Analysis
- max time kernel
84s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 18:16
Behavioral task
behavioral1
Sample
2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 948KB
- Sample260809-wwe9batbph
- SHA256 f770e9f307e45b37c0a774709203ac1640813486491ff76e6ff623f38d6388e3
- MD5 b9a5abaae283b34ccec59a1a7d8fb7c1
- SHA1 3431df55cc66c3a2fda3946b48f0f1c6706f51b2
- SHA512 d6794d90989fc49ea719e92bd79b2ce8d95c7e286ae0cf61fc4bf55c0af8ef1b5010f6c820d8cd636e73c37bce546efc8489e077b131024bc1b22ce0168f9e7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmV:A3k03kHRJL
- TLSH T1F025AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral1/memory/2608-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002446d-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4680-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b20-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2608-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4680-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b29-42.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021218-219.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002121c-262.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002121d-395.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002121e-480.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021219-499.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021222-597.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021223-623.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021224-684.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021225-733.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021226-746.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021227-789.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021229-802.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021228-845.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122c-871.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002122b-891.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122d-898.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122e-911.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002122f-930.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021230-955.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021231-986.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021232-1030.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021233-1054.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021234-1092.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021235-1118.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021237-1143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021238-1168.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021239-1181.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123a-1188.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123b-1244.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123c-1328.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123d-1347.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123e-1373.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002123f-1381.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021240-1382.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021243-1389.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021246-1402.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021247-1403.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000201fc-1413.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000900000000002e-1562.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000168c3-1713.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e48e-2097.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002446d-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b20-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022b29-42.dat aspack_v212_v242 behavioral1/files/0x0002000000021218-219.dat aspack_v212_v242 behavioral1/files/0x000200000002121c-262.dat aspack_v212_v242 behavioral1/files/0x000200000002121d-395.dat aspack_v212_v242 behavioral1/files/0x000200000002121e-480.dat aspack_v212_v242 behavioral1/files/0x0002000000021219-499.dat aspack_v212_v242 behavioral1/files/0x0002000000021222-597.dat aspack_v212_v242 behavioral1/files/0x0002000000021223-623.dat aspack_v212_v242 behavioral1/files/0x0002000000021224-684.dat aspack_v212_v242 behavioral1/files/0x0002000000021225-733.dat aspack_v212_v242 behavioral1/files/0x0002000000021226-746.dat aspack_v212_v242 behavioral1/files/0x0002000000021227-789.dat aspack_v212_v242 behavioral1/files/0x0002000000021229-802.dat aspack_v212_v242 behavioral1/files/0x0003000000021228-845.dat aspack_v212_v242 behavioral1/files/0x000200000002122c-871.dat aspack_v212_v242 behavioral1/files/0x000300000002122b-891.dat aspack_v212_v242 behavioral1/files/0x000200000002122d-898.dat aspack_v212_v242 behavioral1/files/0x000200000002122e-911.dat aspack_v212_v242 behavioral1/files/0x000200000002122f-930.dat aspack_v212_v242 behavioral1/files/0x0002000000021230-955.dat aspack_v212_v242 behavioral1/files/0x0002000000021231-986.dat aspack_v212_v242 behavioral1/files/0x0002000000021232-1030.dat aspack_v212_v242 behavioral1/files/0x0002000000021233-1054.dat aspack_v212_v242 behavioral1/files/0x0002000000021234-1092.dat aspack_v212_v242 behavioral1/files/0x0002000000021235-1118.dat aspack_v212_v242 behavioral1/files/0x0002000000021237-1143.dat aspack_v212_v242 behavioral1/files/0x0002000000021238-1168.dat aspack_v212_v242 behavioral1/files/0x0002000000021239-1181.dat aspack_v212_v242 behavioral1/files/0x000200000002123a-1188.dat aspack_v212_v242 behavioral1/files/0x000200000002123b-1244.dat aspack_v212_v242 behavioral1/files/0x000200000002123c-1328.dat aspack_v212_v242 behavioral1/files/0x000200000002123d-1347.dat aspack_v212_v242 behavioral1/files/0x000200000002123e-1373.dat aspack_v212_v242 behavioral1/files/0x000200000002123f-1381.dat aspack_v212_v242 behavioral1/files/0x0002000000021240-1382.dat aspack_v212_v242 behavioral1/files/0x0002000000021243-1389.dat aspack_v212_v242 behavioral1/files/0x0002000000021246-1402.dat aspack_v212_v242 behavioral1/files/0x0002000000021247-1403.dat aspack_v212_v242 behavioral1/files/0x00070000000201fc-1413.dat aspack_v212_v242 behavioral1/files/0x000900000000002e-1562.dat aspack_v212_v242 behavioral1/files/0x00040000000168c3-1713.dat aspack_v212_v242 behavioral1/files/0x000200000001e48e-2097.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4680 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2608 2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4680 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_b9a5abaae283b34ccec59a1a7d8fb7c1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2608
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4680
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 f770e9f307e45b37c0a774709203ac1640813486491ff76e6ff623f38d6388e3
- MD5 b9a5abaae283b34ccec59a1a7d8fb7c1
- SHA1 3431df55cc66c3a2fda3946b48f0f1c6706f51b2
- SHA512 d6794d90989fc49ea719e92bd79b2ce8d95c7e286ae0cf61fc4bf55c0af8ef1b5010f6c820d8cd636e73c37bce546efc8489e077b131024bc1b22ce0168f9e7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmV:A3k03kHRJL
- TLSH T1F025AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$
- Size 1.2MB
- SHA256 41acc164888d2fcf2afba892a55e087b5c258a08e9fa4891ef73a00d6d5cee7e
- MD5 c1d3cd6ca71d56c4ab0540d724629673
- SHA1 34f5c130980d77a76eb21648c945a0326f513647
- SHA512 f0e926865efaf911636a412282ebb6712e93bb911093410d50c56c1d3b227c659724759ffd747f4bd84b255ab2cd34f38520caaf8761d8eb7da886a7c7682aa1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm73UNUpEisI:A3k03kHRJhUN+Eir
- TLSH T116557C17EB9808E5D11A817859D68716F772B8610B61D7CF2364832E2F337D4AE3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.4MB
- SHA256 916111394bbc88fc32d74354b0763c7b6d7ece90b6540008cf0f7a88019744a6
- MD5 246c9091826fc3bd5421a414cbeaabf8
- SHA1 525d9b703ca57c4e7c64879ae9adbc8e8d569750
- SHA512 3f91f3db5547f36a89da93bb30b2b10dba9dde28c5d76ca49343f94668dbdeace5416622db9cbbdc364329f99a915ef4d04184b028d303db0728702afdc46aac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQml3Td9CHKy7GZO:A3k03kHRJrTd9CHKyao
- TLSH T1EB65AD13E7D400E8E167C6349AA64622EA767C561B70DBCF136882152F33BD0AF3DB65
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe
- Size 1.0MB
- SHA256 fdcff3e81f4f3c394491211fc16910aed048d2644a5812328bc3e29f933603da
- MD5 6ba1bdea469f5af7ac5e93be3a857a6f
- SHA1 9fcfcbedc62094042517ff1b2b27bafc99aa75b5
- SHA512 04da4e8e95681eea2aa267ab06e566e0c4d299cc9c325452191ce12fe99d571f289e63e1da90b01717499b1efaa31e1ef3e28a7e7faba619ce30188837fb7086
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmQGen:A3k03kHRJdI
- TLSH T18535AF13E79500E9E10AC1749AD58A22FB75BC561760D7DF2368C2152F62BC0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 ed8eccf7c61e92a2d6d4c3d452f908e93d7b1c051792e48f905cb379bed0199e
- MD5 c204641a0633131108e949cd19996c70
- SHA1 589b2ae7370ffb3cfb49c64db62f07b7814099b8
- SHA512 ed8252c6dc2bf627dec585440b9c7528902d0e1f8077e6ecd63ffa52cc0228b2d71cf66416bfaea97b78ffd4a2c88daf8222235616879611e8f415020ae4cb97
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmR0Le5ji0hmxNrM:A3k03kHRJ3Pji0Aj
- TLSH T109658C17F6A402B5D027C1B8C6D6966AEE7138861B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 963KB
- SHA256 03ab36e19f5d29b9b2ada0bd41d9f70750aedcf0c6598782f7ab77322770857e
- MD5 f22973b96b945a27f7c0cc86bd287de0
- SHA1 716c9c9f875baec3c9e8939da5fd651f7841f4d6
- SHA512 fc8a0746001bfd04ab9546e478a149ca87d1682b9c6be0aa429beb1bc9ee03e3682ca7a0dcfad990d56f88d4b0c2b90fc95b84907de943451593d560e88bacd9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmza:A3k03kHRJ
- TLSH T1E825AE13EB9504E9E10AC1749AD55A23EB75BC56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 972KB
- SHA256 246b21741397c5d1a33f6af19466bb0ced91f2fcab242383abb2e8c689618e32
- MD5 63d282b01a12f952d86783938c10cc85
- SHA1 5bcb681479170e9264ca69a2091a9d82bab1cae4
- SHA512 dc83393c03e6fbc8677dd312c55fa26d757eed5d4828aae63c6aa1f63ce7bcca191e1e05a4636618507ea2d3c8ed08d85de1e75e5ed8afd1fd092ffdfbb7895d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmy6:A3k03kHRJ/
- TLSH T13825AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 972KB
- SHA256 9d43e1af868ad3d903ea19fa124d0b559e79d986490147bef965a2c21187d38e
- MD5 a256486631329084c3f7b737a5e17d0d
- SHA1 a8dc914953ca6d34b484581069f38f765576ce06
- SHA512 bab5e69914fc71b7baf30f09182be02b6badc8b6ce00542048c761712d1863ede4c4feccac8ad4a21d91b85a96b3f47910f61ab7d51bb66e06e32c5c589a3f13
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmqN:A3k03kHRJi
- TLSH T1B225AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 972KB
- SHA256 5520e9f0504671ec6da5730aec50a4d84b2c488abc3a20dd5421b4e6adfa9776
- MD5 c257678b82259548d9ebb5006ec896e9
- SHA1 713532d189d215b40055d2777eb57f5cb15c76bc
- SHA512 81b2fa4925f527053aaa70ead876ab328ace00be5146c739b47d5376b63879dd3d30dbabeec5f14c183b6813546c494abcbab2f2a2a76085aa6ad86b119d664b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmQf:A3k03kHRJe
- TLSH T15825AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 972KB
- SHA256 93cef7474ddd77a61ae6c831eaa17ec77d90f7a75d6f6e599bb5f65816b8b3ae
- MD5 96a082b9e8b70dcc5b955af73e8d3179
- SHA1 f1dcdf298d772048ed20c4b4680c2b8d57a1ea14
- SHA512 af131802069a046ee144d28ff02d1119d435e370ab4e4098a4a144f2d9983852cb1a36afbbcee535f63184a7484e12b920339b62c482a2b42d1c7f53611dc6f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmqo:A3k03kHRJ/
- TLSH T19425AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 972KB
- SHA256 667a89f17325752f6cd2d8a2ac394f89821b133f3a5eb97af2c60ab2851a347b
- MD5 bfade4ff7fafb438677f62bd99966ddc
- SHA1 a8b31997084732036856a6506b346dd833577d07
- SHA512 35958488c56a87651ab32b674f324681138275266469313a623992c237bbe905e7bab763492159d15570c152a9ba8b96f144fc4b0e080e629716a3fb9194be56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm+u:A3k03kHRJR
- TLSH T13E25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 972KB
- SHA256 9aa30e636d0a797034503bb3dd56bf90d957e65e65bc2cdb575d94789be4ea56
- MD5 24e2118c46da4c671995daef81c56d13
- SHA1 b88f9c2c7ab1f8015efb89690318942a517e8f35
- SHA512 4796ecd9d0291b7b6d010ba31d90ec49cbbed86aa572057cf64cfb31b552c9a643c214c02fd07e75331f5b1b9055aacb1f98cecc90308c488729dfad08914eff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmy9:A3k03kHRJs
- TLSH T11E25AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 972KB
- SHA256 3bd80ce0e7d7db21cc9a5229456d108dfd9024ded74aa5d53823fa415927384e
- MD5 5f3b06ffa0092627b238ff7efb4a88ed
- SHA1 aebf369a375525ca490cb5eeb91abe9fdaf3a826
- SHA512 47a1f7bec9090bfb798be7bd7681eabbd3939a381e2a7215e48889ddb0f9a583e5d12ea5ee8f10066e5e92458e7d13d9ed699a1d907d949a35911c3530fbb069
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmyc:A3k03kHRJl
- TLSH T1E525AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 972KB
- SHA256 0bd182b004b6321fa485654b3ee23fc885778045469ccd41f6d98bcbce5ea088
- MD5 67f272c28a7c45628e417e0473be60c1
- SHA1 47b53d845b79ad804394596733a3c5c3fbe34e66
- SHA512 8ff72c446d6f0bca9b3fd3a5242211cd460646c0b6d92b7e7434ddbf6a5a381b372147a846aa0c871ade8acbf346174b5c4a48039907b809937f534b3162c926
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm7p:A3k03kHRJL
- TLSH T1F525AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 972KB
- SHA256 70fd3eee2385654fa2a8d0d3ff4f0b504bee8ab2ceeb7b14018db8408549c9ca
- MD5 e03d0494159000b47054d097a4ab83a1
- SHA1 3534ba5e4d16f35e417d66182ae92cc1c5b38d35
- SHA512 1ec7ee9f7bee40081c71fbb8ea06c33f7f326e7053b836e26aad09f45e7c9f6bb4d1abd6fdb21f667a42f9b3537bb5611d93bbde69d096da6cbb1a6d6b0df543
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmMN:A3k03kHRJw
- TLSH T13D25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 972KB
- SHA256 cbd95c7b50261f2954e84779b2b10586945f289064d479daf3ebc59ccab82556
- MD5 d535b7a421b4c3be7e427043d9c8c3c8
- SHA1 fcafdf8ae5fdae2d40292f8494b1277ccac44ab0
- SHA512 0454de6ea5b2ef2b2f69c7c221f6180713c9ea84a467b070ce267a18da8538f928db670852f0eea644d6295f1f784736578d92d64aa81914b86c0aad6c69fad0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm0F:A3k03kHRJm
- TLSH T15825AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 972KB
- SHA256 bf4fcecfa169479179eaac1f45815b041c6d0c21f8a2380d692892b37c3e72e2
- MD5 cbcdf25fec581d0d73c6de30e7634593
- SHA1 b7cdef2ccc5ce38ac23180080fb39d974a1ceb0e
- SHA512 5f3a96f67c4b60d0236731db447c6e32b278b5cecb93fa55ca9c0bfe7dfb30795f59a0b72b26897679427150ecf87da1af872fa1cf6f2d3603606a846a8327f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmRC:A3k03kHRJi
- TLSH T1B025AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 972KB
- SHA256 72cfacea874de951bfcea1630cb41537f9fcd13fca250ac03a38ec6fb5ffd79b
- MD5 fdb0a14b91ba6aa1cf30a353cab91edc
- SHA1 ea4b9eb485b3ca13051733db34ecbda3a803f184
- SHA512 41bfd1a9b9adc1b2ffa9eef858fc02fb1a2f50d7499c985e2378ff3106f65d462f3013005567457d24af98901b6d3a3eaf5d2bb405066de3ea1a355ce31d13ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmyw:A3k03kHRJ3
- TLSH T13F25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 972KB
- SHA256 c43bb97843be277bded1886e8c3fc03c62c1667d4ddd78e1cef34789d40f0a4c
- MD5 e58f0e66a8662f0ff3058fcbb1d25225
- SHA1 3d57cbb4708c9136992ec0b1dc74f84fbc22820a
- SHA512 1a5f1f656c93d4bf98d9c8921db4424803cfc07fac7a7b520931219aaa27e44b0b3f4efbe7250bfca335dc47d7c711decd6b41ec060d946abbae759d074a51d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm5T:A3k03kHRJz
- TLSH T13425AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 972KB
- SHA256 d7a7750043fcb3ade584405ff28aa88159dc4bac62ffb763a681e9d1902a2ac1
- MD5 14a68a861f8f5789cd6f90b404069bb8
- SHA1 eea6f7cae1870928faf8bcbf4b60469df220811b
- SHA512 b42263079bb74f802de9f52917fcf4970fd18bee6931d29a5bcf809c4e2280ba905288d33c7d60e49416831171b5ed386284003ac9a99d5e39825ae78d302d18
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmXu:A3k03kHRJk
- TLSH T14B25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 972KB
- SHA256 d0c04929174802370220b5c8fd0ae4c705d97c6ababa8ca925a0b9398f09d52b
- MD5 ef321cf0580c443d9636c2987f10a1b6
- SHA1 b01c14dc18ebc57667cb1f04a8a3e772bb8c6b60
- SHA512 7d105c9d9b34c1612affc4e0987475c04e10e975c102481a38949e12e9718c4150bcf6e518be47802829c18dfff15aa56f8bca5f18fe62a4d236a02fd192959b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmrb:A3k03kHRJN
- TLSH T12925AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 972KB
- SHA256 6e2249e3b35007ba383ad7b59136a03b4c40c501905df32abccf0aff64dae59b
- MD5 100286da6763a0782678626c6c660c63
- SHA1 b83764139aefcde65008fa077b7c63eef0f2e6a3
- SHA512 2edc0877bbfc3c42b0df8740eff49ac8418c819028da0dbbf4eb55038eaf75a48310bb125634f39aeffa5935777b55fe64a5559b763490dd9cdb96557b9166f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm/f:A3k03kHRJ9
- TLSH T12325AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 972KB
- SHA256 0b4e694d5d0f7940a03f1bbab745a99ccd2fbfc3c8d027f9399a0e89d39cbb85
- MD5 147238e0425ba759dd4dc74cfcf5e5a2
- SHA1 6895a2a9aded6d206c1513170052f18284d2c648
- SHA512 aa982b3d56fc7340246f936298b34144fb4ce077702b92e8d00563132723a20191e51378f16712c21c789369c205386a8d4c60e10b1a27c59fe79130e6874857
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmoK:A3k03kHRJ1
- TLSH T1EB25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 972KB
- SHA256 c16b1e7305188609906314b93d58cfe741cd214eec829959455fcab1edb307a7
- MD5 7f156e07d71b94b3978d3d4155294829
- SHA1 03fb2a60a43b34f9ad6fb89ee7284d693dbbadbd
- SHA512 7b96fc9558573e26e63b706c07c68effef91f82c263882ba4aa487eed52b10b298e27b59e3db6d18390608e6e425642918a543f9098ddab84a39c0798df60c39
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmVk:A3k03kHRJc
- TLSH T15525AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 972KB
- SHA256 85372ea0d34d31adb54c942c1e70e8223b5efab5d89725ac6b83522c7ba7523a
- MD5 8654da20b713e3796ec93f451d157cac
- SHA1 eab4e47afbabfb4e62772046db0c0e19247a5356
- SHA512 bc4b13ac8ee53a03db40a1e90f09795e054f7b0c8ffb3c9753a65b2e6159d5807351e59c55dcc139fbf83670b05d5da934149f86fcfa9bc572cf1fbf3f443aed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmK0:A3k03kHRJV
- TLSH T1B425AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 972KB
- SHA256 fb3c520e1410028852a899c24940084fe8cbc71cc4a79a2736f4466f53edd144
- MD5 17ac19e3bfdc83e1ecf431bc3c2af0eb
- SHA1 75afd30c8b6761d6836be73a748b48eeca63ec80
- SHA512 2cf1eb11375d01291083f4418a653ac6f4880aa3ebd2cea7062f5eca551003efa3ef54600bd8123c7a9af04090c618d9c9e647f2dbf3749149a5f13ceabfb773
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm5g:A3k03kHRJU
- TLSH T1E525AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 972KB
- SHA256 88c90aa041862589996a02cde09a00e1c74bfe4767d9a0bb8ae126ca5f8f9ad9
- MD5 c8f561d2a42fbddadda333099cf980f9
- SHA1 953fb84de0b0773a14733c6477839578d41e65e9
- SHA512 cb95d00b5d1b193890ce2378e85a9b8e0dac346c6e0e793d84055df707107749e348623a953fd638ab3970d34edfcee9c74542a22f69bfb1ba54a89b25ee04c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmgr:A3k03kHRJm
- TLSH T1D025AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 972KB
- SHA256 151ac947e0fcc1835f82ab4edbba8df4c48902343bc2eefadaeea3254fbeb84c
- MD5 9cf733e94f8b7368d8e2acabc725aa75
- SHA1 74425f88727efd72e8a095d00d36fa3b21262e71
- SHA512 e5ba2b9b86f7b6f7ba4f6d8296e70eb8785b2222a9c9e0ca86108bf2fea3efc21d3683c355c2c9e46fe587049a49c22e4575c10d37ee8ed9b1db962469095a29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmen:A3k03kHRJA
- TLSH T1C225AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 972KB
- SHA256 1b7db1cc81ee3235b29fedcfd3a7494c2f88a4163cf75c0dfbe536e9dd6d0c14
- MD5 d1b8a8c594da7135b5234b21ed41402e
- SHA1 415d237e07d18357812784febed8a20713ca4093
- SHA512 162f8b2eb884029faa6f0a367afe98db54b47e091670853718bb8bf9701835eec431bee4c58d351e31a6ee987068f249275b1e1e22b36a06718d875a117649f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm0x:A3k03kHRJG
- TLSH T12125AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 972KB
- SHA256 cfc4ee580674d95ecdc29391b168dd029b3b476cf19572e507488677b0bdbfdc
- MD5 01332e88a6994a36361d036ee11e6a67
- SHA1 9d1b05ce8e336bd480679ff125b0d5a9d8ba9d33
- SHA512 a71aa56bdfd396e1a5311c51638a7d5c317228ce0b9e86766c6810ced6aa119b4de35901d1197bdc2e5c81738c34e614ff3a9d6e1c7f25d0abb1df87a372632d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm+A:A3k03kHRJ9
- TLSH T1F525AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 972KB
- SHA256 635c00947ab0dfbd29d170a63f9cc70356b32c9bde2320c2a3d076993fa172b8
- MD5 eb93f4f37b0417148a0b9a9fb1976876
- SHA1 13374b439c8ba5279a962514643026496e89d113
- SHA512 128208d7e6a99041bd1461a65bce72bee4885b4460f1e5a8ccc8fd600532d7e7c5545aa2b9dab280b2aae066ad16ad58d56d02d2b67ab2829378e57454dc1c72
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmX9Q:A3k03kHRJs
- TLSH T19925AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 972KB
- SHA256 df9c1926b0127fdb62d7600909a63f3a40f701fb9da319285afd563ea482557d
- MD5 9973d7ef7a8ab00d1df6386e764a7640
- SHA1 2fa6a9fc1f757093023c5f41b7d5035552163863
- SHA512 2814f1b2a582a429724cc10c3570c838f6c555e17886b7f388bd49566125df28c1b322725361f33b5e694fcc3c8610e3f31215a454c2e5f15f226a142277ede2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm+4:A3k03kHRJn
- TLSH T19925AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 972KB
- SHA256 4871199cd81bc53075238f8102ea6874a0a16db4f80dd281634ddee99600328b
- MD5 2d441d9e860ea9934f9c797a5e66bf16
- SHA1 30aa0970c68eb83afe14ec84d93b82d7f3470860
- SHA512 7f7f6aa025b0c39bffa302f37c098c37728d0928ac6b9cdaf81efc42bb81c5aef7f323f8760ee5a7cf1507679d6d82c8af4fe1c4cc3dcbed487da12bc6026bbb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm9u:A3k03kHRJq
- TLSH T12925AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 972KB
- SHA256 a185c7b1c0a999402fe27389694c10cc156afe14c2afa2861731fa98a1d3d0f9
- MD5 0b3817b37ef59c90018558f26e97fe50
- SHA1 520e53b15f5720dd729ba183def67a40ab0949ff
- SHA512 391eb83fa1767e2e0d7f02130479b30924160f81793c09ebab90899ef62cf77ec62c6c776c8188e363388e0aeaca4b680dfa206748eea4e560d885892e0a920f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmQj:A3k03kHRJk
- TLSH T17E25AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 972KB
- SHA256 ea8fd8d22d7df13bd89b8b388ea9cf9c6654ac3d9b3458fa57cace95c60de76f
- MD5 7c43debd774148666d86b0124ce470eb
- SHA1 086a297ff93666cffda7cf2f34460a67e03b1d1c
- SHA512 d795bc4265fc5390e79be2597b4784c4b1cb3482fa94bd530b846e8206aca6fc2f4d36abc4af817923d066cd20fecbd2d61e2f39636543b08b6d4e00e4fc7af1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmhg:A3k03kHRJs
- TLSH T14825AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 972KB
- SHA256 d3878e295a371e3c92eceaae8e75ab1d43534115ae7ee0701ee99c262041f479
- MD5 58c12dd47b957e78d675d80c83074c4a
- SHA1 b6937c56e069b0570329aa5f5b4f08645b3f5b32
- SHA512 e11343fe29ce94175da049a09b4161e5996409127057898db2db5ca5f78442fb121bcfafd297d94878bc77ef35a51c63f13a3403595852e93f97810ba32e6967
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm4I:A3k03kHRJl
- TLSH T17425AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 972KB
- SHA256 ccf2f312dd26ea5245a6c8b765e3eca885e1238c6bb8adc180e2f957383e7649
- MD5 4eda4b5f20a541606a1d4058d8812233
- SHA1 97158d3c2f43d83c9c123f61df887742c8182f27
- SHA512 70a56a6e9afe75916bc0b04f48d16e0a7a619e88e419b0ba6c8d4179abaabb38171475ad57eeb7237e8d205a8b75bee8ff310907e5c793e129f5375b04c4b307
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmao:A3k03kHRJT
- TLSH T18C25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 972KB
- SHA256 638f4010691803156caee901dbf03a088c3f90edec877cf9b9c780c21593e1b2
- MD5 750cc730b251fcfe6e177bf8e04c7919
- SHA1 5ba2313c5902e63996160e6176e9976237d75f24
- SHA512 99c392f88819abc70e72826f399c4915edf69c29839fe83b69f9ecd163e73201d10ebfaaf439353941723b7b05390a412c913009eb8db55151d932ae9ffd2870
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmx+:A3k03kHRJ2
- TLSH T16425AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 972KB
- SHA256 c3071a16a6351fbe5a4d459cb962cf125fe0256b3b0a9a743ddbd3539aff024c
- MD5 27de301fd6c5a5f7209ce0d69e1e847f
- SHA1 959087a9aafe154e0356e7f9aaa22c962e98db8e
- SHA512 99273faf9f7d13b3beed60886609796db0e89f1d461d2752b9e465328f5273bb384532f38dc225715752608db5bd95d1730a62b34ee81beeb4d288c2d1c93c56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQm/Q:A3k03kHRJy
- TLSH T1AD25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 972KB
- SHA256 90591a69c8bf91058fc8aca24f70ec94cb162cd5a3e50e4d5138b79b066b5f42
- MD5 a9df5ed2de63990535e1391b03281268
- SHA1 c759b48b42e2b62fec8f8518d3765f241e14f5b6
- SHA512 0f2d42179ee4ebd89098bc49afbfe9a16a6ebbd12f8c47d7a351b3a4681f3ddb384698a4b9b6282c17f30579b0fd8223f2704f65225c6b2eac2ea8943cdecc20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmEX:A3k03kHRJi
- TLSH T1DB25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 972KB
- SHA256 8ca8bd4e81b62a28044830e6de2cba3ce0774dec16286816281a8ab5d71f92a1
- MD5 ed71bfc0e356e55caea06555590750d8
- SHA1 dbd659ff90476c48203cf3e8961a9fb4f7c9bf7a
- SHA512 2afcd8b741301412eab7a0c7b50f995eaea6948066268a12f56be89fcfbcfbcaf9908b7511c177d4c83cd2ae50353d87f1ad46eb1e51c5a4f5268633b8ae272c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmCL:A3k03kHRJM
- TLSH T1CB25AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 972KB
- SHA256 fb1620ef3435b5ef7b5f06a00c2e27d81ba6aa354db7f88f0547778b2c69c9b2
- MD5 1e2c51b438444bf301c74cfcc4391d8f
- SHA1 1de3dc5c3bbd73413a9c1c8ecc01dc7ca69e0ed2
- SHA512 f2bc587d9cee4746ec68f5b61f41223cc7ba0ad6c8b74d9877115ccf24a1637da9e9ec736077ea8a1a0f9bfad61f98c8183b7558aa903ae9d6ac60ab66fe59f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmmM:A3k03kHRJ9
- TLSH T14E25AF13EB9504E9E10AC174AAD54A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 972KB
- SHA256 ef4a2dd5ef31d9fdc214b2e88557401f146beed634b9f2327572995c0f960ab4
- MD5 6fccce8acdb9f8c57cbb380ca4d3b7cc
- SHA1 9f15f8bb6a6481baf169071d553b92ad429bf205
- SHA512 2b4643344f1d4383b7cf88ca86741948842d5e00c319876b7056077482e557e15c8ec5d799cb8737fed7b1081ba501a6082e0ecd6048c6ad30f8c88f54607b8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmPh:A3k03kHRJX
- TLSH T11525AF13EB9504E9E10AC174AAD64A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MicrosoftEdge.exe$
- Size 1.2MB
- SHA256 d09a634b144e084f605ab967a381a92da04066d87f7f88bace377b4c1f7b6eba
- MD5 d7c9d720e92e6eaf7e42cedbb7d1bc17
- SHA1 6bf496fb421578d69306ab6b03be8eb4775797ce
- SHA512 3d3f82c27b7367c8d7c289e82454c0ae3eae003353a2fabf6d901840f7d48eb46b1d469c18ef6102bc99585699e655fa121265ad5e41eac6aba26713884ab60c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoQmhV+PAk2hMH3:A3k03kHRJTi2WH3
- TLSH T11E45BF23EBD404F6D11B81305AE99636EB75BC52173193CF6358D20A2F62BD06F3A3A5
- MD5 SHA1 SHA512 SSDEEP TLSH