cd7c171fb51ebc433ea6285d1ea8765be8ead2b73f18026ca92cccdf9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcORN:A3k03kB56re
- TLSH T1D3257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 962KB
- SHA256 3e061dfd64e1c4f7a5013c3bf54babaf455e41e37348dd4e463ad4ca992b7e6d
- MD5 07e67f6a314079ab0ccb3eed62046d1c
- SHA1 d6099a02b6ac13063d8e4855cb2386199adaa6a0
- SHA512 88ed2d9c10318c4866fe5b681a2394feab842a35d2d781f8f02e4fdddec330bc628ca472e5ef94d81fd86eb3fc1a5b576f9fec796d9b77edde162ad2ac59b0c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOzF:A3k03kB56rc
- TLSH T135257B03E6940FA5D10F81749A964662EA737C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 962KB
- SHA256 9c643e400a12ecb16fe6ce4f8ca20dba464e7f325348d9224df7cd9f56aa78b7
- MD5 8c348345469c4af222aa914628e1dddb
- SHA1 d65a6599819ca15af0412ae38bfa589a9d4145e6
- SHA512 27ae3401723333e4e481ad4a36bcc9f1cc0c3640909a06608fdc4589e63df5688911a669582abd40c9064c3f551428719bff1d13e713cfc7c5dd930d36d38db6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOcC:A3k03kB56ro
- TLSH T150257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 962KB
- SHA256 4b89d97f6c1254fd034524e25c1d20b8af73bc3b7551c009e026d5a40a2641f6
- MD5 016996b04b54bd9511c99f4d632893dd
- SHA1 35d6c530a8d642c1be38f5a1a10fb8b612925031
- SHA512 65486be0a685ce576b332f687b66efc3a6de60f665f8cf4fe64c88198bf9b7ea74e0b50fd8525e4fd4fad8405128916ede24712de573018cf5f369c063ffb160
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcO3w:A3k03kB56rF
- TLSH T1F2257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 962KB
- SHA256 60dc815d034d3ae52d94fc99142130d52ba0b76b36b1aa6ee03cfc8cd038849a
- MD5 29285acf756f4b593c58f257583b375a
- SHA1 6190f0a75ec7b59751b0ebeddbe1af5f4f791f56
- SHA512 40d3839374f8c161dcd5f387eb67577b5e57f58b59d82ffd64b49a5bc4875429bba112bf4e1c5b84e0a9542d63a447a1390c4aa405b259935982a6b7ad33a051
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOmT:A3k03kB56r5
- TLSH T124257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 962KB
- SHA256 ebca6a86afcb335813a5b37ed4bc2dd14502cd05cf9fb9a70c6ea34ef583f9fe
- MD5 24cca569d4714068bb382c36703ef014
- SHA1 edc092006c0b613da0fee04694cb57900ff0e0e9
- SHA512 8b76946f1d4f6857eb42b3dc28b6c2d31548d839728a99e6c9a28ab3b2e2d4a76969f087e227243cc14800e957a3b15a56aaa8219baca6ca46b22b285a4ff398
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOeu:A3k03kB56r+
- TLSH T1C8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 962KB
- SHA256 5fdf96c9f55bf337d98e077d876926de456344c23d43613f43ecf5bc4cfbb941
- MD5 2ca846057c226fb4e7a8bee12d13bfb1
- SHA1 1e2591051d48fca53829240b816430c3cb9ed168
- SHA512 44bacd290c0fcf3b7735cea65f6847e29c052d290f47be9dfd48d0016afe987dc2230a1ad63777cf0ac2db7a7bf2eb8d2692d93f9ad481b276bad114710164ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOYb:A3k03kB56r/
- TLSH T173257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 962KB
- SHA256 9736dd00e05dd85c3b61b57f67c2d68fd48945b2530cf42cdc687475bb6869b6
- MD5 a79f0205ef47cde80463767579cc1c48
- SHA1 e22be6299ef0be43c42f17df1967c2b28af3b726
- SHA512 1f9dae3af047901f5c4d71104d3adcfc1830e44a0cbfbeac6ae5e4e3adc52319a6d7d44885e7e56b2883f2751b1661cca7dfe239204c4efa258637c887e88ae1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOGf:A3k03kB56r3
- TLSH T100257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 962KB
- SHA256 e9d28878abd658aa76fbece3742d6c07595d2da58be333720c71fd31da0ca478
- MD5 1743dc4e4a61d52b49aa9e5b7c50830d
- SHA1 852a73df02f3c0814415d11a1142f9730458abe9
- SHA512 2a7b669c619bff5a49346e27adb555bbc0e7d5afcfd8239a29513c5be142b87cd97abce4417cc86ccbde4d0ff279c5bb664b026137433ac39138901024fe71cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcODK:A3k03kB56r3
- TLSH T1F6257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 962KB
- SHA256 bc6f2cb24fb98cdebb015054f5734a6fc86a4e551d5fdc9927294585f0983a4e
- MD5 41c155732d48f6b18a960a212d0a86fc
- SHA1 7639869199ba8000b825dcc27fb9125bf2ad3fee
- SHA512 d795acf289323e5d11826011fce15c6bdcd24f64497f1c9e9eb6ce87feb1cab4badf9285c10ba22a73af57a8cd30b14922a9dea7635d6dfb5eb6d8cbd5acf26f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOkk:A3k03kB56rS
- TLSH T12C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 962KB
- SHA256 2e9142eb41ea060f4c09513a6d5c316f0798d77fbc4335bc7bd16050dee2a646
- MD5 f5830251ceb77d733320d720af01fc3e
- SHA1 3f831a56bd4f8d82c9975b4676943ddbd6ead1a1
- SHA512 e41662a2a1c6ea95992dc64df9a99da244b707d7cd2c79de13d4a53cc50ebf9ae0c45e1ba9cbc61a2dbfad544b5ccdb3d84844e03cd348c40510e0be9add2197
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOt0:A3k03kB56rX
- TLSH T1A8257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 962KB
- SHA256 25455f904d9f452f0a0a078827bad4b8f960b7c64de6ead46b768628f34ba7bc
- MD5 b00c70e1999d4dfe916aee46726fc296
- SHA1 c14a07b3e69e6813d316a1f63490cf76bf15e205
- SHA512 e4a52dab7a65d9fecc2c916ddb8669240b9e257333c59d8774eaee9f89226fadc3ecfb94e5b41a26681299c1019c49cce8cba1911897bb656935b6fe9533ebe9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOwg:A3k03kB56rq
- TLSH T100257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 962KB
- SHA256 3e3c2b9c1549e9c062a7ad527bf6daf791e946a71ea5b751e9a6d4f2d7016f10
- MD5 73038591d78c6bd514e4ecee77211f8c
- SHA1 57b84001ba7194961a6d033944e47d590bf2b77f
- SHA512 66d98bce8b5ac2c0840fde516bfa6e038112fff61d5641754d7737b72eda4c64637f33b136f2e364c12e7cfee1c553e11274a8144d2c9e0144f9147a4acfbd14
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOFr:A3k03kB56r0
- TLSH T18B257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 962KB
- SHA256 05b526e5fa2384f4533bb1c19562ca0148baf8d4af161155f1d5a05b51d6aa08
- MD5 600705841f8bf856254b3ec2329c382c
- SHA1 6f5c991df60c96383d91f9e7f25dbe65bfbd157a
- SHA512 2e40a69559c34ffd69af883c1bd9f6b1f2066f93a82cb0ca9a6a307b06354f36d437899f15bee9138b0d6b1957383af0c683b50d94a01fd40ec80c783f804af1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOPn:A3k03kB56ru
- TLSH T162257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 962KB
- SHA256 dccbe6a2099b13e0f5b1e5aa35889197339d282d88fd1c4d8eb61d612a4454c5
- MD5 18e5b10b467263af4689c8df3b7fec8e
- SHA1 dfe911da3ad2b14aef418dc8cce3d8f5a3651fd3
- SHA512 987b46fc9f41198ebe380719cba81a7c5bb6c210483280fd896fe85dfcda51144ddff0b214ee4bcb1ea0122213bb9b780c9b1fce47e208a318f401f2a58edc06
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcO7x:A3k03kB56r0
- TLSH T1AC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 962KB
- SHA256 d0ece085044bdbfc95b95e408b7c21bbc3aa6c20d94f547f65b46ab4e56cb0ef
- MD5 03441e680d491aa2551640b032fa617b
- SHA1 687daa5c6c8a6b3075679bca2a2913f9720219b7
- SHA512 6ad47224074dc99bee50d25289d6c6002254bcdd44f56460413dc9c1f8df326a1df1cfac9d45abe5cae9f0ed90ee60fded693637434d9dcb6cc3fef936e77033
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOpA:A3k03kB56rf
- TLSH T1CA257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 962KB
- SHA256 551b2eb151134f66ca024b2e260421a08c6e4664521715a847af1fbf3e2e32ee
- MD5 5686197fecc9059449802265ce2e132d
- SHA1 6a01d0a139d1d02aec8210b86030570bcd65a328
- SHA512 94c2ca5af47ebb7d209856c730c4072661a489d19da8dd7c681ac094b2b311859c87cebc6504c96e528e3705cfe34d01d5468512c1c0291ff716eb47f0ee1dae
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOi9Q:A3k03kB56ry
- TLSH T1A9257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 962KB
- SHA256 24f6b2a191c46191ffa25ef4e0b9149f1d5dbefa3cf547d382f8016eb361cbb4
- MD5 3f046ae7a5c67c073c767d11735a179d
- SHA1 87e817fe302dc01814895c18602e9978bca0f764
- SHA512 393ef64e5c4be59a70222208bedbf0bc0e860e86e329c81222370429a5e8c5be98f75bf2501bdadfb1b5b35b5c0c939b3080f40ced4d433ae4fd886b534aff68
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOH4:A3k03kB56rB
- TLSH T101257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 962KB
- SHA256 ac5a3511dcfb9b080024b2204cd4e84d77f3b17df3bb755c42d3a18dfb4e173f
- MD5 4f4322c3f6b499a9437a1ff0f6a17c50
- SHA1 0a939ecbb39f09692097a9077065b44dbddce02d
- SHA512 961982e01bacb759681fd8036ec54c427c3eb66a2f7046187c8f6247787bbeb095b258674a1f3273de025d2019bb7c2b1e5ba6ff1df7867af8205c4edb976dcf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOmu:A3k03kB56rc
- TLSH T104257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 962KB
- SHA256 4542fdc41d759c87a19a9c013e5e45e197de8626041d005607bec94fb5faa536
- MD5 a14ec0a6e439fad2388268fb19c23323
- SHA1 5346108ce8dfe17d21c4f6b9dc6d320c51612c81
- SHA512 46e19dffd3062593dd3a7012f1c9d513539282fe59f3d8cc3cdadc747d00b453c221ca9af35817df412f3b14197a143a479eb93710d9f0a9f5fa0328a3e8c2fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOXj:A3k03kB56r+
- TLSH T1E9257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 962KB
- SHA256 10c50bcc3ab7f4bb761dee8c7baea7e97e3c735967646368e532418b2c3fbfdf
- MD5 6c323d752a430aaa35fd459f1e752bd2
- SHA1 b4f2d521ca89ff8393ad77f3ccc637d9c74ee5db
- SHA512 07efb6194953fb9b4aa598958a330171bb4b749905c81562fa659936cc4782fa47a1ca00c93d19ec8c418740c5263ad7cede76c17d12b89915418fa6b8c361cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOCg:A3k03kB56ry
- TLSH T12F257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 962KB
- SHA256 22818749e8016ed209d04efe2093aa154548515d6b8e0562740050c6cc019fa4
- MD5 b670e53d1867b6eb7967c2ad20aab4dd
- SHA1 d3464188dfbe7212a194c37aa350c3342b0f1e44
- SHA512 e128c1a69dc66f918369d720d96d311fb1adce48c5a5ba7b32299563b9d39611469bda2f647572365204f531ba20ff7713a02ee6f71c594ed1b115b61fee7ef0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcO9I:A3k03kB56rD
- TLSH T123257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 962KB
- SHA256 119348f03d0a3eadf6baf150cd53a9eb13dc02cb194bc605ceeefbadb0fb6c5d
- MD5 8e3afb400c9e926f167b8a900cf79e84
- SHA1 333999c26ef90804111f325fd305cab374c102c2
- SHA512 bf4c0e5e027d9f4e19a7f17f8aa3849f9520e56df810bf69383a373926e91fa81032132c1ac647de678f82d029ae0e99cb2ed6f245ff529a915c8b2715bf9b88
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOvo:A3k03kB56rd
- TLSH T141257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 962KB
- SHA256 cf89c44345a2e75e4808670e0e3cfe550a6280e2fe508543e94cea1eb91a7bb4
- MD5 d6c23849e9bbfef2a0a97039a0f17e98
- SHA1 004bced8a1b055c238b75fd42409dc9081ddde8b
- SHA512 a9eeff52af0437f3f09bf053bc353f05780fc8437f18b1fe38225a8477638bc6dbfb283f349ada7582f765b01f0226266442b864902a9465809387b6e46ec598
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcO0+:A3k03kB56rY
- TLSH T158257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 962KB
- SHA256 97b4a3b8a9fbe30d96c840b78439fd1a455b8370437f08861278ff045f0d29b0
- MD5 ce66f0dc4fad94f084ac0a9d0daca01a
- SHA1 1e56d4eb010506c3615254dadf7028fde60de5fa
- SHA512 c589b1cc622b50856baee5c7c46d78c939b35300c803c0b2197469861b858d15803c42e96da3f0b4226b053e294681aba8ca4593390eea9ed9060db027db5355
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcO8Q:A3k03kB56rY
- TLSH T167257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 962KB
- SHA256 d93c246f5191bf9cf1baa382cb10f437b856fadc4a9b5b0889cfd287cf42d322
- MD5 7a94a822bdb7cbeab68e829483cc3ea3
- SHA1 45a5508649228d802baafcf37dd0ebb2348765d9
- SHA512 e6429a1edabccaa51fed44cf04f97a45a9a03bb183afd145bccb9576a13eb48aab8b8250d6186793492e52380e03fc9fda5ca44b482e697219d07f8035d74c47
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOlX:A3k03kB56ro
- TLSH T1F4257B03E6940FA5D10F81749A964662EA737C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 962KB
- SHA256 026d0347afb58e3c4f49fc096dacd174fe1a7de27606dd8012265f3ba5ae4a4b
- MD5 23b6a3a30bdc8fb7effd5707185f3bb0
- SHA1 d71ee57f8253b90d906cc0dd7b51924401ce49a4
- SHA512 5925a3d538ddbf12f36e025b6f2a2119c9c817f29c1cc975c2422a73bed864aa7fb8ffde974647302eed0b23008e932df29d87dae8cb7c96284cb677527d6696
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOHL:A3k03kB56r6
- TLSH T1F6257B03E6940FA5D10F81749A964662EA737C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 962KB
- SHA256 50daa4d57182511d8ceacb58758ff9076fadc740dad45f39268295025414e0c1
- MD5 753db6f00452c312be43b9d6bfdfe7b3
- SHA1 4ac01a2da65c3c83d71b008cc9677066be7d1bd7
- SHA512 9c72cddb1dcdd4bbb841a1d2a4404533606362bd6b8a6f7558af38731b99df177774a0a906619b02b5585c0b991122979d98c59fa8323d0c0a77f4a1b6c9b444
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcO9M:A3k03kB56rX
- TLSH T183257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 962KB
- SHA256 3a7414585cc82969c4dfb3cf1de185a1154e3e13c123a787cd505facca99a684
- MD5 5c1386425f47951de55287e27987c03d
- SHA1 f91585b1bb0b552d1ebb69d0842a25c8267b79c8
- SHA512 693b1313221fc2715bfdcdc4e9fccce49f591ffdb918c94ff4e8079d4cb201e3c95d99ed2f9c936f8b942b13f77e4154c58e31b9d1edb5f027291f8e461ba0a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdQcOuh:A3k03kB56rJ
- TLSH T188257B13E6940FA5D10F81749A964662EA737C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH