Analysis
- max time kernel
115s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 04:24
Behavioral task
behavioral1
Sample
2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 950KB
- Sample260810-e1w9ysvyey
- SHA256 ab321e48ea33b2f2e90102bd084ee1879c2527e2e7b746783104733243b7704f
- MD5 8fb0467c57eb7afea24bd16775303c4a
- SHA1 47cd43fdd24f6ed7bf6079dc220b736af31e7dcb
- SHA512 8fba0def13a3303cb5cfd41871bde3ba91c028ea516290b2f728c5f2e84f608ada6b109c50ed4fbe6d9b9fff5281da7391bdcb1da34896e7e27089a7510d20d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizO:A3k03kB56r4
- TLSH T1F0257B03E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/5816-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c511-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5816-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3336-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019849-225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-256.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-305.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-444.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a59-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-524.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-603.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-709.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-765.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-803.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-956.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-987.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1086.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1155.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1213.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1311.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1336.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1349.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1374.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1395.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c511-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x0004000000019849-225.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-256.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-305.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-444.dat aspack_v212_v242 behavioral2/files/0x0013000000018a59-493.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-524.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-603.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-629.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-709.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-765.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-803.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-910.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-956.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-987.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1018.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1086.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1099.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1155.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1187.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1213.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1311.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1336.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1349.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1374.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1381.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1388.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1395.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3336 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 16 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5816 2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3336 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8fb0467c57eb7afea24bd16775303c4a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5816
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3336
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 950KB
- SHA256 ab321e48ea33b2f2e90102bd084ee1879c2527e2e7b746783104733243b7704f
- MD5 8fb0467c57eb7afea24bd16775303c4a
- SHA1 47cd43fdd24f6ed7bf6079dc220b736af31e7dcb
- SHA512 8fba0def13a3303cb5cfd41871bde3ba91c028ea516290b2f728c5f2e84f608ada6b109c50ed4fbe6d9b9fff5281da7391bdcb1da34896e7e27089a7510d20d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizO:A3k03kB56r4
- TLSH T1F0257B03E6940FA5D10F81749A964662EA777C025F2093DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 45a43baa197825cda40c718727c1591443efa59e6d9cc49feb6aaa7f34a753d2
- MD5 a6438b5230a5e490ddc18522c7b07bb8
- SHA1 e85eb7b1ca6dbdc9ceeb79cd9b8c095e65b46562
- SHA512 c5869e2dba7aa4e0f330f1fad9bb8b7ff7e75e9cc075eb054e478cacb0ad3c2d867a49a71ca8542b3a5a44130bc828aa3544a8f01efa96b26e1c1bbe1b58ee07
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizD0Le5ji0hmxNrM:A3k03kB56rNPji0Aj
- TLSH T1F9655A16F6A44BA5D02BC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 974KB
- SHA256 48448e0b07eeba0a1292577db94e9f81cc6fa97d8da766f0736b216df6f3689c
- MD5 e0ab069bd17c5650c2523bbe6478bb1e
- SHA1 24c27294039f93e119dee476b8135fab3ea2808e
- SHA512 0ed223f8036f662052938ec81643b9192007b2a9ffb6ada99a3d1a485a0ad27a2fb476de75b4e66f7533ad1491564bac98e9c1b7299c4e0c5ff27eb5d49088a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizs6:A3k03kB56rp
- TLSH T1C7257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 974KB
- SHA256 44bee702b6e3fd76c48aa915c929afe2a5458a7d0ac2e14553b61442af287dca
- MD5 bb3b900238391d7f28a239865fe752fd
- SHA1 ea867bc47f69f4605ed287b2ed5e007076a39d61
- SHA512 85fc1ce552360c7fe382c2ad302e8d6e25bb9749323160c1297608ccfe9151713e82cdb091967b271751b3a5bef8fad02fd4519e0b96a3a1780d436bf832e6dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizIN:A3k03kB56rQ
- TLSH T1CD257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 974KB
- SHA256 31c659d1d8e98766cc8fca6d960889cce06044ce7ed48388139f337826257779
- MD5 28e2021b54905de5e6dda9ac88a29827
- SHA1 42024c6839e9909ed61396764ecfc048e933f4ba
- SHA512 5a2279a0d05ed47b8fac891e752f17ec7f2e36ca2504fd95f09931f019df114097db6f1ca4781da6d03d5506e88c5856000983536d7dad2431ecf055b95dac04
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizGf:A3k03kB56rI
- TLSH T141257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 974KB
- SHA256 30af81b82fd137643784897f358a3b5d3ca4fe515934264275c2021928af5c4a
- MD5 95218f00423d4af566261ce5c04aa4d8
- SHA1 3caa675d47265e99711624bda60811d68bfbf442
- SHA512 4823a944f28853a4327f1d3982cedd067e9b99729966947494c09d6654cb6a080062ed7efc519d3bdaf446dcf5591718c27ca5ee4237444abcee2670594c9438
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizwo:A3k03kB56r1
- TLSH T10C257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 974KB
- SHA256 47c83dc645416d452366a5f78860ac1d039464f8a3daed431ef6e874ce920b6c
- MD5 1cc41348c78a214500959df3b896b09c
- SHA1 6b9279f57941b3ee6835a333c1f3080cc4c50cf4
- SHA512 545574d587ff49293f008f7fd232ab559b45638469f1b5b40d13bb9130005b4fdfc2ca5dd7284e73046011ddc2de62e88f51c039a7bb8de8ce6ffb6842840cb4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizAu:A3k03kB56r3
- TLSH T1B6257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 974KB
- SHA256 e08862f00373f0d9746e0c8d8372ebf20e7b2aac303d585bf089250fdf198f20
- MD5 c63048482797b45e571670ca1b065471
- SHA1 159cea1d6994ca6bb63c5f2cdab0919941fc5988
- SHA512 4e3add098ec42e4066c13b26a32c489b3591d8f7b3840537910e22d0f13599ed257ce82e45bb011700e4978f39e8e13d1e1de43fd6d87fc4467f4009bc4a5b09
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEiz09:A3k03kB56rW
- TLSH T118257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 974KB
- SHA256 576cea4c4c3131077d25b7e9cc85087a42ad63e0cd48fd7613594e5bbe95dc38
- MD5 715eae0f2a67c526d1ed8f7d914f480f
- SHA1 de15b3d7befca8bfd289648231dd3cf91d7b8112
- SHA512 39959b0cb48ec1aa51898cc6b2c246b4c2cc6455d001f889807c275df8401a8b7c6c237a556e57cad48d1ba92ba47d1ed0b18fd34043a114f52186d5a99cfff4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEiz8c:A3k03kB56r7
- TLSH T14D257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 974KB
- SHA256 eda576f8b360d0feaab84655561a420de959c06d2c71b5fc5eb3395fe8ea5371
- MD5 aa7524de6a0417bff2c5d49eec6caacd
- SHA1 2e99cd84f6aa6eb3a0ead64ce8d838cf805aba7f
- SHA512 71334ee99f19850b9e1129cf67ef4e06bf8ada8654d3cca6b02b54b346720c2ade0fdad47c1148eafe35aada2dc580469002a0cde8d7652714155c8ceb865c51
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizlp:A3k03kB56r5
- TLSH T18F257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 974KB
- SHA256 6857815dbf94a6daba99463981edad652a5b12e21d67d2f966cfbebd7dca1b23
- MD5 204805719794fe5c0f295a12fd7d0cd8
- SHA1 f8b02160467fa5aa91e63da20443953b48c49b60
- SHA512 bd290ce62773312b4b4d67f710684551896921006dfdf8b872652502afd81ab8c92cc7e093a5dd201bdf426dc15eddb26d7877d409724b5c338ca99578b5b95a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizaN:A3k03kB56ri
- TLSH T15C257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 974KB
- SHA256 89063787f4a8e10ba6b7d34107113c6be580aac66fbb360d868b95275de6016f
- MD5 e0a5ab881ac891f22d401f441eea14f5
- SHA1 c0e585d5bedd36999fc257651c293944dca59d0f
- SHA512 14670abaefc374585f8d3bf011e3a91fe0c3e407b6ba26e320ae7bf0870713b1a4187d835ad2e7d5fa7ec4cab1011fdbd5488d0e259289833316a884cd6468cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizeF:A3k03kB56rI
- TLSH T1B9257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 974KB
- SHA256 ac5fe60991d1de1ae4cbacf3f3317a6b1c44887db48b49a4eafc2f6a403355d7
- MD5 45c55cc29462fa1a84d5995313a99bfd
- SHA1 b93f7a180234ab8716fe6faf5681a9269d5c7e9b
- SHA512 09e2f8737e77cb85210b44118bde5a37f82e34762fd3c29bf7d4a2690752e02a1413b7e50854d8130b5ca3b234c3a61dd340a3841832de865ddf1016c04672c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizbC:A3k03kB56rc
- TLSH T18F257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 974KB
- SHA256 1099792bcd12578f59dc594bec73d09d178e3029cb739f0030a34e17e5f6c68e
- MD5 eaaee80c4b656899c3b12d91138593a5
- SHA1 7e0b40df3d99384f16f14e146d18fd1ec2937e35
- SHA512 ec2736c4468ce78e79818e25b9d0d1aee09828ba5d44638c2ab24b51f1cb72f2df5694f7027d8ba78d76d333be765605589817bcfa9aa9e5d8eb56f85d73a9ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizkw:A3k03kB56rR
- TLSH T12E257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 974KB
- SHA256 2a7294135c948f50b4620edba60a59b15caaa28c1528935bdbaee5667434fd3d
- MD5 c46ec4de83764028e49cece1c262bc19
- SHA1 746a33f19da7ecb36ffe34b46e0b817315454b02
- SHA512 da4e26baa23c31df142e947b4d3708369684dc34c9529cf6014303e04766c7bca61dbd8c55e0fafca941de5d1997de02bad256bbf087bd993a3bfcc2cb681104
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEiz7T:A3k03kB56rF
- TLSH T1C9257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 974KB
- SHA256 afb8800fc7d99c997fa176a0ff68507802eb33ad1cf8effedb213e69c7f20822
- MD5 31cb7a8862e38f25bcb7b0b96c550e5b
- SHA1 04f17e63801368b1b172324709564c86814c58f3
- SHA512 55d839905b9dc85d181a192ed4d0fe6797ced269878ec259ff6d1ef3c2128378b9700ebcbcaa1cdc729ab0fb162272f7c52e81fda8f11910c370398847dc9755
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizdu:A3k03kB56r6
- TLSH T13C257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 974KB
- SHA256 13cd173f3958faf32f0264e1f97dcf999a294f122f6e359ecded387f9292f990
- MD5 6493b34905bd40c60f763b7bb06171b7
- SHA1 bd811bddcc1054d776deaa44af3c330bf4eb6f02
- SHA512 6c5bcf251b6b1195ee7b65284433ae4169179ef3e2bf2c79d8865bd9276bee62fbbb453b37d8e4648acc03320412c4d46cf4ef69118ca3a4b609e0dd09b0f71b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEiz1b:A3k03kB56rb
- TLSH T1B4257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 974KB
- SHA256 4804f4c5a33f56745d69c61f872bffe776b14f61693503d73f4760db34215210
- MD5 da1169c3235cbae753a6cebad25d354b
- SHA1 cbf0e27bbe878daae93ba0b1ce363fa880a4764f
- SHA512 b358a0eb5c92ebff6bffce9398a50f175d6e66700c645a69f79042232ee585ea6bde1aff0a26ec1364563b51eb5e410dd4c7a8dac851352970bdd8867b4b6a31
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizlf:A3k03kB56rj
- TLSH T16E257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 974KB
- SHA256 7337026017f4ebca1797645578387ad03e2f05546b8b9d9e8eda39122c502554
- MD5 a5023671457df885f9a9d3407aef5235
- SHA1 63356f7074ba0a4f2461b414297ac2e9f33227db
- SHA512 945c3af4c8f8170bffae045bc638f25ab6f862a4fe2f47ada7de83a5f8f857ed6f85ca47fe7b22d687bde333e137ee484fd3dbb888e536fdaf716b8635b5f340
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizuK:A3k03kB56rT
- TLSH T190257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 974KB
- SHA256 00a63bebe6e1eefbd8ab5bb279b4ff254a37f0b2fae620920eb65ed830d21138
- MD5 905eb9bd530515c67dccd8246ea3305e
- SHA1 0c678bc5beaf743b1c4230c5f7d48f386dba1bd3
- SHA512 3123b446da06175e7507b8e24074476f936af9bdae5a1aee6417bd8c4052410b1fc8e81df47d5f13bf8e6f9c1c6ae422639aa494f984166efe9f8ca8921f361b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizLk:A3k03kB56r+
- TLSH T1EA257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 974KB
- SHA256 ad8b6f8e815af7dc3ff75caca20379de1fadf470d53bf65781f571fec6260bbd
- MD5 1d911ae45d6b9bf9c1d56abbb5726fb9
- SHA1 cf08d3224b9ba184fc78d8cb5e4c977d1496a2dd
- SHA512 61f5cf57ef042a010d42ab1a095b2aa47a4cb221574e0961459addf76dad4f0937e611cb6380fcae4bafb6056c5530a86437348e4944ad66228ca802a5aaf82d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizM0:A3k03kB56rj
- TLSH T170257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 974KB
- SHA256 2594b76da4ec20e2a5578f373eeb0887a57753f24fe109f7e0fece93a8f9b678
- MD5 d4404b6522f11d1ec12b4259478ac4f8
- SHA1 a41ac6fb88a680e4abdfc0131c39637ef08f8195
- SHA512 4d163d23e9918a42df63f3c5ffdbb8812b6f98ae6f276cad2e3ed0b474225ec7f7105bf68feba2aed8bd05e36d2505c1833cb1a47529bf9792945a56423bb563
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizHg:A3k03kB56rG
- TLSH T127257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 974KB
- SHA256 ed58a98b02d8760fd45cb5bfa2fa20951a6f86937bce544a8d869d24936277a8
- MD5 307a73856b292507f5e9022c043ac492
- SHA1 d5d29da44daa085077d2d2f7fa1a441e1eff1d3d
- SHA512 ac190e25faee4bac9e42ab432c8191a538ce58a6a3a35a85bd5247c6f64b116901e5266e31aca5cf1c6adda95c51fa85f7dc903c423e8ac9f21285188d6bb7d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizar:A3k03kB56rI
- TLSH T1C9257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 974KB
- SHA256 5f8feabc0e3d16bc8fd042e2ab962d906f379d8c43a2d483d2ec3da59ad05bbb
- MD5 6606f5b617b63a32180a73fd4330e400
- SHA1 9dfb9c89bdcf0d35def033319b74590f8411d23b
- SHA512 b1befb038cc8f1b5a23533dedb399f464f68322c3206dea650bf45eebdecd064d757f4c7087e5d8d8188e128c67fb4c927599c05de3be6bdfe9fecde7350cf38
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizYn:A3k03kB56rq
- TLSH T13B257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 974KB
- SHA256 aefd6d0be57812409df06290f144b14437615505028cccf5cae3fb6fa074aef9
- MD5 09f06b10827308c1cd18b2be38a77a56
- SHA1 a9b6488793f8e3a3b64413d85427d74fcfa9b1a2
- SHA512 c2499c8cf8e413c0684af387423930bbd7613648d9a1c20c99f429e41ad1c15aaf3af5f32b0c8f37f078ca0364c3d287ac9c0aa340e1e14834a2f20af643216a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizGx:A3k03kB56rI
- TLSH T109257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 974KB
- SHA256 9e02684d2a12581398d8c208156c89b9a4fed5b36aafb52c3b235b7c33564eb1
- MD5 98ff68549b554465e202fd764c6726a0
- SHA1 a8117bc7f27f96540efb36f5d7f9956182999fdc
- SHA512 e01cb0ef633a7961728ea834057df272329ae59f49b332abe95bf12736e5cf07a4ba3131741117aaa1316bd44dd438c8f4631c6b65159fa5ee58f8c95e48e6ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizQA:A3k03kB56rL
- TLSH T123257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 974KB
- SHA256 66cee5572e64765a53c73dca7f640c111cb2631cf6db32a3868da99b89818ef7
- MD5 0fdf7696f3f8fd199bf654b7fa3e8899
- SHA1 4b8d86049020715ac3f95c31b812b6b9256967c6
- SHA512 ff4aa1e3167cd20b98e34dda0252083430aa9a385adc53f4488d447c32f4d67801baded0d6fd8be7ad81bb4a3f1d91b94d0fa67d940e71add53fdca70b36dbae
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizJ9Q:A3k03kB56rG
- TLSH T1FF257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 974KB
- SHA256 165ddcca7ef9786b055a7452c0e48914393acec08e26a4f89242c19ee064ea9c
- MD5 536ee04985ee00919f5aeae1ae7b6642
- SHA1 8f1547efe91b67f46c7c84cf9c39793a72876c77
- SHA512 afbbc87e06169e9375ae9cd62cb0dd52199976014c7c567610ca5fbc7c3ee45c19b6f817032f7916a102033928dda9a284febc688885ae4d45cc0dc705ae6644
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizM4:A3k03kB56rV
- TLSH T1E7257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 974KB
- SHA256 08e20269ddddd1bb864ab1387abc21362e7a37d8179ea599454ec3835905573a
- MD5 46c1fe4595f2887aaab056ab4bd3835a
- SHA1 20f4cda028e0a0d169d14c2674c57273dfb89d67
- SHA512 4754bca3fec3a431ce2f01262b783d2f335697f7f92780b6cc3ece24b4763d65f55e32302084ffc0cf66229c24536d0f08bf6b7e288d16a2a57311981a9f8689
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizHu:A3k03kB56rA
- TLSH T196257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 974KB
- SHA256 8fdc8b40e46b73b129bda004f90751f170ff5e78b96fdb1af02c4480fea3c246
- MD5 c57a4aaa733efb9fd7753c4f21359864
- SHA1 351c18494e0ba47abead981cfb53098214fc9054
- SHA512 7efe98bae431cf3cdf287870ee5fd0efdfa657dc8cb800fc19d5a868c093d6e4b27dabe9c7723d69f4b9de6770963a8267178d1eb28fad19ffd3c443c2dfd75d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizCj:A3k03kB56ra
- TLSH T1BB257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 974KB
- SHA256 ddaecb08bf2b2a67184621a13833683c72d1f57de284e1d1f1b75f486d275ff4
- MD5 0bae851878307dcaca5e64d182daf491
- SHA1 8471f438075c9687d2ac9a1edb25488fc84f9bad
- SHA512 e6489713d98eeffb9c3193bc7254df24283922a1a0f1375fc7cc0e68db7fb2d29490f39358dcfa5d1180a9ab6f6c15d0fca1ebac344de0c904dd61c0dbe9ad86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizPg:A3k03kB56ru
- TLSH T1FE257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 974KB
- SHA256 894d19a64de34b4b522cd90fe643be050de07db7ae875e13dd36635ef6699747
- MD5 a16ab0bd56434bc300b2d7ba9b379e75
- SHA1 e32bcb01991e4091c9dc8312e4f025bf71ce2f0a
- SHA512 af2e298c6a4f5611c36f1f68dce25edf7e0e3f1d477b309851605ed750a65e2952499ebf08a409d2c88ea34944b1c1d4c010ccd40ea1098de6c434d00cb6d748
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizSI:A3k03kB56rn
- TLSH T120257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 974KB
- SHA256 4ed9df068174f928f2bc713c225b2b33d9d187d88c9a0ffe9c9fc1f47ddc0da9
- MD5 f754177bbc78005295e9c35715866db8
- SHA1 285d18e89250d90fa7a688e84cf11d4e1e480bd4
- SHA512 7e6891fb208a7f4395e94d95cd10223465b822c07de5cf40b3d63451328119d43734460757a16b6d81388cde20f76325b95cbb1be1eadf2c6dbcd249c50c39db
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizQo:A3k03kB56rh
- TLSH T1C6257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 974KB
- SHA256 e705ea9d33725e73284e9a3d0e4c33ff27defc19b082388d10da37f165977550
- MD5 9cee57aa40eac2e7cac23d37c3add6ea
- SHA1 3525bd2711f8f51d39427869e66b1126bc12432e
- SHA512 6d93721fc328cdd9d46f3b942da3a53ec8f6a3c2c1ebc532ba9c7a4cc2820e0275d96edd471b7aeaf24be06ea1299552d13bf167af6925ce33a6c1f7195a2e3d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizj+:A3k03kB56rk
- TLSH T18C257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 974KB
- SHA256 14ab995a6550810d04bf92d0f1c20e532b33c13597d4c705a7bd7bcd4a4edaf5
- MD5 d4d3418b3e8b8a646137622a87a29226
- SHA1 b156b27413734e9862dbe1b7245adf3e8a95029e
- SHA512 4988cca112542a50e46873eadbf26d1b98b677842cc13a6b8163cd106211a3e829b4e09673bdbff25521c43745ca3fdcd11d07ea98f373e10f96f82c6294c122
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizZQ:A3k03kB56rs
- TLSH T135257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 974KB
- SHA256 a3de8daf14a3d409f9fe14e9dd3b00c4e3dc51f85cab8881e60116cdc405301a
- MD5 4d47a875a4d877f01cc6c444baf6a8ac
- SHA1 e457d9323ca2e87d174d8e785814bfa76746af05
- SHA512 19310c5e882834410c05ec1f5b7479823f2d60d79b92c095da4296ab8dff60f002a7eb04c4a803850fe738f842eaa7ff1c85fe41e749a7c929ada45265ba1da9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizuX:A3k03kB56rs
- TLSH T179257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 974KB
- SHA256 11fd430de6927b0ce1ff2cfd1649b870d5f4f68c853e26adf794dd02a93e42a6
- MD5 1bb3c3ac32e8e67eef50ad4e086fc534
- SHA1 c3c227b3fd0a129ce572471091b2faeeea00ecad
- SHA512 58d04d312efd9cdd5aa63a4acf11f526fd4b9dffcaed3e385961ba97f1cb59a75b696a93514f3d57886451f76ca1d62c639a37bf055f88fe0ba545cffd52e683
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEizIL:A3k03kB56rW
- TLSH T1E3257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 974KB
- SHA256 373e84a58bb127fa679f698964b0018e03c7c44b236b9a7adc2689ca8279f593
- MD5 a15497e8e046c70147ba496f188c84d0
- SHA1 d409506a67b56846b2529ff4debe9261114b8cf3
- SHA512 03c848d4522cd8759882bae38db19d971cbca1f04ca76822e9dae5333a0eb11359b8fcefd4ad55a49920bd05750ad831109da15f1b0e0150c1676af66fa247ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEiz0M:A3k03kB56rT
- TLSH T171257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 974KB
- SHA256 6f704bcb0b8d2ad0226bf739b4194ab2fb8c9f82ddc3ce61ae5891a4101236ba
- MD5 59e393b0a26383cadf7a91d5e41db172
- SHA1 b8d90f91e848b2557ac6a08120c2bf0b439895f7
- SHA512 5353b44aada4905498948208e5c5effedec760ca4373c1d83b7228694018f84f01b706e40eb45aafda56d32efcd9ab619c6e381305e30e6be7eb48b90cd186ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjmtLaoOaEiz9h:A3k03kB56rN
- TLSH T1B0257C03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH