Analysis
- max time kernel
89s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
11/08/2026, 17:06
Behavioral task
behavioral1
Sample
2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 946KB
- Sample260811-vmjppstyhy
- SHA256 1368934f2216307016241cd27f5e35f806da2e769f06e940d1280b112960634a
- MD5 528034d9399d8ae76988d4055d1739ee
- SHA1 a397e07eccd5659ea4c01e3155a245b48557d699
- SHA512 d50914561ff9a43433b043529f196ef6cf3152b93bc53d3ca3dd79c1fe05b42869ec90931e12b38c40920eaf27c14dff83656ad4858fc09be2ecc82a5f03b0f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjv:A3k03kHRJuD
- TLSH T13625AE03EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral1/memory/4640-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002420f-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2600-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bb0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bbc-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4640-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2600-54-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023457-126.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021274-230.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-268.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021277-396.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-480.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-511.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127c-602.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127d-627.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023458-688.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127e-737.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-756.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021281-793.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021280-807.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021284-851.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021282-876.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-895.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-902.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021288-915.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024215-934.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021289-959.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128b-990.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128c-1045.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128a-1059.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002128d-1096.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021290-1121.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002128e-1147.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021292-1178.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021293-1185.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021291-1192.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021295-1283.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021294-1332.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021296-1351.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021297-1376.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021298-1383.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021299-1391.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002129f-1398.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002129c-1406.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a0-1407.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001800000001da9f-1464.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002420f-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022bb0-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022bbc-40.dat aspack_v212_v242 behavioral1/files/0x0002000000023457-126.dat aspack_v212_v242 behavioral1/files/0x0002000000021274-230.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-268.dat aspack_v212_v242 behavioral1/files/0x0002000000021277-396.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-480.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-511.dat aspack_v212_v242 behavioral1/files/0x000200000002127c-602.dat aspack_v212_v242 behavioral1/files/0x000200000002127d-627.dat aspack_v212_v242 behavioral1/files/0x0002000000023458-688.dat aspack_v212_v242 behavioral1/files/0x000300000002127e-737.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-756.dat aspack_v212_v242 behavioral1/files/0x0002000000021281-793.dat aspack_v212_v242 behavioral1/files/0x0003000000021280-807.dat aspack_v212_v242 behavioral1/files/0x0002000000021284-851.dat aspack_v212_v242 behavioral1/files/0x0003000000021282-876.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-895.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-902.dat aspack_v212_v242 behavioral1/files/0x0002000000021288-915.dat aspack_v212_v242 behavioral1/files/0x0007000000024215-934.dat aspack_v212_v242 behavioral1/files/0x0003000000021289-959.dat aspack_v212_v242 behavioral1/files/0x000200000002128b-990.dat aspack_v212_v242 behavioral1/files/0x000200000002128c-1045.dat aspack_v212_v242 behavioral1/files/0x000300000002128a-1059.dat aspack_v212_v242 behavioral1/files/0x000200000002128d-1096.dat aspack_v212_v242 behavioral1/files/0x0002000000021290-1121.dat aspack_v212_v242 behavioral1/files/0x000300000002128e-1147.dat aspack_v212_v242 behavioral1/files/0x0002000000021292-1178.dat aspack_v212_v242 behavioral1/files/0x0002000000021293-1185.dat aspack_v212_v242 behavioral1/files/0x0003000000021291-1192.dat aspack_v212_v242 behavioral1/files/0x0002000000021295-1283.dat aspack_v212_v242 behavioral1/files/0x0003000000021294-1332.dat aspack_v212_v242 behavioral1/files/0x0002000000021296-1351.dat aspack_v212_v242 behavioral1/files/0x0002000000021297-1376.dat aspack_v212_v242 behavioral1/files/0x0002000000021298-1383.dat aspack_v212_v242 behavioral1/files/0x0002000000021299-1391.dat aspack_v212_v242 behavioral1/files/0x000200000002129f-1398.dat aspack_v212_v242 behavioral1/files/0x000300000002129c-1406.dat aspack_v212_v242 behavioral1/files/0x00020000000212a0-1407.dat aspack_v212_v242 behavioral1/files/0x001800000001da9f-1464.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2600 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_101250\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4640 2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2600 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_528034d9399d8ae76988d4055d1739ee_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4640
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 946KB
- SHA256 1368934f2216307016241cd27f5e35f806da2e769f06e940d1280b112960634a
- MD5 528034d9399d8ae76988d4055d1739ee
- SHA1 a397e07eccd5659ea4c01e3155a245b48557d699
- SHA512 d50914561ff9a43433b043529f196ef6cf3152b93bc53d3ca3dd79c1fe05b42869ec90931e12b38c40920eaf27c14dff83656ad4858fc09be2ecc82a5f03b0f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjv:A3k03kHRJuD
- TLSH T13625AE03EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 975KB
- SHA256 a4394b87a97982ec1f5339afa47f48b6528ae013b7fd0bd86afcf28994e376cc
- MD5 3a6a936ae3af7edefc396ab130e8356c
- SHA1 ecc6f72b8bbec5868c54d0789c407024caf3639d
- SHA512 05ea345e0ceff8b345d314845115b3ae1453c0fb8978a700dba002b280ef56a12ff3bb1c6ec7d1f9bc282757c44fd726564ee382c2f5d77a6c83994a2c91bce3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjlP:A3k03kHRJuN
- TLSH T11425AE03EB9504E9D10AC1749AE69A23FB75BC56177093DF2358C2152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 8eaef83b6458bc59f18b4746f8323b3f75f6bae77cf55be869727910e2612f04
- MD5 d7d1293c2f5c1f07e983bd8b03576d16
- SHA1 ea61159141a5b92a35b57e26c5b2b3498b9a2ce6
- SHA512 c21000376d1e67fa0b097fabdb9482763266ccaa2cabe57886ac7a18a222d657532f49d8745e7dcbfd7d1825e6cf5804f0b39bdb83fabe32516350ac62d1be98
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjb0Le5ji0hmxNrM:A3k03kHRJu/Pji0Aj
- TLSH T105657C17F6A402B5D027C1B9C6D6966AFA713882173086CF1359C7283F63BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 961KB
- SHA256 dbb6f62503018e1f4b7203d71688bf07fec4cd84c8b159f5373e43e8214d1da7
- MD5 80ca6af3dba81a68b350dea6bc8b18e5
- SHA1 044b12567674893e7bcc9351e3701825d04f1c84
- SHA512 0bb632f752cec2deb40a07bf18f3ffcc80ac2e26c1895aba6e75057a6a3ca145ee4fece53b6b23b78710ce570d47025d0f3563a12aa4b59621b63ba2d67ad3c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj9a:A3k03kHRJu
- TLSH T10B25AE03EB9500E9D10AC1749AE65A23FB75BC56176093DF2358C2152F62BD0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.1MB
- SHA256 c46ecd581edcd937d3eb74a1a2068f7678d88d00c2050392a78bfc7e6c276bda
- MD5 e42b1b39493749aee84dbc9876494b2e
- SHA1 7a0007e224df0dece2b0a126463109f1c5f01200
- SHA512 a33e469a84645dd4f8bd5718122ccdd8d19fb71d77cbe53ad7e36481da636ff4ffe74963609610f6b7339cceaff443981f3b602fbae7679f9a18ce2aff8df7f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjQD:A3k03kHRJuI
- TLSH T1ED355907E69400E8D10E8174D7964A22FA777C5617E092CB23D8D23D2F62BD06EFA797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 970KB
- SHA256 18ac782a8e5caa9a10d347a1a7daf7fc28fff2b5880b2f9cd3797cdcea187f26
- MD5 c00615762f48280bd92bbee777cac0d0
- SHA1 9e1dd8c1d5596405ad4b5b828bdda5f979d5c53d
- SHA512 179731908898313b64df7e8fcbe81b642cfa40ec34df360e0e07f546aeb2a7f93f4e7444c5ed2ccfe9b00bb3a1646df051b93698989638e7a52214bfbe86692b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjU6:A3k03kHRJuH
- TLSH T19F25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 970KB
- SHA256 9e6d03b558c6ae58a7936a638587c0a3be969c428d86ec2ad60432ce78d4a17e
- MD5 598426ec4981bda7b303d25c0562bf32
- SHA1 eaed550d8ea3b57782c06bdc6afd3efdeb0bf240
- SHA512 1c3eed88043d4d1e6763ba7d65fd8d20c4df9153a0bcdc1d3de3b0656486978ed93ba12e5d1e5397d2c9b9336979804b7bb3a6e7cb2d3b7d33cc971faa740d41
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjQN:A3k03kHRJua
- TLSH T1CC25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 970KB
- SHA256 2ac581cfff8862001ed4313c42de926559b2510267a225be2af18e703bc3a275
- MD5 d78fffe922e1fd797248d5f4db24cdee
- SHA1 e1b269214ee9f5b79628237273450bd1b8a31ddd
- SHA512 0f779d93d6be76a7ca8537b25000cb9d6738452c788228f9008686cd01d0bccedc6118a6e69d9686ade019859b356b5c4de426d4e5b547aa2ed02844318b4ad9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj+f:A3k03kHRJuW
- TLSH T1F725AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 970KB
- SHA256 5e8f8fe4a3e1d51916d514f6236cf2c185729148aacfd17461e91f8fd8d030a9
- MD5 e67530ac80c15f5d4c244ad4a8b171e5
- SHA1 db7def2ac02b5ce8fddee899f649515ede3244e4
- SHA512 5d26ea38451265841bb6cfccaa62047920e05ec2674e317074ec3dd1e5a4e238b1bd3fd4e143b6d51ac0f8888d00c644515f3fdf1390a7a83aceb1b001074b49
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjoo:A3k03kHRJu3
- TLSH T14025AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 970KB
- SHA256 9444e10bbf008e983880166fab7fa45d93570ba6f8b3c9698463012cbee2ee4a
- MD5 0518520ffb9bcc5370d50f3d84288fc3
- SHA1 6479d0b14cdddaeebc17dc6674217b9935ca2345
- SHA512 8e2c42c1d213c7b19a275105543a8385647740836881d64ae1ee2d1516844dc2f40849c9f118fb68c029744ff58fc2602c769fe0e4ac31a0db2249d5d19028a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj4u:A3k03kHRJu5
- TLSH T19A25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 970KB
- SHA256 7cce8520ab142405ba84a1f3380cdff682821d1d426a78f6666f343c155f9b42
- MD5 14ee5af2ed171ebaa2714ad0015b3228
- SHA1 b391727ab6fce1510c14da91b137c60490c6c267
- SHA512 75f150fac3537fc90258557a752e5a9868d05834ad3f5bcd84f4723713e38dbba78c3078462af8517eafeef45a58f473991a6e650f504cceb6da93efff23e76b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjM9:A3k03kHRJu0
- TLSH T1AE25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 970KB
- SHA256 1e046cc2fe5c2ff9ec55a30b699b7de3866a5dfe641818fc02b9e52f230c8536
- MD5 5a33a00f981f5cc4192d4fb01e25c92a
- SHA1 d1a54f3b5cb2870b87c327da1ca5bec4bf8b6c19
- SHA512 d8923f397885d9bc3efb49c6d7ed5ea4e85dfee583cbe35a1a471672bf561eded0fc9abb5445071d563417d86d583eee1548804342ea2730d8111a67cd01815b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj0c:A3k03kHRJud
- TLSH T19F25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 970KB
- SHA256 86b625d9ac7dcee7e03897cc841674e9b60ab025db5f359f83951b43a99f899e
- MD5 37e577da611adab27e43e695f71b79e9
- SHA1 dda98de8e73e0da1e8d6af2a64aa1eacc670933b
- SHA512 5e705c33c867fcfecd6c55ec14cfe46f37125b248dee68b64b794219dade2af7c23add37303d3e44fa52d131e4d3e34c31d65130d41239dfb31a5769f9134f60
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjNp:A3k03kHRJuD
- TLSH T1C725AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 970KB
- SHA256 65ef8917361250b561373cd347ef72c8202ce83dd2967c1ffa93e4f76544b00d
- MD5 274573af66cfffc0d41e946f89f8db39
- SHA1 ac3891a4b5e590f05497e219036b54a024a4438a
- SHA512 63026a1d94ef797d63f96c0552a20be35af3414862b11bbeb829ab0447263e39b1b704f229c51f1ff94b297d733d3643ac247ded408eda16e14a1e6295d6d3a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjSN:A3k03kHRJu4
- TLSH T12B25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 970KB
- SHA256 77ff1d7c1184650113bcad3a93b6d856808c100b05219d958e6a5f67e721e11a
- MD5 2a334bea73f49434d30ef3a3f1d6231c
- SHA1 322f43a11c6e0ef1d8ce31498af6dd11a242d5b5
- SHA512 496055801aae307f02672128cc82163674525d21148ffaf3fcbd455a74351386eb597ffbf13945a4bdb0e362073280239ee3f8a012486b9dedf9024d28b25de3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj2F:A3k03kHRJuO
- TLSH T18425AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 970KB
- SHA256 2104503ea32d49ef124fd185f7f8210afc0b944750cc173a7d78589614ab63e4
- MD5 9aa78602194b60fc9aa1ded2be748db4
- SHA1 3d8ef75c67ec9818dd41cff160ec745d44e5d53b
- SHA512 a47c601ab7faa89716b72b13da88b605a7c3b3a3e343fd82a9bbb7a7ff8dc16aa56cb94f0fa1879ae4606036b6cd870b124dfa1aa85a1a84fa326e875319e16c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjDC:A3k03kHRJuq
- TLSH T15225AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 970KB
- SHA256 d9e54d6273b398c0a4af12c10041bad9c784f65a76b383bb9819a149d8380984
- MD5 6d2e4da2c184e101f14e2d5b9f48a882
- SHA1 be4763d8be6b888665894ebf61cfbe3720df4c79
- SHA512 43245f981ac7e27ec530dad16b884396a9c4dc9ccca82432296c3def295c9f9c5808327b2834720a2101e5e05b514a0ebe3429d661eac5344651843f88cc8534
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjsw:A3k03kHRJu/
- TLSH T12525AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 970KB
- SHA256 bc0cf3acbc21c274ee231ae35ce12f998e44b55c677abb9e59af6209a1906b8b
- MD5 53d90a7ef5fc5ac0abcfc05a38658571
- SHA1 17e4c0b7546de6e0c93264a0b33c2da4182e2d47
- SHA512 1b2678b964089c1641cc661ef62b6ad8ef22f6f231706628cd4a1e7291899b7f3bb41694aef690c92628b6e50c2c8973c0856ed26d5b0495450eeaf150134ff4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjjT:A3k03kHRJub
- TLSH T16425AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 970KB
- SHA256 5d2682fe17fe63dc23c9ed8cc208e2ffb68b6fd768488b8fedc1595792761afe
- MD5 ba9807514d3f64fd8b88ba2ef8875312
- SHA1 1fdf9c46fa32c2fd94b35713fc57481a0cbff5d4
- SHA512 e865cd6d0c7047e3685eceec5d2fa9d286b5e843c136a4d7e05dad7519d18e96aa896015da93714a8e506ce80d010929b5dbb3879c9868c01c8549033c3ba861
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj1u:A3k03kHRJuc
- TLSH T15E25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 970KB
- SHA256 b6514e1fb80e5c734d9255c2b26a5eca4e14bd0ec24d460c6c47f5e69b5bb3b1
- MD5 068fe5c8aeb9889ca1c9955f01fd8f79
- SHA1 a85a6781d55ffffd8cf0e9e637b8416c0c10ce2e
- SHA512 b217f7ff960c4ae891b6ad5be7d9c66e692d5f10b4666dc633765c3e09ffaad955046dd28798b0956675a18195b5e9893f676fcdea268d70dbf529c1c2f23482
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj9b:A3k03kHRJu1
- TLSH T18B25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 970KB
- SHA256 844dbcbc28382540aa7041b7306356cb9a9acce5c5708b741e08320db2dafded
- MD5 088f159eff7a392b6a297d75155e00d1
- SHA1 e1cff4cfd62fde16602c57498af972f742e033d6
- SHA512 26c147e4825e6f221bf751d6f873fb619df87b7e1035831e879fd382cd60426581e389e4801100119341c745c242e80bd968f0550054cf26bc46f8b836c0da4f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjtf:A3k03kHRJu1
- TLSH T10925AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 970KB
- SHA256 030151ff5f62221729cd8391961a211eb1a0ce6fdf7c4968171a81abc85dcf0f
- MD5 0648651ac830cda8064d86fe2881b3bc
- SHA1 d25dd2c262b15d22dd0d85e9ccf77c3474748828
- SHA512 72daddbbaf8f3aee57e50dadf1cab0b3384e5289ac061b5069161ef95639eb9214dad4463871205a548e235234f5d942b05b86c95de3a9de320436ced668a8e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj2K:A3k03kHRJut
- TLSH T13A25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 970KB
- SHA256 9060262c7a1d6acb742ab7bba8bbb5d95eca3714a897ec4a9dd841b4cb37434d
- MD5 bfb613fe6d0dfe6596e8bedb27c0f2b9
- SHA1 151a6ed6e6b2947aed6adac53299806187f09106
- SHA512 0510735c162eb67280c31b1658cef96b0bfa644c32fa89d8127118fa03ac7b7bc7f8583cd2e9a642b966b3174c13b699e2f8b97063b903430794c8155602c081
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjjk:A3k03kHRJuE
- TLSH T1E625AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 970KB
- SHA256 545baa6fb481b494c2c1d69d0c9aa96281b688b1e167d435350f1abd72ed3873
- MD5 df3a1d70aec5e52e41e98888e9cc5a66
- SHA1 8010a9ffa80a5eac9a8cf36b105b97cb1401af20
- SHA512 06daaa2bacd888beefe61d66d7f6975f20f36fe56b48160e6d776dc0059279e6a1130f48f048d54cfd029684a79f6e51872d28e06579d3c40907188414ff9c2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjU0:A3k03kHRJut
- TLSH T1C025AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 970KB
- SHA256 141a76dfff60e27a5247974ceadd5c10504529f0379e1e469d2ad47aff6d23b2
- MD5 5394d9648852b62ff83de80dd1314024
- SHA1 f89eb5527e46a5d7ad0f89be83e55852ff332f23
- SHA512 74e3e07d19d8e81410f4444f34d66ef674592fc3aec2a6fe0a2e6f744e4a9b1d9f1e60a6746ba635667a002e84156b7928f239e8bdaa8ac0ea6d433b440766cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjPg:A3k03kHRJuc
- TLSH T10125AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 970KB
- SHA256 1785ba7b31e2a8231cb78619317d54fde597b77e4eb1d6246921be2a14ed27b6
- MD5 d796c71cb17b918d10e8027ae0f02aa2
- SHA1 305f4650277ca1340fc104699171393ecedf2239
- SHA512 c89f7b59dd32a73805555508683145b453a4c8c8a9974b8170d9bef2f04462f1440644364c9d823002f22e15617fca7607aeea4c0eaca15dc7f40d0d2318b857
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjir:A3k03kHRJuu
- TLSH T1BB25AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 970KB
- SHA256 42e858497d41f30a8e2224f0dc0ef24d8c1abe3afa54aeab0a8d262827d1c0ff
- MD5 53c2c91fac3bdef7646217670d1580e4
- SHA1 5f5b1717403cf1c13a108217272574cfb9899095
- SHA512 6587a5ac4ced0ea266fb7109fb3bf1dc20783db5112afe3e03db86eb0335f36fffc1b721dbea0f0ddc781bf02983a77148bba8b8827c9ad8fc64a8d484ad3423
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjAn:A3k03kHRJuY
- TLSH T1CD25AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 970KB
- SHA256 a597e50477338d2efc434ea5810ec0f5af16e5f3736ae41b166eb05f79146a50
- MD5 a6691de2e1077af5912807fa4fb6a89b
- SHA1 dbe31b314effd9274416cdeb53559e42bedab273
- SHA512 c48ac1a7a2408ee0e4cd3c387738f0b825ad0f8b93b5dc4451cc905238668ac60fd71ecb2090861fdb90d0e49dcd76de350ae2358024747f99854bebe0fa5368
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj+x:A3k03kHRJuO
- TLSH T12625AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 970KB
- SHA256 dfd86f621c86b5ff6418fd9095462554289f7e1174a8fc7974a2949d155ddc73
- MD5 484e225beff38bbd18a85e6f84fe0057
- SHA1 ce07b5d00c62084dfe394e175152eac64ba33811
- SHA512 1839ea7a0b0a464f1c411b43cdc27c14d2a2a7c0e391d4a8cf60ce2602311989e99827a58128137fe9d86821f33dfe125fd015a47dfd094ec87bbd42c3751860
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjYA:A3k03kHRJuF
- TLSH T15525AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 970KB
- SHA256 8d93d52ffcbe8d1428c0fd53c9cfc7cefe9c8a7f11ac8ef6399174f32c52177f
- MD5 0352fd6601eeea422267dfcac5adb25a
- SHA1 c6c79d1c4476ffcae7ee8bbeb9ceb71b08abbfcf
- SHA512 2abd50743d742a891d879055d248aef3a1798cd8700bdf1e1ed17e0d1a7fe627e663067798a599cfb6ed06fdf09d96d0112c5e8774b9d31e395f7c980b099f8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjR9Q:A3k03kHRJuk
- TLSH T11625AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 970KB
- SHA256 980ae6113d09e80097d8bc484520e804c3a8ba49244bc3b031b956c0ba8cd3a2
- MD5 5bbf25dd8e38faee885a7ca02ee054ea
- SHA1 4bf89af0805ddeb846435dda1ed6c71830788e04
- SHA512 fe61f56ab3b7f210b89f2fbf06d2cec8dc3d238a71339687cd353c01462ee689976430e863d4436e7b61f053f0e55384db1dba488a006e0cc56c5e21d48935ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjk4:A3k03kHRJuP
- TLSH T11825AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 970KB
- SHA256 433e0b5a1f0a41379dbb73dae8eae02d5a41dbb7c27a4ac1ca160aecc3d7e90a
- MD5 c3175c2a15b4cf60121c2de153e03af8
- SHA1 4a87eee83c27d7dda3188c8f0361512ee8dee6fb
- SHA512 ab01e4baf5c4bce859b977918976662cb82ca4102d54fe268e6f63d9b1e9f03259ca5ac8d4291754f5266ea486f08cc5f3cdd1f45498f63eecc239e037db3c3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjvu:A3k03kHRJuC
- TLSH T1EF25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 970KB
- SHA256 ce9f3a747e835c7338d109d7c8ac7a16d31cb3ddef097c6e005d6002abbecb95
- MD5 6bcf8289ef37fbcbc750020ad7d7bb59
- SHA1 314277cf41ef5b95b074a51f8833bb7f270d1ff7
- SHA512 103a4fa5af66da3469f1dd565d15b118e6d0968d847dbbd9ee8ad26801e8b3f806d7f4877bb460e33fc20392be36a711eb0cfd722294df2d4ce5befc09ae6160
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjqj:A3k03kHRJuc
- TLSH T1C325AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 970KB
- SHA256 bb9f94435fd6151d55b263398aa42be6ba848d2ad979f0a0940b4e09e7e21cdd
- MD5 f0c88410734ab48e846d19dc6f943994
- SHA1 c244126a1e047eda3e43b61524cef3eac13c97fb
- SHA512 0f28d90235f862969b99cdeb04308999ffc21de598af146649d3bff87967d17b6749b36bb4a5facee786f0d207b5d653ffd90c0eb0f1fd12b335662c192b77dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj3g:A3k03kHRJuU
- TLSH T1A925AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 970KB
- SHA256 6372a0bba3915ed6c1f356af67901f67a7eaee7df2e6ff9f1b695d0c680480f0
- MD5 ebf4d85ea83ab3efbb77e86c91e1f0df
- SHA1 1a69327c6a91f53034cb96f7adbb8a6726a0a7c3
- SHA512 ea17ec62bf33b8b133a2ff29ef636003353d13e9ff4becb6865f2a90b5a8d4d76c5eefe9e90f88757fd16f9cb29bd865a7f63efb22061acf945453cf9ea5884f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjqI:A3k03kHRJud
- TLSH T1D925AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 970KB
- SHA256 f3769d0c75988b0a8a0168a2690605e0c493349b2e722d6d12996b148d57318c
- MD5 17a2452cf5037a9fd455d03f60c27bf5
- SHA1 92ba9ba388cb3e547ea540424a435032cde88d37
- SHA512 18dee2e194cd4936c5f797ba4be0ee202b972856dd48b617183725b025308e57fc9eee540e0485c8ef46349933e39992ed0fcf39094c0f549399e85785845af4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjoo:A3k03kHRJu7
- TLSH T1CB25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 970KB
- SHA256 580d099fa91c86c01bc1c01bf0e0805fdc7c2c8ba9891536807f9a9c51ad8e10
- MD5 c2380c49da8785c92d4746daafb2fafd
- SHA1 c25d5ea1ef2eeff3f8698fbc29444a7f9e620653
- SHA512 520ccd0aebb3b0a24e5f0a9721d15566d9b6107488a78dbf2a0c4b080ef6ac17c00ed31b61a96138996a576965c7e41564c66e2ca9f651216747335bafe64e46
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj7+:A3k03kHRJue
- TLSH T16825AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 970KB
- SHA256 15518c85124c1f4fc9a4e2e310e9d11f379fddcb73b1e9e74df0ad796afba702
- MD5 e0578cb35c92130f0259378c8374a49d
- SHA1 002cf9e5fc6f4c2af2d1113a64c91e384c6e168d
- SHA512 6c25c5900d381b42867b79800a0042b0c7436b8eff91cea7830713dd0a2ec92f5d5d84a0a428a7322c90d96471fd43b5888ca3c2d278aebfaf801f80942df88a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjxQ:A3k03kHRJuK
- TLSH T17825AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 970KB
- SHA256 6c20254093f904e5fe7b503034d0750a111bbcb80b50535722d3fb798ad4d4ed
- MD5 567011a4ac48dbac7d5e9397873609b2
- SHA1 1180bc1aa8afc398ab0ecf0c160fd4acb3150ada
- SHA512 fd09ed3c48fc8c14c8e2958303484b73940ce8b528d77936791326d390e1c47ea4c5b07faebdd31d526e03be260060403dadcc9b5e244be30deb044371d977aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj2X:A3k03kHRJua
- TLSH T1DD25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 970KB
- SHA256 62c7dc7fbd2b85c1d0ca9fb94e5b26deb4727db79199be8f4341bf0896eddd80
- MD5 9dbcb2be7a2de07cab1b0bf5369e6276
- SHA1 0028e729f221f51b4d417816ed775f319b7cd555
- SHA512 138cedd645e0901aa470c3e8e3ac67377c7777e0c100b89c97f72a7b64da778a3ff9b6ddce3ed2e0f3be1f8340e2b8da3c14d0ca273f4aff679a476b6559cc98
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjQL:A3k03kHRJu0
- TLSH T1AE25BE03EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 970KB
- SHA256 018b8b1fa08431295f2023f30bac35c5b7c84bb04fb27661f24c8909f7dc4e25
- MD5 e3d3ce01d983cbd8f6cab4f9469b477f
- SHA1 b34159c2130d3baf82c6ae217d6744c58743ea71
- SHA512 394336c66a73ea02d5a28fa0924267130ddfa334ac4a1ba8258b2af9a91591193cf768c421445fdc929d9a617d2bdc12cade973f987764c7c6f7a5fa7b989d70
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLj8M:A3k03kHRJuV
- TLSH T1E325AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 970KB
- SHA256 2cb2773ae697f371c129391f5294b984da1266f837d5dcd9b7cd28278d17c70a
- MD5 55af9d5d62cd8e5be7a937076a456274
- SHA1 f2a5eb774659e46b02449eae70b186e8fa4300fe
- SHA512 e0d0f68ba5008970b14c83e4a4a730744047fc03a50929e6e8af353064ac082750c6778a518914c702e7aa266100f36c939c43e03d4bd1a2676c3df2954bff0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JLpeNLjlh:A3k03kHRJuv
- TLSH T16C25AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH