Analysis
- max time kernel
107s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/08/2026, 03:10
Behavioral task
behavioral1
Sample
2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 940KB
- Sample260805-dpg58aak91
- SHA256 407273a22e0566725cdc4d92b11caca8eb4d7f3061f114b1aa326e59aea90357
- MD5 3d75da6f07e0effa44e017d9f6a3471e
- SHA1 eb3439c3c432e48ec9a300d639bc2d33ca17adf5
- SHA512 e31f819661eff93e2921d3b30e9aced32e68c4245177399926ba00af2532845b26dbaba282a674f82d6914da013abd8fc63dcaf1e4fb97f04c7bd4002e4848f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11x6:A3k03kHRJARJU
- TLSH T194259D03F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/1240-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b815-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000001b857-10.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1240-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5264-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-435.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-478.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-594.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-620.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-670.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-837.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-856.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-875.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1003.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1046.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1090.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1115.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1371.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b815-5.dat aspack_v212_v242 behavioral2/files/0x000a00000001b857-10.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-272.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-435.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-478.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-509.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-594.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-620.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-670.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-725.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-837.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-856.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-875.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-894.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-901.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-920.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-934.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-954.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1003.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1046.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1065.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1090.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1115.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1140.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1171.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1178.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1186.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1224.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1327.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1346.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1371.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5264 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1240 2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5264 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-05_3d75da6f07e0effa44e017d9f6a3471e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1240
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5264
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 940KB
- SHA256 407273a22e0566725cdc4d92b11caca8eb4d7f3061f114b1aa326e59aea90357
- MD5 3d75da6f07e0effa44e017d9f6a3471e
- SHA1 eb3439c3c432e48ec9a300d639bc2d33ca17adf5
- SHA512 e31f819661eff93e2921d3b30e9aced32e68c4245177399926ba00af2532845b26dbaba282a674f82d6914da013abd8fc63dcaf1e4fb97f04c7bd4002e4848f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11x6:A3k03kHRJARJU
- TLSH T194259D03F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.5MB
- SHA256 daaa8a22abc73810a4a70d8d90d807ff4d0f474068b43ada83e6e68d528dc692
- MD5 5513ad6e7f3396413068d105993173ec
- SHA1 c403b5f5db2006e8ad0f71772e2152c960be6c31
- SHA512 7407360b8aa6310627b8bcaa4937b933a918de2148895e21dbff96631c83df99708ab4624794d398815318c072b78fa6ff7106671dc9f4aa9a027dab90212f61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xK0Le5ji0hmxNrM:A3k03kHRJARJMPji0Aj
- TLSH T152657C17F6A802B5D067C1B8C5D29A5AEA723842173097CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 954KB
- SHA256 8d62d263a0bffbc8138793a7c8b6f9e75dada8ad95da169ad61cd5779d5de9f4
- MD5 2295868f6d6f1738ba262d16c23a701d
- SHA1 5e9390afe4c3357258d578c4fd6f870b367c6a82
- SHA512 a33e5b7c16b6e4dd3c9eb8a3894bb5bd7f888adbbb6007bf5ad356de3455aebba352ec17af9c4dd78456526d08b6410467dc714a4f95dfdc7b235381c17f8def
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xEa:A3k03kHRJARJ
- TLSH T16E259C03E79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 963KB
- SHA256 818ae78706ee9ed399916eb08e53bdb7111767862d8e06d0063dd4fcf667ece0
- MD5 0da5ecb33d37a9315ce24f1b7de3154c
- SHA1 a70a38fb0037f8d2a8dc421f18f589fa9d4adec0
- SHA512 a3df92c4e68a0bc49d052c5b9eb2b936073e95b8fdea3c056564ee5c3d514ff9847bc0651313729629105740977e0fb2637dfca849a715c043573efb0923c40e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xF9:A3k03kHRJARJ9
- TLSH T136259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 963KB
- SHA256 cac4a575c566d985bd839db784b0957e6ef1d9b3a188c2412ac8c44c94304e78
- MD5 d955f39fb3df015d5ef90fd6ae4af124
- SHA1 673972327a2726c61c592d6a9b23d321fc277281
- SHA512 ac6027e09b519b7476a50c1e1ba57edc583938d15886dc838ae11cf3166980d89bcb41e27bee99a80e218fe6dce37bd8450996018d87e69f43f64a499371f95b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xhc:A3k03kHRJARJo
- TLSH T1D9259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 963KB
- SHA256 0e341a3cb1c12f4b252940234e2554dc0f35f1f9c4f9ea9a61408e82e2474ce1
- MD5 6a98318b1a92d0a44c580427b7f95b55
- SHA1 91b7ecbefa8f20561fb9aaecb02513f2c123a3bf
- SHA512 36f311d39c0b125f6c6230e1d258138a894d55b7c17e93c64fc3f481cb3daed4b904e5fa4943fc6fe8745648a488778df6742ddeeca2e2bc014ac6a01f613c19
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xKp:A3k03kHRJARJ+
- TLSH T100259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 963KB
- SHA256 1b2d7b5f3267efac715dd93d01b594c5e20d817b9d2ee12b8771a82ae7ba341d
- MD5 5b15398cac4de4f349a55c0cf76eb9f3
- SHA1 d51a4a2c1c6b64538d5fb0a3f7c896408cf446a6
- SHA512 64c4564824b471945bd11b5c3ff32685ad8bfaf877de81dc83b089b5e33ee88d8f6d6d7733aa7ad7bdc7fbc2bf16ff79845fc6b9cd3daaa734cee48328bda3cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xtN:A3k03kHRJARJx
- TLSH T1C1259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 963KB
- SHA256 b35d2043108d199b0f39de4b6dc442e9b56d111ccbb341477e264de7580eedd7
- MD5 4e09d796bba457858be6c1ee28df61a2
- SHA1 fe8bfe4c4fad9cb8334bd239832a0bdb09899298
- SHA512 284f5dc0f653ac992f607bc519633795053dd825292029608003beb998ea2f0b0fd29083d73e997e3567c63377a3437b4fd7efdc28c5a665b8bb2e8bde69d01b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xfF:A3k03kHRJARJD
- TLSH T154259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 963KB
- SHA256 c52a6c4b9329c78e2fd9eaa5cc5719b662a60f5be9a62b4bbaf7c2f969d13859
- MD5 e55e4b29e24e72899630b824089fa4dc
- SHA1 a101c5c3cd98d386413503bfe5ac77b4e29d621e
- SHA512 57fad127670d6c453f6029c285078d8fa72346534eb67b908870211a5a6ad38f678e7e6474797ce92970985fa7c9745bb2b32c7d2c445293ffa631328aafab04
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xAC:A3k03kHRJARJ/
- TLSH T14A259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 963KB
- SHA256 6f0f609b8647983e4905ed3c7d1b9e07da35844df18779325abd7d58ff1e0299
- MD5 0ce76e83af32e788884a00e4462991ee
- SHA1 8e263028c9aa1a12a2e019b9c4933734cd842ddd
- SHA512 5fe142e200c0d4d6b897d9fcc45b2a2f9b9523a2841f067c8a6698865b0e87e144e8ceb057ecc3edc07da99330eb1c2002dc8dd6ef3624086f8e844d83806191
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xTw:A3k03kHRJARJa
- TLSH T16B259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 963KB
- SHA256 e53a61e4baed4579ddd2f46634d33bc25aef472867e353de20009893c96c39cb
- MD5 3dbf66108bca64d14c42ed09c8336df4
- SHA1 2da86f9a3ea1140dbfed5e497b1c3aed4d3dafed
- SHA512 b8f36a38b94a8876e33c3d7d8e0893de032521517184cea941256936c2bc40616fb31c58b6c2a689ef9f517ea4d7cad03e4b1df4fd4e82a8cec12f26f1b97b6d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xaT:A3k03kHRJARJK
- TLSH T1E0259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 963KB
- SHA256 255267d39a4752aa471901a660a619441150bd5fde4ab1065e9335e872c5a181
- MD5 b4a0c2472d21c1bfed366e50af506ca1
- SHA1 700bb20f327be183dfb5fa53b9a9efff00278bb1
- SHA512 77c93333a39664343c2720b6494745ff261d0e08ba645f1b1d38371f923fabd06af2154c8ddc065d50a00d9c372cf7b647f23da250ff7837ea6c25bb006c829f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11x6u:A3k03kHRJARJF
- TLSH T1C7259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 963KB
- SHA256 049026755dade33b3c0c2d25c32ea8416638ebc9ad75d6e8b57c6233a756cbb4
- MD5 d673390ab7150affecf8d70da91dc44b
- SHA1 151b82439574c98b7db61b0541b86de9b5dc9615
- SHA512 f238e212a3c766adb80d9d55990d2416346cae1013b37a0ca0db2b6b46d5a4f1d42e75a706fb7f6afcb2482d79a2ad8ef3a1e09cc120f8648ccb8d5919ce9092
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xEb:A3k03kHRJARJk
- TLSH T1A5259D13F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 963KB
- SHA256 9071edf3c94096d9008527be9b7b41a54c1d964839793fe1704c921a1c6c7f58
- MD5 03509c160e9eab400106823abe7c13fc
- SHA1 e2a49afc8b1cd9f1db125e3299466c5006cecfc3
- SHA512 de06f70c049963f60cadb2708f24b02221f612959d5f61f41df5b92ae8615096fd7645e1eeb7553c34c2877c18175a223fc58f44db6fbe2197963d0e8e571b85
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xKf:A3k03kHRJARJ0
- TLSH T122259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 963KB
- SHA256 c97cb66b3fd5d6e007c7d94e58c5f18b3491e3251aa9e949a9c28dad372e0b72
- MD5 6247a484a2fd223ea8dee27660ffb6b0
- SHA1 c2151ee4140b550cdac9e93493ea078dae061874
- SHA512 8645fd66cc4143299de102c3cc499cf0decc69e1029ba76143b54c88bc2f8badff668b614ef82546810a1acd547c2df8ff4d55b9e92af4f8fda4e8aec5303dd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xXK:A3k03kHRJARJk
- TLSH T1A3259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 963KB
- SHA256 f6ca1a324c5b1264868d0dfdcb4b786dc3cb9d93c58f3b26425ff52ccfd449ad
- MD5 926a58bcb339914443bddc4222ab6768
- SHA1 c34c68b9d9fad0f88dd8211d226b7913b3c61e12
- SHA512 6008dfff8ee806c81fee652b4c0f0caa48d4fa6ff3f134627b966f09a97735ee89a8a16c435a882cedcf3c04755396066b97efed9f5895ea071a95bca35e96f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xgk:A3k03kHRJARJ9
- TLSH T1E4259D13F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 963KB
- SHA256 b39c27a27e4351b27bd979d414128348a3a08ee5251d2282842ef36ff80a7ce5
- MD5 64f25e8b5c0b5802f0155da2ec6c55e7
- SHA1 ad1263af1fca5158651e0fad8aade237b4903a53
- SHA512 1cd67da2c5eaa73ef21ed03dd6d6ee87c4c51f45065e259c8945ddea235be1f639b3ff240144225598b815fc402d1e32f063387dcdcc4075cc94845aae4ca07e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xR0:A3k03kHRJARJA
- TLSH T1F7259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 963KB
- SHA256 d57f878dfce154975d7b562ce203338175c72d7f7a79a3d568d22baa9233eb61
- MD5 0f04bcf22e451925262d66587aebab2e
- SHA1 14726a23e7e4353e893e4387d2a376aa90c24cbc
- SHA512 0092ec16503c3a8804c2b23ce9d4c1a2bd16006977b62662b0b9180576ae3f58bf5c705467a903ce10011eefdb626e5862bff057a14a22ae7d4804ab937fb930
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xEg:A3k03kHRJARJ1
- TLSH T1F7259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 963KB
- SHA256 5391e62435635c8f9baad683fa5b6e4d5237e10ab1ee5e008cc0ea2adf04ae40
- MD5 b6ff2b5b0bfd15e93a99cfdc5a5383a8
- SHA1 7419ac7ca98f32615b297ebc721471c6278613a4
- SHA512 3f6cf3d7c5b53bd090732256dda0c05db08e87515dd0b55281c516d59a69111c5c7db5aa0c6766a7fd76247d0f26aa8aa9c21302a5e395ce3f377c861999af94
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xhr:A3k03kHRJARJ3
- TLSH T17D259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 963KB
- SHA256 934d5c4b67f4814e5b1d5bd37c38ba653d298ea7ea4e2f806ca213602d2e0b8b
- MD5 ed2b122938c39368dad24bc03e0b9c4c
- SHA1 d6f3b125e7c5073c7fc3e12f0ea8cdec57dcc3a8
- SHA512 9cd5f94b599cdcc1c8152b8f5a010438ae3886fadb2e2cbaf4cb16b2bdd8a2471dc4c72a02c6b9dfd43d46761dd644feecb39ab0fc7ba438d161a94e7f4134b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xjn:A3k03kHRJARJB
- TLSH T1BD259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 963KB
- SHA256 a5c7522bfd4b61a01aa27849011c9c0c7ce65849a183c3c0fac0024efbd5253e
- MD5 24dc22f814e2e5c0669bb5c1fe98ccc5
- SHA1 40c7a52ad2fed5720d9680a03d966b98b899c5ae
- SHA512 d4fd021bbdd4c351979ffa6050a84e1b24e8b2b82eba88fc72ea3f4d7d075203659dd43eb82d3f625ff4b8a63197fcb0dc862a0e4e7e29fbe05d1b8aa7085f79
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11x/x:A3k03kHRJARJv
- TLSH T150259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 963KB
- SHA256 31b58bc477d8fba7b0316935cb6dbeb2940eeee8ab1fe8f182fc48273323428f
- MD5 359fc92a166dd6f47454e3b423c26e20
- SHA1 d02844ce9b1eee52e5b53f693f37987cf3585af5
- SHA512 515f13462445af0e71a8136c9cc2aaaaf689f9890635e21c9a03ba593c1058e1507e19970c5b41ba0b536272b7058cdd1e67d05c59b37d04d851c65771b22ef8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xlA:A3k03kHRJARJw
- TLSH T12A259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 963KB
- SHA256 e2ba258310d9827d370e2ca5f8ccd410fd9d5fe907cc15f0d56ee72d76b30d4a
- MD5 71e4bdb805e2fa96ff7f79e888241866
- SHA1 f80e55f69e980884a7d37615e1b36549771ccbca
- SHA512 d35968c8d179f252f2196068c84c9d10dce2b6fb1855f5de8fe0df321ff10e92f49ee76802ac66e5ff4c51135dbf75d385c792bb21343d31f6bfb9813b608992
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xe9Q:A3k03kHRJARJJ
- TLSH T151259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 963KB
- SHA256 30ef0d1f675bc582408464178d5b2bd04cb2e891a162904ee9473559a244706a
- MD5 535712f2a6ac8456aaf76b07c2e2c866
- SHA1 080be303e8685861fc36d63c0d2e16e69d5b8812
- SHA512 ec115bc2b1bc6218e34634c0741961cf8e2c8c070efe062cc5495a8fdff023bba410cf02563307fe178d4699f5ed54475a0daf3bbd50027c438834b73dac69c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xL4:A3k03kHRJARJe
- TLSH T197259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 963KB
- SHA256 c8dee9a39d3cab2e9c85ac7ecab420e93a5e4a040bd5ecdbf21ae9865d5acea9
- MD5 343a0bad58aca6497ba49831d28bf698
- SHA1 d0e018c1240eace76e8a8c9d0e3ec38db56156e6
- SHA512 bbc1951d9f0e55ad2878228b5d85937f1b7bf3f9368f45ff7a8d790fd6b9eab7d67f068e3fcf43a4ae5697483a92f527a805d113f7c9904c4f75b26308c10818
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xCu:A3k03kHRJARJ/
- TLSH T1E2259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 963KB
- SHA256 4086a2636de562386728bd3ec5cbecd478a507c467455702d087f537658fa3cd
- MD5 97698174c9caf5020d31400519f49aee
- SHA1 2d8250099820db82184364ceccbc55de042aefe5
- SHA512 9ddb3f58425dc598bc971d7406691e2c859016b312c86124e5d35d03aebd2eb408c4812757b63546edec9a5a2c38ec258edba585c640cd1ef48e8ef3b0dcd3da
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xTj:A3k03kHRJARJh
- TLSH T16C259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 963KB
- SHA256 434eb3179db129997cda70bf3fa7dc0ecef9e1b4736c8d54003f643094f0dba0
- MD5 90e11c8580d0918e471930aa1fe436b7
- SHA1 5c113f5696dee19b837eeefef1192f59818b6123
- SHA512 cbb18787d4dfa2373eea6bbc13eb23cff8d46a0bfb1902da9af15441d89c830526262cac34f1ac63f5d37f61316a00354f0778783800fa9f57d52b86482df445
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xeg:A3k03kHRJARJl
- TLSH T174259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 963KB
- SHA256 b7f4604492f6cd74951b1247907b184014df072eaaea6ab781849e7f1e939308
- MD5 a8ddf60a99a8500906f7d3d7370e339e
- SHA1 48ce6a0e7f06648b088fcf7962ca1f26ab720ac2
- SHA512 b5434652ead69e45c726f45dc044bf82f72e5215c4f29e345980da7931f3edad11775b3831a4f8ae2da902e5fe44248d9597b43d42a55314f3a7f796927eb389
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xRI:A3k03kHRJARJM
- TLSH T17E259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 963KB
- SHA256 0b5e9c1082cc776cac15a517b52efbdef36c1ac0d9d78a548686b082f1e3de9f
- MD5 3dcfd2652263a4d99b1800d9237bf9b6
- SHA1 0876d0b967ad54ca8abd2e3ce7efb8750de48c9d
- SHA512 1e2af3d1d81986ad9e530fdd5ef43e2e00326f59e9931d249bfffd5998653c25cd6f7532d51d299f108a67fdbd1b11d16aeaf04e8a3d8ec2edfeec86460e1981
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xTo:A3k03kHRJARJO
- TLSH T16A259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 963KB
- SHA256 8948f8982cc3777f7ad37c451fc08f0374562396ca18296e54e708b4d160ce3b
- MD5 b7b3852ef3a73dfb9d8e6ccc7d4c0d35
- SHA1 3de7ec0e887a2967beecc5c05cafeec1c98da1a2
- SHA512 9461e28a036d160f2f90ad536b94d5a1c03c1f23b7d044b1731488073822dc7f84cd789544fad6975214d52cc5b7164c01bdb00095d3586ceef15603e31235e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xY+:A3k03kHRJARJb
- TLSH T171259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 963KB
- SHA256 8c4ea0d9ca7682fb50b3a6cdc5d76d763a955e1febcae845bf31a9bfef8a40fe
- MD5 61a51f0bc5168f965deb58386847fafb
- SHA1 a791ffabd57b4eb83199466a062ed75627a1e890
- SHA512 a6526b7186e5f5021c183e109c22c12f69de16e029fd013752f147d23ed65cce40252e0bc0355e696be9a9da87f996d4de6c2af84d77409121e8d274a71f0da3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xwQ:A3k03kHRJARJf
- TLSH T12C259D07F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 963KB
- SHA256 4d192195b201c34f705be557ba493dab7474ffa1a53860c02ffaf7bc5cd11e1c
- MD5 c6faab06a0234de38388cc2463cc5483
- SHA1 551dd7c520167af78f00edbc6ab74217248c7025
- SHA512 c1c5d9594b4dd9d7fe31d82a265037185a5fad0ef37e7f2acc964b5a80afeeecf8dd3f92e4b329d5d0db8552482c12a1ca82a94692998c806badf1f495a640ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xZX:A3k03kHRJARJz
- TLSH T152259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 963KB
- SHA256 7be15d2561d9526b646a12c5f8f93fef2c664cef4de9053867b1213cc1b7db8d
- MD5 af71969424081e37a21f33d7297f5bd3
- SHA1 b60f9d832bc2ad3098373054934547d1091c79ba
- SHA512 1f25638659afe7606b6ffde7d7cf8ca56cac649848029d08426590c0ca5ff98f1115c49a02b92bb1d3961e4be8b6674e3bdcf8790ee628945d3995e35ac29a7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xzL:A3k03kHRJARJ9
- TLSH T155259D07F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 963KB
- SHA256 085d7204e391e7ffd2aac212b5d3b950d53d93787825b60fe3e50aa92dc0030f
- MD5 f48fd014e09a2ebd5d5b2d8085c76dfb
- SHA1 8fa18ecb4e62422e991c1a69d9d1ca69c551be25
- SHA512 94115e90ed4f9f4b3638d7a575a5a077cef9b3ca4f6ec7ad6ebff5b0738451fedb312f1fb22e3ae53273732f33fad8ef2cb8bc2e697d811760816849b706e55e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xZM:A3k03kHRJARJE
- TLSH T1DE259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 963KB
- SHA256 4f5ab74b6c6c45d22cae077e66a981b9baf27f9294f5b2524d1d5aa91d62ead2
- MD5 6b17cedad40ac7870b576828490837f4
- SHA1 41abcadb1bb3e64567f4ac1c4f5be51ec305fb67
- SHA512 bc68ba3c39e5087c3a2a4d1935e778a1d10f8d638b8a7aeaaace59d3bfe88171d2a43118c6435e3d9e516866731bfe80e1861d517f6d263cd531c5215f0a0b3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlkDaEpFK11xih:A3k03kHRJARJ+
- TLSH T152259D13F79900E8D14AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH