Analysis
- max time kernel
112s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 12:34
Behavioral task
behavioral1
Sample
2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 948KB
- Sample260809-pr8xha1thz
- SHA256 6ca26ffbd77da2e872d79987d2a8284260769ee187a85565d16d738858d31e2b
- MD5 644f887683de7dd804c827066ffbe56b
- SHA1 8d23930d2279dcc7dcc95e80fa30f3b5c452e5fb
- SHA512 dec82653318a46542fb5c88f4c7503c8145f72910b742f15d116b0f47e34f711b8e65f3d5dfa5070d375b40da6dfa3ca8c99dd184e0703e399754de9d4195888
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobc:A3k03kHRJH
- TLSH T1F025AE13EB9504E9E10AC1749AD68A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/4576-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b86d-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000016b5e-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4576-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5988-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b316-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-280.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-431.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e7-486.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-511.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-596.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-676.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-725.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-845.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1066.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1095.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1129.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1148.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1371.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000400000001b86d-5.dat aspack_v212_v242 behavioral2/files/0x0006000000016b5e-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b316-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-280.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-431.dat aspack_v212_v242 behavioral2/files/0x00040000000198e7-486.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-511.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-596.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-621.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-676.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-725.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-801.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-845.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-870.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1009.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1066.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1095.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1129.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1148.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1173.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1180.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1187.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1248.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1327.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1346.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1371.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5988 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4576 2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5988 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_644f887683de7dd804c827066ffbe56b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4576
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5988
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 6ca26ffbd77da2e872d79987d2a8284260769ee187a85565d16d738858d31e2b
- MD5 644f887683de7dd804c827066ffbe56b
- SHA1 8d23930d2279dcc7dcc95e80fa30f3b5c452e5fb
- SHA512 dec82653318a46542fb5c88f4c7503c8145f72910b742f15d116b0f47e34f711b8e65f3d5dfa5070d375b40da6dfa3ca8c99dd184e0703e399754de9d4195888
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobc:A3k03kHRJH
- TLSH T1F025AE13EB9504E9E10AC1749AD68A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 a14560359aaf7e986f0da9e7d43dd63858e2aee6c835e3c087e643e075e82b3b
- MD5 f07e92d6bbc941d4f722e0d0cf5e8394
- SHA1 af483715badccf58564cd85e4ad534437612fa60
- SHA512 513a9df7f5f494379f107d2bc21787dec3a13f2279cbd8e600937015179334302f011e5134aac8f00bf382b1e85a49c885c3fe586d77cbf34860c1c54301a41c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobk0Le5ji0hmxNrM:A3k03kHRJDPji0Aj
- TLSH T109658C17F6A402B5D027C1B9C5D69A5AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 963KB
- SHA256 816c5afb5aa6500cdc43c81af382ed2f680e66d9e6822a285cbcae9f56612c3a
- MD5 bce5736a1411d1b364cf5c9bbc535e3c
- SHA1 7606cac2418802c1d65351f47b4cc5dfd47db6db
- SHA512 b5be47191c363f74a73da9fb88f00dc3eed98189ec076c653e7898774c48277cdb45a06bce038365bd9b9c8b49f13c3399bcde6d2282bacc9144e075e607e927
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobOa:A3k03kHRJ
- TLSH T1E825AE13EB9504E9E10AC174AAD54A23EB757C56176093DF2368C2152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 972KB
- SHA256 abb461bef57d50d3c560d249ba53b9067fc481310977148a945addacdf610004
- MD5 dfb2b62a05754fb828c18ff9f8cc9ecd
- SHA1 29d1ccbd290802e5f4f3661d968c3cda308b303b
- SHA512 a994530794ad0109d9663ef79147a8e68ed85eb50af476630cec7413bcc0dfb7de04a205918839a867c586e0a6d29045e2f25dc853f727bb15330be6005833f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoob/9:A3k03kHRJQ
- TLSH T11E25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 972KB
- SHA256 5381dc89a21fbf158f9c17b54515f6811a158ddded5f876fd0dfecf19aae7f4e
- MD5 a0197ffca63c51dedb46ffc51c50f417
- SHA1 c2bcb63424eda8404a66fb2a682813444b29a319
- SHA512 5b2ae48fa3f7913d05898cc0899386be9ebd058f6ac9b4b96d1783698e9e28d7dd93d40c1c23ade395cc10b0a67a15702162db1e09c2329b0780f476c06c7d81
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobbc:A3k03kHRJB
- TLSH T1E525AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 972KB
- SHA256 98008d36006b6dac2eb01ecb549a1608720a92e0438ce939786f36bbb23bcfd3
- MD5 1edfe46142ade6bafba7547ff78fb035
- SHA1 7161f0db1aaee77bf47e60fa25ece61e78c01a9a
- SHA512 d409990551145c3353344f20303c10af8dd4b51e538af54995b2b413b835bb6ac947cc854bd9763352a43a2d0b3b562ddb1e52f5c48cc8fbc7aae77306cb2bbe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobEp:A3k03kHRJ/
- TLSH T1F525AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 972KB
- SHA256 2a7c761e7663eed55aa9bda6514d7213cc43c3ebda49dd7feaa2ea703d2a99e4
- MD5 a91463ce84471c58dea44c8ad955af99
- SHA1 2d8f7bc76577e1dc20d37ae64fa5450880312f1b
- SHA512 6e519b0d893a95763c326957cfa5b98dabcca5ba97b1c844cb9a526799ac7c7567b715e07e49df5d7ee041dd017299d88d701f251d8c5a452f77e6a52e726022
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobLN:A3k03kHRJU
- TLSH T13D25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 972KB
- SHA256 8995b3e41057c7ecb749f0776b1584c57f92d133f6b3f877ce6c58c21406d529
- MD5 69c1f0270e1882d0cefabcb8bd7772a1
- SHA1 4ebb1e4d50f8130ba0a95947b799d38241615645
- SHA512 1659555042d1f9443a5dc1fae432331c3be07c0831d351aaf28ac8e3151daf363d7960832aef52323789ceeb415c9602311afc574bee47223c04078fc2ddf8e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobZF:A3k03kHRJC
- TLSH T15825AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 972KB
- SHA256 bf6344ad5f9aa06ec73743e31c1aa890cd19b59d0d3da7d4aea10b6eff382bbf
- MD5 78ec5491f2ec3ead7320ec3c95dd263c
- SHA1 70675d9806997651d11396a455e5dacbe361d5bb
- SHA512 5e4a0df97c0fc6b51029036ec7c3daa47bf833780089382a728f4d24003ab585ca140c6af0b216311a3273c89819f9ea54685388e64d28763c58a18b8a7b96cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobyC:A3k03kHRJW
- TLSH T1B025AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 972KB
- SHA256 33fc08e0335040f5bdbd4479511d07e218ebafd388fa6d6e892b780cdb8beea0
- MD5 326d605157cc1bc6cb7fe7d61a36d9b8
- SHA1 f9be5cea7834c4053a5550582474377f2079fb88
- SHA512 77e1256485ab1681a86e66252995952b444d0b4af6cc1538965499343bd8e8e5d8eb303cdb558ae6cf7dd1914381f672b7b96b0cf715dbb367485657333fbfd3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobtw:A3k03kHRJD
- TLSH T13F25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 972KB
- SHA256 dfeb1cd67973e9945ade66c38ae22afc1714313cfaf687468de342eb2dafdc0e
- MD5 134a24f96ed8a9d72d27ed1b38cc98f9
- SHA1 f15fe3ca861fcfa488692eba49c8095e12736aef
- SHA512 c99f9a8cf08bb44c654b0663ad9ec12f84d117d2112d95415b5adf6579b1dfe4f0c2eb63f9b9b3cb52d87eaaa2f496b1978742b7c193c47d8535739a41bb3e7c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobcT:A3k03kHRJP
- TLSH T13425AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 972KB
- SHA256 767b55e188bb7ec383d64049fe02576f01d167cc9dd698e0ff9e68ec46019ee5
- MD5 747242eb082562d8ed3a415acf416967
- SHA1 0408cf81b89c1ef97efe8295da1e06c28d672afc
- SHA512 f97791e486adb6ff6500f324444fac76d41aad84a6d82e086c3f81aa1dea42db6bff7bce74864b3abce72ae35a26a8de4f2da8220b54d6b6373219267d9cada8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobwu:A3k03kHRJg
- TLSH T14B25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 972KB
- SHA256 6309d8655fa76b7ba3e7ce5b3da8b1a154f71f6c97487c25fc91f7bcb5885c51
- MD5 83a6e39cffda57ee039db30f8b6ba176
- SHA1 18e29c625b702f3c770208a893d35d2e5792ea84
- SHA512 821f0506dd80b9f03c3466c0e0ed521885d4982041e21637e8a015aa66ee7fc206377cac84c6d746ef4bf3c9ca0ac812da2bfd8a53ed3f5789bc63f4ab8a8d78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobOb:A3k03kHRJZ
- TLSH T12925AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 972KB
- SHA256 29ab6c796339dd28d6b92c5e7658a424900d9a0360c0775ffe2eb04ddcd031cd
- MD5 cd2b61c857c6bb0f13f505cc38b83387
- SHA1 bc0e80ce8ca126e07f477e1d2647c1fc690141da
- SHA512 587a702fe8bdbb8f974ce6b41edc0820c5a99c2c85b36ae1e0b035974fb5ffc8fda8577b2fd7f17509675eb4633ae1a49d2eb2be1297e10fb40aae043a2e759e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoob4f:A3k03kHRJp
- TLSH T12325AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 972KB
- SHA256 8e2e4e3c30c21189f1a52dd5e67bad43610b765209fd2e6c81e760f631efb300
- MD5 fe7c8ac8e1b1e8bc2f37560d442c5696
- SHA1 0362a1d8ade6dfc168696f75985ab93eed2f6cea
- SHA512 2dcdeeb545733dc5e158ae9099d8f17ba88c5351fd09705ba3e2a09966f24450aeb751b946d01bbc0b94165e9c857342056538fddefa6d448e9f60eff4fee261
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoob1K:A3k03kHRJB
- TLSH T1EB25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 972KB
- SHA256 20e7956ad22a54932c4de2c49881c8e12ddbb168b9e03088b303b13a5977f89c
- MD5 23b59737b6331e87bd7d8136c2e56498
- SHA1 549a8b654fd83a03c5a408e0cd29bf547347e8ca
- SHA512 2b89618616d16cec8e6cc80113f44aa58d05029911964b11b3c61e94e63fa99c3d195cdc86b4b4ec4f899b3dd228a9f73d076238df1a1d00ef32d4a56c24a194
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoob2k:A3k03kHRJo
- TLSH T15525AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 972KB
- SHA256 b7be3ce183d6adb16314f051217db297a0673bebc0d843259da20187fd27f642
- MD5 5ea30b9c31edde17c210085408334df6
- SHA1 f2a46e1bb4b26e81a83440323cc1440ed724907f
- SHA512 e939dc5251a4ba4c725a6f371ca56925bc22dbfc10376e33898bed3d8b2134e564a187481dfc49971b3cd01ff9d4f8c7bb6ad04d631e543c1d7ad811906b8763
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobT0:A3k03kHRJB
- TLSH T1B425AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 972KB
- SHA256 0707940fb31bc71279971a6411c65b01a3e28514ccecbf656f9a5e4cbacce605
- MD5 3775950f5fdbf56976ace2562dc90098
- SHA1 3cd875d86e33124019e3026a163953b9dc34802f
- SHA512 a0424fbe27a400a4dc1374db00f75c5bb8fee523d835af80f6170a4b01c52fc0ac2e6e0b207b49244174594388e68be720de63ef8dcaede93e62c94fe7b1317e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobig:A3k03kHRJA
- TLSH T1E525AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 972KB
- SHA256 f50b80ea096660f441b82cc41b5ea04ae9ef89fe1ece564386d1ec5bd8bb1b67
- MD5 9d0bd2c0a7c621a887c9e4f3fbc7f5d3
- SHA1 7240b28ecefb73fe8e5941da9c4e05bcc0a0551d
- SHA512 5f9a3864a6ec8f1d68495d0da535fd7ff71c6bf9b4cac55e4ab1e94d0c3435786504652dba2281302f3008a7675bd3cd0568a53aacc4abbf93f5db84e2b89eab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobDr:A3k03kHRJK
- TLSH T1D025AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 972KB
- SHA256 5d3ade8dd8f9c90206eeab09e6ad26233064435b47e349ffade49a9d3d70e919
- MD5 a01a6341389a8aa252064fd8cc310230
- SHA1 c13d610abb1e6d3b4895ea3cada5af6fbd36afa4
- SHA512 deb6e4d0b41c0630cd57cc946d1a3a537aed54e2f0e0a1f9020e623d8dfa43d95e731b3058b38c6dabff0c6f9ad2ec2a5275a7e74e128255cfb22c347a86786a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobln:A3k03kHRJM
- TLSH T1C225AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 972KB
- SHA256 5c511ac4fa9b416da86d54215587a5affbbce36532fb48b3e8dab665f6936457
- MD5 2beb29e7f5c893746c35122ee81001db
- SHA1 a020a01f49857f807415e127b53a8d53515f5fb3
- SHA512 f14e5bea737e9143ad453e29d4ade798db1ab6019959a8eb7d1d97ba5b7425708f7ada2bf135289f3661478413c6a5e368dbc56ca395c8cc5ecd4da9870d0aea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobRx:A3k03kHRJa
- TLSH T12125AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 972KB
- SHA256 4da45615d95f50808d85c78855984c59c49fe17d7be0f747cf16ec8798d230da
- MD5 0d7769fcf407158341343757b2f50f99
- SHA1 9cc7395717495f1d92315cefed57d1c3a6fa660f
- SHA512 17c1750f19fb3aa763cccc65ba5364ccf6bd0e7b4842c7a23edcc4774a4c4c29e472d36c1d40f1136715a1c68b2f6ac77c752dc3fa89711cd9d062d86216f3db
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoob/A:A3k03kHRJZ
- TLSH T1F525AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 972KB
- SHA256 2922d7dfdd1fa23a9d8f640b69bfd94b07bda3038ae8f0e545a215851e324591
- MD5 aa6c82529145d032c69497d6a7e204fa
- SHA1 35ccecb2b0e0c32689b6fd0267efd8a8a614dcf6
- SHA512 a997b3e82d69e99d31fb6974b93e9d2f4a9b0a6694553eb23e7592e30bedaeb0dc9e750594a8fb944430277558d36b3804f50ad781a5e7bf523b044af63090b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobQ9Q:A3k03kHRJA
- TLSH T19925AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 972KB
- SHA256 fa1f41df804b5671e12c4f8d99e437520884b032244b9fd4b2be5d5a9d6ebc4f
- MD5 7ed62b8dd9cc55a44fb7abf2c19f5f84
- SHA1 f471033dfef462510ba19bd3cd75d78affe12a54
- SHA512 be93503eb3ff5c54c3e7cadd722df4a1084d37c3663e2abf925eb4eea77a5878a330a27e9bafd1bde6ea45fd01d98cada0bc74e1e7f44fca4e2d559b21b78e62
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobx4:A3k03kHRJb
- TLSH T19925AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 972KB
- SHA256 d9a95f00505d0eb9866afae962488fa5cb2ada86eed0ad07a9664c0262400399
- MD5 c87e540edc1f95f04e5c9193f0023a8e
- SHA1 d7f5a4c032a04ff11392b9ae51dd496b87a0b463
- SHA512 0e698e099907dfa29d07f2ffded9e626db55b9e698fae69d8e3a1a06db4071ad42a106131d8a45d15aebd15112fe1579988da5bdbeb99bc26d9c5ee8355fba2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoob0u:A3k03kHRJO
- TLSH T12925AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 972KB
- SHA256 7d9ef0d38cb8f8e9278f796210696bfdbce7af96adf361be874925af152e50e1
- MD5 622b643cb0e016107f861afb5e9ab8ae
- SHA1 2dee8b85066c3404d0676f4b2f656a4e0131f6d3
- SHA512 09b514e5fb03ec10ff76d40cc327a22c6782f719a9ca05891cf6f233c43509cfc1d69533a83dc8ca6f624c02788baf8a064e7dccaa67dfa46c5e73837af18dc5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobFj:A3k03kHRJg
- TLSH T17E25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 972KB
- SHA256 decef5562a584fc78a468994d9b2e5d641ea2993dbd9563b450ae2eb65daaaec
- MD5 7af512709ae30e8cd05f3616a98e6391
- SHA1 722f5ff2dd88f97c79dedb2c29144a59a7b29486
- SHA512 dabaf608a2d6260e83d942e163316dc0d15d17366e0c1ee50c56a9ccf2e83740ac8d7f9214c3cf4ea35a7b7a00cc8c27e256100717ac9f75a79bda98853d9e8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobMg:A3k03kHRJ4
- TLSH T14825AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 972KB
- SHA256 78e3b9025371809634863d604d28277a9414612e1824d4eab3106250e5a30027
- MD5 1b2ae114eb43ccab3a58a8f639028bb9
- SHA1 b06c1c46118ebc11104630be65a57af618d1b6f7
- SHA512 76c09b9bace8ddc796d9e2e0150400578d2260e9d7c1f53618c094712d72a4014d42e213e20b10253f7dd837c8578d871b2100728fef0bb8ea17bdf32dae603a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobTI:A3k03kHRJJ
- TLSH T17425AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 972KB
- SHA256 7ac286960efda52c857bd171a00d84ece2b95f54636d3e4ac9303bb388c37091
- MD5 20c1300ac63c6278693fa76cec16767e
- SHA1 16a5176d96acf1bcd1677c96d70d55c5cae35ce5
- SHA512 59e8fc0b6bed5f01d3b5d36170e8354dabcc50e7baf4b65034ecaa2feeb0db3ed05689e7d1203171f8a00db6668fc9582cadb1e9d50a9194c620215dce00afe7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobpo:A3k03kHRJ3
- TLSH T18C25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 972KB
- SHA256 0ffc058ced2b07a24bb804a38a28358fbf1b7105546613c242f0f9f47ed6d562
- MD5 21d2015a9f45e61d604de24a8aa1a3d3
- SHA1 193c1ecd10f811b9a9d3c6266fd1ae9d9caa5849
- SHA512 1f209b1f7ca8be25ba46a3cfd6d82b2d82cc39cc0693a93c477b007a2bbba8740c0bf36245f3643b3ff9e59216beff81ec4004c15d78c8e881b9017b61d79aa9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVooba+:A3k03kHRJC
- TLSH T16425AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 972KB
- SHA256 37e8cc6cdf556458416468e03265e4fad2eabd5ed11896e76577adc73a2182ca
- MD5 a6792325601956ef91b18299e60cf188
- SHA1 23dfa18d5308a51da8d460f485d062127754b425
- SHA512 87ca581c6a705c224f3871b0491d53240fadde628f5fb19bf8e91b93ef540e47e640236ef67dec49911db1d745d3041ae53eec162ad4983e99885abb9d9fd326
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobaQ:A3k03kHRJ2
- TLSH T1AD25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 972KB
- SHA256 a7ccc07032fe8dbf6f62e4f54ae61b5c475596d7efc7602beadb60505e0b9d02
- MD5 d0a95f4acc06229849073b0091ac7e9c
- SHA1 205b80087a5641c94acb898a4f0c72f78a737323
- SHA512 2d1aca21fedaf1d501ccb7200ed03261bd120ac1f8f5a5580d1372544460e13e1d3a380d3129531c65bc66756b7383d9e7d955f0e77cdcd01adffbb9b693978e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobrX:A3k03kHRJ2
- TLSH T1DB25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 972KB
- SHA256 c137b712366fb2a7df86bf8981e53c67940c60ad5de8a5f4f04114256f3964a1
- MD5 18bd035ecdfbd8f913bd0d6d2fc41928
- SHA1 42aefe7dd75538cf979b417011603dbbf98be0fd
- SHA512 c5b6b2eee9d5271bc8d3d78fda07dd2b7e83d1e4792ac6deb45225584557907e1f8c7c788b2aefae553a2b3c0b48124c0fb89e7cb73a8ea9a5e7bf0f6ddb4cf2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoob5L:A3k03kHRJ4
- TLSH T1CB25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 972KB
- SHA256 d307f8bccba1da48ac4fc66f261e3c6063d9636ff3c521b4382f371305391dbb
- MD5 60ea81d31d6ead12b3c4d47ff2877515
- SHA1 ed73a1c0bb49a7a22d7f025769da2f26a6ee8e7d
- SHA512 80e959b0356dfbfcc67f0e67372c10814b8a4be38fe50edb148cf62afb906a13c5ae321669b9435d79eadcdfe7205d5d15fcd078e5a278cf96fa4f8cc7c00867
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobnM:A3k03kHRJZ
- TLSH T14E25AF13EB9504E9E10AC174AAD58A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 972KB
- SHA256 04cd1325962934e2eec7a935942a7fd606a218ef2fa26daea9f1d5dc6b87620a
- MD5 ff3175ed2b27879c982fda2aa1f27c83
- SHA1 35c60c8dcc9b5f976bb7ecf0b60f1975b941e22a
- SHA512 41f010114afdccfe7777019bccd798299968c5337f9c8b74e5eba871fa8414ad70a46823afba3b2ed08b65c99be18667a7227667f01b9ef3412942373ec99aa4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiKwtVoobQh:A3k03kHRJL
- TLSH T11525AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH