Analysis
- max time kernel
89s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 21:47
Behavioral task
behavioral1
Sample
2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 835KB
- Sample260817-1m7dnazfmc
- SHA256 0eff1aeab0986bd15cc9fa211b7a224cc8bd6f4bfff44a34431de1ebd434c7f5
- MD5 9919e3bb3ae05eaf74cb10938016cffc
- SHA1 7e32e58a0e8c5d29b7afd3e6eb81f2bb8bdc5af2
- SHA512 2ebc81913d53c9196ba6e814571c8a8424ea294b6b03f581257e8fbcc7d65949185133646dc2ad5c9fce6e4c03202ec80f46262d4b4f04188c7e37d94532222f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa:A3k03kB56r
- TLSH T18F056A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 44 IoCs
resource yara_rule behavioral2/memory/4108-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c572-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e5-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4108-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4992-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019840-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001ba83-440.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0014000000018a52-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-716.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-791.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-822.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-853.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1006.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1043.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1123.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1148.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b1-1847.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c572-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c2-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e5-39.dat aspack_v212_v242 behavioral2/files/0x0004000000019840-228.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-259.dat aspack_v212_v242 behavioral2/files/0x000400000001ba83-440.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-489.dat aspack_v212_v242 behavioral2/files/0x0014000000018a52-508.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-599.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-624.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-716.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-791.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-822.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-853.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-917.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1006.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1043.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1074.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1123.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1148.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1211.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1320.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1333.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1353.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1373.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1380.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1393.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1395.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1398.dat aspack_v212_v242 behavioral2/files/0x00020000000066b1-1847.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4992 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4108 2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4992 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_9919e3bb3ae05eaf74cb10938016cffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4108
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4992
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 835KB
- SHA256 0eff1aeab0986bd15cc9fa211b7a224cc8bd6f4bfff44a34431de1ebd434c7f5
- MD5 9919e3bb3ae05eaf74cb10938016cffc
- SHA1 7e32e58a0e8c5d29b7afd3e6eb81f2bb8bdc5af2
- SHA512 2ebc81913d53c9196ba6e814571c8a8424ea294b6b03f581257e8fbcc7d65949185133646dc2ad5c9fce6e4c03202ec80f46262d4b4f04188c7e37d94532222f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa:A3k03kB56r
- TLSH T18F056A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 934KB
- SHA256 6c685951e519742be2bde9e11e16ddd56c6d5f7ecadd23040397d027ad7c7dc6
- MD5 86d66f49229058e8c3f4078edb78ad48
- SHA1 cd1e959e09192cfd53508dbbfe19e4f252210d2b
- SHA512 2f763059395653f3029916219cd09ffe971a4c5812536e2e93245fb59978ef0e8b5ad4fe888641e6099ce061ba8c5f01307c83f56796a350aebcd97e4a64425d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa82MqDBxc:A3k03kB56rEMqlxc
- TLSH T1AC157C13E6840FA4D11F81349AA58A72EA777C121F2097DF1354AE253F32BD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 64b2be7fbb7ba6df261b5a78be586f3c98b8bb59c24e47e62ccdca45ea04a3ed
- MD5 38d1b7e762499ee7bdaf48272e7c0b9f
- SHA1 cf6da51f011e86b8020c374958bcd57c94fc1bad
- SHA512 5cf839fd87471070442a740f84b3245bfbe7b126c8dcf80ed02f724feb86f817ffa9f6e13bc3c4e76ea8506b2dfd12a8b63a240288a61b06401319602be20084
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaP0Le5ji0hmxNrM:A3k03kB56ruPji0Aj
- TLSH T12A654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 850KB
- SHA256 872c15cf848ee4951e8335505979ac9d224158a7438c4e51f387623970ed3dca
- MD5 7a4f178247ab0938ea19caeb4b38a5c3
- SHA1 da329efb186c2095ef3edebcba98e7823984817f
- SHA512 478b351940c8e0e1ff46a0ed123fd945ff00ebcccb02fbb92dfe5b99fba298096279ac0d74aec086ad9397126b4515d9a2f492b2ecd3728b007df08e3b6fc918
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaRa:A3k03kB56r
- TLSH T1AB056A03E6840FA4D11F81749AA68A62EA737C115F2097DF1354BE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 859KB
- SHA256 e73593d15d76b71d79d8f4848bae814a96ae18401d6e724fcf776d92591d62c9
- MD5 76850e461ebc78e72ca6287097cb5f76
- SHA1 2a2c14ab54629d17e90cbda6bb1443f5177486f9
- SHA512 339efa4fdd21a58664693e183ed56caf40fec0f1550b56523732b2d625beef6215edb0b23fc975bf2ba79f1c8fe35db3432b3904e7500aa13a75d63a258650ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLao6:A3k03kB56rY
- TLSH T161156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 859KB
- SHA256 f9bd44232fcd092d8743a42b910a28ac69e47f6b862f823d4e93e42d1a4066c6
- MD5 2ea6bb2d0ebe2465b4b5661f587c20ec
- SHA1 6d100bcf62518ac761852604908709d6f088551f
- SHA512 8eaaf9395141315d61226dd2764d6654df6aef7f923810891ba42042a40b8818d92e31c7c338470ef1f6ff13b5688e398abfb0e91ed20ac7fe7b6b305914d213
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLasN:A3k03kB56rF
- TLSH T17B156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 859KB
- SHA256 9d52a77b65c18eda4140e940978d4175caa6e7c20bcf9a63e467cda1f1af4c39
- MD5 f82c0f2893f5d4d04fdd98f131a8edb3
- SHA1 0949f676bb4fbba8dc9897082e1d51ca5f9a1f66
- SHA512 dd55435a36042468bfca9e8744d919ba62a82aae6126b9f254c72f30767d24f53ba4874e888d71f04f0c7b4814cec16624a1311a2898157e096ede42c8166670
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaif:A3k03kB56rd
- TLSH T17F156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 859KB
- SHA256 6ad12259a0d245f8cc361c4146f700458d40733c67aaef536de85d56c49c0b3b
- MD5 6da4e41700e81389f38c0fb10218d58c
- SHA1 b96e5f28095a2555be93d812776202b3add33ff7
- SHA512 b49463ffeec86df62130e780f4d25fd3869a3ab19b0404378c6a9c35223906d155c7d9020f1843d2434dd0630a4653f459c2dbcfe03f6ef1292043b5482dbbdd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa8o:A3k03kB56rI
- TLSH T12F156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 859KB
- SHA256 f949412b5eb3fce49ef43a9659654b44fda9c0d8e71a9af1020318f776960a2f
- MD5 607324ff19fadbd3fe91e74086bc4e70
- SHA1 fd5e08e0305a65965ce78f22c396784446872897
- SHA512 85c657f612cedbcf602c3a5aeed515e9be8d16b7e025ec75490099dfd3ba56db2ee8e90d90a799eba7d6a57c55e6503e5b17e25f6d554da626e459d4396f9547
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLacu:A3k03kB56r6
- TLSH T1AD156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 859KB
- SHA256 5fe4dd65a92e27e9785cf31e4b4f0ec2b7b56b051f48ee4ca0f3e993b1be66dd
- MD5 5482e9fda59894fa44279c39cc073c34
- SHA1 f40cd191152af9ee06a45f6ea580b77c3f8f1fd6
- SHA512 d32c16780c31b72cf5bd79b23fb0535bd418aac4c2cf00be103004845d6c68304322852f8efa90153daaca71681e7b0de1617ebb9e65424ea209c30a3fcbb6df
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLag9:A3k03kB56r7
- TLSH T17C156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 859KB
- SHA256 7f56912193e0667c8427b53f4e56d6f9245a6eefbb0e778549c67cf7c3528996
- MD5 f74c08d6828efd59441590cbddbdf045
- SHA1 b65db594f5ca283c4f560e9e066532bb1da12681
- SHA512 2ac4cb488c0e2ce5c21a0a977a6b47471952f6cd5021164287202b3851a470c8a966a835ca229f6eabf363b046287c7e887f574b9e2ffa9dfb6fccc08dc81fd6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaoc:A3k03kB56ry
- TLSH T19E156A07E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 859KB
- SHA256 fad18e2753f9f190e8e3cfe75ca6d1c55dc454f0e7af904a80a3aa066901334b
- MD5 b1445d4abe88619bdc5b06dbfc9d9c97
- SHA1 daa516a45426309c90eb77fd9f220b70e37b519c
- SHA512 e46e81f8b11355641782976edc5662ab1d05e5636cb90a4cff39eca23b9d16171ff2cec897ab15d24e24b7143edb6e703ee9731d62d4b1cfc2d4d6f868f6d1c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaBp:A3k03kB56r4
- TLSH T124156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 859KB
- SHA256 9cc3f096ba3ace0cfe381fd43bdfebb6278de76fd503bb070677409623e65e0c
- MD5 f53dd93b999f308d51e7a6dbe78bca15
- SHA1 f0da8d8578cb8a397741608dad85fe5b7eb1a0d9
- SHA512 0189f82630966daf5e875333be41b681506163ab9f500a3503159170cfc9716d4ec40f0c8ca5ce33c0db14eeb1d7daea018c65e471b729b9fccbd1f28f679ee4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaWN:A3k03kB56rn
- TLSH T131156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 859KB
- SHA256 506100c1748dbcd9e1b024d696cd21756070c42c9c3ba92febfcb89715d95fe2
- MD5 d30dafaa600bb2943428fba6454eebf6
- SHA1 9034ccf925bddcded0c95e015e2a7e68aaf6c608
- SHA512 fdc54d2f65b8fdc6dae125a522f501422dc4bdfebab873cff862717fc37926b164635989a3f5a76470d5288f476e009d047567b3e8f5467dd4ea6701e1069a51
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaaF:A3k03kB56rh
- TLSH T1B2156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 859KB
- SHA256 3c4c332b2d44261b87fcae5643b48a84409f9276a4101a0951d7f76d15a8bee5
- MD5 e9481f7c6803ca95a4593458deee717f
- SHA1 0546caa30c72d180f601671b4a2c3ed4adfb39b2
- SHA512 52380f6062257c099e39dff5d5f58bd94cc664df5cc14cfef9367fb0e5497b34b3005f995cd047797a110cb0b3a2c40cf0ef96e4a9cdb7f202ca91d368dc7c6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLavC:A3k03kB56rN
- TLSH T10B156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 859KB
- SHA256 e24d313f5fe0ac4ea643749e4e54f4d4625136e90d370dea3f0a70d2d6109080
- MD5 84b388f878ba2a92a2904dbf40d4876a
- SHA1 9ed6d8d81c45217038183e06d558d5b72c12fa87
- SHA512 5de68c40e8e0160107c3f5faaca0a0b4d825bcf2e1098b88fc6d476a4b7fc52819c42720492221b62e408fb8ca9e5b66b9326f92e452c18f7503bb6b8e5ccd61
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaQw:A3k03kB56rQ
- TLSH T117156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 859KB
- SHA256 063b749829e59415d75ce24c10435fa8a9b5e995482d2f0d15c5f1d673853b9d
- MD5 ec075d173340424061544faeeda6431a
- SHA1 f5b4b117e777691bea2ff4d539e1568deae3e351
- SHA512 773b6fb15bc5cbe77efb33dd24249a8bf7e232c41ee42ad31efb62065dfdcddebb248907e283482f984993b4137d05eef95c2dce81f5a15c7da4223acc94c9b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLavT:A3k03kB56ro
- TLSH T169156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 859KB
- SHA256 7eb546f52632f3b84407a6ff94b0542fdd8d55d7b7f6e0541c64ef5f5c514152
- MD5 e434a34b0a6ac25b9d3a820d40c76157
- SHA1 73ae39ca8fda03f495ef0722d96bca75ee30d458
- SHA512 d3d152fd760039f2fffee05e56d6beda7ff1c2c0cdaec3c2bedd8a95a0b86b78136373ab439765d5736c272626668eb1fd7662aa6d751368f7183a90695a16a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLapu:A3k03kB56r3
- TLSH T1A9156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 859KB
- SHA256 40ac15956af8be8e044ed82de59408474094b961d9ead2ad25f7079c8e9a6131
- MD5 dc38490ce910ffb700e547a8ebcb876f
- SHA1 5d134eac597c224d50b0f5f4a5ef7b47c0e27241
- SHA512 1f89c7894d31355206616e2b73b13b1550f9eeddb2c06bcbbc16a48458510f16dbead22c7754fc4dcd8a36ea5b4d93cf4b36c8f083a6abe0269539a3636d651a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLahb:A3k03kB56ru
- TLSH T15C156A07E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 859KB
- SHA256 c784551621310b6af4bbe6b9fbddce8dd76f08df9b82011cb4c5d030987c1d17
- MD5 477a3d2576a75da8133d34198b590460
- SHA1 2a8dd7973f3e68c8ceb929b1c7a43ff1ba3812d7
- SHA512 247004069db493ddac649c2d36ba1caab06e72505b9efc736cf906d9f0833c0b32cc9d8e1838a6ae9cabbf4c0414512d941732a46b53ff8bd756eed437d03279
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLapf:A3k03kB56rO
- TLSH T164156A07E6840FA4D10F81749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 859KB
- SHA256 31b2f384b057ed5f973dd4a5de9a6474bbba5be03838b99d7ff7b449802672bf
- MD5 7f23c3a743042a66b5d7c4ef26571aca
- SHA1 e346c8690afb027933427e9d0a962134cdacda3f
- SHA512 64f31b7b7c6342303527f7d1eda911688ebb126d7944c9dfbc653e5897bed23670871299ad49caa2c284c8874091364fc1c3bb83fa74a75b9f416b3727c88660
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaSK:A3k03kB56ru
- TLSH T1CB156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 859KB
- SHA256 384067a7d31d7a181c7a7bebc2fd86259075613512819a235d1183b998db3300
- MD5 9094b438f8f175e72bd8c445429c7072
- SHA1 c05d41ebdb382eb8773ea39f125db9a557c9b244
- SHA512 ba701bd3001e96db3c444e36faef6e763ddf821cc02050db3144a4de06e032c5c58f3f34f4af85fa94fc83d9778895b53ee41eea7ba5ce5348b8975e3a48c7d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa3k:A3k03kB56rT
- TLSH T13E156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 859KB
- SHA256 6dce19f6d911ca9f7d379728183de91fa93eda990ab0c3fb124ffea0952eebd2
- MD5 cdaedaf491270b58d2d998d881559f69
- SHA1 0c8dbd7558076bd68a5c85e81489ee6c4c214ad0
- SHA512 2f4846234f3bbeaf28dcddacfd5a5ed717cd03212067728dfda7baeac47cc00f1c8cbad46c925b304d304f491aa2187a545ee89837fefca93d042c180461f012
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaA0:A3k03kB56ry
- TLSH T165156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 859KB
- SHA256 3f91e25740078a451d4d05a662941cefa4a7f72f0219f023902a782d582f3531
- MD5 e15d2c574e4081487e38b91c76065398
- SHA1 bc9b5ccbcbf48226ed880a314570f5dba16c9ed2
- SHA512 de860ef884eeee3224a12b704f1c2d90191da84c05772da12ca7ac18cfb49df6fbd0fc06763838bd2ca0465373f7044dff6558fbd200e795776d9b09d7ac3936
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLabg:A3k03kB56rL
- TLSH T1CB156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 859KB
- SHA256 bea3b8a8ca779152f1a453bf66c2ceed81b4b7c5940e9e23cc326465de305afb
- MD5 6b1a16870ee32bf2c5c6517ac2d1e725
- SHA1 5b6c2693fd25d3e99e144882952cecd92e3fc69a
- SHA512 cb96ea262816af458975ebc1287082bc33cb26fbb215e5b8360368d37767a24817cb13745458381f19d34f84cd1c2f2888fa93aba8c60a37fdb1df243d55de37
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaWr:A3k03kB56r9
- TLSH T112156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 859KB
- SHA256 dc67a54b50aed055aa8cffd5f67701b48533cfc4685009847734f44b5c062e0b
- MD5 4304759fe0f211f3ae4fa863b6e427fd
- SHA1 cf738cbafe2a457c3c7d2d5b4199b701b4a3a54f
- SHA512 ec153e6d68e8fcf82adaf84fa3b2206c1e58d0528a6ab00ccecf96ef438d06be36fd75447a808c20c8e9ef58a74b2583007eb82ea67bb83d90f752bfa084387f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa8n:A3k03kB56rf
- TLSH T1A1156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 859KB
- SHA256 6e49dc0195b3504e7abf9326e9a9073a418eed8cf0ae22fa2ba017a8ea3635e9
- MD5 7a9f3d057e492fb7e11a602819796431
- SHA1 f028a2eeeb2563bf020dc9572200b24fbcfed8b7
- SHA512 7db89608d1532315b7a3edf1c826accffa0ebafffd278c69b5f381e4ff7426e3b1f25009fd5332ff5a7476199ba4712150a4daa6c585604943552b3045baa440
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa6x:A3k03kB56rl
- TLSH T1AB156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 859KB
- SHA256 d43343a682baf3f9327f6913c2b2191db872a44beb56b35c53ee186a16eba90d
- MD5 25c3f5c52ac66ca6f6d4c302f2a7594e
- SHA1 533234b779422311b21b27265621a482d9a8b95c
- SHA512 c65b511acb526d0b358af26cc8c2fe614169d7dce9719698c6c683194a497b5834b7a1aeb4d72e9d8290052e9206f4a024cb4117ee213ed56778763e1095eebf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa8A:A3k03kB56rq
- TLSH T136156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 859KB
- SHA256 4103c6bca066be32417234d66f581f1e8458bf58ce59031cbb6dcd80cfc653f6
- MD5 c85af4e0ad318cdd998282d13190a0b5
- SHA1 5c19f05c9334e06f02676f07b487c1cf70542ad0
- SHA512 0d302f3b6d3f3f245445ed91e04c573de281f04f997473a1d1984cba76e93cedfc89ec82088d396b26e9e91435b76710a53f84934f9c52b43cce7c7269b5c8bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLal9Q:A3k03kB56rX
- TLSH T1E3156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 859KB
- SHA256 2fbbeafd7df272f20cc0c72970915691c757c8ebf2627f2a0895918a21c32d79
- MD5 ba62672105541628f0bc1a0e41799fb1
- SHA1 3463af617eb2a4b260d0e3ea23b0f34f8380cb8a
- SHA512 c701738864a75ba713c949c63cb8a194ad80f36a793beb8b08e150d9e6ac3f417f85c87cce799bc109aaf758eb177f8a7fb36a6fa7fc590ecb7f58c263738468
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaQ4:A3k03kB56rI
- TLSH T1B2156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 859KB
- SHA256 20f1f7baf7d1cdef646b289d98068bff7d8ebeee93466975aead42d47a9b6f3d
- MD5 e7c2c687db31d0af0104310427559107
- SHA1 a3722c195c3dbfca0cd8062ce785ef816bab5fc8
- SHA512 b1cb2432ddd66a9a6108095d33b5e8520f3ac9a98d0ed903ce66f41ce4439b7c7d9934463304bd4a6d3f34fb3d95403e389249826201c11b91a93c43889e35c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaTu:A3k03kB56rZ
- TLSH T175156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 859KB
- SHA256 4273e296499cbde181b9a71080092a29868fe5c995f31eb8e33f33356d025cb8
- MD5 fb72954b431c64aeef8a5c1ce477a450
- SHA1 4defa231b5f657aeec1fa2d633ad2cd1a177c934
- SHA512 dc4bdcef53eb0f9502b584b4aa3a2ed2faeb62e756b68c7dea0b05e7be930b4377ba0e38eef1416df43e0755bc22a752bd1b459651f8899c836f59f6e2ccf383
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaOj:A3k03kB56rD
- TLSH T156156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 859KB
- SHA256 4a925a208fa278bd3e477b5c44282681ca34bb46575beb97d98f303af83f51ae
- MD5 79f9982ce50a1cf96df91adf490e1c14
- SHA1 41cd492f2d2a020f41cd455b50b49eb124ef0f18
- SHA512 13f4d9d3a0423d41be2965af620ef8257ea1bebbdce5baa431c96c593d952f234b7616d665e4a629b152089b991dbad9c2df9047ea3ab5512aed2c872726a8dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa7g:A3k03kB56rr
- TLSH T164156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 859KB
- SHA256 4e8172f8c7c167624744f892897f3fea8e9aa761dc9e1263665a1af3b76b8efe
- MD5 929302c05889b9ca9837956eb54143ff
- SHA1 ac7475b82b50b20e730fe09923f0f24a992544eb
- SHA512 eaf734cdc0eb06e086df7f25db77f211ab3b58c70e493b0e4ea18027d3cbb0b289847f0c7c7b5ea0bf479625114b47a858bb4e6bb30228046ab906fc7fcbb146
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLamI:A3k03kB56rC
- TLSH T16A156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 859KB
- SHA256 3be98f4f77d1b9acb3494d21f4fc964296e513391f6c97b7f16ee152ee126447
- MD5 044dce848c6b968e8d0320a92acd360f
- SHA1 49d5a4640c928540f298e8e194ec40fddc1e5273
- SHA512 669a4247286dcfe4832a128ab093915a3835d1b71bce3192626701e8a00c916be205132c035dab7b171451eb91ae2bc924393ac4bbdb1329a32b6bcbc54315d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaUo:A3k03kB56rg
- TLSH T17B156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 859KB
- SHA256 157b8c16544772f2075e6889d455d63bf0104921d9b48b2bfc59da3d60c2bc7e
- MD5 b10e7774f1cb7e3cdd7887c6bc5400a3
- SHA1 4613529ead26e53b966016c0cdbb0efba5f6e65f
- SHA512 c150f521d8621e3525ad8ff6fa4007bb23b8eaf7d3dea1729934e77febeac8199223ff9c42b2823ab7071ae49fdd9592ef81bfabcd31276ff238b3dbe4a90a5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLa3+:A3k03kB56rN
- TLSH T1FA156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 859KB
- SHA256 9672870c1a5fd52259f0cbcec37e27d9c7bec67f6646c59bd57d09d3d9e1e774
- MD5 0e491c96ac8a9506c808d661e9bc6383
- SHA1 4022302a032573dfe9b5d305013fab6379c0d78d
- SHA512 a57dc2aae76fb900c9acd2f015836659bbfe1bebee2aa529a3b2def043abf68905a542dda5fd817221a7c0fc5035884aa8ce648ca7f0488b6394dc79fd2101f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaNQ:A3k03kB56rF
- TLSH T130156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 859KB
- SHA256 b0f4050ffc646315c57c89e205baf0bfd5fb580b9bbac58941b22ffe15ec353c
- MD5 3fe77a304f84cee3d1c8039bcd9bd3ba
- SHA1 fa6ca8149995910dc53d105612e1d22ab0f292b8
- SHA512 41e5f82e3c80cd5a0e112a67fca24cf241ba14db5dcdbaeffe99a4693c50bef8c1cd8b021cea18abfa96a0aa2c81a25daabb56c92235bc3c7f7d1b885d3bd32a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaCX:A3k03kB56rR
- TLSH T1CF156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 859KB
- SHA256 7dd2b7099692db4d2aff55efb07658aa15dac176d767adc2aa46fc10b18bb85c
- MD5 90829fb047dc6fdf2e2f557f6f542b3c
- SHA1 9b913e18310d1a3c0094c52d34a2a52f4afc6d6d
- SHA512 04d3243583d3758632f25b7a40b509fcf2bd3d76978a91a1e8f1e6aa7bf75e97aa76018513b97f5a7e28060d101258cdbe4021a5e98cf00b778b9697306225d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLakL:A3k03kB56rb
- TLSH T1D7156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 859KB
- SHA256 5ac68f925d1859fce319da4dee4034a8509f7520ccef8ef8d880f6f6f77a0189
- MD5 263c273a2f46de2442f79a17089750c4
- SHA1 75e6358c053f50dbfc2af9296918ed3d5a340b0b
- SHA512 a707968a4e91ae2c4e8982c0e42cf32513a6d6c50fc29440812889c3355a400d352a5f58945bb4560db308125432ac80522ce27152acf4c4c83379d3662360fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLaAM:A3k03kB56r2
- TLSH T1F8156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 859KB
- SHA256 603a418e1de4b5c0705de154283e399a5c090108f1c1f6815b0f583bb2a32d00
- MD5 cf0a6f37ca87a7d13732730f940148be
- SHA1 c695ae7f5368c563b6469350479a0ad02d02f6a6
- SHA512 f4d61663272f756c77eb507b289c0953ef2066682991392ed2a29091bf57489a45f98ba4e8c1de4df8d46fd0ca9d8fa077198e25e4b1cf15bd4dab8d5b195566
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasLahh:A3k03kB56rI
- TLSH T19D156A07E6840FA4D10F81749A968A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH