Analysis
- max time kernel
100s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 02:23
Behavioral task
behavioral1
Sample
2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 948KB
- Sample260811-cvfnxaej9s
- SHA256 91fa9421ebed7d742bd058f2733e1f93ad2b9b3e4e118cdfdb2fd8f83f78c29d
- MD5 c83a222ad529c2e8c45e52b062f125d1
- SHA1 6d69d42c68963ced34527b81408e087d959b770a
- SHA512 21b619102841dfecb0269b0fba2d2e08986cb84cdcad56ea7ffa8674136bae10ad4fd15ebfa9e3bf2dfdc2c280f57762981d1bd74e92ad82a1b4ab456eedc962
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vC:A3k03kHRJD
- TLSH T17625AE13EB9504E9D10AC174AAD68A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/832-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c46e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/832-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3508-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a65-222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-440.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018989-574.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-685.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-735.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-784.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-821.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1103.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1217.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1400.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c46e-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-39.dat aspack_v212_v242 behavioral2/files/0x0013000000018a65-222.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-440.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-492.dat aspack_v212_v242 behavioral2/files/0x0004000000018989-574.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-617.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-685.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-735.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-784.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-821.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-871.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1103.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1172.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1217.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1320.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1339.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1364.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1377.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1391.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1393.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1394.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1395.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1396.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1397.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1399.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1400.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3508 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe - Drops file in Windows directory 29 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 832 2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3508 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_c83a222ad529c2e8c45e52b062f125d1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:832
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3508
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 91fa9421ebed7d742bd058f2733e1f93ad2b9b3e4e118cdfdb2fd8f83f78c29d
- MD5 c83a222ad529c2e8c45e52b062f125d1
- SHA1 6d69d42c68963ced34527b81408e087d959b770a
- SHA512 21b619102841dfecb0269b0fba2d2e08986cb84cdcad56ea7ffa8674136bae10ad4fd15ebfa9e3bf2dfdc2c280f57762981d1bd74e92ad82a1b4ab456eedc962
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vC:A3k03kHRJD
- TLSH T17625AE13EB9504E9D10AC174AAD68A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 f234bdcd28ec144d26b7bd842bf31b31faced6f91d4b6d4597f9aef758b96cf4
- MD5 b38f6b91df85fae673aa8b27335984b0
- SHA1 1287ad46ebf029460e086bf8cafac2f428074e90
- SHA512 1dbd208487f333712c0df1c207e7693594208ecb7a856b61972f538cd9dacebce7b2f47ca8d87a11064b1b72a638ba2824341b98bbddf43afbf0d96322ff9adb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vC0Le5ji0hmxNrM:A3k03kHRJ/Pji0Aj
- TLSH T1A4658C17F6A402B5D027C1B9C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 963KB
- SHA256 3ee0911c36b6d996a7c578d26ed7d5bc52cd70d2859570768b666bc1c6dcef1e
- MD5 0c54a5a2c94d289c5520f2884c0cd7d9
- SHA1 836aadcfc7fd21a0b122a63a0c5e310ec714e5d5
- SHA512 161d5a1c89df3d4213ec7462f3f52fbe7331f50706dee53dd2bf98b4d61c06c05037539b7871698b2a9f839ee65b6d175132a81a04a57eaeaa8ac465269dc2e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vMa:A3k03kHRJ
- TLSH T10125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 972KB
- SHA256 818c4267ac89c12b1d7976dbfaa626226015e86053c796c1c1be81deb6324830
- MD5 758f53e007cb9d3576858a30fa437b78
- SHA1 8b7447192315325f147013d40fe11718a701b06d
- SHA512 2acf0b61ac86af604d7e0dfb719800c43f036d88653de936551efde4dad9755b5a8d152fbc9c84e0552504f44f4dc273df83b0f9f90b1cd13f4485a63447a359
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vl6:A3k03kHRJH
- TLSH T17225AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 972KB
- SHA256 a7a3d8cc8479e68ffab4dd5091a2ddfe75b05c0a88b5585dde1aa0aa3610c416
- MD5 d2efaa87cd88ae74b99a2cd89abf6967
- SHA1 4ed64dbb2b9c4b6b099b66af5656725bfaf8748a
- SHA512 145d981e7265503eb9f34506db2ec299f34d0b955583c92a7ee700f76c4c8736b2d52c5c92add5a5236d88eb68c37f69297513bd9b58da051e5158385b35b5f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/v7N:A3k03kHRJa
- TLSH T16C25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 972KB
- SHA256 5572d3c6167ac771a67d2a9f6cffbb3531e05827bdc2c92afcca4540774c99a2
- MD5 12168a493e26d450f4c8eeff2ac237f0
- SHA1 cc8051e9b0d6d0542da9c7afb594b37d03ca19b1
- SHA512 6f09812f34cf2a7ebff409ecd8aeba3fa11470a29ead7218326718d5486931b0a6bd0f9e4d7dfbd639fc86f0ac3fe4304a0afc79ff9d6bb84cabfaabe753ca64
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vZf:A3k03kHRJW
- TLSH T10225AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 972KB
- SHA256 ba52ddcf2e3fd8a8deaf54e2bf64ee08400b542f30856fb02302f9a3bb677dc9
- MD5 ba6fee676a2dfc82ac9a6803eebaa2fb
- SHA1 51a1cd9959847dcf77ecb03bb7290f37952afe25
- SHA512 4ed633264b01ce19a1670d24bf0649805cbd3cab1ba6fb37a615b36355a54683522deb025c12d0f0d1e27b84ebcf12c9f810bd0b409ebd9e984feb811fbfe469
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vbo:A3k03kHRJ3
- TLSH T1DA25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 972KB
- SHA256 b90b31462ead88cfb61c7b2c4bb991cb73e5271193bc44df4e1730d4486cac00
- MD5 b97165c0cfb150d0ba3745067f551b74
- SHA1 ca5d7e59879a56a670dc0c4b49fbc7ff38ee92d7
- SHA512 47aa62a2d523087d21e5d6c5d0205171255bda1e0857a4d5261100210b630676a66ca29088f869b643e26840e8660a786c171a3b41dbf218f0bdb2a2f331e245
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vPu:A3k03kHRJ5
- TLSH T16225AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 972KB
- SHA256 65647c44f59d67060a4e7f30dd601cd9b6c5d0af00ea5d94383e463d6c4617e8
- MD5 d2f27dcfd4e4c4aa133661c285764057
- SHA1 1f2de49b341415e3976789d8cfa25951b92dabb3
- SHA512 b3c3976f88d605325c7b6983d125bb00588f7eb2031426da92398f5a3835815fcee36ef994c3fdc99938e4a6983bf0ce96806cc7e8aac6c3348bf4a9ca50a05d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vd9:A3k03kHRJ0
- TLSH T15825AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 972KB
- SHA256 8441536d5e43aa19286070083b3d1372c57481e3b3fd17b54e37004aece753cf
- MD5 9d90235cba7b913af3d001cc5815bad4
- SHA1 0d7f635b677dd30e8e4a2c2550378fc7fcd6967f
- SHA512 24d8d10225a98bd6906b88cdb79a61239ff0d331a37f0a02286bd43f8bb179b6c02b5948f1468c9c82c0ad6c381645bd6b16ae5bc8780c67d75792088e3f9172
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/v5c:A3k03kHRJd
- TLSH T18425AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 972KB
- SHA256 22b978907f20470852211992acf52ff5e43caf036c530fb11e3e19cf79980aad
- MD5 dec0bce9e957408316b843d0bb575049
- SHA1 d310d71228923413ada6b5747f67395e99954cf6
- SHA512 7a092567b4003548f0bf630e9d42a890965b2a99288e297a7b0959b4808dc1b1b013ca263711396af420709ed1b5f09d7fcc6c43f9b10f8aca0b6b59fa68f03a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vyp:A3k03kHRJD
- TLSH T12A25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 972KB
- SHA256 06174ab38597116557cb4847b23941bb5694eccd12bead1395d5bd5ace1280f8
- MD5 d07f594bd686093053eb1a1842d2cf6b
- SHA1 dc92c13b5c5361a1a33505f7cb6f2ca836d1877d
- SHA512 995214332c6c1ec148e908636c08a3b7de5d9f1f44807a59f0f178bc7dcacaf334070512413a0416a1294159bd85f071b4303f2e7cf29b0aaac3b84dbbaef559
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vFN:A3k03kHRJ4
- TLSH T1BC25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 972KB
- SHA256 a873b3b8008c60ff674828c5b4605fc857be42ba8a65ba5cc736910702b5bfb7
- MD5 ec7d5155793293ec8a36252d8863a257
- SHA1 de260dec2b98d1950a086cd01ab5157bf69a7831
- SHA512 91000aa982da2f6c2003492f4821029af9ee3a1da9013e4975a3fe111c5ead9450c3e5b215bf6051ffec5486561c7129fce03263e04a632f7a75151a845c33ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vXF:A3k03kHRJO
- TLSH T1F125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 972KB
- SHA256 acdc34f75ce0f0fdb400dbd11cd23da619ebe5ac2cc21a66ce1c9dac1fa87e1e
- MD5 8fdb9236b7adf836b596dca591ec7dcf
- SHA1 4be6d5799ba7543b1d493bbba8634a923c941bae
- SHA512 6f155b2ad81fd3c112938045986a8440ed31d0ff4aa72d67c843df52040b9e8046e3a00f9a38d84c91d32d3e254c31e95fca6f477fc68f50f54e6f969bd739cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/voC:A3k03kHRJq
- TLSH T1AB25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 972KB
- SHA256 fd916a3330dff7b9cdf69244ff46f44fde174663ff0cc986c47a95a333da35e5
- MD5 098e9f14d1dcab35df009d6bf2a81b71
- SHA1 be00b474f06463bb76e40bab457f0debbc2ec172
- SHA512 2aaa24be2b38baaf484d806a343b0b1d705f5d841c28545c53ea6122533daac7df43a6e153d1bd6bc86e9e451a86da0c2cab38494169006b99d5f78b93299edb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/v7w:A3k03kHRJ/
- TLSH T1C725AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 972KB
- SHA256 09148536d578bc7e18756b54b2681ab0e636f3ff377e397df8e376199dd6f705
- MD5 e7c8c136c95b1c1ff280ac12ef29fe93
- SHA1 2b69e1737258f2fb0fac7ee1535c31f2fd84d18c
- SHA512 78cda8ca634695c06e2804d28fa9edaa0fcad5941dc050c9efe931a83dcdde868bd4f5342b3057e29f9f23fc32cd72d58a62f0286dc316fca514c576c6707b8a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vCT:A3k03kHRJb
- TLSH T1D825AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 972KB
- SHA256 385c0c25e26301db22135f058906efe742580df14d76d1d731f4d8595891749f
- MD5 560fce899a338f3a5e56b564cb63fb3d
- SHA1 821c197b140ecec90910a61a595f6cef049461ab
- SHA512 1ea2a7ced9bc0e41e1d8e1c6328fe8753bcdeeacccd0bb530d4aa358f2e60c2554902de29432f7c000da8cf1bd0489ddd4b9c5c6b2a1bd440fcc999deff5ae1d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vSu:A3k03kHRJc
- TLSH T11A25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 972KB
- SHA256 22f108e4741849172c34748836a90f2ba13b737f720665b9f994f3de6d64866c
- MD5 170df308a16bfe2a12eedcdf05c26f8a
- SHA1 4a484c24eccafb2030d9c484f2264e8c6b9eb3aa
- SHA512 e6ee992af574b2b673bdc55d10e04c7ff67dfcfeb4a73f79e8520d6fbaa08b02764a617cfd86994935c30f580def57a8fa8c4cd03ce441ec08f36b9f60b56b72
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vMb:A3k03kHRJ1
- TLSH T1CB25AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 972KB
- SHA256 dc0ba2b2f238e3581001e109a2449ddb49ecbc85ba904c7e58e6589701c523e8
- MD5 9d1d3b26c3ac3149386daa5180cd6922
- SHA1 5b64033bcca4ed19462c538749651ae997cb1122
- SHA512 88ed6437a2a84c8ce1916c7964dbc81f6071d13c97756c6e07fc53b7f95a8f1cac3a640bd968b24104e645b23b07bd78c4fa02a544d0f4e67f18510a205c8a36
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vyf:A3k03kHRJ1
- TLSH T19425AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 972KB
- SHA256 8f58060bd93490346862eae4156ed777fde34e2bec67c86c4b4b4e64615520f9
- MD5 50df1240806c1b6d63b07768343e574c
- SHA1 4898649cc6fd4b12184dfddc5ccfae06ddddc5a9
- SHA512 6bfe888d97792ab6c61c656fb03539cadcbaff3f6d80a736743bc10881306a4b278bc2ca47d69f51750a4d32ee9563b68d660e8baa2826b5defce1bc25686ad9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vfK:A3k03kHRJt
- TLSH T1E825AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 972KB
- SHA256 4c5af8c3877087156733a8a8e601c4a56a33534cef07c285e8f8a176ba930dde
- MD5 ef187117e6ded5c134baf79e18362969
- SHA1 f6bf13590dbe078c87f7a48841174f79405f50dd
- SHA512 2ae33c54776eeb6ca602e7a8ae58d352cd332ed44e3ddcca74fa6625dc8adfcf363e3b897cd80b02174d9d32823400978d5e4e3ab03ef743f2e0ae6c1e321ba9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/v4k:A3k03kHRJE
- TLSH T11825AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 972KB
- SHA256 c8e2c8dd4ec9bd9fda9f5518efb9b1f732b6ef758ac46f975de6eff90a382396
- MD5 e10eb27817da379c51085fcf9998c0a3
- SHA1 e8cc51d8fa41a0598050419085a744146f790196
- SHA512 d48680882785d5a40548ffc6655db69f04fb3169174fdf88f9da91af5785e1fb83b2ce7d7b4e6007694da688a58705dc8b3609a212ee4abbd5f2e11bec962740
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/v50:A3k03kHRJt
- TLSH T11825AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 972KB
- SHA256 f4004c13631567afbcc396d71c476441410a5faf6a53af7774ad0d172ce1bb5c
- MD5 b27f8b82169cac7957cb7da6214f17c3
- SHA1 1da84758e548c594925307e67e055a5c66419db0
- SHA512 983fbc10a9e32163ef6324977059139352ee429d15afa0aed614a408cb14ebb0e28d484c32c10f97c9573cd42ce744bb9bec1025dd306df032c897b4a5a61970
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vsg:A3k03kHRJc
- TLSH T19725AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 972KB
- SHA256 871eced573460a87c79b50160293319c069b934e2ea97c56bcea4387be89ecaf
- MD5 7af78f309535d40eba5c68660b3a2f15
- SHA1 f75ab8bc042cae9324fa474122d6f2eaf7ee5318
- SHA512 d66feb451580abb85f5772e03ce1fab22f3e89ab8c87b4e7c4bbcde4d270cb56b5cddc8339f6298b4cedeb7cbdf7ea1d515c7fd3f87ac6ab72a0bc3965157b89
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vJr:A3k03kHRJu
- TLSH T1EB25AF13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 972KB
- SHA256 fe84dfd7baa258618fc11c2602a5a671f32e5ed162830befde3992d94af02c34
- MD5 b95a536ee5c9726f11bfa6626b6b3f8e
- SHA1 93a7e6c96146220b8065ffb2758c049fa319bd74
- SHA512 218577f6dffe39d62c9735b40d6a7849ea08c12957ec86e8a18d0b9709cd5f8f581280949e3ae027d1379006f94386072721453b0e8eee6773be31d3b589d575
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vrn:A3k03kHRJY
- TLSH T1B725AF13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 972KB
- SHA256 e238820091c64e7bafaf43ba2425b115ae881f54c357f79848c15652d23ee5af
- MD5 d3c7d956fde3d85a68e4e6a413b1282b
- SHA1 54993cb0f6dda8e2e40c47c49b1c46b860edc6d6
- SHA512 cf590f5ef3dde1ec6fd19582e2e13a14dd356f19f97345017867b23858e4e2756722fd181a8e92dc920e2485d7fb0884be0f397311973918d4793fbaa3362b3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/v3x:A3k03kHRJO
- TLSH T12D25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 972KB
- SHA256 10891450e18ae2d1f32b87bf3d316d9df4191de98f31dfa0881504a5d3c8f1b7
- MD5 0d28f0ae37fec9f8da88eda5f18e3e3c
- SHA1 370ddc941d8fa5cf283e3b9cb4daf56fbcb3884a
- SHA512 5d02fe7346b0435db77372b0d4ba470e4eea9bfcd990453b3a60f0b664886bd4832778cfa7e658302e59ef7ee9c550a3d705f25d178730bdf160135d40e2bb21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vtA:A3k03kHRJF
- TLSH T17225AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 972KB
- SHA256 2f65cc1f8fdb6af8629942fac0e8a1e10f749dd3c77f796409bcc225c837d8a5
- MD5 b0525c6fcdde499a7bdf0d640a38f5bd
- SHA1 b24eaca6fb4d0fd4306182475a81be5dde39151e
- SHA512 6f4d57a7e05f310a9c39cd18e0cffacefc98a27f48998faccabba1dc8958b18f542ecda4d0477cb49811927760442c6257f35b1dffe61cd23e9ec7b766dba888
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vm9Q:A3k03kHRJk
- TLSH T18D25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 972KB
- SHA256 bfa3fa0d606c5367037c5f9ab628428966602c4b800eeda40f426655067e92b5
- MD5 f79c083949c05c186c4078ee118610da
- SHA1 17f4c87dc7eb07b64d8237eae7678bb536f5637c
- SHA512 7d1ee4e16fadd260c901d4eaa96f734fd0b768be8fda6069aba7bb46425bcde8e99a623b303fd7accee723ac94ea60e8be7f1c44e0cdaa2fd0df2c57b385405c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vD4:A3k03kHRJP
- TLSH T10B25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 972KB
- SHA256 c0de2ec0a3343a5c6252cd147a3dd3becd0d114a1898271d987c005337648a4e
- MD5 82c670ad2ec821c6c0ce4b67d2a0ecae
- SHA1 8817d5c72fd72778e0c3d320c54d0e24d82acb89
- SHA512 c46e37a5a0056c28f82998f6d922700d9cb45e97ab8b76a32b95dbc83e82be4079992a485134b4d3238061dda2ca831d361024fc73c91e96328e5cafc4c45232
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vqu:A3k03kHRJC
- TLSH T1E425AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 972KB
- SHA256 8b3e3ea1ff109df8b22c60c7492d86a19c59d6d0c66a5c111a4fd57c9603a05b
- MD5 2978e5076e6558fe64df1e860649034c
- SHA1 8e9622e4e79033571b987544f02553248479dde9
- SHA512 bc0ab8ed6520aec43429029d8d88148f37924e43c9bdb07929ea117e364c496e98b4dcad5a4e281fd0105126893a0fead9ad18d9bb6dc04039c5cca8b46f32e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/v7j:A3k03kHRJc
- TLSH T19625AF13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 972KB
- SHA256 62e135f437c905dd537caaa080a44741cc11e0c37245686218ab03a46c921aee
- MD5 c6d702c2257760b7fe71d262f508f064
- SHA1 b9bf773f754226d768789826f5eb261239541694
- SHA512 16138804e8f5bb4be69ecb36fa538098a12682bae552443479531f77e0c46eafc9257e31ef430f3ab4f0067a7a10a09ebee2a558f5d6110dd7f84fe36c919fac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vGg:A3k03kHRJU
- TLSH T1E425AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 972KB
- SHA256 859c9c0da57feaa6352be891f062719c9e5cef119e9e56cb49c0916be7df3813
- MD5 396b58e3a1c67e62b2e2945f9c339edc
- SHA1 c2a817173e3fc89aa9454ddad7bfaa97b236f3c4
- SHA512 64891830fd3e300b4721581dca6894ad9f82ad35968afb9f84e6db6c927829263a0be29c6222e455f9084bdd242214d92ea4e5599bccf3144a237e63fea166f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vpI:A3k03kHRJd
- TLSH T1FB25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 972KB
- SHA256 cb171af313838af4e87b1bb848018d428bd2796421e358c142fdfbbcf8c75e30
- MD5 bf2757ba8d13b001fbd86bb7c59ef784
- SHA1 51beb05d1f5148cdb6e1f243781aa4a003ed22ba
- SHA512 0d4de5c35c52f79d43eccb0ee22318903b63ab1891eb3424e14fe6791296eabbd46d0716037ebe84aebafbd977a226dd58601bb28eafa045d3b61ed6506472bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vLo:A3k03kHRJ7
- TLSH T1CC25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 972KB
- SHA256 99ead67ff23e63d41aacc77a95cb12de2c26e2cf188e93ad98d983dc9cd37d39
- MD5 e1350031e5bed5617f109ef3d504bfcd
- SHA1 2f58f949e77f1a589a003da955439c8c1ead8d17
- SHA512 9f6048eda9dd69cb343720af7e53d2c618efadd4ff3653f4a746363db344f2a4c61c26d391e883e2e24cbb09f3e814c1a92c9b916b109b5393af69f0aa64a205
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vw+:A3k03kHRJe
- TLSH T12725AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 972KB
- SHA256 402544fa2ecace5229f225d0048715a02cf5aaf6c69022fc0bc83bd1eb9c97b9
- MD5 b4456dad1b90991cb5cdf6487bd07ec0
- SHA1 adc7501b06ed83c15928969dc3d3cd6081d11ac6
- SHA512 19c6f93b39d048717f92881d9bcac721763bc6958b71a5b233adb2113ca1dae303893ea883d03721f3e00aace0564aa1cb2c89ec04da7d968db49048a14074bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vIQ:A3k03kHRJK
- TLSH T1DD25AF13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 972KB
- SHA256 726ee80327c9a102e7c6ad204eec5ff0c9459944d8cc5c2c890b9ce6c773dca4
- MD5 74dc829732f63c308cde37d88d7372df
- SHA1 f33ef57a26a1e7dc33cd87f4e6f9e689503512ff
- SHA512 1a7532a49b0e5606e64b549ebc3eb5a40b326ec8969dd66d0ad05d31826af7a9c9ff73bc7359d351c2e5dac98902081e744d6d762b4b9f981fb267e32dcefa03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vBX:A3k03kHRJa
- TLSH T19825AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 972KB
- SHA256 a12c55336fcc43ea2fcce5c3ff6fbbb5f9643ce755dacf8f6b36df1db0f93b89
- MD5 906ba4e2ebef1ca59be94cb43bffcbf8
- SHA1 31c20f8d4ac365a0e32f7b42652de945b569b877
- SHA512 25a021a8c91e87206447d5cf3ea334c165d07587ef13b3b539fad4dd9a4502af8849a09fdad19e48ef4eb5a311b3aaf15e0d04a1282e1ea37a30e28c41b01eaf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/v7L:A3k03kHRJ0
- TLSH T1C225AF13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 972KB
- SHA256 8b7e053df95db072fb0310d68f87278641c72fe97f894ec625bda9ef59b8b839
- MD5 e717711e748cf44bec6255dd01e1292b
- SHA1 13f2bc3c11e81b09f228581f834ef99f1c685676
- SHA512 f097325b5e614ee502daa6aae7f71d1b10fafcfe257e99c4f7fe8b719bb62465f026b4fa228b35ef3c807364b83d5f6a29c11dad523ec7d20522b993345a5e8d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vBM:A3k03kHRJV
- TLSH T16B25AE13EB9504E9E10AC174AAD64A23FB757D56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 972KB
- SHA256 f6729a882f6792d730a00bb3e8becd1e02724ef966d4e2d146b4319d0d7af582
- MD5 71cc68fda62f584db7757d1c790e3fce
- SHA1 5c97913579a7f16c13409591a2f9a7ec7d460f96
- SHA512 2e0921eb8e3a56622e3f09bc06a8cc3dd479ff1e4686f0ae08e047008d6b3bdb11daee9766fbde16714d4a955a7130481d002c076dc35aa04f6f89f18692bd3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YtI2xJP/vqh:A3k03kHRJv
- TLSH T1A125AE13EB9504E9E10AC174AAD64A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH