Analysis
- max time kernel
120s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/08/2026, 03:12
Behavioral task
behavioral1
Sample
2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 844KB
- Sample260818-dp72msvena
- SHA256 a059a579fd93428941a96494d0c28cae4c6803c72da6066ffc67986c75b38eb4
- MD5 7e9601ce8b959d14e2ae7ca2fce7cc59
- SHA1 7e28dd9aa32c78e0306c1f2c128967e0c1aaf7cf
- SHA512 73efb1f5943e6866082f99a52b5d885f9aee02ee18b37a3f126a3cc4a85dafe9e66486200fb408a9bd0b6d5919e9bcefd98af3a47bff35c514e721ca3a1ca0e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5/:A3k03kB56r4/
- TLSH T196056A17E6850FA4D10FC1749A968662EA737C025F2093DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral2/memory/4608-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c498-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4608-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4316-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c89-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188cd-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a59-212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-238.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-251.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-271.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-453.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-502.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-521.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-652.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-731.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-756.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-813.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-881.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-967.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-992.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1023.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1066.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1079.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1110.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1135.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1154.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1201.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1238.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b1-1865.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e000000000138-2166.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c498-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c89-60.dat aspack_v212_v242 behavioral2/files/0x00040000000188cd-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a59-212.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-238.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-251.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-258.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-271.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-338.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-453.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-502.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-521.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-601.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-633.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-652.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-731.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-756.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-800.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-813.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-856.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-881.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-900.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-948.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-967.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-992.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1023.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1066.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1079.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1110.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1135.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1154.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1193.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1201.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1238.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1323.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1342.dat aspack_v212_v242 behavioral2/files/0x00020000000066b1-1865.dat aspack_v212_v242 behavioral2/files/0x000e000000000138-2166.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4316 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4608 2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4316 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_7e9601ce8b959d14e2ae7ca2fce7cc59_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4608
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4316
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 844KB
- SHA256 a059a579fd93428941a96494d0c28cae4c6803c72da6066ffc67986c75b38eb4
- MD5 7e9601ce8b959d14e2ae7ca2fce7cc59
- SHA1 7e28dd9aa32c78e0306c1f2c128967e0c1aaf7cf
- SHA512 73efb1f5943e6866082f99a52b5d885f9aee02ee18b37a3f126a3cc4a85dafe9e66486200fb408a9bd0b6d5919e9bcefd98af3a47bff35c514e721ca3a1ca0e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5/:A3k03kB56r4/
- TLSH T196056A17E6850FA4D10FC1749A968662EA737C025F2093DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 942KB
- SHA256 44679ccd3f77e11e87a3e88a252f9c064bbfca2890ecc506e822bf6691543b23
- MD5 511b51132289d77b3426589fa5f19cdc
- SHA1 0a38e1ae2bc6f41fdada1e6bc483b988801eeb86
- SHA512 a652f4643afa7535f6767b9f3343e016cc5a7797660df9e437a4b27602753d54009a98019abecfe4054c0f51ae7b164bd1070334ab4aed57973bbf12122635b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap542MqDBxc:A3k03kB56r4fMqlxc
- TLSH T158257C13E6840FA4D11F81349A958672EA777C121F2097DF2354AE253F32BD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 44d873b43c9e9ac6104cf1aaede7ddced9f92f62f5366c655a68899e924b3888
- MD5 f44f15d8d48b9516803776aa5caefc98
- SHA1 3f1648da1b5fc600ddcdd48e18b9241c4ac5263f
- SHA512 86e6e8a997e43e7841c076e33f328f525fa3468a7a81f56ffce2976b8f4c243ad7177997ffd14959b90bf26c3630df552a67004d79c35408fbdf6937891ada23
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5r0Le5ji0hmxNrM:A3k03kB56r4rPji0Aj
- TLSH T151654A16F6A44B65D02BC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 858KB
- SHA256 9074412520d3dcba8f6eeb1f28c9407e1fd6d80bebd6c85fd24f49b551bd35f1
- MD5 4045bdd10f90d3fc59a1715854629d7d
- SHA1 1a2a72b08dd70a0224165a9970a4156319ed6710
- SHA512 1cc5a92676305de6cb859bbe9db5141ecdf5e45252d689efa9061aaf3e4ecc91ea5a3ffed257d0533da79e0d3cf89e975ede5ac78af93021bfcb4c041a22a09d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5ta:A3k03kB56r4
- TLSH T16D156A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 892KB
- SHA256 31a01945029ca72a042ed5ada7ee4b557ecd93743b36141d45357148932dfc15
- MD5 e7e6bf8b7b2aaeaa3ef7e40139b72a14
- SHA1 45fdfd57c331b9175a97fd4f0b235c476d7a8454
- SHA512 98a4dbe214c76946b942fd5a90f660566ee09f1d6ff0fcc0eb00b353a69e2c3403b9117fe677ab3cd72fd0d06af82bf27cc5a492e68dd4ac7379959e8571c2bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Ob:A3k03kB56r4Ob
- TLSH T1E2157B03E6880FA5D11F81749AA58672EA777C421F2093DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 868KB
- SHA256 50d509d282e70f68ab3904fafe05ef40be536cf6149ac442457c3f7767a935d2
- MD5 f70328e20e1ec04c17643bea9c22c5d5
- SHA1 d57096f43619838537b3973478627db434cf6e61
- SHA512 3063c7228e974e758014db0d41886c58c8fed9bfebc6874a34b08e41ce0e46737d5dbbcc8dec5f5c9b11184f6c1cd5d8be157f85d3566736e5b2597f3aef46b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5NZ:A3k03kB56r4P
- TLSH T128156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 868KB
- SHA256 7f76a51f08a6049bf24b9cc32395e83d50b8b15dcda73ccccbd85a0022de241f
- MD5 1fbed35227a5388820a4524de1cb8a5f
- SHA1 4e4ceb4a45505dc32a9523710606cfdbad63bf73
- SHA512 14c68b4219981b9fa29b9cab347038b244ad16c9c1ae5d6f71fc48432f7fb40a455e89b1d35a7f0a3cb8c9f6b6e74bb3bb270fbdc0a3e987d2e64d83ee827ba0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap521:A3k03kB56r4I
- TLSH T15D156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 868KB
- SHA256 be7358f4302ace0e9c79819308d7526f267f3b78f3049e8cde12650d3d147efb
- MD5 b61d2d1bf5ccb0531af09cba815df6b0
- SHA1 32a3d52a48f8e9fad63376bcade40f3b6cdba2f6
- SHA512 324d0ebf0a210902ac5ec6b87446293f082288dfd608187ebbfa4993d760c911adedd48110dcae2dca398b01b2e73bb5893b41511cb2d9c8e604a61508cc70b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5k6:A3k03kB56r4z
- TLSH T197156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 868KB
- SHA256 fc6a8a0dc51566351246977c19c6b269f113f55c859364539f5da03d683362bb
- MD5 0a9e0f127b62426116673a06549109ba
- SHA1 283c80c6761577b9f40724553e5932fc7b45e0d3
- SHA512 528bb0ba0facda31607337696036fca65a845155d9b158f7d8b45943a54f12255c8230170498a3c486a734776045c78359fc46f90ac70fed051a5a9ce3a3d951
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5AN:A3k03kB56r4u
- TLSH T1FD156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 868KB
- SHA256 c34fca079c94ce5cbc2313c0b93b592471409a17848c8143324689fd6830e322
- MD5 a4c3c2c48d589947b30ee487fed74199
- SHA1 7a6221573c5d5549a95b77925ac7dffa73b21a82
- SHA512 24e67bcda4e77a95cfa3f4a38821bb31f69fd4688ce332d92776e841660a8d9420d5bb7d141ef6d1040f1b2815b33a13db6d6407e3ddfaa2ae847a9bc2ddc185
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5uf:A3k03kB56r4i
- TLSH T1A4156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 868KB
- SHA256 d69548a25a6687af956e1fc356a45ad71c197e5f8dcca053e3916726bc9b51a0
- MD5 6ee019a93abbf52d9054f11c075604d6
- SHA1 e1dbeea05f4a57ee490d39d7eb888acc1da3d793
- SHA512 6bb7148c4c3b45d49ce6b10001e92d3b4b43afa48f2f31f04aa62633d0c7fd0b11408c29e9fee27b452562833ea4e8852968a764e0ebf7c7e2b2d6c57b520d70
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Yo:A3k03kB56r4r
- TLSH T1A2156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 868KB
- SHA256 dfe74d39bb8babfa9e690d7252305c4ffbf5150102ff7ad1904eedfffd79e016
- MD5 c41c1c80e895c1ef69d33b3597f053a5
- SHA1 e09cb000e768823b185a533102cd104d4b13c3f2
- SHA512 3e4d51cc03ed75ca54542b1f11aa3e3bfc4361445710eda401d981c3298a6375e79e61adbd70013cbf4ad182f5a177f6ff9182d9cc4e2d2d681d685c2afa7132
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5ou:A3k03kB56r4N
- TLSH T13C156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 868KB
- SHA256 43ecd9bc6036cd57f37eb93b5c39d85b6815fc433272242bbe6b6d28029ba6eb
- MD5 59e9a14bf0c17f89f6271446ec7658cb
- SHA1 acb70855908c49f7f2c2c174f2c678805488f7ab
- SHA512 9bd4655d5c28b320266e49e8ede45c1d274114df954be70068cc40723774f27b2c7e60d819b3de089e2ea0d34fb12d645d1d2602047cbb4540e1dfa33e64c672
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap589:A3k03kB56r44
- TLSH T14E156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 868KB
- SHA256 e823d9648981863648141859c0a82080af6fddb95488d1e0f78102ebd6fe21dd
- MD5 db01e2aa9bfe39657d03fca63ac26411
- SHA1 29b36ddfd0371ab69f020a58c22935e6a7fc4455
- SHA512 0487f03f254e8824699700ff0b56b77c4ef7553546d02ce2502fc707e8049ad65db0b3950df995f14aa8287b69de4cbfaae0e067c81e9dc6eb5e0f10c5a77ec0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5kc:A3k03kB56r45
- TLSH T180156A17E6840FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 868KB
- SHA256 97b46744273e66abbe6a0c0cbe62300172a2824f760201adc75ad68d10ffc081
- MD5 d9c5f7035c68ac282865a4f2dee3d3a1
- SHA1 076ad847be553bf5c84bac6f47f01dd6a61163a9
- SHA512 a058a1117f5294bc8f1ecd240edc792f82ab790bebc49c813ac5f3befc63258179dceec586364cc05859a84054810170a5ca0893717ed59f43784d9647e63534
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap59p:A3k03kB56r43
- TLSH T145156A17E6850FA4D10FC1749A968662EA737C025F2093DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 868KB
- SHA256 caf0ed45adf8bfd316d15277965b772762693246a11c9fdceda83648921ae237
- MD5 e5092a9457dac246a901dacaa5f349aa
- SHA1 a924f5fee78d49244689eb480659300e5d0b3709
- SHA512 d24c96eb222122f45c41e8fb52ef5fe2f3a449ff22475ccc1658512d2ad53e7c6f77516db17bc2b22aa9c7a5b08ad4f21af0485f9e36357b078e3cebcdb95dd4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5CN:A3k03kB56r4c
- TLSH T1A1156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 868KB
- SHA256 e198d05ffa3a855172cd1a17e8935ccda1ab6402a2b84a772204f0beecf2918e
- MD5 32821003cf361d3f25801b319b7b06bf
- SHA1 3f9caa2540d4d00830f70bc764d3eb4ab670540e
- SHA512 7fcd90ad5968b3272d81b7d973b7bb3781d941f4966b9db777681eba7e1253798e120759652d36957be216f1d439af60361cdf0f7ed649eff7c364f09e10e380
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5mF:A3k03kB56r4q
- TLSH T14F156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 868KB
- SHA256 a93d0d72f05b7351330df9a2b91aa467fd4f9d2bce40b3d1c35a3f8eb0e982d4
- MD5 7094f9a934c934fa5d26cbc75d03de1e
- SHA1 011e00e2db4d44d4fcdbe541957aa6bb5fa6507e
- SHA512 1fac29c756bfec896b04d524b0251d0ed8a46ed8763d1609c7f9231d1d52b19651c8eda8f12ee146122bc611981e6508668766f1bea54d88e36794a2ce70655a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5zC:A3k03kB56r4+
- TLSH T1D1156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 868KB
- SHA256 2e491ae13fdac5d5f13ffcfff478d7df4bb8352596727520dd8163687cbb981d
- MD5 3af9acb4032acbd8ac63c09b2c70c5d7
- SHA1 e4e614ef9e861fbfae7148e5933876621b4f4cda
- SHA512 da5c7d32869504b5e0a14e0ca0329820dc91bb961ecf0de7b8025804e889ff1f3cbd9626f7019c1552108b3cc30d176ed8eae45ae69f0ab3f86d98c389383d1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap58w:A3k03kB56r4L
- TLSH T112156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 868KB
- SHA256 ca0567566b5293b175b4ab9f3c6419c6f905e6cf07dc73a8a932b2842d4cda02
- MD5 dfcb0cdc13b838633fb2f9c38363bbdd
- SHA1 49592627920efbc531fde74f0c23c91963012937
- SHA512 0c1d8fce216646ea8d112b846f0ee25085a15218eaafea67f1e4ae29d0660f23f76fbc20b346db12ced89d657c3d5222a643768cebee30f768ade5447c7d8c4f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5zT:A3k03kB56r43
- TLSH T13D156A17E6850FA4D10FC1749A968662EA737C025F2093DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 868KB
- SHA256 09c0f9c159f75164164aa6b5ecfdda061fe62ef7ef59575791786482cc04fdc1
- MD5 60a3c999214f7eb779b81198f70e5fee
- SHA1 2168eb1f3a7ffc48beb039fc7a1819e086b99859
- SHA512 9fb0589931b63e44787367ea12170278ea2353d81e27a853f275d42c777360d077e7a41eb4fb55489d5d969ab1ec6baeb6832498e8047466c267b9225ace40d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Fu:A3k03kB56r44
- TLSH T14A156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 868KB
- SHA256 35f922a6bcaa1012d46d10abd2eb775dede0fb61c9077bce5d37086cc3e694e8
- MD5 431d3ab2ed18a3119590f46a475554ef
- SHA1 2667c40a0195d9bd99840d727d9ba9a63550ab1a
- SHA512 bf9cb06d508b3510cb04242dc213add01ec0562e9764353343e4f795b8405a472677780f31a2061a2ec6b564da00216b53e4c4e2542b73206a2d71ffcd69528c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Nb:A3k03kB56r4h
- TLSH T124156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 868KB
- SHA256 b5b3ca3e9ef33cb1b4ad7297b27148b7ce7468d9f3fbd2bdc0b6db51db1364b7
- MD5 7face8312fad596f861c622098cd23f6
- SHA1 9a6e1bd3fce61b2ccc4c07a7a8fdba35d4b58832
- SHA512 52bac82838af3b7120028fcfab70cf35e37e2c1a4d8b5c8781a954d07eb29c4ac266c9ff79871ac7957e0fcc264efd133ccd950f5e163bb4ac82ed1d41e3f29c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap59f:A3k03kB56r4h
- TLSH T1DB156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 868KB
- SHA256 776eddd2f61c3b8603fee8eeb334b0cc4305875f6082a15c737e3a56f3df879e
- MD5 a2a35411db1c090714dd6f4cc30310d5
- SHA1 93d2b80852224d1e832cecfd871f9c2feabee668
- SHA512 d85c05e693f58f085939454aefb9fc22b9824781e96cc11dd58f3ce4aa802d055928cea5dd2eb2e23a4af9273e9ba0ded8733925ae42b2f48951212caadaa1e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5mK:A3k03kB56r45
- TLSH T146156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 868KB
- SHA256 720d5eeac27ec0096ba45dc897511b9ddb7af2ffa59a03bda0dda7584af7f448
- MD5 3797ce09080d8f0fcdaefa3a8e491f83
- SHA1 118ff7285d985a43c0857a13e682f954d90784a2
- SHA512 020c7cef691674dca75d3683a28ecefd0f67d6566c55887570cedf6fceec1e3482b9fcb90ff6096c58f38fb4ed1ec919699f717e667d22e03d7b2f517fa9d937
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Tk:A3k03kB56r4w
- TLSH T1BE156A17E6850FA4D10FC1749A968662EA737C025F2093DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 868KB
- SHA256 b8408b02d438f5279b491c70c5d864b1df2197e560788403396cc1ffb37246ad
- MD5 e68a2db4afbb46ef1690354d9d471de8
- SHA1 1de4d7e1182470dd2ad8b0c23419c0befd1fbdc1
- SHA512 1e58545a020b5b527f601bca9adff3b7e1e0aaefc15577875c6488e024e3afe8b25b7b1615994adcb8ddc3c7a75afd8487146f86bef1472bef80be20ab3f5b67
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5k0:A3k03kB56r4Z
- TLSH T131156A17E6840FA4D10FC1749A968662EA737C125F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 868KB
- SHA256 8711c62c945aa793720cba37b1be0e2dbb76d18eb6d5aebd9bfc88ebef827152
- MD5 eed052084d31d67f7ca2e00f55b9e84d
- SHA1 2810c08d34beba61aa465e4a1783413732a78df6
- SHA512 aebb5e01b573224e3ae0eb288f55c3561fba2104bc4732cf5aaea5f2adba953ae2566843ce6fff4a69545c881d3447805ba9866e79fffb19140b68cf6bde02b1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5fg:A3k03kB56r4I
- TLSH T1B3156A17E6850FA4D10FC1749A968662EA737C025F2093DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 868KB
- SHA256 a55b1bc3e1852227060fda756183d881bfcd4c389aaf456bc6e28c1c842eb71d
- MD5 e41d5e7af6df2cc891ecf6ad8251bc32
- SHA1 0a566fd7b784505009cf82b76380e014c0b31b50
- SHA512 fe2640f0e798b5012f7c1932bb6072463a38d1ca1f49773aab626d6e692ad0da0337e736edac4863ef91f15d393386b0c49b3aa0a59cbfd1dde57341f1018ee4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5yr:A3k03kB56r4y
- TLSH T12F156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 868KB
- SHA256 322407d0cf0a9eec4d73e71b359a5eb50664fb58e4be884d42c1c6f94d51e2d1
- MD5 70ecb7114e8b449100146b7dd1f81943
- SHA1 4a6f730305137af97fe922e4b68168db25857d80
- SHA512 4569c1311ca1fb811bce9fc76f7eaf8262e694f8b5ee7333a65fb3106d01876fdd13f70916886bc3caa2a235d5dec929acbd8cfd41f3840a11c7a75837e538f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Qn:A3k03kB56r4k
- TLSH T1BB156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 868KB
- SHA256 ca93e649e1825bafcbab277ce7ffff1e3059cc9b8d689fa69622744c468f4935
- MD5 c6bf53c57d42ac37bb8c0f803d1dfbd9
- SHA1 c5f933e299f1df3d5150961c7c805795fef32dc9
- SHA512 eb407485244fa13e3644263446a887ca8da336c5d6181a09737f9ba6aa1efa077c8915410340db81b32ced96a706e9aff44362034803021fc33fced2baa5daf4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5ux:A3k03kB56r4C
- TLSH T1F3156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 868KB
- SHA256 5295c5d0085c02dbb058d499709cf037bcba283559d1ec38c1c9b83ce5557adb
- MD5 1a7d16e161c1061547c3d977ffbd3c32
- SHA1 073fb86d9b866a92ab88df03353d9c9557e0c0ce
- SHA512 fdaccfa440a86688957e5f05abfe36ea85420f6e6ea4b53778c6de53c6cbb714ef79d05bcfea87772a039a6ac084a923bd7b5cfa2c5ba628c05fda4461bbffd5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5IA:A3k03kB56r4h
- TLSH T191156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 868KB
- SHA256 0525d26b9f73925a08c7f11267279af6f221bb5e028f0371b9535d42b9777ce9
- MD5 026d1834f77b10c379634f4010368ac6
- SHA1 dd66a30cff2e35031d5d7e89521572d4c1e45b4c
- SHA512 414582bf04e46b56051c9aa7ad247e229319dbdff9d966599045177e83766eb44513c04a73b200b9b725e53d2ca0db87973e526e174278a2b9d3e3d14e83c5be
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5h9Q:A3k03kB56r4Y
- TLSH T16F156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 868KB
- SHA256 9c44300dfad5b5e91ecc0020859505c2c8c2988862245f565721eff3847952dd
- MD5 fe366d5374568824778ec2ba56fd2e63
- SHA1 0c992b5b65ffdc3e2ad0faf5a8dd8e3e7131a435
- SHA512 06f0ab92085289f8fe9ed6f5b36199a6e6c50f60adcc947c4c3e7e7d29cbc83f9c9db5390f5175cd926116e5999a3eeff55cf2145d59a1a8df2aa77ae6e58327
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5U4:A3k03kB56r4j
- TLSH T134156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 868KB
- SHA256 ce967ae3bceb42c5995f209e22feb154c0876c4594547a05fe11fdfe4fb83515
- MD5 ab5688f66b9e6b6e972a54d17ee3972a
- SHA1 2d63aa4a78f7a996a955412db80dd1567e1034e0
- SHA512 fcaee2421b660e9db54d5c273c9fd2478a5f7aa85fc3e4425495dfcf93983ef689d8a269ef9ea49b18474c21e79dc1af98eae644314342edd41456f69dab930e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5/u:A3k03kB56r4G
- TLSH T12B156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 868KB
- SHA256 bd3b5de515173a592f4d98df487acee00a7a9d8b0bdf6ef733d433931b5a2cb3
- MD5 9205fd837d9794f43c43cea4e96433c1
- SHA1 1c7d04bcff03b81779f1a5d555b4b1c6ee19aeb8
- SHA512 6bd42ace7c3c93b87482dd9259c1eb03eb5ebe7137dbeb48b678bf0a55888bd3b1ccb4a19aad3e3f87e72ca5c5a133fedfb5167ba92bf9ed3b3d7430d6f3cadf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5aj:A3k03kB56r44
- TLSH T137156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 868KB
- SHA256 482a15d7a0d20ee4de73cfc2ab383e3b55a3bfa1d2c0965eb4fe694f8b40542e
- MD5 40eec2ef5019dc322f662b6e7cec510a
- SHA1 be46c328e0fd0025034bf1d1350986368fa8510c
- SHA512 82137d55451e22df4b1cb07c4898db2955d2c6ce952e58127dc39f95d7485e1c30e364d57de8d388622deb14fe2450536e29afd2562ea83d4b80de99da29a709
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Hg:A3k03kB56r4A
- TLSH T100156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 868KB
- SHA256 1add5512880814cade77851c30b87a430fbf312cbd58c0ebf51f977978c77f40
- MD5 4ff73149522e9b14c7097e356aece934
- SHA1 e7fab1bdea3d56b7c296f7f6d84608ec372b1800
- SHA512 9d7940241e8b052425e4486bf9213a5cd18f1816a2316c1e0d96f07609f602d2d457d138602ab540a5235311f24f5c97daef67ca840bedb369ca07b9ecc35205
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5aI:A3k03kB56r4B
- TLSH T185156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 868KB
- SHA256 3b2b3337e540851e6d2fdb314b55b8c7e8ee5625e8bcfd66205e6c3c600ec573
- MD5 30793e81846931d6e6020f78adbe4d3c
- SHA1 4f14a125cee04e18bf527078b62de747a91459c7
- SHA512 23ca59cca4fa7af05924f4f1c099cf97e2cc6b22b45c06c8c83fc0b1f01d9c3b723306b970708b8a16c5bccc168190a9978080f9222f47c83ebfe83d369152af
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Yo:A3k03kB56r4f
- TLSH T112156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 868KB
- SHA256 4a9ccb4f2f6ca9f75993bc3a9ced97b8a9b7424615feeec9714cd8bc4a5d1b19
- MD5 ba540547363cea6d205184f1e2dc0d1e
- SHA1 b3c993278bb19542e55a227cb9d666dc816f5c97
- SHA512 141782b0c0aac022e13c266af93ac1ededf441145bff9581fee85227d223fd2482d6831dff3426f7119d7deb35543e2a41f4c0c29af3076aa8adc8a533b20480
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5r+:A3k03kB56r4q
- TLSH T1A5156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 868KB
- SHA256 dd5bec8572b57021f7a16442b4aa3da79eea5a0985689834f7a56137fc366ae0
- MD5 3761b26fd32173e59677dd2c4fab6630
- SHA1 cb534ed878b2429320aab498ff5c00736a866713
- SHA512 6ae86445a397340832ab5bb5568b0fa23cd5005184a5356456428abf3c63336644a16b5eff85db1ea2751e98a354dce303eb975cf04ad194ae33a68bf96b9ecc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5hQ:A3k03kB56r4u
- TLSH T124156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 868KB
- SHA256 174275a3cef96e5baabfa0ff24a28e969caa2c861b59cf18fff2187fdbee006e
- MD5 096d2b8a01e75a2f507a4514b3bd695e
- SHA1 5aeb9dc5a2890415e5b1284659a87b02c807a184
- SHA512 9e720dd2a92b3cd05236c052df7960c8ce0983ad63e33e1838450f3c11fd11b617a92bff8820ec4165e4c0d0e54283db51aec53509bba7e773512672f42d5558
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5mX:A3k03kB56r4u
- TLSH T184156A17E6850FA4D10FC1749A968662EA737C025F2093DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 868KB
- SHA256 b1a5342cc8435e1372f4cc4caf68f316b6d24ccf43653e6a6c845f9c6a0f488d
- MD5 a208721ef06952957e6876509a05f3e5
- SHA1 835c7c68e01e8dea78bf3c91cbaddc7af1030eb0
- SHA512 7c7fe40847426743f6e3bd9d7b4d600276b9e4cc31a2753e5b0c9a9653c310d9205e49c841aeff43e5ea712e952d7a164183e02ee2b43b53a42dd6edc450e338
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5gL:A3k03kB56r4A
- TLSH T106156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 868KB
- SHA256 d794763f18a58043ec564e0ebc91c7fe3af3f793023b12ceff36d63ac9e72fb3
- MD5 aff4932ad8003e3313c0506e0d5df076
- SHA1 c388ba581c764148dd59ba4abdba2ac30b919e9f
- SHA512 56372f344f3d2e7ebcdde467e98ac50f3c0a37c45dd49f1424069b5e9b155ddfe0c6144e222fb94f96df14aae7d72f21bf29f674b97c35f21699d49f69f664ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5MM:A3k03kB56r4R
- TLSH T11B156A17E6850FA4D10FC1749A968662EA737C025F2093DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 868KB
- SHA256 9e65a8ac61a285fe5ac9ac83b234f9aafc438f2957dd1166ebcc24b686db1a16
- MD5 2c7a1dc282745cb0f4a071118c385b75
- SHA1 0d5d54e1ab3c35fc0700a6bc0176aed3dc7394e1
- SHA512 d210f849496ab54e640ec80c1234d9827747767356d98b26ea9d3b67fef236352d63eb1b2fc9e371600d961b0305089122c78ee4d1098c25c95c92299c744a7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap5Vh:A3k03kB56r4j
- TLSH T1FE156A17E6850FA4D10FC1749A968662EA737C025F2093DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$
- Size 889KB
- SHA256 f11301f645ca5ae59c648a7d97fe020ed08e539cf9fc10307edc79054207d24a
- MD5 c1f1a7b8ba159fcd5eeeb587940b09a1
- SHA1 6e93a65b6281d1a3d74b2385b4c917964f5c2a78
- SHA512 f32f5be46481d08402e029c7fd361c2680826e65e240136d4db5cc44720f2db469b042c5a3267648cbda3ba8d5bcd2cbc0ef1cef52219b181f6e97b3fa75c7b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdolxEaRap51:A3k03kB56r41
- TLSH T1E9156A17E6840FA5D01FC1749AE58662EA737C021F2097DF1354AE153F72BD0AB3A29B
- MD5 SHA1 SHA512 SSDEEP TLSH