Analysis
- max time kernel
122s - max time network
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 14:00
Behavioral task
behavioral1
Sample
2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 844KB
- Sample260809-rbfbcsstc1
- SHA256 ecd55c85a1f8e6a27ed4eea61b03f8fea06e058310d84fba9fb51ca23b56f068
- MD5 962142b3599e08aab69885be5d949d62
- SHA1 bb3e987ed7b014c778e99733d59f1536521fd5b1
- SHA512 3209d58ad2ae97b65c35cea68b5418f1e049cdb7af63c3695c87fc7efdbcf63fb320ceea85867648373903bdd6b826cdf44aa7b6c30c6c24f129ec638327a7fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEw1:A3k03kB56r2
- TLSH T1A9056A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 52 IoCs
resource yara_rule behavioral2/memory/2548-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c54d-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2548-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2124-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb6-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000189a9-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a83-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019871-265.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-416.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-478.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-504.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-577.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-608.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-700.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-731.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-831.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-961.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-998.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1029.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1092.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1106.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1143.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1162.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1195.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1232.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1356.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893e-1484.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-1551.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001894b-1596.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a5c-1693.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018953-1856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001895b-1941.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c54d-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb6-60.dat aspack_v212_v242 behavioral2/files/0x00040000000189a9-209.dat aspack_v212_v242 behavioral2/files/0x0004000000018a83-252.dat aspack_v212_v242 behavioral2/files/0x0004000000019871-265.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-416.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-478.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-504.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-577.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-608.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-633.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-700.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-731.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-750.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-793.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-800.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-831.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-863.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-877.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-896.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-903.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-916.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-929.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-942.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-961.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-998.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1029.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1060.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1092.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1106.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1143.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1162.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1181.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1188.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1195.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1232.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1335.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1342.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1356.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1382.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1389.dat aspack_v212_v242 behavioral2/files/0x000800000001893e-1484.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-1551.dat aspack_v212_v242 behavioral2/files/0x000300000001894b-1596.dat aspack_v212_v242 behavioral2/files/0x0006000000018a5c-1693.dat aspack_v212_v242 behavioral2/files/0x0008000000018953-1856.dat aspack_v212_v242 behavioral2/files/0x000800000001895b-1941.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2124 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2548 2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2124 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_962142b3599e08aab69885be5d949d62_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2548
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 844KB
- SHA256 ecd55c85a1f8e6a27ed4eea61b03f8fea06e058310d84fba9fb51ca23b56f068
- MD5 962142b3599e08aab69885be5d949d62
- SHA1 bb3e987ed7b014c778e99733d59f1536521fd5b1
- SHA512 3209d58ad2ae97b65c35cea68b5418f1e049cdb7af63c3695c87fc7efdbcf63fb320ceea85867648373903bdd6b826cdf44aa7b6c30c6c24f129ec638327a7fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEw1:A3k03kB56r2
- TLSH T1A9056A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 873KB
- SHA256 28368408efba93a7b12ecc9193845d770b8ecbeda99052cf602fd3a3cf61e8c1
- MD5 7ef3acc4f1bd4006c28076f7cf79430c
- SHA1 497d65aba33457261328ce06bee8dbc617f69099
- SHA512 002867a5e9392b68c2613b29634e47a9267b521be972f27a759fed14197da086a092517f66c21f01d1adaafea72c5ea3053ecba947cc223c0f09fbe6498256cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwjP:A3k03kB56rW
- TLSH T111156A13E6840FA4D10FC1749AA68662EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 891KB
- SHA256 34bb2152f4a3dfe58e728d0056ef0a52cd24a7f9b598f33c11d6f2994f03a351
- MD5 c8dcc761aacce5c36b76071596fa834f
- SHA1 3c9886c96c9a5a900270a24355b96d27e5481fd5
- SHA512 662dde347ccf52716c9080f98ba19555dd36456b45b0e2d2f961538257d96dbaaf0feb7c2d1f3c2bc771793388ca49821c36bf55966d11ced4d4aa23b7e8cb8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwY0:A3k03kB56rn0
- TLSH T181157B03E6840FA4D10FC1749A968662EA777C125F2097DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 936KB
- SHA256 9f18e3ec97161aa9cce1529d715fe3d5a1a9d6d242d345e6e96072b157e68680
- MD5 b2ee898ec7433097589a0dab7ce0e79b
- SHA1 3866fb8ea68a647d7f6e71a722497abc76575b60
- SHA512 5a9dcdb0bfd373fc9bc6bafd2653c942152f1d0536866e0ae52ca57e454b35385f0eaea4d1ae6214bcf4bca00d10ba399cc5997dad5f3f0ab80ecf4640be859f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwR:A3k03kB56rE
- TLSH T1F1157B03E6840FA4D10F81749AA59672EA77BC125F2097DF2358AE153F72AC06B3E357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 929KB
- SHA256 fcadeee3c4601edab2897152070945fb6ff99199cc34ad44a59c70b43da3c19e
- MD5 c2ccfd376543606069d84e224f1b1a6e
- SHA1 6efdcf9ed95647076c0c1c9916715536c8ed2ebe
- SHA512 369b9c35359888380cece99b66d8771beb90ce249055d95db2e5d1a630f8291b5868739f4968b50f1b03b8f4f23b73d95115c479a364cd70df736740a280b2cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwk72:A3k03kB56rP72
- TLSH T187157B13E6840FA4D10F81749A958672EA777C125F2097CF2358AE253F72BD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 897KB
- SHA256 7194b03ab263e1c72525d0bc4f6800857a2d347231857ec6388292460d037609
- MD5 f6852a1c44fdff54b8e9b51262ffcc57
- SHA1 3c9288334b567e5bff3f110fa1fe622448731b03
- SHA512 5808165807ec5638ac10057e7949b7ed8cf21a02fb908a6b698d9e0d2957a6145ea19a31dd060cc882a5257404305cfa921c845a9841f450b247d76dac41aa60
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwUfj:A3k03kB56rJj
- TLSH T1C5157A03E6850FA5D00F81749AA68672EA73BC115F2097DF1354AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 952KB
- SHA256 f869da774a0832ef66f2cd67f8c452adf55b9ae46b7652379592fedd4d8c2c10
- MD5 b4a19b87847abcc3d3c8d74c1fff446b
- SHA1 398fde5d7b596912518e0bd6057058c8b5d9a0cf
- SHA512 fc0f03a458bcdb04fe595471dada3c6ae8aaf96411cbd55cd7262b713c4f90385a04f1151164ef9a390cb81bdc0de745f98188ea8976bcb82870ea2004d6a500
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwphk:A3k03kB56raW
- TLSH T13C256A07A6940FE8D11F81748AA58622EB737C161F2097DF1354AE253F32BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 c0e20488af51361171d77a8e0311406ef4402cd33142f445a6427b7b0a55df94
- MD5 f5c11f8a1d13da6c44f2e735b60081e2
- SHA1 12d93c6845623745a6395fdec88984cf70440751
- SHA512 254fd4eca5071f0289b86f090165a9ce3999a11cb8bb78f95be561e7f0433bca89e6b30af6f9a097aca5ca7db802c959317f330d479658de54e52b47d1f7c0d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwx0Le5ji0hmxNrM:A3k03kB56r2Pji0Aj
- TLSH T118654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 859KB
- SHA256 217814e0ee8d21b46e38ac6a9b311198a27475e3a058259345ee85b556d75192
- MD5 16982f488b076e4f9755664f4279b437
- SHA1 cf689e1a1653d48a4ab87608aaebef57113920ad
- SHA512 0164e5c2996411ec89e0fedc3b6e2f040035aa3551077184d3759fc3c095760d9fa2f205b56cd96441f05727df0392e6d43c635a4dfb2bfcd957c0d5548c8768
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwTa:A3k03kB56r
- TLSH T116156A13E6840FA4D10FC1749AA68662EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 892KB
- SHA256 b5942022e84a05b4c83e594c940bb6361213bc3746f9960a1c7e94c83b5927c3
- MD5 36b8562e9351e3a1fab82ee795f5ebd6
- SHA1 9be8e7e5f4069bcea68506785bb12897c9772e48
- SHA512 cd9a2adc07b87568b74abef98654e3722502cc629e6620a1996fca0087c3052dc557437d7d73fbd0233a0701a32af73f3ed514a5fb580e314c396dc7fe7c76bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwAb:A3k03kB56rrb
- TLSH T103157B03E6880FA4D11F81749AA58672EA777C421F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 868KB
- SHA256 f9fe313f155699e9bc02e8fe7eea1dafd1fc0e46b84dcf85c067bac34ccee8b8
- MD5 7ba5c9cac05ee600e5b8132959f2e523
- SHA1 1626157b51cff9f1b50d0fbf07453fa9a824d107
- SHA512 a4cd180ea11669ab6357f76cb3a7a06f6aaca8cdf24fb2044fc5cfd3fe4abf478c063da3a28b8db3ab44fe9f9d53db0c3d9959726c67cff1bcb91352e4157c23
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEw7Z:A3k03kB56r0
- TLSH T1CC156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 868KB
- SHA256 be534f4e33759a8e6e48312c3e0c530f0063cacc082e24a83158f34b34e87351
- MD5 eb9b88300375d4a902ff9b49e4585313
- SHA1 8e09cf56217c4a8a725e6262f2f9d7614dbe5a57
- SHA512 b4f8fff4cac8a9006a4beec9a4f7c6be4c0c6500e95101815f99f2bba30010c9cac6d4fd376fcaea53719c357a3f599067964666ea8caa7018c57999ab5717e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwg1:A3k03kB56rL
- TLSH T12C156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 868KB
- SHA256 bfdfa7fe0d44b5fb50182f1806b10b545cc4f1240a3b3d6aaaede5e119420f64
- MD5 0a30f1afbda62a05db37d79e262ca718
- SHA1 6ceb9e1978e816e917f3d2afe94c7919a2b5269a
- SHA512 0f36523d7d3443bf1740018aa89ba0b2f022c728cf52b89a4dac103bc3d04fcbc269ee282e2213b3b53e94ed7a5d4f8b06b102529184bb65406a2c5be532059b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwS6:A3k03kB56rg
- TLSH T1A6156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 868KB
- SHA256 dd19d50e830ff01736f4197c343d25766927dff90e9b905f01be14b953b29055
- MD5 4918e061a127c038f8a90eed9f339c68
- SHA1 5883169096d486ec7332b33dce7562d63bf085ad
- SHA512 5eda37db54fa43338c217c9a99fb84a4570bbd0a048ec91e2f08315cf092d10ca9eb58c86e1693c37d5b0570a37b0e5d823f2ccd6b464bb234ff934c3b71e168
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwKN:A3k03kB56rd
- TLSH T1BF156A13E6840FA4D10FC1749A968662EA737C125F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 868KB
- SHA256 b94a5e9b6e9ddf48fabd2e493c79c18ce2648c6a4a8292e0e567010a3774be69
- MD5 d44ebf758fbd7a3f23bf515c167c9701
- SHA1 bb10ee4417731f4b6138b519692f13742d960fa4
- SHA512 57b9f37bce5f5e0c4bad0e9fd1045bbeafbd8268445d20120b29701b1d01c13170b005d615594ad10bfb9533162300d90a9bac7328c2a742c180de350b5f66c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwwf:A3k03kB56rV
- TLSH T192156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 868KB
- SHA256 71be0a464e66914fb7b9474e1b99ee2e3c64518a206585a678fd8b9e4d42941b
- MD5 5765306e41b6df0dc355139c5daf8f33
- SHA1 761057747c7421c8c3602fe709e135f3624b190c
- SHA512 05dea299436a1ad14bc13edc4b46b943bf05d7f8e446a8f304ddd349f51596eda2ee4958bb16c6df28d19fbc8d72c2872351d1374944a5717626a4b823b1e5b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwKo:A3k03kB56rg
- TLSH T191156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 868KB
- SHA256 0b2c81cc6167ec920968c039441b16b9f42833dca9016c5f2e1f563405120f8a
- MD5 833e5b9e48378dc37c5ab23c85ff7efe
- SHA1 da2c929159203876668b08c129a77f6f8f3678f6
- SHA512 705aeee59f375aaca1e24256a04e1897cad89024f60663e84b63391d1b1b73a6733b11f293c80ffc0764cd4eb102c56762bd708ca87ebfb53db9ff218ff55a1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEweu:A3k03kB56rC
- TLSH T1B2156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 868KB
- SHA256 2e8d2bd624d79d2a96d3320b4b1b5875345431f14dd55e5012dcee4b3bb44437
- MD5 df64892241e9a476b7b84167e36d7334
- SHA1 b504bfaa7e81b23ce20fa896618efbf69aa98306
- SHA512 cf3ada0e087b248830d52ab8d6fe99444cc6eb77a76b781f137fa26738ff9a8d759d0d4206e1be9942b519cdde79b2fd0a793df5ded1da20736814991abcf099
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwS9:A3k03kB56rj
- TLSH T1C5156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 868KB
- SHA256 8f07c5c342d8fb914395e4783105b710111df3d84d15bdd93254b506c5dda1b0
- MD5 9977db2ec20381900e3f0f578ec7e555
- SHA1 46cb01a3931ed1c76b170b1128e343c7d66eae42
- SHA512 dcd167ee65c83d2d0c25498e7434bb4602e0f3bec984d2743bc6fc9d0a472552d566815f5676664b382a4c1baad1132fd837dbd5efd633822a672fea26e3093a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwSc:A3k03kB56rK
- TLSH T1FA156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 868KB
- SHA256 c940ed66caf90a57f5c7f166f321a18a934300b1ebc1d7f20cb8340ae9514070
- MD5 8a299fc6b8afb9e0557140dbf401eb9e
- SHA1 6a3a508497ef1b28a826a957d59cb9c4e0f221ec
- SHA512 351c7da06936dfc67e120c3c5c0e283d4ff26f6481441f8dd37e8f9f595b8fd58c4718e5e95559f6e84c3f6d04692ca7239c2a4b202f521497fdd358fa7d705e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwbp:A3k03kB56rQ
- TLSH T13E156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 868KB
- SHA256 ff6d7874a6364069788d10f1eebe71c330c997ae3603a1204ee8d00bb2af8c09
- MD5 d7ac2679bc9f00a750401b20a30e7ecb
- SHA1 b39e00a3494b2577ebf42f1da569ecfde1093106
- SHA512 f51c4159f744f17ba4ebb63b991faf63bea5da97e28e2b328a89cd9d1afefc4fded77d7953498eacd192a333aaa53b0ac966d69d38ed33585f2d862fa6c90ca7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwsN:A3k03kB56rv
- TLSH T118156B13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 868KB
- SHA256 6838f61594a1709385e3a99ea496a9a66bc7eeedd013abd24a5fcc6fd18e9a0a
- MD5 a9301fe3a89622bc27a5381b66fad295
- SHA1 ff2c262e58b220d90fc39b82be546a0c4224a6d7
- SHA512 0a9193cbb41b0b6f3e120df5066494dae1c157d55fa9797a7bee71fa0c8f1d869c888d3b95f99e7267546f4c3707298867cf0dcb07b4fdd273888310208a3460
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwUF:A3k03kB56rJ
- TLSH T152156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 868KB
- SHA256 5dde9e718c70ddbf63061a15f886eb23f6f17b1ad4148a8367989fa2f75eb4c4
- MD5 3119720802d960f210524ec0e995a47e
- SHA1 53ac5a2f06333b2b1e09d84d0056771f71f5ac48
- SHA512 c50b59c75faa4c8dbfdc9514ee521f09a962a11fd657377a2208a312a622629c7a4b82c04f0307d1614b1c28190e64c1030ee3285b433c42e8a4036a8fc2ebef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwxC:A3k03kB56rV
- TLSH T1CE156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 868KB
- SHA256 586beaf05d2ec6aee63bff69da13436ae01c4029a7ac8a8330fe550f701afc0b
- MD5 13eca2e1d1a41105aab9fe5035e223a7
- SHA1 c9303f196e4c355111ffd33b82de74d9070ad261
- SHA512 b0dd65ed658e8a1ecfe008a0a90b934633a51acbcc5c986afd6e9a4634248ab05236b325664e84428c912d09872a898cbe8602e041314c7f816eb46a976c74c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwSw:A3k03kB56r4
- TLSH T1A1156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 868KB
- SHA256 00e4f15c3c7d1960785b9e6d8cb14055568684350b75ac3bd968a1c70398e2d5
- MD5 e38215fe89eb06f2542518e791ea5eda
- SHA1 4d0fc3ad426bb684d6e7cd689948fd3213f355ac
- SHA512 ec408639b459d34a281c6366e1b61d4498dbb06a6a00e5cfaba99852a6375846fbde64ba9f8112fd0fb188fac7bec70cd26da2a4ba7eac789114dd60333cd1f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwZT:A3k03kB56rw
- TLSH T1FE156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 868KB
- SHA256 6e2d10bf8629c7d122225e14e44c0f491397f709c41fa50c0c4523d6e73543d3
- MD5 76c9c281cc280267c74c8759335b35f7
- SHA1 e11d038b6022172409283f6a0d7422b651b550aa
- SHA512 056d38ab3ab8ad83bfe4b79b4e49230117b5c36514e73d3120409ce57a230536ba38fb5936878b80b78ac7abed0cccb1e411492b17307cc9a7f16c66f0a941c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEw3u:A3k03kB56rv
- TLSH T18D156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 868KB
- SHA256 ce24169a46fafb14c9afbc6cb709fba18d84ad3ba7c7ffe8b708ba240a1b03ef
- MD5 4bcd66ec9bd8fd967195b432360273fc
- SHA1 e130be02f1581e46a5836dcb05abe04caf6a5145
- SHA512 3238b4d6974cd030db335314e0a9281c70f3757eb00432d76e608e801adf3a073551343248a37a2e1463e7b60e6162e783a35d2083e0c6bcf119acc11a215923
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwLb:A3k03kB56rW
- TLSH T13C156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 868KB
- SHA256 af9bd7baa72e3356f1d814ee47e417a833847cfe8cec9c9ed2858a008dd11648
- MD5 b1a2fed24065f4f6119ba3ad593060cb
- SHA1 59f6bcc063e5ba95be797ee4ce1019fc3e78b4ff
- SHA512 eb6f44e241d918ca601f973187672fb53cc6cbe75484ff37f99e61cc9c20cee71499be4b44cd0609ab4d208ee508a7bd8cd11f41db862670623651665e904217
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwff:A3k03kB56rm
- TLSH T165156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 868KB
- SHA256 cf08c06741570f4ab3c9b8b8c830501d2af69cc4eb26dc78298ce12beaf64a37
- MD5 62298a787be5c2795e58f3f55df176ba
- SHA1 7768afb45bbfe3e475289c44218688fe9367d895
- SHA512 0daa820122f092bb78fa3d53218cbce7aa971e1bbf5d8bba5bdef112917ecee6d51257316da852fb43625fcf6a5f09419465aa1e5071eb206bfefd34d941b110
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwIK:A3k03kB56rG
- TLSH T1BF156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 868KB
- SHA256 5c980829dfd512ee65b3d33ef7965b2685188334475864ed791cf1d106f4701d
- MD5 e5044d0038daec84ab1137cd2f931683
- SHA1 3332118b509cb1204431844c659ae119d1bef49b
- SHA512 74a104a1e8ad0c40a04020805be213ec73dea7c0824c7ac6f3c0cad65e07f249f8c25f27abac14cf479d343ab1bb7a5c1fb411438e090b58bd1e5818b4e3f6b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEw1k:A3k03kB56r7
- TLSH T1CA156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 868KB
- SHA256 9cb1b092ec4d4d761bd4ddc0c50bb93e0fb3d1747912d55e6853aacc064607cc
- MD5 3f9fc91e7f839aa204ff232852f11e13
- SHA1 eb246e359a75e5f785f2a69336831f6d3d3ae6a9
- SHA512 741b397b1aafafd8589a6f6c7eb49bc257b5eec3f7ee170c24696f659adc73c22ddbebc3b5b9cd5dcbb1d1b75e3411b59e8a6a60f95f7dbac5dbefcb30bcf272
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwq0:A3k03kB56rq
- TLSH T1D2156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 868KB
- SHA256 650ee46ec4b3ee91688a40cc09c7a48994c6b75c030927cb956c63f416fa93da
- MD5 07e46e3372ff47feaa8d8715f3893290
- SHA1 53442d350db5c3e28166b0219b746351223ff8a0
- SHA512 5919ce4d048b15f998db5a819db8a86b9fad5bd2f8c17c4754f351fd36726cce872a28c85cd9eb10c7009f3938f0e63f01dcbd0dd7de2792e8a7c3042c0fae33
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwZg:A3k03kB56rT
- TLSH T17B156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 868KB
- SHA256 25893c25206fbbbceaff854f88f93415aac2ecd6a1bf1fc238203894cd2a6ba6
- MD5 cb149df05de85bbddd78eb0d591ca469
- SHA1 6a3c63d59b7a2691c26ad89ba4541eea15b7fad3
- SHA512 13dbd111528fc29e87c9f86d01d847a33cad5fcc56f10067759acfa38fc3e1b06e7aa8551f4046fe42deab278bf442367cf473f0a438c4ef8f3364ab817e39bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwAr:A3k03kB56rl
- TLSH T19B156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 868KB
- SHA256 7feeb9b7a3b2ab1cd652eb82c96a923f41ebb87e257ccb7a2254922b802d0891
- MD5 5f4207a56ddd0d9d63e63e8fae14723a
- SHA1 ac39b2a64392522c2a5cd44f1b5c7ecd3fef9181
- SHA512 208fdd6c35c00c26fa71fc8199edc15967357158229b143a1a458e705822aedf789be85804566c65ebbf7b823d4046517af8d804e5011b837d1ef5de0051c08e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEw+n:A3k03kB56r3
- TLSH T14D156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 868KB
- SHA256 8e6fa2f100a023d32964ebe26f9e38efc2cfebe6e968b8706ab7ec1ef57d4304
- MD5 e8c283e15f67f2099c27e1d8a002205f
- SHA1 fc09553235c579e2bedf5bdfcde80944535be62b
- SHA512 34b8b51b0a000836cefa91292f7c1686e287cf316819961c8e2646fb7f11117b340fd95f634cec817c4e2f97421357a2329ec514019bfd58762d2aa01bf05925
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwUx:A3k03kB56rt
- TLSH T1B5156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 868KB
- SHA256 50ed973d41af050fe06c6fc9e1b7932a0fb5a41332cbaad866a979f6dddb48d1
- MD5 4bf395b5331eb3151699a815356be21e
- SHA1 1f681e09bcf8171b13cce71344c97cbbb4b132d4
- SHA512 9bc2c1c212e9fedcefd1cc4e4d9e7a3fca4e189c992272e280847eecb04074e24302fe7ef47a799fd92d0fa8263a83f25c126c15dde2c48e15a7f597e494476c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEweA:A3k03kB56rS
- TLSH T10F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 868KB
- SHA256 069b621af6a155011d259e41e1b3337866fb97f61902d6ae21c2ba00b3f0ea6d
- MD5 16b2fb48e21c21c82262694e68fbd3dc
- SHA1 c05e22c68978df366b843307cc4b86ab0c250f42
- SHA512 b9d880101ee7d526df0f8b0f667274ae532da41451ec6252559266ef46ddf5d2644913b8102ff1c5138330653cb763a24c33c481178d7e24a98aebd8491968f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEw39Q:A3k03kB56rP
- TLSH T121156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 868KB
- SHA256 c3eaf399b3e492c2c0e712dc8fdad1a4bdbe2a6faad8fd04102a3e6b6033d3e1
- MD5 e5ffcdb27d397933cea09b77a0a22a1d
- SHA1 ee31d86d1ff3457fab2e4e5e1a643671e1d91da4
- SHA512 1490ae850554fa61a6294fa88b926b04522004f745a90c15462c4f28fe2f44a32ef2c68d00ae4dd321dc943ac78e099fa3948b7bd99103afe49808b742cd9c74
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwe4:A3k03kB56rw
- TLSH T181156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 868KB
- SHA256 c59a0120b2d2979cb6542821358001ca1466e4f0af9f9af72247c171dc7304f3
- MD5 57cda4780e7c054a9c26ce3c78b43094
- SHA1 ddd0411c3c25bf21ebf71baf736b820922d52e66
- SHA512 84fad833351caf22e66ba9c3dbf53431b301cb52d55301025f33e84fb21d735ce9d7b67efe3f71e495a9a81a5ddf93dd57b3162a0d0b0d97a95e346977f86542
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwdu:A3k03kB56rR
- TLSH T1C1156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 868KB
- SHA256 bf2670213e8753ea1ed802d810d1de4fc71aa239fea5155b54605c07ec7ed52d
- MD5 931dda945878ea12c074bceca6b8f12c
- SHA1 4a2fbfac57ab563bd1d674f3740d782c0b28f732
- SHA512 1b89209a11b5f527c8d9beb25acf9c229eac66338a0c6ebf9565db61b338b96c5affd90dcd00ee2caa228a57f3b8ccd04868edfe31231335c6d028ea9b7848ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwwj:A3k03kB56rb
- TLSH T1B7156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 868KB
- SHA256 e0137e1c5e487c604704020da8f9dbb02c2a36d5160461639cdee97906a192f9
- MD5 5e8a1db889e2d93a0c1172bad0c4a0cb
- SHA1 ac162ca8e645b0580c58eb35a8e00b069b79cf79
- SHA512 ac276cd7d375465d8bdd057dbc551c2b83ed6376ff28707bc2ffde4ede8bb91731373a89429d6fa10842c0d5ffe81cabba6bff9b2f37a71bc18240d36e7a980d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwBg:A3k03kB56rT
- TLSH T177156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 868KB
- SHA256 4a8cc7e0df7a2a9adb5dfa7359a606d682e90815a9a6446f06a92dd8a9f3fa05
- MD5 2fc815dbbfe05c0275849fcd83673efa
- SHA1 df46fed76f11b3bbe7155ac85520dbc1a483bfff
- SHA512 764ebe43b0268814358ad16fde6173010c5cfd0a31341209034c072109ace59b78f87ca7df7d8f4db9bbd1428249c9078b241c590514aa668e5fe9b8943592be
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwYI:A3k03kB56r6
- TLSH T1E8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 868KB
- SHA256 eb65e0709dbe7fd99c94dd7b306cbc2d91bd0357399d029384db893a9856e43f
- MD5 218ffbf2dc55abd24b9193ac0c95832a
- SHA1 ceccaeb16787737d87c740d780ff34d5d85e375c
- SHA512 5130ad76297f81a59b7786c144879bcc84565293872b8d8f3b63607ead4614f85e62bcca0a845b778ea7c05730758749746cba5a230e70840c82f0468946e029
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEw6o:A3k03kB56rI
- TLSH T19F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 868KB
- SHA256 053ce0043ccb73b2d3e38639d96d25d8d2bdd77319f62098ca15e2f55b9f74bf
- MD5 4cdf9d0777e1e4b8fac5691230fd01fd
- SHA1 c5d1ef79ae79c21e83e29cac562dac62ab60f458
- SHA512 e0d606526459ad191e9b3d8ae3db140e83bc4ebcefaf376d548f08bafe3ccd9e098a29d935523f224885f9395905dd290f90dd1bb224371668a8e6d5bc37fd26
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwR+:A3k03kB56r1
- TLSH T11E156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 868KB
- SHA256 2de059319bff28ba562ecef070da392722aa04f693136596872c0b5a510695e7
- MD5 c88203bcc65794b329010660053f1d06
- SHA1 07eb6af9b730efa810393f62870f71def20a8705
- SHA512 bcd26482ab2d4d6666f3acd522cb56bf624e3b0d7fb381e698a797fdc1056135e74f4fe307ed342e300774e084097ced9042bf49f1b6859b0c074d04c0eb7714
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwfQ:A3k03kB56r9
- TLSH T1E5156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 868KB
- SHA256 9e2b4b36b14085ebd6d3251ed83e8410a037572e07ba7f89ce6baffaac41e8e7
- MD5 de03d54c0b0b6d69c378a596678d09e1
- SHA1 526fa9d29050246aecf89375140773c8f8acfbc6
- SHA512 6397eb73f6802725eb8680e7a2fe6273f7fb5641b84c021b24cdbe2b859b8dd829b1dc5a5d17d0ead1644256e48e7b7734ee639df467b2590fdfc0f477ecfd8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwkX:A3k03kB56rJ
- TLSH T137156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 868KB
- SHA256 b1ffbea5b52552dfea942e8628557c7f72b7b24500d0eb1aad549adb010b4c77
- MD5 b12597ded11237c5d1cbd538103f5f35
- SHA1 8948d114ac81bfab08d0bf3100f5fb4bd7c7251c
- SHA512 8e21c0934fac0e01ee4628f9f59ea5a9bb5c004cdaa357c14fce47aa664468f24f592ddf58e9b9c83ac4a2be1cfaba9b649885dc5ecf5aaccd88fc4b49b79efc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwiL:A3k03kB56rD
- TLSH T103156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 868KB
- SHA256 1acc3da4b320b5697b926bc3c9b8d6e89575768b4128eadeb48015c970984446
- MD5 42e3094b53573ee002320a3efc7c38d9
- SHA1 74dc948b3bdd18f53e672757edde22e458216ccd
- SHA512 2b70e0062b4656ca2fd3d33c563920e37b3c2ddd287cb1cd131464a534b020d7a00f0d232e93156abfc148a47d9c32aed0279985342ef1e5c9149c099571bf74
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwGM:A3k03kB56ru
- TLSH T135156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 868KB
- SHA256 d5e271bfa928884927e726f3c337e2b7797476d109a98568ce87528d703adff3
- MD5 2986ba3d31e165f232dbc3b663a9893c
- SHA1 c5be59e881646b596241c52179925f26dd819598
- SHA512 5bd5f3690c6a998ebc0c0ad0fce003f298eb5925729af61e2eeb4a5531a30db754e52c28df499cb4e1bdbf3b199d50ecb5a39ed3f77c18296154277c8d3d221f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYEwvh:A3k03kB56rA
- TLSH T1D2156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH