Analysis
- max time kernel
100s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 19:32
Behavioral task
behavioral1
Sample
2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 886KB
- Sample260809-x9aresvaqb
- SHA256 58005bbdd9b050a0b8e7909ce4b2b375010aa6ebb9d33eab63d1c774616fd552
- MD5 bb52940d511906cced6caf907e5d61cb
- SHA1 3b62bf50d6d80b09cf8d97f825399d3cc4bbed77
- SHA512 756d8752fa5e23472ad29100d647ee537215ea671a00aee0f0cdef916c8efde691bcbc217c770671544d93c29383e0999ce2c0e27bc92eaa43acf1b3475463e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaw:A3k03kHRJT
- TLSH T16D159D13EB9500E9D10AC1749AEA9A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/7112-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000001c81e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/7112-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2856-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c72-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a42-223.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001982f-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bf-437.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3f-517.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-602.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-627.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-718.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-743.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-823.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-976.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-1050.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1168.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1182.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1207.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1366.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1401.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000a00000001c81e-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c72-60.dat aspack_v212_v242 behavioral2/files/0x0005000000018a42-223.dat aspack_v212_v242 behavioral2/files/0x000400000001982f-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198bf-437.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-492.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3f-517.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-602.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-627.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-718.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-743.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-823.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-887.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-926.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-976.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-1007.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-1050.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-1099.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1168.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1182.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1207.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1322.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1335.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1366.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1373.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1380.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1393.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1401.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2856 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 7112 2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2856 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bb52940d511906cced6caf907e5d61cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:7112
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2856
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 886KB
- SHA256 58005bbdd9b050a0b8e7909ce4b2b375010aa6ebb9d33eab63d1c774616fd552
- MD5 bb52940d511906cced6caf907e5d61cb
- SHA1 3b62bf50d6d80b09cf8d97f825399d3cc4bbed77
- SHA512 756d8752fa5e23472ad29100d647ee537215ea671a00aee0f0cdef916c8efde691bcbc217c770671544d93c29383e0999ce2c0e27bc92eaa43acf1b3475463e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaw:A3k03kHRJT
- TLSH T16D159D13EB9500E9D10AC1749AEA9A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 4b312d3ab5fdff0afb8f88cfc450583e3de9ad5323364d88f1ea470557b4df22
- MD5 4a85d3399e87847e7461be6871e960a6
- SHA1 13df54a4abeddc1b51310164b96109faff9b3ae3
- SHA512 9c209ce35ae6c249650971e867a8fafe4a1a578a8d44b5b53d805b1e172387a382126a8c160859fe6742e1116d232229841d62236fe627974987fc3e57383546
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaI0Le5ji0hmxNrM:A3k03kHRJPPji0Aj
- TLSH T1CE658C17F6A402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 901KB
- SHA256 143b3d9066cdc5e19f95b067528959ea4787554e943636bd1315a372afaaf5b0
- MD5 c25712c146f66edeba34c105df3cd49b
- SHA1 7b2e84952dd98e448e3912283e4b53da23e2cbd7
- SHA512 9b6c94108971441ef386f35e23009a616d23fc374d6c4c9856745b4fd91e9d1821c7e1af127126366a73bc20edba9905ae154fafa1e0a82d0dd8d10a4c95442f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaya:A3k03kHRJ
- TLSH T12615AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 934KB
- SHA256 ab9a517687e92c7ed3a77551f6571d0c636246aa81087570d5feda14353dfdec
- MD5 b04356a96b35489d8dd880f07f320cc4
- SHA1 d868c26e7e171dea24c8b46e5068ee42d382b470
- SHA512 4e047374c8e675de2e635cb7c4b9dc89b108de0e8ee49f75d751089647a4e2610d61c542b68a42bfb8c3f332d068b50f628076801b3bf75db92c262718850189
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaRb:A3k03kHRJyb
- TLSH T14815AE13EB9500E9D10AC1749AE68623FB75BD56277093DF2358C2152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 910KB
- SHA256 16f505bd670f6fb544013bad6ff8d5aa4d3ec3622648ce367cddfff38da4f110
- MD5 867233915a4295a8d13ce8c4e9196c5a
- SHA1 deac0ba80533c1a2c984c0eb7d69e7cd236d8fac
- SHA512 9d548dd5d6a913ef25acd5b325fc51002edcb85510ac1d831eea1b693a563eb3799547314144bdf7d6e3480e47ab9838bf1caf74992a7544eacd2100e2171cad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaD6:A3k03kHRJX
- TLSH T12815AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 910KB
- SHA256 08d341aedab511284ca27de9f0752fc23d4a8e143f30de827005f94197926035
- MD5 27fac6af1c7014e6a26278f7a07c5110
- SHA1 b5c6de6db20e343e71066c14d5fbd81a099ae926
- SHA512 5cdafb0bed4000d3a977c13c206244361b0a9fa622716dbe7e8365e4e3ddd678733aa651b833547048c10a5b281e737e3e4a234bc86275d8729f95bf0bbfc7e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSatN:A3k03kHRJq
- TLSH T18B15AE13EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 910KB
- SHA256 b0a298ca38ca3c9415108df09ae30e275b26854a60074b38d06e660353317bde
- MD5 f3e7f5f9efa543104958978193932bae
- SHA1 2d35e4208a0eec0c529f164a4f3a1468073b5b15
- SHA512 eddc56d74feb138ae9bc033099d8b6e0ece5e2d01f50f1eea041f861081996aded70cac45e34cef44183d4e728ceb62ea41cbe7c0e01374c1b41e6df504e3eda
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSabf:A3k03kHRJG
- TLSH T1D015AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 910KB
- SHA256 55ea3f547122d9e6aefdd924cc34b30ccc24b73022df52fd7a3b6f7f5746a53a
- MD5 ed4f6f8da83f5eb3d2a72683a574fd27
- SHA1 8b90ea39cc7c7fcc0f2b68489fe8f678f67f0e90
- SHA512 3a37917ba19370b7e6cd6acb5fa0266a1575eb99f407bb2ccd2951fc0604a56805f1dec2b22aae0f8d2c80c2e3445671709729c470f6a78662d1e2087057e943
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaNo:A3k03kHRJn
- TLSH T11315AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 910KB
- SHA256 dd2f646704ccbb5de48dba8b205ddb7e6043a9d787698c0164208a9ca0ddaf87
- MD5 0ebd36acd044e7c46b0f6e5ab1fd7bb5
- SHA1 e55f8860d1ca4d80c8529ff320bc86fb08668906
- SHA512 ae472b0872b50b1fa5d7b570ee552b354cc34f3f0abd7cf1890ab7a3416ed177ac09eba0a91219040f349908e937ef8f19d4e3b43aaaeb426c8e4869efe6464d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaNu:A3k03kHRJJ
- TLSH T1BF15AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 910KB
- SHA256 0d4b82cb876c57bde28164bb2143f32c347b374b2011ff3d4b8200555600e286
- MD5 57ce46a022cc2bb83015c449f2baed14
- SHA1 bbe1da859abbb20682e046051083f142653350c7
- SHA512 d696306a661dc432cf8d9bcb20e30dfcbbe504d8ff9ee275abc974a7c7cf5250a5bf57a15a5126b0bd96f9215a645add18c308f6c6dbafc6ac73d9ee518011e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaj9:A3k03kHRJk
- TLSH T1F115AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 910KB
- SHA256 00d5c133bdbb53d24833c732b191f86a965977ba3091bf5999c2db11bcede29a
- MD5 d43de73719206d32c011e551c3fabe28
- SHA1 bce2a50e46b28d1a8ea6f972ffe384f22e68b575
- SHA512 11f3d7c93827a7a1e8f4d35f6d0af2a21bb328ffc45a5c4e7c80557b50e7ec9ac9abaa90eed0c93f20e248fd0db429c2e9dd9e5a1bb2bd0f214038a9a2bd232f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaPc:A3k03kHRJN
- TLSH T13715AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 910KB
- SHA256 573918fd82927ef5e78ecef82f5711aa2b7010c1b7528a775ec07a689847a404
- MD5 dcbac1ffb1e58154c1d675bc68577a89
- SHA1 3391172d736e35b587b7152abcd74986ada41939
- SHA512 7607ef31d169e0bc94b2c60a93b5446072c90c7970be3a6aa61f10896703e4b6200e0338b258cce09063f4c0447f61bd8aa1e51bddeedcff12b3cab53e762923
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaIp:A3k03kHRJT
- TLSH T13415AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 910KB
- SHA256 117afb813509fce1c2657d4b8097905a9f0b0a15637b88a0c597b250f2a27541
- MD5 c645ee9de3a1c2ed23f1e3b43a279562
- SHA1 4301fb559ed1581a0b84fe3d463c2754be100545
- SHA512 d1e96b7ac326ddbca42eca50229a46bd0465b0455884a521b80f2cbdf2d9ea791b5dc150b61887f91c8b964d242cdabe97fef9b7e157fd6a64bb1ee0ef434dc7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSafN:A3k03kHRJo
- TLSH T13B15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 910KB
- SHA256 a1818c9ebfdf7f1282acebad707167bafec1de85123b04b783dfb16839cbe192
- MD5 fc59f8fc6da14d7ae02cbf0c66f1c6d1
- SHA1 42de95965b1ccb740c8c982ca576c8d280125311
- SHA512 480e82ced929973ead9ee6cb628cd746995aa5c926b8540ad31202eb0794f6a4b0b93b80ff9b1646c792939b7617963feacc9d6619878241cdfe62eed2cbb46b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSadF:A3k03kHRJ+
- TLSH T18515AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 910KB
- SHA256 e2e09217a58dfc632b769b04e613d9e7a1932b9d0618f9ecdba0e906718f29c0
- MD5 0026aa65d47bcd5285318683e175dba2
- SHA1 b656e8ebceb68b4825752b41e851132fcd76ac79
- SHA512 4877f7108844dd4ce8091b6e8954917582533a4f118b5650aab0e9f03219ccacc104a86dc4ee42dce324d2e2331ed05c403e340f473a89028208932b538b20c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSauC:A3k03kHRJa
- TLSH T1E415AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 910KB
- SHA256 163e47d796f622348cda48c68c5ad2f71198e45a967005272c3eca9ff3e90f47
- MD5 bf1dbfe71ce00ac36bc14682af8eee14
- SHA1 3a32e68270a837d59c9a453e0f78636192fd19da
- SHA512 41208be6b9601914a6f1836cb73b9b78b17311ff335945e37b7cbc8734ede3b108c7e36bc8cb590c2bcb932b27dec008ab4233ea1aef37568f14fbe1322e2cf2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaxw:A3k03kHRJv
- TLSH T1D715AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 910KB
- SHA256 d56fe51c133db3dab3fedc83bdc3f54700ea73514c70544e2b080fb11e3ae4fc
- MD5 0e6cac6eb7f42e4d165c610c98bcebc3
- SHA1 c90a4f09299d1d78dad39c75deabfd554fe2e2ba
- SHA512 264d958f3c4f41fd243b743a93812e53c2eecba63d7934fb89d5633adea171548b4e7aea21ac9bdf66b9b02840a0b760c0701bb99e16981fbddd388f98e4311d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaYT:A3k03kHRJL
- TLSH T18A15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 910KB
- SHA256 7cfeb490aee6fd854ad0da67b5c257c6e2c12bdb638cdc8a25b525da8067143c
- MD5 1a55522c90c4e952a995110d88c006bf
- SHA1 88d68bb19ed7eeff2287833c0d9fb2efa0ac1f07
- SHA512 fd7a1d39e8f65e6368f3b5e760dc8ef81d69479f04177e6d4cff2e5fb752851370d72ac4be8a5c5ebf6e12e4ae0e13f73fb7e27e297c0730d4e451cfea8c4458
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSa0u:A3k03kHRJM
- TLSH T1A015AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 910KB
- SHA256 9b62cbeb03dc5688b25d73abdb0188d31c9b6ad11fe00ef4a4c3c88dfb4f8ea7
- MD5 b96b23ff0e73e9d920e4ff873a6320e0
- SHA1 6a86a9cc153e1d60df0797b6f8d2a83e6eb52860
- SHA512 64ac178d635ee64f3dd1f57bf55ccc65d7376841fd55bf1b95fbdd10e99c9471771474cbf3107ec47f70dcf18c3fd91a83eea8127c478541b79b3223cc1ec5b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaib:A3k03kHRJl
- TLSH T13D15AE13EB9500E9D10AC1749AE69A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 910KB
- SHA256 09dfcb0b693a480f89f368fe9a455f92f5c3853e98828b41367caa328aebf965
- MD5 3d5c8ebd9eeab0fe692387a4021db65b
- SHA1 bc5566f3e32b024515148ef58ed3f4478017ccba
- SHA512 7ef98dff0b8ac890aa2e463161141b313b791f97b8f7b214c4924580f5b38385ccb64d4c023cc95c792de5eb57de0cdc0be51617edfd9fe496b043e0aafe3fd2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSakf:A3k03kHRJl
- TLSH T1BF15AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 910KB
- SHA256 6abe48a9d0abb52d24f8324e4e303145d162cef6b510f49d56fcf28564fb731d
- MD5 7b1fa1bc04537ad2d01a72e63b669e17
- SHA1 71ef7b218cc9d9aad8bd6c925cdf289ff3118561
- SHA512 411f9c55af7c9811a77ea38ed0089180f8c59caea57b14159466cab80b3a71feb25f491baf482ff62edb21f65d47202d053d25cf77ba10c24204301387eb397e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaBK:A3k03kHRJd
- TLSH T1FA15AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 910KB
- SHA256 cf7341c251ffdc66d543339a14b1aab66a764c25a24299010764a6807d4ba786
- MD5 4aec9c685fc97b182d9297e1fb4c55d9
- SHA1 34e2b7ffdd7b030b6015652580ba5704c34be46d
- SHA512 cb56d313504f1ad4dff202e86b39b47bd7ae0d6710958bc336fd24714eb0090a4f7acecc34963e03808ffef6adecd0952a1e6fad763ba11a40e16dc9389dbf17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSa6k:A3k03kHRJ0
- TLSH T12115AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 910KB
- SHA256 c3797bcb18c54ed27a167589b25f9ac541ee2fc65333d0843895bc6db7f8e927
- MD5 c7432326f85dd5ebbae9351703d8a886
- SHA1 fb9b62376838e8e0b9bcefba3eb36b4fb18379b8
- SHA512 a2162d05c10631bb4b763ac36949b26dca72163d9a1ae3728feca7e119c8bf225b79cd891e711f85f45bab2430adddc69f4f97da9198c3c92acbb0c736eb23c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaf0:A3k03kHRJ9
- TLSH T16315AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 910KB
- SHA256 2b339c3de7df9a2fc1d471e23c22c8b053d89bb2e22ee097ac45805820cfdef3
- MD5 26ad9ed56234dc2fcc1a5f0032c58b78
- SHA1 1924226ade1f3b8b038a61b379ae96b8c77cc5a5
- SHA512 cdb3ee7923026d99dccda2cddd3d3c0bde160599bc2a459e337f6dc4bdeddfe0a477e0b4a0ed9fb3bbaeb23703b9f0a38c0b4d677cbc92b0e9384d0bff9c82e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaug:A3k03kHRJM
- TLSH T1C015AE13EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 910KB
- SHA256 cda48b49881126b03fd9f3c284d9f051bea30ae7ae7a719ab64e9e70912eaedd
- MD5 a7d57e6710a6c0a90cfac6ee17a02ac7
- SHA1 9f8e3dd33e346446db5b7b415113c19ede63ffd3
- SHA512 2b98394359bc53781c52c255203e7e17772165e60febcc0193ec3828af22d34b22be8d2a7333634a3a93cba5b86a5110bbe90992abd973587c09d5fbc219ec13
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSa3r:A3k03kHRJe
- TLSH T1D115AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 910KB
- SHA256 f6a178f00988ab2707c66a64c7bc7081012656f1b99820bfdf090d8fce9992f8
- MD5 d85dbbc9e9e7b9ef2db55cd2fbf67d6f
- SHA1 53066595c18fe8996338183b36f076478defd734
- SHA512 437ab7a930757c52a78419f372088ab1aa7f858ce7b80657e91e25498c47d1fd93de18d4ccfdfd199b5900bf8a5fbc60412d6438646bda89c749681f1dd5499a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaBn:A3k03kHRJo
- TLSH T15F15AE13EB9500E9D10AC1749AEA9A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 910KB
- SHA256 5d6b0109d4e83cd1cdb48c36fd9487ab2d67d504d678e13c3df4b273b0c0a65a
- MD5 5b9a6cfe74f40dccb813ba788ef977ae
- SHA1 45ccda57da254d10030a523fa93d844e178db47b
- SHA512 22b6c893046756127770dae4ec724024176dbd83a6dafda4762ca33133d2e53cfea0f0fd28e17e306876674bbe7813e167d458c2b6e56a17b6c83cb270e36198
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSatx:A3k03kHRJ+
- TLSH T16815AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 910KB
- SHA256 b64ff4fe19bef5adbb86a2abd38a85f9816751e7ea4b5cf14c4cdda3d4969063
- MD5 5c7087b6d3fad71803c13022307c1732
- SHA1 815be382dfb085b6d7a5b8d9644ee63e7ec2184e
- SHA512 6c5aeb551d775eb469e64c907f526b63cf71f91c772cfd0f4d8c6ff807c9c06cd980e1c79dc69d809eab1b9cce1aff1799663ead9046a97e4825b1d208f3a1b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSazA:A3k03kHRJ1
- TLSH T15415AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 910KB
- SHA256 c6d33f28d013b5575a6667ff3ca87ff210bc0c4876cf9cd9735e57dda894bb9a
- MD5 7e69791879ee315f41bc06bec41bbaea
- SHA1 514180a3116ac0dd36662126bdde447b6deb2a47
- SHA512 60815bf68f3f35e8ebaae1baaddf7724cbc917af40a31f9b7d4d676b6091af88125c9041bfe238c1ff456d42949dd730e0333f34578c1c83abfe7c2e8510961f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaE9Q:A3k03kHRJ0
- TLSH T1B215AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 910KB
- SHA256 26b4da7ed791c5d8eaec6d120d117b9d3c88dc20442360b0656c13332bf45f96
- MD5 0e585cfe8f5728f942ae83c62060359b
- SHA1 0d4c33d294392a23686c853258fdef99b3077073
- SHA512 362a7b704b2d9ba3309a2c9bfb6b29ab23fdcf39de95605e4db01f151c9a2936a0673c94adc55e6429ce61fc51e8d68b76a5553f3518f96ebaa277799a51d72a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSad4:A3k03kHRJ/
- TLSH T1F415AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 910KB
- SHA256 a4840ce75988596fcc34d0fb5e65292663b094cc0d4447a657ddedac2872fed0
- MD5 21301f4ae448ca6a1a83be529b00b5a8
- SHA1 56e26fe174ec7b6f877f643fe9205ce103b23d7b
- SHA512 8230c410f8fea8d234d512b80fbfdad6e332f88ad4edad3afd4186301a193fc703978fe48b3da0c1542d059ad2f8f47fcc912c0c9138a2c36c9b567c897cf6e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSa4u:A3k03kHRJy
- TLSH T1EE15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 910KB
- SHA256 c421628a210ec7fabcab82960368516523e170a5d923dd1a7875b28e0d375df8
- MD5 69490d92e45dd8974848208f044c6fe6
- SHA1 0025cd73aeaa58796c4d24ef844b44dc809a6eb7
- SHA512 86cb9bfb08ab8ec25cd51160773d4cff6ff9f0d5ea5a3d250045930fe42020647c70f57df800d39cdf0431e851012b3bf5aa076d7d49429cbd226f335e734479
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaZj:A3k03kHRJs
- TLSH T1A315AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 910KB
- SHA256 b605345cfa10bfdbb64e08b5c19c3637948af3ba20d06eb28e0ff1d2e8539e2f
- MD5 97f4b6fed00136e3027b34be26dedad3
- SHA1 8483e7c48485e7b057cbb5cbab83bc371b634812
- SHA512 bd8c32ccb721b14a37ecc9513c8ef8866ef04070511a12877d12db7a248f1236d6cb8e2fb142b4594627cf5e924f55575841ca77e5b97b9231e9a3245238ece4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaAg:A3k03kHRJk
- TLSH T1DC15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 910KB
- SHA256 07f5cdf9b8c4596555332440646d3fdf2b8909d6a323aa6dbbf27a32aff2fde7
- MD5 cf14871a6b9afdb1e5b612dc2417d536
- SHA1 686c598e57c87da86620046764f6c9d00a29ebca
- SHA512 57ebd8ccc8449f7409ff45456892a1da34e7bfd98a48807b5d555387f7cb7b2bdd1c4ce62fcfa57131e1a3df104a5e36ac6c21b0fc386395fde4db8c41803e55
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSavI:A3k03kHRJN
- TLSH T1FC15AE13EB9500E9D10AC1749AEA9A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 910KB
- SHA256 3dae40b73fdb34180c681ef6a7b24c519b0a21d39044d5bdb1d109ceefcfe52d
- MD5 21730c65f21c034d64b2eb7f57b5f8b4
- SHA1 c098afabed2d47c5a1d737c435b2825e7898dc59
- SHA512 7c605377b92e544f7a52c2ef429096141e9075a75fb8667818e65a5222db5984940c4029de56259472dafeac52928c2cb8b7712a3e1953586895958da72cac87
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaVo:A3k03kHRJr
- TLSH T14715AE13EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 910KB
- SHA256 199d9365ec4a74e7a883400bb6675cac6544a7e7be2f2ea990edd2ad802314f7
- MD5 9991489ecf68f4d7fe4a57b0808ab8b0
- SHA1 b7f3bf562438a05c7fd0f9bce28575bbdbdc6b08
- SHA512 afb1c6496c1e8632ce2463d19fc77fe5b24f71639a328d23fddf2fe4be945d63135a5c9d019ee6f7fd8e514daecdf02b71645ac3fbcdad425619431de2fba2f0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaG+:A3k03kHRJu
- TLSH T17F15AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 910KB
- SHA256 770d7cf2a3e9ff043ab5cd8a3f3505f3e80a783b10946ce3d8d7aa218436883d
- MD5 cc2dac95c1eee09ccaace242ee1a4117
- SHA1 1bd0bfd175849ee9fb8524564d3f0bd4203b9721
- SHA512 fd7c8932f825a5b8f221c6039ca0d0179cc54e058f8ef76eef111575c2f42a32f1cd95b46090c1b9b2a72e7df8abe783f23a8c50668971510a69b73978b1c02a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaGQ:A3k03kHRJa
- TLSH T13D15AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 910KB
- SHA256 f00f265f53cb4a33738d563172464c5c26cd53571d59f110980ad49d2738b47e
- MD5 f2c885ae8351b25c76e467d6b957bf00
- SHA1 43570bb9f2e1ae0cfdf21185b4b48d7b6cea8d22
- SHA512 afced3f9c5ffd10236aa3e413844e6315a07453b2555ef4fb2b5a1cef8aa61799d0d07b58825f98f9831da0d84af13d514ccb68cda7db5506c7b354faa119a11
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaXX:A3k03kHRJK
- TLSH T10715AE13EB9504E9D10AC1749AE68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 910KB
- SHA256 384f28ffaa7c57945b1e4878179414bfffe4fbc618b3d828cc712c07e8ef3307
- MD5 5b7e44f4d45408c7e3ad471c835edb01
- SHA1 24021a9b0c9e9689e5e9fe22aaf5f7406021acc8
- SHA512 e6aa678f6a7d5f72b0e1c0945bb8151c1c16eecc75e5a4161824ea1bbba9626817e42c1c9cec448d4367beb22910f7cad6b364617e784d0fcfc84a1cb85dac5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaNL:A3k03kHRJk
- TLSH T11115AE13EB9500E9D10AC1749AE69A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 910KB
- SHA256 083a2ca7a695840309abf68ff3a09dbdee98c3e1f61f9c9da74c951da2057ae1
- MD5 7646931161bc48c26d3b1d26e3075731
- SHA1 a6ec8a712deddeee0aa31532b81f0fa4f4e78b20
- SHA512 f23d77c1b32abf12ee7577ae1bb1fd90821cec8d8f34f8184f1024950f79434bdbca695c471fc511f558cb4ecb1f79dde44c7faae33c761b535f57de64a37a0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaLM:A3k03kHRJl
- TLSH T19915AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 910KB
- SHA256 d3782b940067642976b8cd14604196ea3dcb37a0f5f3225159021ef226556368
- MD5 d477512ebd961c78e6e6413d72660091
- SHA1 4b43fb9cb97139f716461704819148b2ec1cabf3
- SHA512 e01294c937d69636179bcd26acd521947934ab22214964ae8ab177132afc99fbda345ab5ba7593fb770e95052755ff2d52ee13a922f17e7f0615145f3e4c20ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtIcSaMh:A3k03kHRJ/
- TLSH T18215AE13EB9504E9D10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH