Analysis
- max time kernel
107s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 16:01
Behavioral task
behavioral1
Sample
2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 868KB
- Sample260802-tgde3acc72
- SHA256 24fa400d30d68ba5d4f6c97ffa2520b87d9a68e40965dde42b29fc9aa6ca7c96
- MD5 fe2199ae03e14c7f0bfa656dedb8571e
- SHA1 f62d0110eb44b9d7829d0827e5fe8974da82bd36
- SHA512 58d1e15bf395487030ff876d93239d326b3ee0f4020b897611bc7b0ae237a7e2491596832f7dfed13589737a87aac2623a9d8af5b72bcdc80197dba9a5fde1db
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghE:A3k03kB56r
- TLSH T1CC156A13E6850FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/5968-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000019f9b-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5968-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3476-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f9-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c89-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-288.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-463.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c483-579.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e0-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-827.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1004.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1067.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1104.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1198.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1295.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1351.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b677-1914.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x0008000000019f9b-6.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f9-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c89-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-288.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-463.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-500.dat aspack_v212_v242 behavioral2/files/0x000e00000001c483-579.dat aspack_v212_v242 behavioral2/files/0x00040000000198e0-616.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-641.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-747.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-827.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-858.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1004.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1067.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1104.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1141.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1172.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1198.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1295.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1332.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1351.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1377.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1385.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1392.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1399.dat aspack_v212_v242 behavioral2/files/0x000300000001b677-1914.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3476 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5968 2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3476 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_fe2199ae03e14c7f0bfa656dedb8571e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5968
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3476
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 868KB
- SHA256 24fa400d30d68ba5d4f6c97ffa2520b87d9a68e40965dde42b29fc9aa6ca7c96
- MD5 fe2199ae03e14c7f0bfa656dedb8571e
- SHA1 f62d0110eb44b9d7829d0827e5fe8974da82bd36
- SHA512 58d1e15bf395487030ff876d93239d326b3ee0f4020b897611bc7b0ae237a7e2491596832f7dfed13589737a87aac2623a9d8af5b72bcdc80197dba9a5fde1db
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghE:A3k03kB56r
- TLSH T1CC156A13E6850FA4D10F81749A968672EA737C025F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 967KB
- SHA256 47159bd388293b1b056570ee1d5968edcb89567f998e45cd1bdeb873c2780347
- MD5 47a433a8617c27cd90bcdf8541e017cf
- SHA1 2c06dc5696e6beb2f328cb1de2e37c918828209c
- SHA512 42cea8c54343a8e8223c9d107062200607d1f2bf02b2feb6de7000d99d230e5a034c19ddeb9a67576fef4c3bf91a38ae6f6f14e9ae1a370d3673db6a7a90fbe1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghElbBPzBAU:A3k03kB56rzBPVAU
- TLSH T17D257C13E6840FA4D11F81349A958A72EA777C121F2097DF2354AE253F32BD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 4a8306a67a269cedcf4d3e8bbb760b8a353dec4503b657512f405d57230fd90d
- MD5 7b939a7946c57286f5a6fc15901340df
- SHA1 1bad70d514496d210fe13bda624bc1b10f5d6129
- SHA512 a8d834cebbc3fc6b4d8c376a5307ba381c259d7a8cdf0a5ea37761960dffc414483bbf56d587c161eac02196e975f908fa070e7a6951ecfb5534caac8ad5f9d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEP0Le5ji0hmxNrM:A3k03kB56rBPji0Aj
- TLSH T1B6654A16F6A44BA5D02FC074C5D29666EA733C421F3087CB1354EE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 883KB
- SHA256 c28e9e407aafc0b96da0df9e4d673dcbb5320e094ca169a316e11314161c7c03
- MD5 7df168de44619fb9c74c5f541f71e334
- SHA1 e528d8ce71c7c06178c491954024a4a738f0b988
- SHA512 3742a2d1f47c32a3edfc360a867e3afeb954b9eea8a8aec2d6c5c251c3d0f796b24bbbe980289e0511d7734aca0dbf1da895ef8b4c9a89074375eb56b9c79d1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghERa:A3k03kB56r
- TLSH T1CD156A13E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 916KB
- SHA256 e90c43ebd5053f8c2d91fdc67171b563951ca7e9b7a72b8ebf15b47bdf9c69d5
- MD5 b7a01e38172f3f118398c0147f0e5fcb
- SHA1 117a5e843e89e1c3eeb955e76a1440c44e1239ce
- SHA512 6e42a1d9a22196ef57c9084f3d82e9c099d3ccff0f13c2462b4129315f2496330f0871ad998b0634ad62a0083f957d52eb131cf3c65708da4ee010896739a0aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEyb:A3k03kB56rQb
- TLSH T11F157B03E6840FA5D10F81749AA58672EA777C421F2097DF1358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 892KB
- SHA256 bf378742a0fa8280d7408565929ae48491b5d12a1f721fe49f05ccdb1634697b
- MD5 9ea851c2557233e168b93c490ce626cd
- SHA1 fc9cc381d0c049f78daf53716615a0b005130b62
- SHA512 85c2d7400aa27bcb6f9aa5dd30fe76d007507c5ffafd6b22df52e184dbf1899b4dd9dbed2163c4b33c66d17008cea74269c3922477ad1cdfd67a473080c38778
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEg9:A3k03kB56rS
- TLSH T187156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 892KB
- SHA256 ecb14d55d709ca38fe3c8e5662b71e9cf9cc42e17d461129b69aa24ea997dd7a
- MD5 2faf25c5e1cf7f62f7f13494def5a134
- SHA1 25584710e8fcf1ec38a646c82dd77d83f1bbe479
- SHA512 257a4a83c1e744f53aca3bfecd089d6ae6e5db324e582fc997050719e3db1d59f0b1117b479cebe4e04dc5a2ce74adabb6ed4c192b1c299362a8eea9e969667d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEoc:A3k03kB56r/
- TLSH T13A156B13E6840FA4D10FC1749A968662EA777C025F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 892KB
- SHA256 79fd43f34f2dec372a4d19c9bdb5828da35ce0e67908f7ff8f2cf0da667405fe
- MD5 2b179dc9baa2f3d7056d28589bdf5c32
- SHA1 64dc00e20b49dce8ede8390c1c9ca06443ce89f1
- SHA512 23a78ad15a91ec555c6c49979a5364301cd00f60350dc2fcfabf5d65fb1132006ad261bcd1347e42a9a04c6ee4dc0e17c527285585efd8c8d7b0cd4d33516825
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEBp:A3k03kB56rV
- TLSH T102156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 892KB
- SHA256 403503acc6e98a7816774ab271ee95a806f19ecf6f3c79efd574ff8ebb711e25
- MD5 3fcddb3cd61e99cc2b3ab06c06259a1d
- SHA1 660908525bf04c164349a8efaa09374ccdd73f3b
- SHA512 b659953899ef45bb8bedacd307aa84d3409cb0f0236f66c9fcf7993a90da754b7b9b2f8c9a02a9b08c92f7e805181bdcb1e8929663bd2978cdfe09d5b449b315
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEWN:A3k03kB56ru
- TLSH T144156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 892KB
- SHA256 a78949751cc6a07405720f44d36d282395038d2cb16cefe4f2c6beb6ebe84de0
- MD5 2975030688ac993106b9f15882b4f3e1
- SHA1 1fc062a0045e7f98bbc72f091236303eaab94be9
- SHA512 b4281d3997f31d53628c41fb53940c54cf5aca76c3fbf30f6e5dfbeaf3a676fbf46873785dfb593ac204d0c0ed745e2b5adb6a91375d17b7e7c9ad9b9b26a7ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEaF:A3k03kB56rs
- TLSH T1E2156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 892KB
- SHA256 4727722acb0b355f93d42e86f903c0fbd9c0a114bf85a64032114289f5d61829
- MD5 78076657ed70db96210cc4d740d440bb
- SHA1 7091348c2baf16bd22bc2ef4841e3527b5d6e126
- SHA512 cc96c74ac6e648a63a1557c8f775ac1ce80120f9bf4dcf34cd0f48a83301e3ece4f2b5a2c401c3f902e13353750f528178703e8eaaa2ec4ab88dff0b6400e655
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEvC:A3k03kB56r4
- TLSH T1D9156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 892KB
- SHA256 f9d4bf078b6e7609d361ca79956717fe328368f745b2f0940a6ef41c51488e2b
- MD5 b7b1acbe57b9c15cf3411dcd455c6dd6
- SHA1 209623b0a8d181150c9aa56fddf48079b518f65d
- SHA512 0a4f15b07f1f9f1d13e19e46714883cc6084537307b7ce91e51e6230659b60a7ed081ccb429cc0d230468876f0cd41ed3277f3bc042c8b802c7c279099c825bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEQw:A3k03kB56rV
- TLSH T1B2156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 892KB
- SHA256 cbdcf9ef644386dd4f8081c1d631d646841931438537d6fa96c7a7a2ca6395a2
- MD5 7f0abeaa3e57cded031b6826589e4bfd
- SHA1 07f940710fece8efaef83dbae11fcb9a308852e6
- SHA512 1e78b6f09a1a8666e59a88b63c90e341e1371ddcba57c1d27c7f541e5181cd68f86ef508d3b14cd7b4bd62837cc76e1b890eed3605dabd9477cd31df95eebb45
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEvT:A3k03kB56rJ
- TLSH T18C156A13E6850FA4D10F81749A968672EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 892KB
- SHA256 5576f1e48eab02594bbb855a52867d53feeb16293fb0026117213ea06f2d7d69
- MD5 6bdec6e31a89b92d3a6fad18b2004df8
- SHA1 eff3dada5842552d406ff20e4d762a330fd6995f
- SHA512 abbceff4a8022f76d323bc84e1eb5f34e6a351c8de725d518766f2bfd63127db49349ed6b06f3949aa43e6645e292ebb36ddf8fbf810d2f3164d701c384a9525
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEpu:A3k03kB56rO
- TLSH T14D156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 892KB
- SHA256 26121646cc96d43648f40930d46a225d7c497f92f8ce6a5193b2670c65ae8c97
- MD5 3fd22d361a29d7547269277af11ffc0c
- SHA1 6afae536bf8a429d60ed8f54b41a620a8ce067bf
- SHA512 4baa3ab90ca8683cbb7ce33f2cf0548fe0f43e2eac1af7f587b5848d424406d770b770985a9057f8fc9d1e53c3e85d037a4af9c56f31c40ef01ff91be0744ae8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEhb:A3k03kB56rP
- TLSH T14D156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 892KB
- SHA256 f4d71ea1a789e7573524589e8bca29e13f275c4679100a84297781b2dba46124
- MD5 b8e9bf871ad9fbbe67f9dd1c6494d996
- SHA1 22284feef5a8aecbd2857bff5423ccbd8a85dce2
- SHA512 4faeb9570523a7f5a9d3785a85a430e2a6743bc03f3dd31bfb0ee27261ef02e7983625592a0e072c0734197ab55147f59608de10cab82b9c6531b520f6fb8111
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEpf:A3k03kB56rH
- TLSH T15E156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 892KB
- SHA256 6a6cb732bc8a6d9b9b53a46c84b9b246bb41bad979045969e33d60c5ab0b3567
- MD5 5a6b72db94e477ec866ae97485d5849a
- SHA1 bece5e79b32a1b94f97c82f8c8c51aeed7d69ee4
- SHA512 fba792f05cda8dac5fbb5ae35f25e64dfb180953687a92031546a1df2c1cad534cb606dc920452b808779aa7310e0fb9c884eb28813a4c27eb03b90ab204a256
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghESK:A3k03kB56rH
- TLSH T158156B13E6840FA4D10FC1749A968662EA777C025F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 892KB
- SHA256 98b44671f692aeca93932fea763187e035a58f97ab42e03bc0ed72a569f332ad
- MD5 e037c18ffa3bd304f2c7c368796dd5fc
- SHA1 6ea8dc310db603ad6a823ff8de70ad6127b7a6e8
- SHA512 9a8c1ce1a9bdebd6dee48c201b0baa1d729427ef8b23cd9f8604e53c1d591f022841b7cc7e78c7e01fed93adbc08831855f4a760e3cb26de9a0e117540310122
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghE3k:A3k03kB56ri
- TLSH T168156A13E6850FA4D10F81749A968672EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 892KB
- SHA256 5695909b106387573dbfc45fc2ba612d2b5f25bd364c108a39391a5de00bb422
- MD5 b99d3d958a06fa801fedf01533616485
- SHA1 1498381d718c73eea3252bfeea72d78d29f9a544
- SHA512 8e158f8834f57b899d00eec1fa0a032b2dfa5efd20fd9512d37e4b7bd76856408637390d33316c9e67e31c370cba80066672ad8a64e26edbffeb138fab460d92
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEA0:A3k03kB56rH
- TLSH T196156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 892KB
- SHA256 28454d22592bb1a4b65347664e441139d7bb6f337de758564c1cf04d1f633244
- MD5 a02071b0577d48c7a9e194c909d77a0f
- SHA1 fe522bae417862040d47c1958eed00bd0b332e16
- SHA512 1828985e72e1fdbc74eb9123bab0b7185bac5d994c6ee805cbf4dcaccae81528a4f1a00d662a375a3be354fa1dec1ca7fd0271dbb7dd13dd8117e76df939cc14
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEbg:A3k03kB56r6
- TLSH T125156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 892KB
- SHA256 16f0bef98289fb1ffb71e92c6194f4a10315cd9bf466aa5be7d77631eeb20775
- MD5 e500b70f9478511679fc9d0a21f3cd8c
- SHA1 1be74cb497770c65c02cfa1ec77c053caceca4fd
- SHA512 82a87a59b4149d9dcfcf5d4748cfd3df2080714b9e7ed079aa6faf34da555d35469b8e7a46aeb69e8324bbd39c9364ef407b7676ba590aa78cd290dc9fb72c4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEWr:A3k03kB56rE
- TLSH T1FF156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 892KB
- SHA256 a56c61b5306542907c8789b0359b899d6474bd9ef307a30d602f33b6fefb3516
- MD5 f2131241b4f91d8b4463135665e0ad52
- SHA1 3f6c8f39d1d73c845b422db720fb64422e97e5c2
- SHA512 229911b9f8c916dfc28a7baba8bc2b9c2d51a36816234a0ad8fa83f8d64c36fa2c9d4f78ab568a61582efab1c58ac47c8027758a89d7b6d53bd72ceed2036cd4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghE8n:A3k03kB56re
- TLSH T14E156A13E6850FA4D10F81749A968672EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 892KB
- SHA256 61d083a61b55ea2aa40cb7b8e9d23c9ae9c44eafd1b5ed5783ea19fbe64f4950
- MD5 9bb65a84a9332fb87c935d397c01bc5c
- SHA1 71de0c3897dd8603d14f1363aebf19f0edd31c19
- SHA512 90a6d46ad9284d7a920634165ec0ffe38151e0bd34f0d8501b7a9f26755ebbb5e66069aa08213d7a3c46ba3f890f7155d49fa84daa4b7dd552ddf35f57f801da
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghE6x:A3k03kB56rE
- TLSH T1BA156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 892KB
- SHA256 f81d25f94779cb68dcf163546b9d4ccb4cae4e1dc65f00182071d6e05f065834
- MD5 cc472394f5c3750c3954929941a1aca6
- SHA1 dff6513a9b6af4458ea65424086386c5e1496f76
- SHA512 bd763d49fcbb871127969ff22705f712f2d4005a50423c6269455b444615ec4ab5bbc107f253eda5f1dd586f4f837701e3c22fdde68dbaa644b3faf3574c663a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghE8A:A3k03kB56rv
- TLSH T1EA156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 892KB
- SHA256 fa095955a52863d064d2a20bfe60301ebfe9b0c921c04c09e15f9c31cf8217b7
- MD5 8e63492010716861bb7d2ebb179db430
- SHA1 514d3aec731eebdef943b52224cabe294fe1a833
- SHA512 0db7de0bf00d3bf09f78904214797eab2f04077c51135c1e7ca01e9f01ef704dce5372302ea260052707807834062888ced29919703599c2f2c5142b3de463d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEl9Q:A3k03kB56ri
- TLSH T1EE156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 892KB
- SHA256 fb218afc93f6797df811eaf8e3a5d97491a3887d3d4f8a826128b4e02e3a646a
- MD5 512adf75dfd661301dc846cd3e231199
- SHA1 d67ac2db13bf8157d1bb26fe7019d85b6de655d3
- SHA512 0a087238e1393eddf3fd7720a321fd738f6f8946093670045f921ca18a3dcc062f164720390ae9aa0563a827e6097dbd65f05bc567761008652689a91ab59499
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEQ4:A3k03kB56rR
- TLSH T1BE156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 892KB
- SHA256 b0eae2d825a2e3da74ccab8d6ac31df2b1cfd222abb917370e9a61c27cf8b71a
- MD5 2da85355bd831ffbd6a7d054ad9bff25
- SHA1 a93a845e960a7ab14caad2af94eaefa72d6a24ed
- SHA512 8e8d296032fc8f729268424b0f189640e854a91d61a7ba4d9045275498f4351b2cf31af96f6ae65c3a6abb95556bf8ce10451d82c417a147cacee0bf2d3ce860
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghETu:A3k03kB56rs
- TLSH T144156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 892KB
- SHA256 e690f6b3847f9da8dbff566b7eaa248be5b83fb6bc8e051267d17a7565f8560f
- MD5 0a6f525f87930aa9dfc337dece6699a7
- SHA1 5939a3bcd6e0728a8b5c6b7f10165cf75be73ecc
- SHA512 f891535e38f6b48681e69a62eb446081011fdfca47084e6e3853a809a51047b9a38c5b9f92ab4e2fcfb3c96002cffff53632c979c3d7f72ea8558de224951990
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEOj:A3k03kB56ru
- TLSH T11A156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 892KB
- SHA256 b6cd25ef55d2a2f7a7dfeecd04617ec1f47b4dbb261b83380a4cb236630d14ef
- MD5 254cee0924ff48a82d5cc59264d8c558
- SHA1 cca6585b656fddf6d7bbb3e95be15004fa0d7594
- SHA512 2760a874364786ff099a4bbd1f32e956c2bfc277c1d39c42643bf4f42ffa189b437e6b46aa498939a5c5c464fa966d37f0cbb95163950dfef35f37b3671f3632
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghE7g:A3k03kB56ri
- TLSH T153156A13E6840FA4D10FC1749A968662EA777C025F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 892KB
- SHA256 6297612971315c7a8e49d9ca53d6983c19d5cad0610eb1299290ef9bf5d59946
- MD5 4501374855d4cf1e14e66072c3ec16e9
- SHA1 eaae8eba88ad230894309cd1bf3e4ec744e19b19
- SHA512 12c0e0092bf34a9d15ad510ecfc95c3df185469a78fadc77eb58e74bf2203aeba32047b4ba79b46e3519e2064d0c02ab8d4147996301c25610c289545989eb59
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEmI:A3k03kB56rT
- TLSH T182156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 892KB
- SHA256 78ada2ece7bdf1873ee433130b26e5571ecd079563f9ff8ab20ff84041fce204
- MD5 8044d42b114ed471bfb1993a878a5e88
- SHA1 ef2e312f376f0aef6a9cbc334d67abfe9c0da613
- SHA512 8c7c75abe8a3b6d6774c12a9d804fa0e059b40e8d3541a2cb0cac12012944e9d04c81379c645ac627365524ddc8f8607445e5ab03dddfd7ed87322cd49cea751
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEUo:A3k03kB56rt
- TLSH T1F9156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 892KB
- SHA256 50729727b56abe533e201dedbdf5a9faf55277d901db225c257233426bc4229c
- MD5 8e29c675c8b4126f1ca5348dd0d7c2e8
- SHA1 f85a6d6477170f5245bc1d057d288f50c3bf6f69
- SHA512 4aa58bec2d4cafc0786443152ad9c490a709d1420cbd2b334d13791c9c88642b32a8c8e1efade7920c02735ab9ecfa83e02dc5a1c50944d27304c645acc5f4f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghE3+:A3k03kB56rI
- TLSH T153156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 892KB
- SHA256 d12b2b4191ce822eddb02d6207df5e735b8bb3a55b512f518d74a0441b3f2fc7
- MD5 60147b4f33c7f9ecb00c36a76fed506a
- SHA1 0b1ae1378b393a72e9dbacb389e97a448b72e174
- SHA512 e28058243114bd0142ebbb81b888d2e5ab2eb2baa805cd29ca628fdd4e08a285ee8ba5be142c929f04c7cfcbd979ffa33f7bce0cce03c1f0236871f48f99f653
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghENQ:A3k03kB56rI
- TLSH T116156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 892KB
- SHA256 247cfc181b08d9be84e7d090a6080bc32a692db5bff900181c1fdfbdb76d7775
- MD5 84544bd4f71bd5f65ec281b61e07f92e
- SHA1 3f02cb59e4caa77acb843b6fd3aaf6db9f49facc
- SHA512 d35a3e3b5a4352d812ddd0cb51e68c96988f9979bdb406f435e2f616d3d8bcb6098ad80c0da0c2ad02edc3123cbac9eb90139b7c1c5e8b730865026630b1b0f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghECX:A3k03kB56r4
- TLSH T150156B13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 892KB
- SHA256 f55d5d35a6167c06ac985f0e64f4a338966e236470dc24c729093545ca397688
- MD5 11e751d6b28fec570e61acd6a7f0dbaa
- SHA1 edb8a1b5d41b090140c72a279dfecb985c4e1f0e
- SHA512 968eb61f51f6e7fa6f94fb16f98a39963ca64b3134c79cb3130d46502a83c41cccd0717f433ad4be63aa5323adad363ab96a70a2dbd74da589249abbc6b30889
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEkL:A3k03kB56rK
- TLSH T14D156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 892KB
- SHA256 582027632d10f6a16b6f28695abcb2774d750ec345f120c809d00c517edc5ea2
- MD5 371c779c75535131fd0854d0ac51a76b
- SHA1 7cdc6748a487549be344b532fc3ae1689f74d94c
- SHA512 dc529494a80cf584e2a791b17dcfb513b445efd0c4ccd654a941d3ebe7429ef267ae79e3fe77dd7a7a9cca5f280b296f5a8d6f8f338ff7fb0bce2cf208f8ebb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEAM:A3k03kB56rH
- TLSH T1E4156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 892KB
- SHA256 85cf841ddaaff47fefdbb539876606e615ddf5f58d5af3cd5cd2eb4479780cc2
- MD5 47a5a407ce7555706eca87e213ceee38
- SHA1 d7c34efbfa54d1d0bcae9c4fc255a16e3acc67a3
- SHA512 46a3199bef467052bfb99b3c38194e1494675e86bb8ec225188eedcd982c2d30d499d06984503d4975253649e28bd74dca987e730576de994e15d7822fe6adea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYaghEhh:A3k03kB56r5
- TLSH T19F156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH