Analysis
- max time kernel
101s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 20:11
Behavioral task
behavioral1
Sample
2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 943KB
- Sample260810-yygk9ssvbw
- SHA256 8884987fb65da0c149582d36b72fd4e850ff0b7a29e2ae94b76728e9f72cf40f
- MD5 78c593636dd07fad1f850e9d756fb7f5
- SHA1 e0bff06a4a30640c2091c774fdc6247138266531
- SHA512 e3bd972fe734fc40dd9b9046040f8f647c0205e50bdf4396b1a236e51543c158d54bd5d0a53667b0ae7c95275764802a1d467c73605a287f000743fefcad7f3b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZf:A3k03kHRJi56rh
- TLSH T198255A07A6890FA8D11FC1748A968662E7777C121F2097CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/4612-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4e4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4612-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e5-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2660-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019840-216.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-429.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000018a52-547.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-613.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-638.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-729.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-766.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-918.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-974.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1017.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1098.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1217.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1401.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4e4-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c2-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e5-40.dat aspack_v212_v242 behavioral2/files/0x0004000000019840-216.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-429.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-491.dat aspack_v212_v242 behavioral2/files/0x0014000000018a52-547.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-613.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-638.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-729.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-766.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-899.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-918.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-974.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1017.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1098.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1217.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1320.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1339.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1370.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1378.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1392.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1393.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1395.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1401.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2660 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe - Drops file in Windows directory 31 IoCs
description ioc Process File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4612 2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2660 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_78c593636dd07fad1f850e9d756fb7f5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4612
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2660
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 943KB
- SHA256 8884987fb65da0c149582d36b72fd4e850ff0b7a29e2ae94b76728e9f72cf40f
- MD5 78c593636dd07fad1f850e9d756fb7f5
- SHA1 e0bff06a4a30640c2091c774fdc6247138266531
- SHA512 e3bd972fe734fc40dd9b9046040f8f647c0205e50bdf4396b1a236e51543c158d54bd5d0a53667b0ae7c95275764802a1d467c73605a287f000743fefcad7f3b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZf:A3k03kHRJi56rh
- TLSH T198255A07A6890FA8D11FC1748A968662E7777C121F2097CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 a59c603ebc11ccf4c04688dea11b56c86674a37fd7cec3353c12fd434f4ec94f
- MD5 fccb397454e7ef5933a13969973dbc24
- SHA1 597931c5dcdaddf80500c15365f23166676d67c0
- SHA512 5a788199738d9d83410bcf6ea5cdd084a529cc3608d91e71e70a08dc8cd2c6a46e41e1e0677937c94f5e2653c7695be51e0ca71d1fba9c9d1d9bba68fcc21d96
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZL0Le5ji0hmxNrM:A3k03kHRJi56r9Pji0Aj
- TLSH T117655B16F6A44BA5D02FC078C5D29666EA733C421F3087CB1354DE293F67BD19A3A722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 957KB
- SHA256 46dfd3937c902564d3910de2bfe3f5bcbc108fc3dc353a89d7db23ff044b6eba
- MD5 0beca96a1feb55ab32e506dcb681bb4e
- SHA1 ba0d5e1918b6882fbb2fe47affe5b3a067f79778
- SHA512 15e046c5c2b89df8a7b2cedfc55d6128179d6dc7d9802ebef957acd90fbdfab43e63ce7c950e73c31087bfbf7e8e4d2a874d18f26084ab3d799f4b0a77a1dd04
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZNa:A3k03kHRJi56r
- TLSH T10C255A07A6880FA8D11FC1749A968A62E7777C121F2097CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 966KB
- SHA256 a9e7446a40d33f6570435f23718cf1df49b9f2cb24ae0dce261e41af2979d3cd
- MD5 0985b11b8718f1cd7b4e90378d2908f5
- SHA1 dd0c813f1024aa881e0f4dede7f32a359dc8332b
- SHA512 0cd12cd734fd279f98b94df2d30f4aae75e75ed444d84111450d050ecdbc3567c9b59057a38022d1a61f34911bf5efc367abd0fedff418f6060c84ac0bd117de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZE6:A3k03kHRJi56rZ
- TLSH T13C255A07A6880FA8D11FC1749A968A62E7777C125F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 966KB
- SHA256 bdfb6bf5b7046c745702ae2b56d52138422af48d53aa7acb10a0e741836c6d29
- MD5 1089192800c0e1e28bb0700bfd09f7dd
- SHA1 dbadc91f03e442b08d3bc628b910c69b4f325791
- SHA512 ff34902b0b780bfe2439d38b50e778810ae60f4c4529d6296ae72e7bb6e8bab78f2a4db7094523619b5bce69d364ca6ccc1c031b430a58421dab0c085c39a2bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZgN:A3k03kHRJi56rA
- TLSH T177255A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 966KB
- SHA256 9dfcf67503dc56823cb770dfaaf20c3f5ebf63a4a26e17616854a2ecb5d381ec
- MD5 64a7dfc25dbb34d07654a98ca138f211
- SHA1 367318e98338de836d55e5fab6786102e5c6e86e
- SHA512 7815dfba2bd8ca662f4faa30b819f39bde8bd3646d5205305e899703d699643078c99a4643ddc700bb62d27a76aea90434a8802d929934a1ec2bfbc47fd0f1ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZOf:A3k03kHRJi56rY
- TLSH T1C3255A07A6880FA8D11FC1749A968A62E7777C125F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 966KB
- SHA256 5f79d1eec9ba9123d04d0b5f0bad6954e88fc59fbf91e6ddcc1be32d38ec583e
- MD5 5ca5ebb1c9e9abf1f99fdfabde78c9be
- SHA1 0f616bc8add2aeea0b3e40f24143660efb20d502
- SHA512 94e57ca1cb7a519819ba3581d28c8f1f2ff01d3c24e5e08dec00f162ef1bc8ae0af9af36b8a641716af359abdabf0a49420bc19fcf8725b19fce0eff70c91f53
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZ4o:A3k03kHRJi56rF
- TLSH T12C255A07A6880FA8D11FC1749A968662E7777C121F2097CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 966KB
- SHA256 5cee83b854912d1d64f065d6a1b4ad73c444837c8f00416d74ce3b7a54dd6de6
- MD5 fc061ef87cec5b30b03a476c631f10cd
- SHA1 5f3e6ed1f70d4e649de543566456790236b89546
- SHA512 1e12a3c476a48508ee8cbf1e681a2ef5f089a62150a32adf58240c805c8abd1b6b9954c5adf2ed4cb7447f6dabd0c46fbec619344622c94c4ef885bb3f405b2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZIu:A3k03kHRJi56rn
- TLSH T19C255A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 966KB
- SHA256 62a2b0fc2517abb30250435e744e22a0dc64e6e4611c4bf9f1df53068e1d7b58
- MD5 381eb35f1bb87629cfbb284f4f8eb75b
- SHA1 45168146912ba0e53c0a6cd9013713f8c543566e
- SHA512 09d72339f59766c3be6110f239154ccf4651609fcdd8270ede77ace11e58a424c7e0115b63f5824a9f6b60f032d4842e08ff6e98eefd00504a16850d2b826b96
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZc9:A3k03kHRJi56rm
- TLSH T100256A07A6890FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 966KB
- SHA256 118b4c177a7da222e37251493d86b50a34dc1ade2fda7f5067fce1757dae4283
- MD5 7c8c0cd18b3019c88aad031b84822832
- SHA1 7447716683dde27836f6f66b153cfe50b0f8a30f
- SHA512 1da814b3572cd451993099f539ff1e6a16fbf48ce53b6d073b4f0066a4d8b3aa3638c80135354b7eb661a106dc584bfca6b2322fe65afc45ba8acf18eaf8e43f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZEc:A3k03kHRJi56rL
- TLSH T1CF256A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 966KB
- SHA256 2b24f358328bb71a449859a0727918dc6ac6898792ac308c81f123c75aa001bc
- MD5 bd5f121dc88478a3658620de91821e71
- SHA1 96c1a28111b724ed3208030e9de9ffbc59574404
- SHA512 33c88a897f6b657bce1e896d78ea15e3b6dbdc8b9614a6383236a31befc2c584ac9aa1a89a2b3c9dc458c069915982abe8abb3ef3f46c4337e75a28202782b68
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZdp:A3k03kHRJi56rp
- TLSH T11A255A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 966KB
- SHA256 e24cfd6dda64f8adb7dbd7ec676243b5d6e882c04dd3c32e43bb517c51adda97
- MD5 deebeb02ddd12792e5e398ec32e91d15
- SHA1 f15665dc27c8b30565632133f99e16cc9932c3af
- SHA512 b3b39b08ed5d058276c49a3c0b294fd8fbcc4486d2c7a1d0c01b2a32d3aad4cf5ae0879991d3e2b08de25ef6faaea61deda0c35e4caac5ff557484e58aaf7e6a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZiN:A3k03kHRJi56ry
- TLSH T136255A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 966KB
- SHA256 e2a940028a94f346e1c4284f539b2660739a69a0c2bc19acc362e614eb40a0cd
- MD5 8b77adbd6b4d80350de37814a54aa512
- SHA1 ee2c3e18613991b06ac00a859c7204858900f537
- SHA512 4f656082663bbee558f4439c2bd0895a74d01d17f2ee2f40ddfb9ea75638216928a1940a525cfe119474a0f11bfe264ad9eb8728998c0bbffa693ee96cf59f64
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZGF:A3k03kHRJi56rY
- TLSH T121255A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 966KB
- SHA256 44149a77875dae7977eeb18c1843b3f076255b0de8d8b5435032f2faa86eff71
- MD5 dee38a8cff9addf5e94e77c89a14735b
- SHA1 bc7cd9f5f15cd4431b92ada10030d371375d8397
- SHA512 7f6052acc1eb8414b5f58115339e3407027e4151295dcfc2794f68f53cf39215ea47330e599c3bf2a9d415fbecb5ad9a28a321a08f98f946db68e2faca316231
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZTC:A3k03kHRJi56rs
- TLSH T1F6255A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 966KB
- SHA256 e8cfa54f94e744691bd20cdc96bf45d377c82b5c9361fce4ea45775446d4241a
- MD5 049341e80d579ae54869bf5a5b6df9d0
- SHA1 f6dab1e5d688df87a1946a88e09a297b4d94c51f
- SHA512 fc83abbabc67d0fdf086aa975021676cb393976993145a70291f02d81b6745645075e577a3e8f346b7c01a7d0df0279a8ed02f154e2f78dadae75e49b6f427b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZcw:A3k03kHRJi56rh
- TLSH T1F7255A07A6880FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 966KB
- SHA256 7c0488cbd00c91dffc18d1f0d394b93a73a70afad37aa560323609c4aefac584
- MD5 88d77dcbc73ae80006bbdedce86f644b
- SHA1 2f7d4c30775dee790b60ace00fefd1e2d089c6cd
- SHA512 b440282ddfa77acfdc54f327e2750e2483dbd159b01ac866fd3425b46ec4ecd0a2f8b978bef261cd5830851f3f52ce0da2b450aa32de60b4e759c648df0d2c6a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZTT:A3k03kHRJi56rV
- TLSH T1F8256A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 966KB
- SHA256 3afe99fea7cae819f9d987d7e4bf6d0aa1b56895293a5d07c5c95fa46383a40b
- MD5 a4b55046b022af14a29c52596d7c5152
- SHA1 1711f3f05286f853c20bf2e31effd032f48b361b
- SHA512 eda7cf316630f73ba8104b269e11859904a15612eb9bd1a2526c3e1ab8ef18d7cdbb7be4afa8a6be79a36c4775cc9cb5a10c90ac3e2f32aa71f1b359019cf7d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZlu:A3k03kHRJi56rK
- TLSH T1AB255A07A6880FA8D11FC1749A968662E6777C121F2097CF1354AE253F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 966KB
- SHA256 1ff7f9310722e74fe5b736477d460e301034e8a1e454e49a297e658a76299833
- MD5 76a269e5825eff84d9705d0792a53714
- SHA1 327b523949536c845f384cfcf14fc7c08d9dc94c
- SHA512 77125cf4e51775911bfcd55fbf355c4fc104045ef1d98bae28a310b25e20ef2c18bba9f459d19d2224c3629fc6446617d25e627bed2ada4b22bfc34ddc9c2f20
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZtb:A3k03kHRJi56rr
- TLSH T1C8256A07A6890FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 966KB
- SHA256 4917fd8ca3a17d1f0cdcbfac54f582dffcf4529e6bdd5e4eee10ddbee92c8abf
- MD5 3c034b87c9ab4945f5f5222998ea7d72
- SHA1 bec516d41f64a2e98e424372066ab53428212900
- SHA512 4ef74fe9f955ec581bd1c9519c7f22f36f7a1179f393a020d8d7dc275e2455c4c6fb9fd30375869a26b15256791eeb6a0d0db5870c735e6a354fd60294b7c097
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZdf:A3k03kHRJi56rz
- TLSH T198255A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 966KB
- SHA256 c97e0011bf66f353b60cebd22886c399666eae9b0571e8d1d32bd3b7313c9af5
- MD5 4b790466580c1a3b3aa5a559fedd6859
- SHA1 f39dd55cff9f1f68fa23dbe4f93e4e227f6249c5
- SHA512 6343243cd3ac7b6596165a6ca43e3a3c02ddbfb83f583bf61821886144bff732d5d1bb87fd2cd640669b8872f0ae5716b1529d026fa57f8fcfd0ceb6e25468d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZGK:A3k03kHRJi56rj
- TLSH T196255A07A6880FA8D11FC1749A968A62E7777C121F2097CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 966KB
- SHA256 2ad62cb6145a248a64db7bb26da0e15a8cf8c4a66afad0e59dbb75222a0d17d1
- MD5 12c3028c7c60d76bdf8742132a8791d7
- SHA1 958caefa4ce9d000babddfa68edaec517fac3c83
- SHA512 dc4a5a212bf7785e14e6999b0e0053d893c018216ef79a30e8ad96ea4c2b57a32dc52a4091c7b23f6ea9e7a9de05c7ca0b9da829d701d18bd3c2e6cfac99b17c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZzk:A3k03kHRJi56rO
- TLSH T1CD255A07A6880FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 966KB
- SHA256 b9be5c2f7cd95cc597a1538c72f8b2281a3b686f4cb948cbd81f12fe30dc6438
- MD5 c44155b29f28d173d7a107f2bcb621f6
- SHA1 6453fa2407a6ed12cfe47332bbb5b3e18b2ed197
- SHA512 d6d62ed737f877ab1ea2702b5b6efee1eeadf986d7e456e4066fa3e4814644b9d94bd70659eb0a20db32f8befed75be208321fc85a284edd0bc3ae195985ead0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZE0:A3k03kHRJi56rT
- TLSH T19B255A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 966KB
- SHA256 06e9546aecc5e05472ec2024bd35b166bb49ef44d59edc38385ba1b18554828e
- MD5 2875c62ab2115baedc7726c55ce944f8
- SHA1 8cfa9ef7772423ba467cfa93e3c4181941ebf389
- SHA512 4da3ea5dc17f7b8d622fb17ad1c3ff87c20a63235351cb656592a9cf4aadf1393f6d3ec5a6fd233f6756f64dde40e91cf4040df0fd7592a62d79cc29590a7234
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZ/g:A3k03kHRJi56rW
- TLSH T1A9255A07A6980FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 966KB
- SHA256 772b487359631de158a436ac59cec32e3d12e3fcf4b6eb658083acba80c2b79a
- MD5 59c6e3e0f996b45cd4d7fb9541ff7545
- SHA1 5502137090b80fcb9f6033c0d4cc1327857d28b8
- SHA512 0e3b7d1a3b52d8591272d8ca0b70a8e79822254930f59bed37bb6f1f40dd5bed8528d7a2dc19830787e0b32bab424b235a141f285f00651f23215ee6483280a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZSr:A3k03kHRJi56rY
- TLSH T11B255A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 966KB
- SHA256 06b047d0de746b57db2cefea0145eb6f4fad0f1a4fc36c5ae7a9892a9dfce01c
- MD5 21773385cee5ffc87ce8c2e41bcd803d
- SHA1 6c7ef09f2c89212e3a5b1a1226d3297ee40bc56d
- SHA512 e9566ac4bc9923a6dd3fdbdd97aa33c0e5d289ce83c59bbc1c4ff34e4aad20b49116941205192fcaa1b8fa8ca5e4b3bf2dc113a01ead9dc6e35a200968f9eb1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZwn:A3k03kHRJi56ra
- TLSH T14C255A07A6880FA8D11FC1749A968662E7777C161F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 966KB
- SHA256 ce7d4d374f67301ca866f39e773f8f36b3049e1b0aceefc04a01e32c697fb82f
- MD5 6cf4e8ef821e1d35141b3645d6643fc0
- SHA1 d57d94637a838ca963ccd96e4497d6868abf7801
- SHA512 adfe0f73b125be613c2634101b26367514e03059418c4ff4c1c1d0abcf401590cc7fff3ffa4d1425512d2c54372db1f5865c1d536d5f3bb699fa1d98f2967591
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZOx:A3k03kHRJi56rY
- TLSH T16F255A07A6980FA8D11FC1749A968662E6777C121F2093CF1354AE253F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 966KB
- SHA256 9ac3d9ebc1ff730a281a3d6396d9fed7d6ae814a1b62389c229033d569a326c9
- MD5 c4ba7cc6a76c9a3edf4647eb5a6c905a
- SHA1 72a2be39f49a8aa87e6a416b27fd6ccc10655826
- SHA512 b82034876302bda868dff7187afeff4244a464dbde86f56d7258594021e39c1a0760c029343415383e956d7f380beef219e5c02a819bb7edf05f34966b64183b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZoA:A3k03kHRJi56rb
- TLSH T19B255A07A6890FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 966KB
- SHA256 dc4ffa09a811d00a16db455871a4c5d9fb195b5f49919762b29606e12a468154
- MD5 3472c7933be065cc8a478df1159fc642
- SHA1 d06d3fcf324510c41c8218b9deefc268a50b356b
- SHA512 75b322369968e336d23db9dbbe4fae8c8fab643e0c44d22d8ec48bb864a1636499bd4c2962ab2d8ae7b2a3fcc1f7e96122c8049c1b08344cb83e4474583a2101
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZB9Q:A3k03kHRJi56r2
- TLSH T14A256A07A6880FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 966KB
- SHA256 bb6b10f8c18cf9a533c8d1c85d941b42fb1a2e45770e084d269f7d2ef5e23cf7
- MD5 f29324efe3e76a491f0abaaba67026d8
- SHA1 4ce55e7df378bfdcfc168799550387a6c9bde489
- SHA512 c2143d8954488ebe56fa2e833f99c7a2d1efd39f0ea3145e157ae7d3326121eb3c06668f58c858f33306813602b7fd47398e5477d5e89ea9b8a157d333fcbccb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZ04:A3k03kHRJi56rl
- TLSH T1AF255A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 966KB
- SHA256 693a7428657eee772d234728b5f04f4b792c60d6f1f6c01be0c78ee4aaf730b3
- MD5 7d7b59437e3ccb0608aff01188f34f96
- SHA1 a6c7b3212bc0dfc5cae6642f9457946ff224769c
- SHA512 ee302e7a54d7761126cbade82dccc8fddb4715b8d85b83a1cc356ac74127743c7e803690691077d0fc5b1666821ff03a1e974139673fc93b92ec8333995a7fa1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZfu:A3k03kHRJi56rQ
- TLSH T1CE255A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 966KB
- SHA256 7c361cf9b57d5ae4ababa8de3e96df45aa695b7bc76ea1e92947a5f28b7af4e3
- MD5 d90169a5f937717e2b50019eb706809e
- SHA1 da299e24ffd5d565654516394b308b295e9e9a42
- SHA512 43c8ec79dfa6822a34eba4b48f0102d5c954429511e0e1caa4452c3650a0d512ff24c0008fb1f82f9acdf33c2ec7a0f5e08c6c254fe28d14949d50ebe2cbe760
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZ6j:A3k03kHRJi56rK
- TLSH T1C0255A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 966KB
- SHA256 6e5c75caf6971bc8d05c43b0b5402874d9d345dd9b6b562afcf06d0f26d7b723
- MD5 ae1cb6f34c05831027233754234c101c
- SHA1 fca09b12e4866023a864e509a39f42ebb9b1fc66
- SHA512 a02044e1624b5d1ec718cb27198da7fc050d029f36a276c9f84f2bacfb84c60d239a63d1c81b6349367ac409e61345d0c60acda868c015f275f29bd3f8ed8667
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZng:A3k03kHRJi56re
- TLSH T137255A07A6880FA8D11FC1749A968662E6777C121F2097CF1354AE253F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 966KB
- SHA256 e52d959d37dd397960b7f2cdf58af0fb3077c2e404f86fc48002583bb7876d95
- MD5 f3f1d4ec695f7145f8d8125c6df5b94e
- SHA1 7caf176f0232dff9d301b41f2d4f9acb229b5cba
- SHA512 df591ce0c66a885ff94b4908918ac7bc59db40326ba4e3a483fd757618d5f8ff66d4e9328c6663163379f427511e7585f0cd1ea1d50578e8afe27163279d47ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZ6I:A3k03kHRJi56r3
- TLSH T1B8256A07A6980FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 966KB
- SHA256 2a6182534ab5aa950f041e45f6734a5f01e0c7031d31af033242d5d61ac7c76c
- MD5 102bd3143f4cd47e818f1c903c2090ce
- SHA1 59292251cf192020c39a59bb96e1213d1d21bcec
- SHA512 96b8052b6fe394e714b1dd1e1a3be0e90a1fdcb36ddf6e9dbc5fed9df59b4827897839d88a624488ebb19d6972ea339989fbc336a3f01c87a5e186fe2c85e815
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZ4o:A3k03kHRJi56rx
- TLSH T11D255A07A6880FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 966KB
- SHA256 d9e5097c517b3232425fb1cf2b6ee902af2106d59571ee09bd12ca5a87a842cc
- MD5 fe0ab628b3b7880c90cd926d5bd9d38e
- SHA1 c57c27c8859937afd475c0132f0b962e9b38cc5c
- SHA512 61ce52464c64fc64749955e242c28b4b9dfe2fe874e976e2bafc177507df3b701e34ef36659669d6af5cec89b1aa1b1571834910fa63a988b5f7515996796625
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZL+:A3k03kHRJi56rU
- TLSH T19B255A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 966KB
- SHA256 8b2e72eeeb90385ef2da46f0f1281e3c16ff1a4bef9ddca08ac90ab17030a996
- MD5 b9a4f365bcbf9cd9d251aab2bf6e66f2
- SHA1 9807110d6452a8ed1cf3c1b11d14bf5bd1b44f2a
- SHA512 dc87305681e30047f8ebbc0fdbf9db2ebcacb8bdd7ff66a5adf8c83687b3944b766a2842a6c913c306bd0400e478732fbe7db213d5274dab32c69121b17102f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZBQ:A3k03kHRJi56rc
- TLSH T16E255A07A6890FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 966KB
- SHA256 8008bb7942b0d7709ce93ce026359cbe222d6ebb7f1069596b3d00eac35ec806
- MD5 fc04de5c5967a32bd64b221cc7a8438f
- SHA1 ff33a21c0f0790442d7925d32004006b64860cb4
- SHA512 e5d067a45891ffc113c49906a87b394df768d59e1e205fa556a564a14a49f3f958a0961035cf6740fe4268a67124572ad20ebb4d7a0d7446c4142043d9e4561c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZGX:A3k03kHRJi56r8
- TLSH T1EA255A07A6890FA8D11FC1749A968A62E7777C121F2093CF1354AE153F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 966KB
- SHA256 02508a171ed6c8b6a985152fa691c3f980a2ddeaa2b01d6ddcf268f9255dabb9
- MD5 871b0483a5396f6526d10f38e203ea4b
- SHA1 ddc826ae668ed4236f5e57c756791e30d28f29aa
- SHA512 ba48f9a89687ca6ecc58610d9b45d400b10bbe36f3fba9c9cf4c08f1b294214c669989cfd66716826a8e55fa8c0796997f7c2c4ce43fd2d14face5804d1c323a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZAL:A3k03kHRJi56rm
- TLSH T15E255A07A6980FA8D11FC1749A968662E7777C121F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 966KB
- SHA256 55f4c751a172abd37cd96beae94fa8c36d96c36aca8e7a21f44bb3806be7671f
- MD5 876628071d5cef467012106c9cf15f7f
- SHA1 ce867d5fdf5d9a9c687ed86b21c2ec8c841ce41e
- SHA512 14d3a413db11301032f52c63cc97a57e09403809dfb8d05d8baad905b04df199292a9eaa37b0bb0ab320ba3ce7ddb1c75949456abf4ae416ce11c0dec37680c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZsM:A3k03kHRJi56rD
- TLSH T13A255A07A6880FA8D11FC1749A968662E7777C125F2093CF1354AE253F72BD0AE3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 966KB
- SHA256 d2d0cc139c232db9b28e86fcd0cc4035f7fa0fcdda1e641be95ca37fddde974f
- MD5 b416136b04e9abfa59d11b95e1505773
- SHA1 75e4ac9404fe2d2a5655730ab9967aa63ce4ad71
- SHA512 d5f4e57f5ff696713b66dd209dd8c3760aa866dd73e3d723cf0e2a554d4f2d91ba6131462eb03ae0c8b1db3dd0737d0e4d650da42120efa29ba4f2da55296553
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliD5Tvinrmyk415vZ1h:A3k03kHRJi56r9
- TLSH T165255A07A6890FA8D11FC1749A968A62E6777C121F2093CF1354AE153F72BD0AF3A357
- MD5 SHA1 SHA512 SSDEEP TLSH