Analysis
- max time kernel
102s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 17:29
Behavioral task
behavioral1
Sample
2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 933KB
- Sample260820-v21lrsvyby
- SHA256 be4dd0b1132f92373522fc52640256d607caaadd480d1cc75bfcb47766b3420d
- MD5 92e84d81da7bd3cac07ea1431bd83748
- SHA1 e18b66d6672e4e1c5927b83750f469561b62b207
- SHA512 7be2a64ea7c539b2e9e6c9d00a6ad9c4787229e051f74e7f6b78f1cd1e71179b5794bdb1995ad8b85f23746a693a83087936ac47f0e43a28e6bc7e9ef8e7d5d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtw:A3k03kHRJn
- TLSH T19115AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/3872-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c587-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3872-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/6032-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0015000000018a5b-254.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-339.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-472.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-600.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-717.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-743.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-841.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-951.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1000.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1043.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1080.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1129.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1148.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1268.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1347.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1397.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c587-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-41.dat aspack_v212_v242 behavioral2/files/0x0015000000018a5b-254.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-339.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-472.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-497.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-600.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-625.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-717.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-743.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-841.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-885.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-951.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1000.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1043.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1080.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1129.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1148.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1268.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1328.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1347.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1372.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1379.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1392.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1393.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1394.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1395.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1397.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 6032 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\7-Zip\7zFM.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe - Drops file in Windows directory 19 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3872 2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 6032 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_92e84d81da7bd3cac07ea1431bd83748_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3872
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6032
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 be4dd0b1132f92373522fc52640256d607caaadd480d1cc75bfcb47766b3420d
- MD5 92e84d81da7bd3cac07ea1431bd83748
- SHA1 e18b66d6672e4e1c5927b83750f469561b62b207
- SHA512 7be2a64ea7c539b2e9e6c9d00a6ad9c4787229e051f74e7f6b78f1cd1e71179b5794bdb1995ad8b85f23746a693a83087936ac47f0e43a28e6bc7e9ef8e7d5d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtw:A3k03kHRJn
- TLSH T19115AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 13a4bdea33ba856e1ca7f69f50676e9735d466e5b3f2ddd458cd55425b10a775
- MD5 db13ded6ab0730066197d316e0c24451
- SHA1 acb7f410a9f0753d7f23ee5f8e28630c381185ec
- SHA512 cd5b34c24e46d102d9a684532e06fa7156424e501a3b00d57fd449f42e26aecfb0d97f16bc2c4f6c97fd86a76db3cc14315ce1e51472d42444a799a307ca4d02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtI0Le5ji0hmxNrM:A3k03kHRJjPji0Aj
- TLSH T132658C17F6A402B5D027C0B9C6D6966AEE7138861B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 948KB
- SHA256 6b827cecf4baf77e5506e64c7b57f8b16119733537accfbceec5c7e676dafbe1
- MD5 acd5f7a4225ac8188ca3ca3755f24324
- SHA1 11b3479792242a4243cf20eb20de1412bd2c5271
- SHA512 55426e1176e0ce22c44b47ab1fd0fac59a4e06344b442d401dbdd047868be8fa902105986dbe3187636310381a2a11ce3ea4da7c1a0e3bdccc7dfcc46e51a305
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtya:A3k03kHRJ
- TLSH T15625AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 ce2c5b05d49c2877498e0a7ba9e7f4ee7352eccb3c5850ff5268054f45324b0d
- MD5 7870a953043a14a21ab41b9b9fd6d1a6
- SHA1 f2166f3c6b4be95bbc85ee1a7a7e1dc0247a1def
- SHA512 cef2e4d5b94e6c6c4cb6ca0e56d5344a60e5d7c0d8bbc42cdead9cdbabfe3dc88bb834593a56b0a780b5e8d2ad21b3e1985d77bf1a119ed32b57316c78f0e6b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtD6:A3k03kHRJL
- TLSH T1F025AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 92d498c7a22751bb8cb5dde4ee62740a99d0d40794effeb3df11363aaf4f9c38
- MD5 553f3ea74d96b4bc2582b483b8642da9
- SHA1 b325529df12733d55ba171f069e6f537855dd07d
- SHA512 718d663a6f96c8e16096ed1b58e4f0dffdb2723b1828fa8c48b6257b01b150069f936dee4305184032a0f2891d7839e1e6a695893e35f71b9b44cb758180eb2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtj9:A3k03kHRJw
- TLSH T1D425AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 6ab72a5af600ae20caa36e80e8d30c0dabc6218d927e3bafdc02ab7ce135101a
- MD5 502fd794889b332428eeebe80c8f8e29
- SHA1 0bc66add51cef9fdf0881a3be79641aa49f08641
- SHA512 c569ea815f91c718ad4c19bc18ae94c94983c7f1d00012f618e57dcf1e2602de7006e00aa377ddfafe0f4c6f91cdc3275926d09f0b3df44e4572792fa3fb6a4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtPc:A3k03kHRJh
- TLSH T1C225AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 f85cb7c137c43823fc85a1e3dd5c8b338decdad92858b7260200334bbf62c7a7
- MD5 0df79e83b514d2fd8035239e2cc55717
- SHA1 c394d88e7b7327374a50f8ca79197a2ef62b9500
- SHA512 15a992c4d63c83dce9aa9b290f06c3304374934bff96265030dbd9018b215ebea7dbcb25832023908a7f408c96b230cd6241313370d2a6493a91698f16f50e01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtIp:A3k03kHRJf
- TLSH T1D925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 07f4a7bcf93c9e0760a783efa3a8cca40f6b2b564e968cc7fb2857cf17b456cc
- MD5 9bf3f628c0b6c4851da3ae39eca483e1
- SHA1 494f35478070cb0916c037d46a61f853364302b4
- SHA512 4ebe4713a9ff6dba20e1ab7fe4f8d1e127e8691afe3dfabb4e5ec102b43b6cce7f03f08ac3f0d458c614b4115139bab3d7f7e12009a7bd74845ee8ce8faa599e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtfN:A3k03kHRJ0
- TLSH T1B525AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 e70d9de0c2609980ee41442c60e2e966b24cd52370db50eaad10f08c507b5e97
- MD5 3fd6f4d5abd2116354f6057c86bf0902
- SHA1 79ccc8aea56d86203181b6e0b63c1bafa9d32138
- SHA512 1cc5b402b82a1f1801ab7533d4968df7c3b6d5489fad5db5e48dc187b1fd945c92f39e57a3828cd2b26a85d25c57684b6a0cd3bfd842948f1086beabc34cc5c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtdF:A3k03kHRJi
- TLSH T1CC25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 39a1759d41c1c3c0c563b1740b9aec293178c104cb9db82e70eda2aa5fc8fbb7
- MD5 e9065b06806c761f7190d593d7f41a58
- SHA1 4e06ae9cd412e26032ae54404eba68747d29811e
- SHA512 4099085480aa38ea0ab73c96ffc76c55171b3918938852e055ab762801e50b5581b661204fcf96ece1e6ebb9ebe9687b83f653cf01f254ec827883dc9ec4867c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtuC:A3k03kHRJ2
- TLSH T17925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 9d93413088ed3b5e0dd0591dd6406a98d9887b97a0d79c23f0a68ae2c3a5c5d3
- MD5 4e7bc259b6fd6be2b2aa22b95b593a04
- SHA1 351375419b05ab4cdaff50e2d178513fe49ca17e
- SHA512 680d450446b76d7fe1dcaf768240afc47e15fafb13ac5a7373a6eba7452c7de10b49cbfc4378a503eac2d1ad4829dba5f981a7ca6f9bd943d750880b9315e64a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtxw:A3k03kHRJj
- TLSH T13C25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 fe5bd229d242c650c34487d9a76a2568c7536f77a5f7ecfbd99af174e47d49c3
- MD5 ad4da89522b7ba12334b3f89d1526146
- SHA1 c0d261b1180670c7f0bf2cf646b4dd7e1cacde55
- SHA512 2e79a96a5e44abbd82e64233352e9ad7c9fd0172a4108304da688f9cedb51ca59e09082f2eae3413d92d88a27203b08c8ae856928f2499504283773e9453d878
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtYT:A3k03kHRJv
- TLSH T1F325AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 85b87cbc5804061056cc9d465c71c60f9dd3f0f393dce0f76d61794c5400a37c
- MD5 2f567cb0cb50b132b25d189ae02d0b8d
- SHA1 57a546670d5fd2f0fc30f40645eafac997ef5b27
- SHA512 824b202775ed3af1389c97622e1562cb4c7dbf8d8fa66c3ed9dbe18097e0a6c257ef894dcee275888559e538a648ecd3e7784b4871f3839b8e50c070ecec4fb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrt0u:A3k03kHRJA
- TLSH T19D25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 62d6f99bfffabfde02de4b5fca8c4c2a2e13e4585af30bed352d93c8470b5df5
- MD5 bc51fe4ec3de4883316cced85a3d35ec
- SHA1 4e38ded06a79d4de6b4f79050736ffede53ba556
- SHA512 a8e331d423b0fd8f5082fd32bfb0e857b7c4a9cc336cb05bec65953bafc271f0bf62eeed4970d25e07f706e16bc4b18a30213c60dfee5cecaf51bd5a0dc8a34c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtib:A3k03kHRJ5
- TLSH T1E725AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 b9494907f19e569e1e9aee2e9a548f93ce7da174087d77b304343e3cb2c1d4a9
- MD5 75d4a8a98960bd8eae2ccae1c656bbba
- SHA1 7bbeba6561e72902ecf9a88ba6e3d14cd9b75e74
- SHA512 47810fe8c4d6a3ffc78db604dd28441e13d0299d74bf8fa0a9cf5061a43e440b5dfb046842afeb0fd7c7a9e4fe9a0d255f1f88c462a1c93e916f15bdf15059c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtkf:A3k03kHRJJ
- TLSH T1AF25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 f4be41f210cf20ee9e78b088311bdb42508a340a024ed841343fd029139a2dc5
- MD5 68c4aab019573f4bd748aa65a9457421
- SHA1 b7c4eda03553d51c4b1e84559a8f6c494db39e4f
- SHA512 f511b0ed700b8a8258a3210f5b8409fa81744f82de67620dc1983929be8bd4fcf5e9301ff7f569c2abde40fc8c2d099db51812d647c2082edcabb2d1d2ec006a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtBK:A3k03kHRJh
- TLSH T19F25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 bb47001be341e9145a6cdc61aeb7978a1164aac84c8a8af780fe29728ce685f3
- MD5 2707b4cc6a5f4614da4c00486595f28e
- SHA1 a00d90dc8f4ac4a88b201c41ee926c378040dd3a
- SHA512 3e0f77f5fadd6040c9b1d5151cd58b09ca2c18bb583ecdc929dfb82565b1872b9f7e82068e95e5e58fe0c76089f5f4b2c80badef04f414f0b0f79503889648ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrt6k:A3k03kHRJI
- TLSH T11925AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 adcf7875a0a6e350e4cfc3c6c7083a81daf1bb3b25448944d22668669789442e
- MD5 71dd6e92a5e182542f5bb5c9f2baf152
- SHA1 5ab50d1aa3d82b41f5ca6b2fc2288f97e290a5fb
- SHA512 389fe700fe315e92463823f16bb8f2c38f6398738a8064edf9a49021666506bc21b35c2fa9522f2a9a2d6e0772a240dcb3d0eae3ae3cd2b5fd148a1bb0a22fb8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtf0:A3k03kHRJh
- TLSH T15525AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 b90e83fd5f025a3eebf3ee8641c98f8ba398c70689af135778a74250cdd5b650
- MD5 601592413d69bd740ad2430bdb3dc5b5
- SHA1 dad1f08e15f484a9ded91a0a03c279b477bda393
- SHA512 f58936ff538977fa47d5303da65171ca1a5d6c01a22c01106da55e91e4543cc035620726e60ad145d4f0c2fd24d6f0842a5138b2509266388f645d36479d3e93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtug:A3k03kHRJg
- TLSH T17E25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 90e2ef7c8368a012b92b90fbee1c15001761f9c5b80d0e0bca37f936b5e12c44
- MD5 c1cade101bf9b297d3b737323c32026d
- SHA1 c6ecd824ccbf9d4a7a19103ed845a2f23ad0260b
- SHA512 92ba71246eceb04e507c940176f81d327763151c9f7bbf7323fa0f9c02241a9db5976672c86a5c055aae6cff576b10fd37ac337f9988943336592af39f2509b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrt3r:A3k03kHRJq
- TLSH T14A25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 5eeec59df48ce4eda84323aab5995fd69cfc07f81592325ae1fbd34208368bf5
- MD5 cfbbf5acb713259add313f4fd0295302
- SHA1 3a135f35ef35caa024cee744dd71587f27f6c11c
- SHA512 7841c5aa434afde89c2b2015b78978d4f1346f9fd2a5fbdb6e8d2d819da6acbc2ed518e83153cba860a193b143773a87cc01928ede76eaad46b73ed07d1976b1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtBn:A3k03kHRJs
- TLSH T11325AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 7f828f0d6c1e2b84e7e058afd6a2d05de0207f26920553300408fc0935770fbb
- MD5 ff5083859695f4a7e7740d5176889d2a
- SHA1 f93b8c646b882556365fd9066ab95fcb5a298af9
- SHA512 fd97c630935a51452eaa2cc62c54afed8325c0c1ba53093b43aa7478591e44af06186f501740453fa121e4c072d55d38076e9aac49ba0d2f6a7ab4adceb5713c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrttx:A3k03kHRJ6
- TLSH T18C25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 a95d093bb01d6b7ebfdc10c75744abc63d2a255ab747ba2afe0517332aa9c8e2
- MD5 315c136fa0f9805736addcfc396b3e7e
- SHA1 ee1dcfa7297f18952c40948ac96f7df8476ad39d
- SHA512 0d0accaf26f2e4400c20dfda4346129cb652ed63129b2c874cb9708c7b9f84caccd683bf71539eac77c6663bd98079fde72b49c9459a92af799f403cb57a05e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtzA:A3k03kHRJ5
- TLSH T14825AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 b6fd8b237294fc4a304e5aee5abbf240466c5329d7de70157f11a3c1b9947e70
- MD5 22149fe2a0c17658b18b04715003b551
- SHA1 35b8a542ff7e4aa1d9a3ed67f8f7ce3da2a17cdc
- SHA512 499de07775580fed976f35b712de132a024a5abf81bfa2145a9dea9894a6618f3a21ea694368c810a5e5e78587d05792ca7a109a7f5dc8c0a91d61ee186e0fed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtE9Q:A3k03kHRJg
- TLSH T13125AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 59974a6a976ae8198dcc2eda3b0fabb964b7c76479bede2323191734ded95b02
- MD5 e5ef3c2bb6444b8b41f1f985fdd6d177
- SHA1 bd18084089ec0a7299b14c7a4ad0042e66bae4fd
- SHA512 6f6f9bca5fef529cc29259cbf629d60423258bf38c2ba2f7988e2827260b6b888c63dd22e51627e6ad8324345ef0f1d455c21a6725df188f643a5e8769772c10
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtd4:A3k03kHRJ7
- TLSH T1C225AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 e8bef12c295aab82662a9750e1eb3637571dc2db9dfaf49c010514b33460e594
- MD5 5ecbd8d27cfc56a226de1a8c394c8eea
- SHA1 e5ef02101cda3f3d27d9d09e4f7ac22138e46c79
- SHA512 92696189107db2cc648227e84f62999dde9bccdc1f2d0368bbe46acb5a61af179d3d002d37a8006125c05423d3d2104bfa5043504fc479e6cd25fd830d5f790a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrt4u:A3k03kHRJu
- TLSH T18225AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 bfbe9ac59d4dc6316a1b0fe83c79075186c0c3e43748ee3ceabc7db5c890b598
- MD5 26f48f72abbfd62c8fef887490833e35
- SHA1 1405502c53d42ac752a32e47819de2ca744364fb
- SHA512 78b7d21b2a15765e0a9544e3b786c956e36565313f809a021bf7bd2ca97ec2109c95baf2d3cdfff6d2637cfd5fd8e7506e392bcf78c84fd81e085b5dd1debc29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtZj:A3k03kHRJA
- TLSH T1A525AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 b0e8c433c89925626f0340209df57b4cf39449e6432cf5acab3c23a3cee1b7b6
- MD5 86592d9b55f1c11b40a715a3bba30e8a
- SHA1 82f626ef6ae23c9d36c7788aa8fcb876df43a95a
- SHA512 31518b63fb86b391e50f31c804cdecf3f91cfda26571a9bc52ba785a00f18b4c5aa2e7683acaadba2716e05d4f89f7b5e6a22d15117c285459b50504951f09d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtAg:A3k03kHRJY
- TLSH T18125AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 560902bccddb894460678933958bc98e9b58eee89456a10b47c328ca27f322a2
- MD5 e1a53be9a9e5b85d3d6a76d40f85a8b6
- SHA1 1562178ac4a511aca63d7cdc353d9536996e0477
- SHA512 5d4d37bdb571ec119fbfd510fb0385bc7cab95ac5f206bde98c668667e79467377e9fb7e3bbc38f59c26307c6db962c23a2db4d1763f25d61ea5c68b2ad63643
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtvI:A3k03kHRJp
- TLSH T13325AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 0008fed27d4729081d3039128487a03a5cc7f6893b58514886256eebd6f6a292
- MD5 cf33eee4e662c2f60db3b94d1a4677a5
- SHA1 b747dbc1b22b589ab55c38c9424473501f4bdece
- SHA512 3a0b44c986f4c41020966efa812a03ccec6ef3d492d59c5f586cba75c54c2413e220f6031a1dbf9d1abcecc7e1ffb7093ce3b11c6456b706904207d0bcf36ae7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtVo:A3k03kHRJX
- TLSH T1F125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 90cda53af2f0c194858099254c3a518c91d599c3a16326d6ab4b21042f4f1214
- MD5 81c233f8d78e5546be78dccf4fa83999
- SHA1 cca084e839980dd68a90ae6a440f304a189ed0a3
- SHA512 05f0bc635ff3e9ce4661996711300d50268a36cb5ef5369087e2e59f2bb5bc2fa8d6873b78bd65c5f6d0004e030956ab3f99f7a9a724857bce00801aad687b85
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtG+:A3k03kHRJi
- TLSH T1D725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 db1cb119851578e7aa3b5f82d7d6c546d323171faa7dfb99e61439600bbae829
- MD5 652fc7b31bcd86c2246bbba4846e9bf7
- SHA1 45caca3f9a0617f7712d707209c7ed4e33bc487f
- SHA512 53c9c143e16bd3c0dac334bc34ced9e12fbd03d5c19dc12c12a60ec49857023d2ecfbf5964fd89a9f30a59efa3a523201d12e3db4a13831a0d5b747968b29cd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtGQ:A3k03kHRJW
- TLSH T18A25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 e8eecd8f8e1aba2db71faac3a94570638154aeda6ceef8e5aadece4d8eb8c9d0
- MD5 849022d89761237c875497db00fa17e2
- SHA1 587793b1e5782a44173d52b88b9b7ab45bcfa182
- SHA512 1faa3268a966b66763c50f6c8b76eb09a87fa3d23d2d32b4b9459a84fa82a340d0f8b94e507e75b91c47aafdc2e9e279654cc023915a2ede009c908e6ebc47d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtXX:A3k03kHRJW
- TLSH T1EE25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 1961e6b2243f59d0f2ee315d3807f4f9d098d3e67ba215be37768f7241a1c396
- MD5 a3384a8e4d5e8681f5abe40b501f8900
- SHA1 c880e8fb97ef288d59f1fc905d1e2c415df073f7
- SHA512 2f00907630373dfdbecf98f4ac6303f72dfde58ee278e7f93f37cbe38dbf39abee96c4f1ef097a7280f8779fe1033bd4b61a93c401ddb3aea9af08d867587095
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtNL:A3k03kHRJY
- TLSH T19325AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 3de72bc07d7a256cd9948306732f7257bfdeb381a684b6c781f52a0e1202218b
- MD5 58fb5228c7d9a4b71e1fdd477aa09e82
- SHA1 fd050b0a740592c6ad3fd7d152ca3065e658dfd9
- SHA512 34e172a1c8162d1f7b1b4b887cfd13e2a6db4061cc76330c6e8cfd2fd47d3060303bad0766fa4d24994b1e7dccb8fdd036a9a5a59cd241743f0c808463c591b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtLM:A3k03kHRJ5
- TLSH T12F25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 18a386c000ec62cf0dc0c05d79cd5aa58f5d4e4942876a2aa94b57d7bcc6d3bb
- MD5 b5e2230613a4db10b6a40debf8503cbd
- SHA1 4d7771210416f5ee024c4d19073f2f7aab2b5921
- SHA512 4e5db609bbd17631abf7eb468e6d18e617fcecc4db98ccda6bb0cef9d7abc26a379397d999317a4d4247fe2456e4b28146593ffc39d78b977e8faa409bf654fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcrtMh:A3k03kHRJr
- TLSH T13125AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH