Analysis
- max time kernel
97s - max time network
129s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 15:00
Behavioral task
behavioral1
Sample
2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 917KB
- Sample260820-sdps9asycz
- SHA256 49fb620daebc28b4a76c5a30bb25729eae34c1f280ddd6bc0752e113d7912bcc
- MD5 9726ba5bc2227a7fe5db37f86a1fd1fc
- SHA1 4c2f79c2cb11f8ab523eac53eb18bd8cf340f712
- SHA512 8fb04f744306fa2c607b54adadc02f34d8d9c3536a9de2874538f262d3a200ee94435b88f7301cedbfa7ad7f52f97969e2b17b6a6af409a3bd099d98ab771eea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5:A3k03kHRJARJ
- TLSH T18F159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral1/memory/2656-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000c000000024636-5.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2464-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b3d-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2656-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bcf-41.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2464-42-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021609-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000202b3-220.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202be-263.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c4-384.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202c6-475.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b8-500.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202cc-579.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ce-610.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202d3-641.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030b-727.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030d-747.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002030f-790.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020311-797.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020313-828.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00120000000203f0-859.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126c-878.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x002100000001f2c0-897.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126e-904.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126f-923.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-937.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021271-956.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021272-1012.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021273-1049.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021274-1056.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021275-1093.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021278-1112.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021277-1143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021279-1168.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127a-1181.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127b-1188.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127c-1226.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127e-1330.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002127d-1349.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002127f-1374.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021280-1381.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021283-1382.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021286-1389.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021287-1402.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00050000000203c7-1479.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0020000000020242-1566.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024679-1734.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000729-1924.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000723-2005.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000e00000001db1f-2224.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000c000000024636-5.dat aspack_v212_v242 behavioral1/files/0x0003000000022b3d-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022bcf-41.dat aspack_v212_v242 behavioral1/files/0x0002000000021609-61.dat aspack_v212_v242 behavioral1/files/0x00040000000202b3-220.dat aspack_v212_v242 behavioral1/files/0x00030000000202be-263.dat aspack_v212_v242 behavioral1/files/0x00030000000202c4-384.dat aspack_v212_v242 behavioral1/files/0x00030000000202c6-475.dat aspack_v212_v242 behavioral1/files/0x00030000000202b8-500.dat aspack_v212_v242 behavioral1/files/0x00030000000202cc-579.dat aspack_v212_v242 behavioral1/files/0x00030000000202ce-610.dat aspack_v212_v242 behavioral1/files/0x00030000000202d3-641.dat aspack_v212_v242 behavioral1/files/0x000300000002030b-727.dat aspack_v212_v242 behavioral1/files/0x000300000002030d-747.dat aspack_v212_v242 behavioral1/files/0x000300000002030f-790.dat aspack_v212_v242 behavioral1/files/0x0003000000020311-797.dat aspack_v212_v242 behavioral1/files/0x0003000000020313-828.dat aspack_v212_v242 behavioral1/files/0x00120000000203f0-859.dat aspack_v212_v242 behavioral1/files/0x000300000002126c-878.dat aspack_v212_v242 behavioral1/files/0x002100000001f2c0-897.dat aspack_v212_v242 behavioral1/files/0x000200000002126e-904.dat aspack_v212_v242 behavioral1/files/0x000200000002126f-923.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-937.dat aspack_v212_v242 behavioral1/files/0x0002000000021271-956.dat aspack_v212_v242 behavioral1/files/0x0002000000021272-1012.dat aspack_v212_v242 behavioral1/files/0x0002000000021273-1049.dat aspack_v212_v242 behavioral1/files/0x0002000000021274-1056.dat aspack_v212_v242 behavioral1/files/0x0002000000021275-1093.dat aspack_v212_v242 behavioral1/files/0x0002000000021278-1112.dat aspack_v212_v242 behavioral1/files/0x0003000000021277-1143.dat aspack_v212_v242 behavioral1/files/0x0002000000021279-1168.dat aspack_v212_v242 behavioral1/files/0x000200000002127a-1181.dat aspack_v212_v242 behavioral1/files/0x000200000002127b-1188.dat aspack_v212_v242 behavioral1/files/0x000200000002127c-1226.dat aspack_v212_v242 behavioral1/files/0x000200000002127e-1330.dat aspack_v212_v242 behavioral1/files/0x000300000002127d-1349.dat aspack_v212_v242 behavioral1/files/0x000200000002127f-1374.dat aspack_v212_v242 behavioral1/files/0x0002000000021280-1381.dat aspack_v212_v242 behavioral1/files/0x0002000000021283-1382.dat aspack_v212_v242 behavioral1/files/0x0002000000021286-1389.dat aspack_v212_v242 behavioral1/files/0x0002000000021287-1402.dat aspack_v212_v242 behavioral1/files/0x00050000000203c7-1479.dat aspack_v212_v242 behavioral1/files/0x0020000000020242-1566.dat aspack_v212_v242 behavioral1/files/0x0007000000024679-1734.dat aspack_v212_v242 behavioral1/files/0x0004000000000729-1924.dat aspack_v212_v242 behavioral1/files/0x0004000000000723-2005.dat aspack_v212_v242 behavioral1/files/0x000e00000001db1f-2224.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2464 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\pwahelper.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2656 2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2464 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_9726ba5bc2227a7fe5db37f86a1fd1fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2656
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2464
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 917KB
- SHA256 49fb620daebc28b4a76c5a30bb25729eae34c1f280ddd6bc0752e113d7912bcc
- MD5 9726ba5bc2227a7fe5db37f86a1fd1fc
- SHA1 4c2f79c2cb11f8ab523eac53eb18bd8cf340f712
- SHA512 8fb04f744306fa2c607b54adadc02f34d8d9c3536a9de2874538f262d3a200ee94435b88f7301cedbfa7ad7f52f97969e2b17b6a6af409a3bd099d98ab771eea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5:A3k03kHRJARJ
- TLSH T18F159D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
- Size 1.0MB
- SHA256 913273e5b8cfae5d6c2e79557e21dac5d7b7f7209d0b26278769fe60012ac0cd
- MD5 44410063f8c8781a90640e484620e604
- SHA1 665d881b1fd51201faf59f56c4cb447fb6f8be8e
- SHA512 038711a55beee660e70e3937f22cd520be3f71e298e85a9ad81218b939a56208e0331e0876a51d225b79940702db56f899d9ea58c22362c3feb54fa769e44c5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5oqU:A3k03kHRJARJH
- TLSH T100359E13F79400E8D14A82745AE99A62EBB57C22077093DF6318C6162F77BD0AF3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$
- Size 1.3MB
- SHA256 df81d4a3a79e96ab162e8861169e34928380057b66c30704ebd5445b91261e47
- MD5 b7acf07dff2eadc6d13017bca63db015
- SHA1 fa10bf9645b2a484e538421370b5a50f0eb8dbce
- SHA512 7dfa9d41c98fe89084e3cabe39e84373ca6dc79e6745e2f9be3cb91eb7fcf9160b8d561bec8aac5ae3738e9c1b070af01cb70c283103cc22c49da74810f56220
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5T3Td9CHKy7GZO:A3k03kHRJARJETd9CHKyao
- TLSH T1D4657C13F7D400E8E167C63489A68622EB767C561B30DBCF1364961A2F33BD09E39B61
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe
- Size 1.0MB
- SHA256 d83ed7aa342d0bb42b7301d079c00891203d2230d179312f2e244b7e1dbbf188
- MD5 d2103df33a2e3f98e47fc83aaf8da04d
- SHA1 7ce7d3351788fbcaf9cfee5ca160085990dffb69
- SHA512 33e4b4fed20f254d4866d1a9b8429d478c47650e62049d2b1a619799dffc601ce9c4034b75dfc460f890d545a3b53b20663e50d2db48ca76e4fcd8ad65b3b06b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5qGen:A3k03kHRJARJoI
- TLSH T108359E07F79900E8D15AC2788A968A22FB767C660730A7DF1354C6162F63BD0AF3E754
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 f0c10071e1f9a02dbc1b2f485336ec16e702cf44c4d0dd2c408bf546dfbdfa82
- MD5 7ae078102771255b463a540eeae9dcc9
- SHA1 e3fcb6afc4d3758d6c483e44365a566a42a84e6d
- SHA512 fa7ee40f6164ff3fa1e3926aeea5c56f987cc396c20a34ea0bd350cc615014d6cdf74b08dba99af557dccdd7a2a635d66d16e7ffece47e2eaba024deaf72ba5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5bUr2d29dBrtpDiI:A3k03kHRJARJSUidGl
- TLSH T129659E03F79801E8D05AC1748A968612EB767C560B30A7DF13A4D22A2F73BD4AF3E755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 14cece0783093a84158b18f52a25ae69490abb6a35cddbe1670b012acc18615f
- MD5 ebaa5abd12811f2a9ae82c750588aa14
- SHA1 2ab14972290e0f952eb775f64a6ca61e6dec6b5a
- SHA512 0ea3014af5bd9296540eb16e5e02a6ab62749b66992d68d5f7e0120e2027c1a65fa966fb9369c098fe73a32aa1805e5ea6e8c6d4ca8593d1adcd766388833da2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5P0Le5ji0hmxNrM:A3k03kHRJARJmPji0Aj
- TLSH T12A657C17F6A802B5D067C1B8C6D29A5AEA713842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 931KB
- SHA256 452f4ccb81acb66e49c18b032729b0d4ee1ee7ffc027ed55d6f1d5eb89232ce7
- MD5 1f9dcee4f155d846f8c974fa26fb17aa
- SHA1 05049e3e9a77320c6f86f62e13256ae629071788
- SHA512 18e1df1db8c280b90e03bff4bd3eefec7a73573802cb2c488c2eed0808102ec3e63235afe217a3c4a4bae09375d60169633452f21bb088f71bbece462965cf03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Ra:A3k03kHRJARJ
- TLSH T1AB159C03F79900E8D15AC2789AA69A22EB757C561730A7CF1354C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 965KB
- SHA256 00ab7b03d1a2effffdf88a77d3d1ba6c4901d21d2b0040443bd3aea14e5e30d4
- MD5 68d57f95bb304b203e90e04dbd6ea569
- SHA1 5e631036ebfdfa09e83df35969dc150978b55b0b
- SHA512 a0d80d820fba2c77aacf3e52c92790ec1d5f6f9e536b0e1ae101e2f5f86ddc381700a3158d578818bfb14164a8adecfbea63fac59786a880f9ff1204f52809ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5yb:A3k03kHRJARJbb
- TLSH T196259D03F79800E8D15AC2789AA69A22FB757C56173097DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 940KB
- SHA256 13db60bbd78796728a61b07ac6c0c5462e10bb58c772dbff0f018f57582696df
- MD5 18fc40cc54ed3873f1ef103cd9048b25
- SHA1 8193661d8235b38c0154d6d87451ad67d76ad5e2
- SHA512 73f9532ed637bfbf991a7637880b40d578a84270e788f8d52292b29dfd1a32ec85445af0962eafa0cd9d638785522cd1f1ce98f015de57969aebc6473b45684e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5o6:A3k03kHRJARJQ
- TLSH T161259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 940KB
- SHA256 07881eb8a768bcaa3319163e8ec6af27b0e0d11925c2afb8cea52b6923e4d6fb
- MD5 2efb2d895619967c36a2d135ac7a6948
- SHA1 1afd364c9fe01cfe919cc70fc8ef360bcf42f21e
- SHA512 dd7c6e6eb4e5f7cc821080f63c0c3b0372a6d60dfe8b8485dc914c2d2e7abc3d55b13ad4252fbdd16a647008773e7ba4e34b2e8dc23a58f0433e97f804da8d26
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5sN:A3k03kHRJARJN
- TLSH T17B259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 940KB
- SHA256 97d69cbaba045d41098af09dad97cef52a12fc1a95e30698e7e355f77c67060a
- MD5 8f614b1d65e79ce0054aa965973618ea
- SHA1 0c9b2ca1b9121abb406611460b6a9a4df5c58dbf
- SHA512 7f53319add9e5daf32681e12550a9e8990cab2e5106d9e1c108d8220bfd5c6df32b5e639a6d14e61db25a8fbe64cfb42f2098c44ad1748b63633eac66cd46f77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5if:A3k03kHRJARJl
- TLSH T17F259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 940KB
- SHA256 ac72325ccb5e3df5a09f149b5975cfb52b8c66a0ab9a03ec34c1951191eaf0f8
- MD5 d927f6b0ab49e357dce2e7f1a0d2e1e9
- SHA1 2907bba87c76fe6c90104c4d68b6a5148113a5e2
- SHA512 d471ed996ca87ac4aee310ee57690ae7fe40183e5612d5833fbcb741f81477704384a0046901ba824bcd397680cbccf621dc831bfa5fcef6007b419a228d8eb2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO58o:A3k03kHRJARJw
- TLSH T12F259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 940KB
- SHA256 eeaea2a5fe0a330b078a350688853e1c5259c2b6056e9580dea2d6ce1a8503c1
- MD5 08291296f9825cc2196ffb70a55bb90b
- SHA1 c2f6f67f756036b77bb31d8c101334c762c020c1
- SHA512 d550592828db9d6054d70f3f4a1939185373047b3d5c4a814ac6b6db8e68f00996095ede139b55e6c36ccea23768ece3a1062db3d55cecfad28eab88506ceb0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5cu:A3k03kHRJARJy
- TLSH T1AD259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 940KB
- SHA256 9e4a6f31705574ba92eb089cc486a37154e87c0fa7388bfa8ebe8554038635dd
- MD5 21ccaab8f677652ac2f50037e2d1369a
- SHA1 46b2da3fabd591516f318ea253e11e20553f8d35
- SHA512 8e6b8d43ba859917c0f7569d5845e44fc379367134e50cf7eb01dd44887e63d062b1f0a3a164d6debbe700db0495c89640927d2132489e7bb6ec716c73af14c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5g9:A3k03kHRJARJz
- TLSH T17C259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 940KB
- SHA256 316abbbd23eadefb31c5ed53e804fbbaa55d003493c84bbb75b223726d84fcbd
- MD5 943d89e7c22b95b06ce4eb7df4688990
- SHA1 d140a5901265cf6573d8c274ac1a7407c9ee2fec
- SHA512 30f48b5c03941a28a76dfcbc9e5f0a7e4e32a65d5ef7b57018c4d531e440634acf1c2e6fe537fdabe22e787a39f08531261561f92f20e3da1f64a29cb92f8123
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5oc:A3k03kHRJARJa
- TLSH T19E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 940KB
- SHA256 537872ab86a703685ca8d38baf166b5b932960ddac70c0ee08730e279d61497a
- MD5 1a34fe361c8c98b4f2e76e56c2745a72
- SHA1 7f63ff48626caeac891a61622dfbb4fe331a9d63
- SHA512 c2f84124b1317e2d9d1457094f9ea347c6c177f24c3da984cb8dcceea496821cbc10eac3eba77be48f751568e8de108e45fb910c06cb2b6a1b1b3dddd3f23084
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Bp:A3k03kHRJARJA
- TLSH T124259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 940KB
- SHA256 63c7ed855aaab44121b236465853500c9f30c859c8a13a341f89e2216eaa048d
- MD5 c94cf0e502951aa72efd718f08874035
- SHA1 b06d475dc255609ebdee5c0d938c757b05f72652
- SHA512 8fff8e2700995229a146b60a0e480fcb1e969ab2939a81787967cbc5961dc88f814c9d9213734c032ba7a47914c9dc58d3cc35f4cee14396eeec7665da99817e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5WN:A3k03kHRJARJ/
- TLSH T131259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 940KB
- SHA256 69f7e43783f0e55d09625908bc34137a37f63214bc3d73b1b39ae5277a43339a
- MD5 3bd6323fabbeb70c0a3741af77e7cf6a
- SHA1 96e8f2a81f1770bb510c65d79bf58d72b1cf364e
- SHA512 0b1ee83792c5145c137db43b83a357af1d016a7e837dd04df11b02f0cf85d60ff0663410887acc5535cd9f8fdc84421fca28c94194e15616525b373eadf704ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5aF:A3k03kHRJARJZ
- TLSH T1B2259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 940KB
- SHA256 c18c054fc41878b96f961d10d42e072f6427704c14ef2809fedd4954ec74533d
- MD5 63300a6e5b9fb6f6ca53cabb0e610df3
- SHA1 4b4320f353bb799f736185af79606f6c2d04882a
- SHA512 2cacec8373acc0e01b276e86f84d4570e31e44542704aae9f648d5d8d09d637264dc47febb289dfddba79aa2c43c72b3aa8195d65570a76428b1a65937270a88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5vC:A3k03kHRJARJl
- TLSH T10B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 940KB
- SHA256 bb841d9d03d2e8b28c998f6df2847c597479c5d27ede8daeed9fc657aff1215a
- MD5 4afb65611955ab21a3d85943546abe99
- SHA1 af547fe4460c0a6c424fdf24fc18ca48df85eccc
- SHA512 21ac6087ba74f4e87180b15ce486eacfb4e4961197d68f813774dbd01d5f3761c17835f48afd10ae3d4368e8e119bbc7878fbe21a32d7b43056ca1523d4d504c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Qw:A3k03kHRJARJI
- TLSH T117259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 940KB
- SHA256 c85c73b96c4ea5c76492b6e61704f56439810f6c285a48f7183ffdd9df499017
- MD5 d1095f4860a319d0a6b6e02759e866a6
- SHA1 82b09845b100ad3d0dd90a6dd63b3e30d639d2ee
- SHA512 9b9b2f6e7c809e2481fd9bd5a3d7c7d76b7bace238a66152bcb2a41431e394bc6a6f9f099f2c077dc08b5282b6bd1de5a7c3c6c1ffd510f4081484d3fa808363
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5vT:A3k03kHRJARJA
- TLSH T169259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 940KB
- SHA256 5d4ca8e34b8a5aaf2d70c24094b7160ac2612f6b447a3080fb47dd121d0f6e05
- MD5 928b36080f26f0d78e8810461f87196f
- SHA1 2cc56203d822cccb702394e931cbb7d99d3043ce
- SHA512 2816a0e2fc5ea4cf48ffd3420b2b44d665206e08c5179cc7423ccea8bcb1d8a0669903b320782a0e4d3a4b5ec3a99985902ad3d132d9a4fa66616d05a67edf78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5pu:A3k03kHRJARJ/
- TLSH T1A9259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 940KB
- SHA256 23ab4540ff81ae469fc3ab70b2b814e03eaedbaafd7b1e45b231602260d48834
- MD5 cad46c51cbdcc978feb1f2a69b88cbf3
- SHA1 9750f5d590ea392193a07d9f952d520aa5d3c5c9
- SHA512 3af2757662f7b5e508c3cc4cee4ec8fe266eb9975fd931cec8c7b2f8ef26cb696803f8c2873e1faddc4185531520a18dca08a18de4644d9ce308b6711c996635
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5hb:A3k03kHRJARJm
- TLSH T15C259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 940KB
- SHA256 831b40c27fc55216f14940ab762b51228f82aaacae06e5a81ec732d6b1297e3b
- MD5 ab042f3a8817dddda425c07588fca98b
- SHA1 371c19bb04f9d9668403fceaf707a0ce0d6c89ed
- SHA512 7cdba6eca1341c1a3a0f78bb195b5e9e2733efad0f703f80e092b9f1aad5a5311a4fceeab63b8c33858c6287c7d226972b793c8872fbbc706166ba87b9663030
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5pf:A3k03kHRJARJ2
- TLSH T164259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 940KB
- SHA256 4529deb5847a0878f83549e4de12dd2d2f3e54d334da5084fddc31bfabc01b4f
- MD5 5b672f8a1abde7715db64e48ca230a55
- SHA1 ca029b58b3d4b99386229a02770c69f725cb5fcc
- SHA512 6e18b033532202771e3ae7619b38a2b8bb6f4eb241d8fdd44a1ec1ef3369d8172dcc8188033c17c072cfe01a5f9ad9f90788b6c381c4a96e37b5c1b3c8c165b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5SK:A3k03kHRJARJW
- TLSH T1CB259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 940KB
- SHA256 2b487aa188a41588714c96125bd311aaa58638822aab0c38234966cd306f09d5
- MD5 e779749cedd73f219e8f5cb0c65fcaff
- SHA1 db20765b1f80813b2a0977f2bb373906f2179440
- SHA512 93b67190b036f8b2997c13d5b15af44d59c701b65578fe8de86bc6bd521b49b8032fc3a580ce3221b8ea760c0de1b75c8ae40242d2491de4385e84aaacda6dc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO53k:A3k03kHRJARJL
- TLSH T13E259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 940KB
- SHA256 25399e127e63b3f7b8a70408e1aa7cacc908eab3a2a851f75e0cfe33e3439a1a
- MD5 5b39b9fadd617ac88bb47644e382a0e4
- SHA1 020b9bb07e3c9d6c183e552ee3b8418ea3488a00
- SHA512 6df572643aba3154270091191b0c5ef80baafd7bfa7eb647bf3dacbc1508e7a50fc5b8535139fa111427c0c7da6fc40133ca8af0d1661dfa964efd5e3ca05236
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5A0:A3k03kHRJARJa
- TLSH T165259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 940KB
- SHA256 57ee4a52846451f3a4d8310cd2e7a3f89482554724a160d713f9c6c806d977c6
- MD5 152b950cbe9d7dba221db7436a8cc56a
- SHA1 67e1afec397276307365190aa20f66a06e83024c
- SHA512 81414effe3d2bbfbd6d494cde6da57a2dea48efa4137bb5c1a36f0923fd35d89f76ecc421b428491a2b5eb8d7679889ac219746447ccdc83e13cc8d4a6c09af0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5bg:A3k03kHRJARJj
- TLSH T1CB259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 940KB
- SHA256 2f27b4dd20ff6358c8d54d03e4898c1c7aa631c8a72802e99ec89c4017572de8
- MD5 9be7b3a3ae53fe2ed728587bbc0fc4e9
- SHA1 820266528295a34ca7a392fa16950d352534d0a8
- SHA512 b0992f9235de203c7c4ca3a426b76ddcdd3bb260854d4fdd125ff6f552fb8e5fbfa3d64bc62ddd974b13089ad7034850e086121c619fd30b57c943e919f672fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Wr:A3k03kHRJARJ1
- TLSH T112259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 940KB
- SHA256 3f2230fcc6763f0a1c6a3b469624f34946799504636f49f9b94fa3f5897d96a7
- MD5 a4f88db783a2925354acc20c1d87ea52
- SHA1 317d20d58046733afdfa01136b210942d4ef64d2
- SHA512 2dd3ddd5f3d30007e15beeb9960c95a07b2bfae0727c6e4d8a11fa53f151d9ced21a15bfa96b44966c6725bd471fde0fa9db88fbfa36f050150ce3be1aaf976d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO58n:A3k03kHRJARJn
- TLSH T1A1259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 940KB
- SHA256 e919759f9eb51078c710c5a0781413c9b08b12fd4f9fbdeef8c3efdff8905c73
- MD5 86da776dc8c3709d2def905c7fed0a74
- SHA1 ec2ede23843951ca8476255b10b2f9166ead22cc
- SHA512 86b8fb28c0dce7f70e3dc4559ad3ac4b4efd27fcee923fee2fe9322a9345cd7e9b3897c1f67d075a4e0409a7f202642c1e5ad3a955aac4cf7629770c4cefcf18
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO56x:A3k03kHRJARJ9
- TLSH T1AB259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 940KB
- SHA256 3f6bed8d119ad2f9267bb45cde5db8d68c8a4af8233a63b628684b339e8dc4de
- MD5 f08d65e0693dc72cd2c97ee412891a3e
- SHA1 14a5f39fa7c7643d38c008614b25a57c66a55cfd
- SHA512 48517ef000efb4d222967bfcc59ec0875f20766eb6594755d9fa78ad763b107cb280fc31f7ffb3937a7c91a7b3711a909c07f626584f931acff57cfc02fda1b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO58A:A3k03kHRJARJi
- TLSH T136259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 940KB
- SHA256 5140bdea4fb8fb06f6ea778336c7a643de67bc8617f29472bed0698d00a88814
- MD5 44d8993532aa061cddfaef9abd69d998
- SHA1 982a63faa4ab381efaaa649948b67c49f3929811
- SHA512 15f4378258bce7f982b20fadebc66894efd452303b0cf19a4d60593e166fbf6e7d5c003e33e4ef432eaf45c5bbd199cadf74c6e15416868fd68f0e874dbca2c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5l9Q:A3k03kHRJARJ/
- TLSH T1E3259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 940KB
- SHA256 64e43a3b4712dc77f193ff94f969c68b405246bfe057c3776277216d8c6c52ce
- MD5 4172a167ae81993d8a0cb41c197ea546
- SHA1 fc9d5fa495b6af99b9a37413dd69d817405b3223
- SHA512 80eb293b1236354d0eb7d3f7ef1f20ee9f7cdcf55200b970022105396d9f7fa31d8988d47756838d1749d4312beb5f3cc7b2324b9c193a6173c7b6e12f56cb03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Q4:A3k03kHRJARJA
- TLSH T1B2259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 940KB
- SHA256 553861f8fe87ac6c9d3164afddbc434bc5522d0f0d748dc5d94ebff50130221b
- MD5 db6b1f3f4d13ff9f7033c2079f07f181
- SHA1 91b13fcc6e65d1e4912fd131d5f1b569b2346f27
- SHA512 27df198252a56077ae5844ef007c00dba6bb7f06f1844363af07c24bcadf6a4ae28b2cf2b8a0783400c7c09e2e9b8739968a9be0564627d592557bb2e509b9de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Tu:A3k03kHRJARJh
- TLSH T175259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 940KB
- SHA256 3ffa5acd6f792ac5576150bb8f6680e5c7c42f7e9c2a2aaa7db3d6d0cd491a52
- MD5 86103886f0eb7576726471d33f246984
- SHA1 d5f6a3695c35b339c972947ddb22ef9bf6a09b24
- SHA512 35657b8ec8121370933d0207541fedaf25c5b5ea88fe4796c4f10220b1f514580d3497fe3abbeebc8e2fe82c947d8f200afad941c6be50c3135b51b2ef2fb370
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Oj:A3k03kHRJARJL
- TLSH T156259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 940KB
- SHA256 4887d0fae17b2d081fcf355ac762da9506bb3561989d5de8ecb287b0a7c649ae
- MD5 295b051cb9086aa239b704b8cdd411d2
- SHA1 dcc58e9ba92e4f712ac4b1ffc61deeebf262d1d6
- SHA512 fdefaee9bc3126afa20801340eaff50111e6f284e4492c7b54754fccf80d7ba6ec8f2173c5bb6484f53f516c485959a5f59c413aaff86b7eb5c651489693f8b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO57g:A3k03kHRJARJD
- TLSH T164259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 940KB
- SHA256 fd62e028ba666affe2064f8ac20553ccaa320fec2acd339225f367f58407e810
- MD5 dae2b4b96842a1d54c050b4829458edd
- SHA1 6001ef823901bdaee2d48c3f6dbbb4a22cde45c4
- SHA512 36ed59fcba32d40d5fa82b403d29e81d43170b918c3af7b7f859a81946ff32d0201760b701d4926c70e9d9f1eba54d71ecf87920f2b0ebbfca932603a9e90a46
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5mI:A3k03kHRJARJK
- TLSH T16A259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 940KB
- SHA256 a275546fd070a44d83fe3665c0b8d87ccb8120357ca72a924b33fab7ba6a2917
- MD5 565d935108b203a3ed29e74d0774dfcb
- SHA1 469abae1c41825740b7b7eb9a50d6e1ce7584731
- SHA512 55b8fa6e08375cd602e095c0158b688bf2fc777667a4906f02db9c1fed3a3100c4be2b4daea0ccc1d8d4bb3954064af15f911cce7cf3e7ec8895beaf60642705
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5Uo:A3k03kHRJARJY
- TLSH T17B259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 940KB
- SHA256 bf834d624c96d2a96e46cbe54a4f922c84e04a30ba71173f1c1f1bb84e8ff625
- MD5 87edaec7a82300fd4fb451cabd3fd084
- SHA1 1c3be9e549dc49c7e5b238598c3276434c186932
- SHA512 33808b042f6baed5abec2fb590df7d1ce8cfbd97b38cd632901188b2e78bb550548a0fc8bc9f38eb82965094123a15e291853e52bc0a3ba974a36f4228dbcfb8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO53+:A3k03kHRJARJl
- TLSH T1FA259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 940KB
- SHA256 e0adab404e89b02f7cf5915f98a73d40f4dc9f1bdd143286b7f5fde1ed9c6eb0
- MD5 87cfc4f35b0aeb86a5c51f1d6bcf98ac
- SHA1 65a49a2f8ef5c547a7e9774482d9de9a0a6b31bd
- SHA512 67cdc9a2aa28ec19dcfd1d1a835febfd4a87f78f67a6fd3fa64ae4e5eee7464e1fa214090cf463e43bd1e9ebf324e02b43f95a5f0c3fb4c7b41c98e4e0a677af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5NQ:A3k03kHRJARJt
- TLSH T130259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 940KB
- SHA256 8052809e7b2d35120d4cc6ae6993b4f2e495716d1a76ab9060f6d74b2ba43c23
- MD5 96f9b605aae8d3b7cb3649ef579d4262
- SHA1 682d56cb35f772ed7189c157866d41c8564349a8
- SHA512 65701b8802a97dfa352783b927e31fba1ecca4cc9981de7e5ec3bfa48615f71e8d25fe9efbbb370ceecc45023a73da43bcffbfb5ada48204de52f1f94556ad7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5CX:A3k03kHRJARJZ
- TLSH T1CF259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 940KB
- SHA256 d55af051471816153a2c8ec8bb9a76a507ccbdda8288d0ab2de85f7a6b13a1e5
- MD5 749298ad34435d1e895e50b9d59224c5
- SHA1 688676360bf98de5a383fa6cb29444a08fb9f963
- SHA512 be666f27ba6136ebc72442e966a08f22795dbb395a1e116f4720e9465fef2290615d5bb05a1aed8ad0c6191d56f2263118ca9dbebb9bcf3408e8e46e6fb714bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5kL:A3k03kHRJARJT
- TLSH T1D7259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 940KB
- SHA256 787029eb8f5d6a07434d1fd76c4fb3e393afe59e4c020657633e473b5e8ad483
- MD5 ba00b6026e32dd90e89a649961729393
- SHA1 a4986ecc70fc58b21aa5e6ff2b834c0fb312d631
- SHA512 00c036b22789daddaea8b99269d892f56065181f105deb52cbcabe4e72bec2b8d682470f700371777122d528c95569f2af710fd7abee9a80d97582c6ec530511
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5AM:A3k03kHRJARJe
- TLSH T1F8259D03F79900E8D14AC1789AA69A22FB757C56173097DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 940KB
- SHA256 44abbbecb139fcb23f2b97c98c3990889088cbfda247aa1e599f2ce05343a37b
- MD5 d40143e6cc760c8a6b08580c165f00f3
- SHA1 2b3ca3e84719e279c1cd0d7788889399644040a7
- SHA512 27cd000377aca426568bb21a59c50b1c96ec6e83d178f1f9bc2371bf970fb734009093d3253bfd6e12f53d13f2c9b4ac1776bd478486506ee970245853f59f02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5hh:A3k03kHRJARJw
- TLSH T19D259D03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\ClickToRun\{9AC08E99-230B-47e8-9721-4577B7F124EA}\integrator.exe$
- Size 1.3MB
- SHA256 1e9cd472eb54e3e8203b9f12af3c5d274d1910561483d2c5f73a5e717657813d
- MD5 d631ca9450bc064691270825d639254d
- SHA1 043c540a8c162b876662c065f867d570c7f99c28
- SHA512 37fc31587e10508d554d2be8980bc328bdffb668869deed5a2558a2ca81d40aac5c07ab02649d437f2a2e6007819d738abd1db53c25f0b8999a5c84a0eb87a2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5K3npi63iC:A3k03kHRJARJ9XpiMh
- TLSH T120556B03B7E900B4E1B786349AB59622EB76BC615B30D3CF2394560D1F71AD0EE39762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe
- Size 1.1MB
- SHA256 d15278153cb89be44f830a43558c5f065628fda7b551a8ca0fc44c8abdda06e6
- MD5 3e20fc70950be9b37f4cc5acc27c0b3f
- SHA1 e0d5c87eef9f5de7a02daa380de933c24797405f
- SHA512 bafc758ce1fa8961bfd48ab38f45b12a9ea73b16b403aa1088489061fc672474bd1584d6ee93335da5d4bfa5b6921dae869d044727a56f01c6094fb8c1ea9526
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooFjvO5ZQZ:A3k03kHRJARJEQZ
- TLSH T136358D13F7E800F9E16782749AA68A22FB757C151B3093CF235486192F72BD0AF39765
- MD5 SHA1 SHA512 SSDEEP TLSH