Analysis
- max time kernel
101s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/08/2026, 14:20
Behavioral task
behavioral1
Sample
2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 907KB
- Sample260814-rnjvbaac84
- SHA256 3157d947f3a809b53f18df7f08946e0d3957216ae86ec2e965391a487b4ae1a6
- MD5 10f93b2c0f171dac84909286c78fe6cb
- SHA1 220cf3c5f0cb6e53edc3761981e64d9b9a6ad2f1
- SHA512 62371b68ef8e38de26d79799bf0de574404259059684e01b1f58d49f012153c6075aee3a9a5e5eb01d405473a132e228cc9e559ca41e363b3bbf2fe0d5ae58af
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF:A3k03kB56r
- TLSH T152157B13E6840FA4D10FC1749AA68662EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/4940-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c643-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4940-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4760-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a65-222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-440.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018989-544.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-605.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-636.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-722.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-840.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-884.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1042.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1073.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1128.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1321.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1365.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1400.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c643-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-57.dat aspack_v212_v242 behavioral2/files/0x0013000000018a65-222.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-259.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-440.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-489.dat aspack_v212_v242 behavioral2/files/0x0004000000018989-544.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-605.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-636.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-722.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-840.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-871.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-884.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1042.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1073.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1128.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1147.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1218.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1321.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1340.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1365.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1372.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1373.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1380.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1394.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1396.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1397.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1399.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1400.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4760 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4940 2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4760 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_10f93b2c0f171dac84909286c78fe6cb_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4940
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 907KB
- SHA256 3157d947f3a809b53f18df7f08946e0d3957216ae86ec2e965391a487b4ae1a6
- MD5 10f93b2c0f171dac84909286c78fe6cb
- SHA1 220cf3c5f0cb6e53edc3761981e64d9b9a6ad2f1
- SHA512 62371b68ef8e38de26d79799bf0de574404259059684e01b1f58d49f012153c6075aee3a9a5e5eb01d405473a132e228cc9e559ca41e363b3bbf2fe0d5ae58af
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF:A3k03kB56r
- TLSH T152157B13E6840FA4D10FC1749AA68662EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 53713b449b4c166e22052ee3a6969ff88881e0d125312ed5d638c8a9f09add23
- MD5 b54251a6c7b485b2f88a741cb856d215
- SHA1 07ae26689ccd0595952b6717e1f000dc716b3c0c
- SHA512 d576f11eb0037d88a2446ea3cdcb62fc5bdef0d07165c70af7b338a1f52efa7a671acbd202d365a269bfe7887cc6d1a81aa2c2ed21ff3a1e60999bd2a6de2996
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFP0Le5ji0hmxNrM:A3k03kB56rLPji0Aj
- TLSH T1A5654A16F6A44BA5D02FC074C5D29666EA733C421F3087CB1354EE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 921KB
- SHA256 b9cdb0cb40e2be8548cdd536b49db949a473fc95f5d2af96f2b8d2f37a778948
- MD5 5e4d50d55c67f479e59371adb6c946ba
- SHA1 1a5002aa4e0e65a9ad4fa9398cb92a58c033f989
- SHA512 eafe9bbc8b9c7c7654e68c04040ba42531e47358df5f1e859677fb8567bd7e966f88e619ac703ba8ff1be5f76ac8050b3d04ee8ff68113d64d86b35115a9f7d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFRa:A3k03kB56r
- TLSH T10F157B03E6940FE4D10F81749AA68662EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 930KB
- SHA256 932a451b0ebb7ffab7b54985b980712792c4c1f6e09f8a7c04572f8a0d6a79d1
- MD5 8a5b16a373c2aac67f8083eac6766826
- SHA1 189bf562510f7c08ce125212df7cf0634c4eb006
- SHA512 24395bfec311d1e5b5dc88ecd5e5fc325c15b161a5b397dc73ff45b9e702d3f8497faff0503eda36fc8ebd3551325c89538458238b78cc8e9af1a15b5ccf2515
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFo6:A3k03kB56rT
- TLSH T1FF157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 930KB
- SHA256 142df2a34ecff05ba6d2fcd2ef4e220572a429de8f58e6a60ee3b727c159e1bc
- MD5 442171cad7f75676197512296ad35573
- SHA1 3433b544d2a34fa494fa7bdac246246eeb73a3c7
- SHA512 736943e4e085593ddf43d5d111261bf2f032063545fda649e003fcece3cb9a1534772ab299b7b3bfc60020ab71999531fc18143ebf882b13118bb1455b371d09
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFsN:A3k03kB56rO
- TLSH T147157C03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 930KB
- SHA256 25b8db2f3c561f46fe272f808a67e54668dcd64469ebf3f0165d5dfa287e0271
- MD5 14c150db2636ffb38b1e3ce63f5ffe45
- SHA1 f9b7e466547af9efb066de7a6aed7d01fd9e6cdc
- SHA512 c212ed99db35f4db1338086af1a27930daad588f22e392659b4adc4983a34e34b1fb5fadb61b124fe93b290908a19fdd9eb0a953cfd9132bebeb0f33a15be86e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFif:A3k03kB56rC
- TLSH T172157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 930KB
- SHA256 50ee74a76de11dabbf5c7f59f7c7dc54db6d5bcc7740895e85aed1005e8a1472
- MD5 a00ab9aaca2ae06a44018913ca479ba4
- SHA1 48ca6d95918fb85be1fd6fc086b33f37ce45f014
- SHA512 bfd034cb95d720e4fed1b5b4e61df9311d1d314d772de681c0bd2719b1944dab467b04b62944f3a8c17a981698b4f1114c62b7928d4405887936b94845a8e6e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF8o:A3k03kB56rL
- TLSH T18C157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 930KB
- SHA256 a5c1ee72f53f9ca633a14c58261b50aa4e442bf18e27d5cbc4bbd5fb87d530e0
- MD5 74cfbc7e546076ce43478c7cce5fba4f
- SHA1 fd276a87d6a21274942b56360b72fb67e4c822b7
- SHA512 dc1e33c3bb0965888987034e47fad85c9f30d666126b9bba2f0cc4794455b02e8e4b3dade7bf7c6adbc107459bb5a8e60252aa8e4beecfe18801700ee5160dc5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFcu:A3k03kB56rt
- TLSH T1C5157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 930KB
- SHA256 0b1caecea5b1e7cf6817c5f93ba5427129e6972407903531fbe65de96a1b7075
- MD5 5e24ca333693f759a403ed9dcd2e72d5
- SHA1 59e53f9d1ffd35d899e7a3bc8025378ed2f69437
- SHA512 e7fdf05361defb72e1a3e7d3359983bec9b35ace0aee139e7651d36f9172315ce980720c46e1c812c3f218a65f8a9384717098615ae2c986f35b72e02fdeef5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFg9:A3k03kB56rY
- TLSH T140157C03E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 930KB
- SHA256 9a5f8a8292fa93f18561a8eac0c21870e34997aad20d9f6d5cbf4476836c95cd
- MD5 061ccf5801639f2573347b1283e62b7d
- SHA1 dde3792220d1146c098dec198df6d332357c0dc1
- SHA512 cdd19a4e3868ea3d8dd94a49a4b8787d73b569a95f23d5d26f4044dfce9c6a774d39280c9c08bb905cdd070f8daeedac772487cabc58cd9184096474fd45db40
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFoc:A3k03kB56rZ
- TLSH T1ED157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 930KB
- SHA256 89e0d0ee1f8b55a8a31c9409efeb7c1e59c23f7707e2ad247236ff3d066bfa93
- MD5 661e095f9d6371db4bafe246dd22aba4
- SHA1 561029462e68203891377312061fc8a9a0f8f379
- SHA512 7dbe566a5b5259498ebc869048b19e4ace9b472340d2c5f8d113591b6d43e82dbc6a697ea0006201bc225a86b861b8b08b91debb563f578a96c8cfe3deb86793
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFBp:A3k03kB56rX
- TLSH T1DB157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 930KB
- SHA256 edff8e8a157a7eee19e47983974f25b526913605c01d3d77c5532672da540182
- MD5 aaa82621eb12a34006e88f8bb1327333
- SHA1 a942e38d9e08ec7cfded5ec1bdc8efecb8926581
- SHA512 ef17b2e43ea3f8e5d62d6e0c90a2b312265f80fee02ba33dbca94a984a398911aead2431cd55843e612cd626a460cf86b3b4e513f2821ed92ef86ff84d4de122
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFWN:A3k03kB56r8
- TLSH T13E157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 930KB
- SHA256 6c23f1b0096452271d606cbf4390180b360baec512b17f96618ee70d6686e297
- MD5 8aedfcc23157b9bcbbadf114dca89f54
- SHA1 0997c08b3efcc4d5b966f487a89aeec63bac50cc
- SHA512 fe267bbaf99eea4771b9a2e7762af3dccd98550c3fa07374924e08beab63a2ad50b40136026a58a877478844a77b055e5d9021636e289df3db72226711ba9681
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFaF:A3k03kB56rK
- TLSH T1F7157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 930KB
- SHA256 38f56592898fe52bb07a8b9df8a8437e8135b1d84d8d59622e54c7dd4b53100f
- MD5 aa61c29ba92f9e548851ba88e237cba4
- SHA1 9c5a7791b9c9f2529ee0fd1745ac4cf8fc1a1a15
- SHA512 ee2e192089b1bb2d31b379dc498fa87d609944c2d6d0111de25072b6f048017ed3e249a5c508da7784c93d0c581720f004d011c9020ca0ae2e7e48f6db252a34
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFvC:A3k03kB56re
- TLSH T14C157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 930KB
- SHA256 c834f72414e2996f5e817a804c8306d44461aa3c1021ec637e70031e3c792d58
- MD5 e006d4cb99195212e2849980d0c5b986
- SHA1 644606c629b78f0991587c385f036bd39722bec8
- SHA512 11c579654b4156e1c21335da9976a25cbe6e99281b794d391aea66532818d9a048248b420c70053abe5378120fde0a80bec596788a20788a94c618cc33c7b28b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFQw:A3k03kB56rr
- TLSH T11E157C03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 930KB
- SHA256 6176b3fd0f7cca823ebdd1dbd518aa87392d8a9ca5c9730af93fd709bbe1ef4a
- MD5 59946a3418e063312f80f382d9c73c92
- SHA1 2a4981dbfa4cdea55a0c0f8fcf2c367ae7ead636
- SHA512 841a07f7b4eccbfb61a44c3b9bdf411171298ba34b9763f37138299ff032f2b2dc963ca8a0d3e1be42992b32dee0f491c03ae4d138bd69cb37099e5c786f5f67
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFvT:A3k03kB56rX
- TLSH T1BF157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 930KB
- SHA256 2d6ad75434adcc6d75bb6047f37d2245e7fd18b54cb5847958b70c30b0d2ba6e
- MD5 50be42b1db31ff8644a18d78874e1eb8
- SHA1 df74da9e96c144e03e56f027d015a6968709a8da
- SHA512 f79f0f9af4fedadcb4ad90f4740689dd5c6dfc247993a365b793ce7d83aa784105691d3b477ea6300d1d0cca9c8973e1eac7f1137cabb334df0df22ddf2458d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFpu:A3k03kB56rY
- TLSH T1E3157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 930KB
- SHA256 66604bb54bef5cdf18ea5eb1734f19b1959817588a3f112c8cdd01d4bf9ae226
- MD5 2eaf791a2211243bf4f86b47a905028c
- SHA1 314ed5c90499bab730afafabcead60e29bed0261
- SHA512 188d9d2e73ab97633749c6556342c82231fc0c1de714ee3d24265780ae96d0aec2a2aa60338cf78f30b9ac3640e496323e2ab9d3429649c992f5041e7e57884d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFhb:A3k03kB56rB
- TLSH T1DB157B13E6940FA4D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 930KB
- SHA256 c1cdb670d8e1d4e9c5c2876ba152a76067a409dc9afe69c3a2acdbf78271c1ac
- MD5 e725dd234c6d03a19edeeeb2456e802a
- SHA1 899e6e18b5cf030cdb54ca3fe1f93b09dd8c6423
- SHA512 56f807e6b7017c43f0edd73c2232b9361d7543dd2abbc718255776da34d2c65c6b6cb90dc596942b42ef4e51df9ab99a150a2de37280250404a9f56bccafa1d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFpf:A3k03kB56rB
- TLSH T180157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 930KB
- SHA256 ee405f8e780fd0eefd3cce8189ab31bbb5484f34d0c1b4a4293969b12ed6860d
- MD5 cc563b6183aeb91c3aae28cda987e0cf
- SHA1 fd49b291d55e0f10be4d40ee42a80ee793ff755b
- SHA512 d6309e2279f5c9763d70f04f70053863b0a960f3bba472cd10550cc11f8a428e7f6ad3077d4c3f6f843924cccc6c172b59180a8ecfa7ca78b0b8b9dc1cc44fed
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFSK:A3k03kB56rZ
- TLSH T1B8157B13E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 930KB
- SHA256 d610d0905118fd9dd7f2f4855f693b1f2fcb9670b1139fb376dee961e2010371
- MD5 466ce8241b127c0282a841be97958224
- SHA1 98620d08afc64897913fb09213268ca7e33d6971
- SHA512 d061b64e589f5d2c4ad6f48efbfaa7a046b1ddb659a3d12e38f710d331ccf3b83de9732ef4f492c495b8583e5de9e08aa8a820f2ad1d206a0b15cef687e1118b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF3k:A3k03kB56rQ
- TLSH T114157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 930KB
- SHA256 9e9995477dca5b4e5c9b4d3b7d69eb91b8f01e5c18db3e8ee8060c6441178bbb
- MD5 acac740d01e33f0904d79792483e8fff
- SHA1 41c33d253357b6ab5c0f209d4c8c7f3bf03452f0
- SHA512 9acc6beed6095ef21b543c92cc4ffa34a050e10bda3bce91464c4c37142a5a2ffdb2d68f6611bfda5f0adf177025352f618d1e3c9e50d31f98af707e770c0bf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFA0:A3k03kB56r5
- TLSH T137157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 930KB
- SHA256 435fc0815dd6b26054a856a1fce2687baf7eb7a113dc93da71eb36bbbc26ca8b
- MD5 739ea70e9b395b1a6cf4e35662af9f5f
- SHA1 648354067a3b1be73086db8d2a29872aa6d5db7e
- SHA512 c6837f5dd68c91595912fe42251cef912b6c91dec63dec6c5c8c9efa44ebfa87f86a79e145dbf3966b604cd7ee090ba672ab9a6a3664b968ba661069d371ad51
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFbg:A3k03kB56ro
- TLSH T138157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 930KB
- SHA256 c9fa95e65a70066771a097079c13cfe8e8d45c58c06a6a417f799ac8235b4227
- MD5 6e19cc2b0864217e6de4d6fa5f441413
- SHA1 b51bf5150d737fb2d1afb58b6125332efdd56e48
- SHA512 1e3fe76cee17c3c652bacaf5ff1e8bbf6b7cc7044ed54cca5109130993a5887d96624dc1f8c34c6a54a84351026c8324e6ee06ef393d407109cbf5422dcf611f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFWr:A3k03kB56rS
- TLSH T10C157C03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 930KB
- SHA256 a114ae3fe6bc39010dcee4bb37d36011fdc3f1a2cff01796ca42b4284b462bb6
- MD5 f1dc40e1668dcd85881b3d1643e161bd
- SHA1 b707161f1b716b1f22a1fd0f8ea12fc7ed0619b8
- SHA512 03e742f7446060013cb3ce8a49c258c3a160ba79d985fa2a989bf90c32481f323babe328abc531d14e672363f74c081b9c6f99b5842ce5a5f3df36a2cee24e87
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF8n:A3k03kB56rE
- TLSH T107157C03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 930KB
- SHA256 4e74fe6b0f913e51b52817f6b6ee51051c1a26245285baaee36da36a4a515eee
- MD5 a9018b0fcc37965207147fed4911dccb
- SHA1 e68ba5cb3155e08a7c9123479c91f3d7b955e5f3
- SHA512 477c315a0922783ed50677992ce462ed6168bc0c44ff02ccb343d25c91816a393476591831609dd2f537733df6f2e6eb9e720a18441b5023c6e67e49eac4513e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF6x:A3k03kB56ri
- TLSH T163157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 930KB
- SHA256 d20e3f02cca6b57ce34fa1cd9d944ec8ca654a279af37dc663f0ca4b37617fd4
- MD5 e434a63d8e3285470ff345b4dc356162
- SHA1 1fdb0362c1b90730e4483114b6f8e7120b1cafee
- SHA512 c5050d25c158e0274c2d5e7a064360de6e8783f2954c31e2829b408ee88aed3f86522144bdd1d59302aff749ab12190b6839b110e13122cae18fc23039bf76ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF8A:A3k03kB56rB
- TLSH T18D157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 930KB
- SHA256 a7a62d266220854ac35e28f715069d088edc409ce83f7ecd953f850ae6e7bda6
- MD5 e2353c88783bbceddbb50b5cd1561145
- SHA1 e6df4aaa2fcc35cac1d6a6ccf2e3464103003ff9
- SHA512 5c92a7e306a1104ff18a4ec529d5b65eac9acbdd5012e76dfe8035da5f5cd6d602358b43b321b83c1e9983c1bbccfa9626b350e7f50e1e592b1bfd1f76dbae95
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFl9Q:A3k03kB56r4
- TLSH T1F9157B13E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 930KB
- SHA256 e9a3f815134a08bbe01cefbfe0a5c913138a25d77390ed928b18432d07905ef9
- MD5 3e7947c5cac1caa748cceea4bbc40057
- SHA1 432b907131dc9f82f570aacb2f0dbbbc0540a928
- SHA512 2857d7a1078d647a7d1aa039ea735060e95844944e5539da3c3c4e481555031437acdaeb11f3a3255de50adf810789647b04ebb1162bb901ff331773fbde9b45
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFQ4:A3k03kB56rD
- TLSH T11F157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 930KB
- SHA256 6e1c746e73c8467966234aaba677ea573cb9e591e92aad050d8f67b751c5229a
- MD5 cf85d446ae02153d7cb13e7f8e46bf77
- SHA1 9b8af0d6ea4a8544e57133faed033c6fb9091674
- SHA512 1a417c7828112349492e125cc747baf1be1618311bc23ade3525065c61d5091055007f13cba43c77805419c3d47d9b23f9e24ed268875b502b6256c19b1bd7aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFTu:A3k03kB56rm
- TLSH T14C157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 930KB
- SHA256 089d3e91f00d92b2643b0bdb9366645db35860e8881b532cadf7d7543f8f1db7
- MD5 fcea0a4ed208338c2401c83ab5333c1a
- SHA1 cb95467fdea32bfdc6dd593df4840840c8a9b665
- SHA512 24cc9f5725cd0125671ad44aed0ff4bd4c7d8dc4e179fd4068fdd089f085aeba95904c1b3ab352a8436635fd44e116f863b81ed96ae962d8286c53d169bc1b7d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFOj:A3k03kB56rY
- TLSH T14D157C03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 930KB
- SHA256 f0386be57e5feb4dbd254708acb9b5f2b93549375465b0c1ed251d734e0cd9f3
- MD5 e13bdd2175f6888ab85dd7e30e4a7bc9
- SHA1 8ee71999401b3b2e87e3d089545b5d6df14bd38d
- SHA512 75f518bb8c877cbdee1ba02f5ce243b6aa7946f6478bd00398834bd91b22cb9b4e664a3a9947db42e164866b7f4ef172341d6977a3f4d5360ed78c505394bd97
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF7g:A3k03kB56rg
- TLSH T130157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 930KB
- SHA256 751b7519c9aa304fe4cec0fb48be95dd76e6b0d4fda4541cef83f86d8b545ed1
- MD5 a93d794f763fcab4a72b586fcaaf6564
- SHA1 2a6aefe03409c8b8bf11fe4dd0f2004c45cc1f53
- SHA512 f038efb8bbd79e1b3d08deee5614458f1d42b98532d3920e5c8d2c37ed16582a5921cc941b133820c9f03b1dc8a47ae4849de85dbd673d07004d3307535f8e07
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFmI:A3k03kB56rh
- TLSH T1D2157B03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 930KB
- SHA256 604216e1a8d93d3e48b4bbc2c825769560c3ade571405902451a1c634634783b
- MD5 096d6b4f20139d39cbb9da1b89fe9377
- SHA1 36a4be9acceab4ed74cebd46bb2fe31a63ad0bb7
- SHA512 9c81563f7a2e31c78ed72d5efbe390b2de491b8adc99cc60c2ada5bdcb3a8556cc6ce9accd4de196d96655a81d3119839af492a6309c270ed38d2aca76d80588
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFUo:A3k03kB56r/
- TLSH T1A9157B13E6940FA4D10F81749AA54662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 930KB
- SHA256 367ed5b6b923e9e69c4ffb1b16e9faf7188622a27d8b948ad214f82df8fbd8f1
- MD5 65e5cf7f755f0ca57d62ad00cbe7386f
- SHA1 c4bf6abe9a7f3a92303147da1e205e0bb1f8e6c1
- SHA512 3bc4533ed04dccba21b05db019e4119e6af540b06dbca1a2466f221dbf82b041f981c867979f0cbe5360dcb78c12ee8a51842d94d76d74b0f5e1db82a3a61459
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaF3+:A3k03kB56rK
- TLSH T19A157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 930KB
- SHA256 bd03441b6ce867eb32a0090dae78baac105510a3766e6d362aaca792c52b9daa
- MD5 0bca414f4d36e5a7b5ef760a949e22ca
- SHA1 ba454a91b0feeb95739f9987615fc394f5d9a8da
- SHA512 26503d1345c9980ecca67d98c0d06a59ce0ca787d6a511153585233b61a799fe0f38bf785adbd1875d5283ed3d0874b0e14d5a68236e095e86e5ae97d652af38
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFNQ:A3k03kB56rO
- TLSH T125157B03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 930KB
- SHA256 b920af68f45a0ac2f609e3d3908f692f931b24b33b8ced66c82dadeff84bad26
- MD5 18afd81ff342beb96c729f5c7d21e5ee
- SHA1 234976a9f101807113914c9de521e20930991640
- SHA512 fcc6b1b14cfc3360515c9b4c28ca87dcb7790da19c550b32d1c50ce40f724b6f30a8c200fe44e62d816b52d9afa8932fe6259c758ccb23141dc837dc82903c92
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFCX:A3k03kB56rO
- TLSH T1B7157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 930KB
- SHA256 4152407aed65d31556c7499ad7e1bbaa201991dfd2e5b17bb09e9577a007fa7c
- MD5 65aac2611ccc1469558e1fe866d9df75
- SHA1 06ca6af5c140737059e41ae141b4b704d0998ac5
- SHA512 d7c33e8826afc853c4d69b2ea5d86f5bf5792cb1fcb91db045bbc0c30bc8d86b1a89cc8f340731c84fafcd8513f7ce901786bdd7c6ef0c6828a21b2b023eb07b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFkL:A3k03kB56rg
- TLSH T145157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 930KB
- SHA256 dbd1bd6960d4d7486ac4c79320eea7ac4967dfcda58a97a37fa452a508c30f9d
- MD5 5881fadea367eb808d2d419561dccd35
- SHA1 98940312c3b1d6eecfefce743a7734b82cc4d50f
- SHA512 631e6c2b2ef2bd7adf3f4a2ec8a9d0b0eac4e7b140838325a4ab18ad8fcb9569bc74dac5748f50d35c87d9cf16df5c127f47ee2d6375b96f0d3f444f7520e4cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFAM:A3k03kB56rx
- TLSH T1A2157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 930KB
- SHA256 d18ff20d22f15460ef84ad5c5551b1586d208a9dceb23cf5ed871c004f518e76
- MD5 376a26023ad8ce2f06b641dd1b9a3aee
- SHA1 697fdf3a27a3c4be8331317b93d3f8c5287b774d
- SHA512 a61d56dc333c52d32e609d8e42d2e3e7d43a8083d45a039a49370ffc49a7c7083b0889c0ead98eff7a648eedd941f5896fa7227927168cfb774531e6be03a1ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEgqbLaFhh:A3k03kB56rD
- TLSH T15C157C13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH