Analysis
- max time kernel
113s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 15:26
Behavioral task
behavioral1
Sample
2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 946KB
- Sample260822-svbb7afd55
- SHA256 084e6586ba8a50e03a8df2cebdf1d7b97870d8fbdec84fe41026eb1846312ad1
- MD5 4ca918240f596975cc65f082fa731b52
- SHA1 92a1b871b95d4e00b8ff6f7e06ef6a022d00bbad
- SHA512 94b99f8599a2c8178cf44f6dfd16432ab1a5f1e1bf7a9c7f55b6d8086e79a5d38d4ee28ecb0736a5bac54061068fd9fe502127f9e5a5f293619c13948b391017
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYC9:A3k03kHRJARJ5
- TLSH T16B259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/2844-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4e3-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-9.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2844-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4436-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2fe-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a59-226.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019842-245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a56-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-287.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-438.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-603.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-679.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-752.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-809.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-961.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1017.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1055.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1130.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1255.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x002000000001887e-1744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b6fd-1742.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4e3-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-9.dat aspack_v212_v242 behavioral2/files/0x000200000001b2fe-41.dat aspack_v212_v242 behavioral2/files/0x0005000000018a59-226.dat aspack_v212_v242 behavioral2/files/0x0004000000019842-245.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-252.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-259.dat aspack_v212_v242 behavioral2/files/0x0004000000018a56-260.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-287.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-438.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-492.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-518.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-603.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-679.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-752.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-809.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-929.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-942.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-961.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1017.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1055.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1074.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1099.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1130.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1149.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1187.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1194.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1255.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1334.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1353.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1379.dat aspack_v212_v242 behavioral2/files/0x002000000001887e-1744.dat aspack_v212_v242 behavioral2/files/0x000200000001b6fd-1742.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4436 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\updater.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 22 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2844 2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4436 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_4ca918240f596975cc65f082fa731b52_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2844
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4436
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 946KB
- SHA256 084e6586ba8a50e03a8df2cebdf1d7b97870d8fbdec84fe41026eb1846312ad1
- MD5 4ca918240f596975cc65f082fa731b52
- SHA1 92a1b871b95d4e00b8ff6f7e06ef6a022d00bbad
- SHA512 94b99f8599a2c8178cf44f6dfd16432ab1a5f1e1bf7a9c7f55b6d8086e79a5d38d4ee28ecb0736a5bac54061068fd9fe502127f9e5a5f293619c13948b391017
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYC9:A3k03kHRJARJ5
- TLSH T16B259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe
- Size 1.4MB
- SHA256 6a1a4331fc84e3d95d4556309bb86b19813989c312e8d9e94eb95ff1d9f9f3c6
- MD5 4b9340ee8fa50d4a1e31169cb9f70881
- SHA1 deee37170edfe5d95c0277dbff0111604a4f48fc
- SHA512 df4617d2ef08e875ac6b0be298bb4d658d89f1c7cf98ba7a8b3c89d5ffb8dcd42c55cc9e4daf0eec8e7b4ac5d2fea4bcf88e93e3bbcee2852e3c249c8f5e54fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCQ86n9kAJ9tA3L:A3k03kHRJARJUT9t2
- TLSH T14D659E03F7D801E8E15AC1348A968612EB757C560B70A7DF13A4962A2F73BD0AF3E355
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$
- Size 1.7MB
- SHA256 0eb7cd930e5e297ffd30d562ad3102a637a3c1f5a0d45589023d79c8d8edc884
- MD5 03944a43fa8f3cf276b1c0b81f9a345a
- SHA1 109b9f172bddd8355a58585017a58bbef1ba95bb
- SHA512 b96d5e6764b2e19dc3f266f30df51962e59a4f8446b69539171dd0770137e576a6cca8fcee1a1f0506ea6fa857176810b6331d4d237a4e62443e58974c0fb428
- SSDEEP 49152:A3k03kHRJARJ1PMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVV:A3k03kHR+RTMMHMMMvMMZMMMlmMMMiMs
- TLSH T18E859E03F7C840A4E0AA823049679A22D776BC554B2087DF3354B71E2F727C1AF7AB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 4c3cf8cb2f30e0512ef2cfd9344e7dda7f27db6d44f1546b24159e7fed1f923c
- MD5 07ff7e52ba1be5d7b8b3397eacbc324a
- SHA1 74a3fd349cf05152ba538c9db7280dfb5bd82926
- SHA512 147ae77650f41962ddf2cd2ae8e54b189253a893b0dc8a1d00b7968e10a9dc1451cd72302ea2f7a5f9ef7ac25352652897e3e5baa76731ab7c9203f9f332104e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCJ0Le5ji0hmxNrM:A3k03kHRJARJlPji0Aj
- TLSH T150657C17F6A802B5D067C178C5D29A5AEA72384217309BCF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 960KB
- SHA256 dc2dc355b341a4279d049ee998fdefa23cede2238f880c32b30d436ece2ce419
- MD5 19ea608ae481db23f5c982f6ae1e1f9b
- SHA1 28dbb1392152e3f2eab410f9812b350c90a9b25e
- SHA512 cd4511709c7d00367fd91c5354e3cfd8f44a89f5e7eb9f6e62e8239c25d7e0dc608535291e5b6928edfcf3b9911243782c53162d18eb2958229ec4f8de7acf58
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCba:A3k03kHRJARJ
- TLSH T157259D03E79800E8D25AC1789AA69A23FB757C520730A7DF1354D6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 969KB
- SHA256 9a075f57515699a5f12e4468aace0caa215ccb7cb8f73e2d3d9280e80795602e
- MD5 6920a66b9e38fbe528c298b3993e7d0d
- SHA1 f400228b45ccb11b97ab02f4405899e575f1b357
- SHA512 5e20a22689aed4996ac0f5ee294a327dfebc2919e7066274c987a675df2cf26c5ac54ff42d7edac9474101289c069c165bb4958bc9898195b7661ad78cdf915a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYC66:A3k03kHRJARJh
- TLSH T100259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 969KB
- SHA256 3c897db34ca45c278822db78224758691b7a71e3fe47f9a6d35a34a2f93a2d7d
- MD5 c4c36c31122733416de449456b82d76e
- SHA1 5055d1ace8caf29537e3909b1484700b4aaca13d
- SHA512 bbe95e54928e275a7234c536e925c3673b0466d60dcce8abb595805c06ca689328c10d5a43a009476dc16241df4357c606c35d8a66598ffd471e0c269474d416
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCyN:A3k03kHRJARJ4
- TLSH T11E259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 969KB
- SHA256 609a83f01f8e595ff2501da1c350636b623c2b2da37bbfcbe6fabbf0107b1a64
- MD5 5eb23a4a38ed68812d502735c6057894
- SHA1 29b66aa96a551140b160ffa35421563655441139
- SHA512 5d01ac176aa66da3c6401a4d92b22a805389328e0ccedf3a422368ead4d67dc7a821de2706afdf631b3f150e74d49c8c7911cc2db3a319d89cf86cdcad764272
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCof:A3k03kHRJARJw
- TLSH T19D259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 969KB
- SHA256 687530ea6ca73511d3e3734eeccc63d4a49fa9fd96e2b76399b59bcb1cd5627c
- MD5 1ae903babd5b57eef6c6d81502ef6216
- SHA1 b30d2afe693771324d65a2b93b70baa5b156c2cd
- SHA512 56f432024d26f51d444dbd3f84445d317d97be91e1318c9521d637b7b431b05fb6ac709e5721b02efd9cba970c42e2f7d8eb929fb741b4c9c86cd247ded06da5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCCo:A3k03kHRJARJ9
- TLSH T1D1259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 969KB
- SHA256 e0188fde9606b3f78e428403c12d7cf7e2df1d49f44448ec66d407f028fd8a90
- MD5 bc0f3bd97e80384f3e9e10b34830c266
- SHA1 534f8cbe56e041753eb407f75f1d39af06b38706
- SHA512 5248d73feed21baed2c4d5f6e0ce37a2a810f476a29b70769f6adaf36f4d6234f34cb4b20d3abe2b9dcbc6dde39ab9274118a2937f4c93c448e329d0ee32b15a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYC2u:A3k03kHRJARJP
- TLSH T17D259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 969KB
- SHA256 c469499a2df214f6a92c338b238df8a7ed0960478fbcb816af0ac84c9b2b48ee
- MD5 4c3a78d91cf5ad23e6013c495a278b4d
- SHA1 8c5244e1e0c82a5cd42939d1a0f44b2f67495645
- SHA512 3f8d5fdcb870d253a58429d50b6f88795bb3a522908f7ae278c4e95c7e698ba9e8858f4d71a47b5f955bade40daefb320a6a74488cc1816443390dc4e7246976
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCq9:A3k03kHRJARJu
- TLSH T144259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 969KB
- SHA256 4c02513c372eead40516883676fda2850688f9a03638ae83ad7cccedcee58319
- MD5 33cd2c5563e25f03a71b751952abbdc7
- SHA1 ee8f47c22d84a314ccf2e4fa12953dfca867faec
- SHA512 0da20b9406484d083c163b9134a31f227a1d0369632c58006bc213cad81b1039d30ae3ae2f50907c93a167a2915529fc1ed49a385ad1da744772e2bc8a8f9074
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCqc:A3k03kHRJARJD
- TLSH T12F259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 969KB
- SHA256 f80ae38f90005f9b9402901685dc93f3851901064ec45ff261cdf78bbb5c485a
- MD5 39b3b99f076ec5e201a1c3f761c159fa
- SHA1 274eb4a199c7507757c155123203fca30c8a5329
- SHA512 187427fdb713cbadb618c22a13b4c1f8fbf1b14299a5b25eae600d697e52a1e67786dfcced3f301f58789dfe08f4c56e7716d9de9d088f48827daa58e52dcb77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCjp:A3k03kHRJARJB
- TLSH T1EE259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 969KB
- SHA256 a010fc30c4f4b1583d985ecfc6c4b8bb1d556cc19a007a4275736deddf7ec84f
- MD5 187df97ef079a617c2234b93a27a7573
- SHA1 96ee86150dd9f2d5698482138ecfd0a248e644d0
- SHA512 55d11463fc232306bbd37a9300c074ecfb7a4c948d885de7a9d3461acd6989c1745317772807272b55e28b018dc4ecc212adba4ae84c417b8f2a1f3f0cade763
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCEN:A3k03kHRJARJa
- TLSH T1BF259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 969KB
- SHA256 6bada098208c6e5e39d9b8a2ad7b446535ddbe63765fe7dfe50c72707d433f8d
- MD5 dbedb9088be79fc3aef184be34b61922
- SHA1 cb0fa07eea12340cc582804388b89d72a4e1e3c9
- SHA512 5abcd88e967a66076202eb5645e034ad3d4afcb8f2548e722aa2e0e8651660bd17f743273f98c72b4f0b8285c775837634ca01b147e49876703d8629b62112ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCsF:A3k03kHRJARJg
- TLSH T172259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 969KB
- SHA256 a51b44e5f9f00c8352f97ee11027eb0ac80ddae5c56551c46212632b3ad4e167
- MD5 74a8d1cbc8fdde3d5372d65f10cf61e1
- SHA1 1495a1994a14765da27d32e59484569b91ea71ba
- SHA512 f0d1a78c23e614e95914cf7ed14d2f1111f13ababda5eec11bb3b9ed2aa03710328773664a1a66039f48bbaf30d9502d96647fe5f6c649a5a5f8e8e2de878264
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCZC:A3k03kHRJARJ0
- TLSH T1F0259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 969KB
- SHA256 79b4ec06f20f213bb3129c81ce572ce78b257dee6338f2c7c0e81c3804c219f1
- MD5 356dd685ee6ded8b7f3eec2dfc1e4b9f
- SHA1 a15441942d049f974b17055543219f52fb23f5d9
- SHA512 c8e4f6d1216558af5596db0ee9ff59879bb8e041c2a8593d7e5a575bc39739933416477957c5a16d63e8f7bb0793851d9a4a0cf5ac007e340a4d51bd3c0ff861
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCaw:A3k03kHRJARJJ
- TLSH T166259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 969KB
- SHA256 9f7f18674b70e4ce91ba89e9005aa124fb1dad10e322a98e68e7853e45d922ae
- MD5 d9eed0c889cfe17187f314c0d277fd95
- SHA1 51e9778f6cf22bb7ad7ed83dc00c3700c1ffbb7e
- SHA512 62d86c198486c329ecebb4c336e13ef5c7091326d0e021c01a0076e84b4284d40f93f0115421fedddbb1218483e95ed61c08a391fca73e93a5ebe7c82087884d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYChT:A3k03kHRJARJ9
- TLSH T155259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 969KB
- SHA256 ed5bdf24224fb477773f034956b0bb19bdfcaca9b07f0238b3209e7ecbcb81ea
- MD5 3ddb3d1d1ccb1cae2fd7a77e0362a054
- SHA1 104da8a23251304efeb5a48f259b54abd83dd710
- SHA512 8b14931ba5cd53d756888e0346dce364b273d9630822743ccb10c055289ed7039f1ac5ac0f3fda953f658d05393779fad18a05413a9f891bd55587f11e2b222d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCPu:A3k03kHRJARJC
- TLSH T1C0259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 969KB
- SHA256 5fba7f8058ae75bc03e720c159d9ee8b98ad3830df0e594ddc89bf86650edd0b
- MD5 f8624b8cfc39c52b2a0725d8165d9305
- SHA1 fdc13b6cd8492e35b1718f09ccfa83d014a09424
- SHA512 c4ac56c2e381dc2835427fd19fde6e2355f59be042ddaeaae2faab81b7a7c2042e664b173363ad74e4479d339a8ef5a634f2f51505feee8b7e1bf5d177de14c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCzb:A3k03kHRJARJz
- TLSH T1BF259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 969KB
- SHA256 194b449c9f5be4bda87ff3dc76a992c5dc18c127e6c9b955b0b0d4ae1acf5531
- MD5 999ffd66f70658142bffd9206ac79463
- SHA1 72b6f988a6df8f5ee776f3804526aa71cb345e74
- SHA512 fe7a9bb57f2f89dc6a941ca5b4835637fd28a74956118c828f7f08cd7cf40b6d3a597867533ca9a7247107fbec089dc0f87e40d578ad7f3a35bce4f8b80fd1e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCHf:A3k03kHRJARJr
- TLSH T1DE259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 969KB
- SHA256 4b138147927ada90758ac6433eaba8b987ed591bd8737ea07bb0a23c82ab45f1
- MD5 183c812982aab399540616f1d5248173
- SHA1 da731fdb7290e53ca847a77be2adab782a2cda4a
- SHA512 79daefdf9573a6874d165c88fb47250c5883fcdd4e27395698fbebde1930a75609b3b4954cedb11747dec9ec43424bd71db490429a5a306cd6dc50972a165a01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCwK:A3k03kHRJARJb
- TLSH T1C9259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 969KB
- SHA256 925f4c436b7c56003669cde23c5171f9057ccf99d8657ca0ff7c65880d01d595
- MD5 7dfc5d3d4be66308554f2bdab0fad4f9
- SHA1 14fb81326c7e7f7423b15c9e920b68ee7595e862
- SHA512 ec7b953cd85c75b2ab2cee81c70183ecaebd8686be4ce55e89bc58c8eb46a4665ad6354824efa27f94c2c9c2fe14b10595c90c94321d7ac68b2f6dae6536b134
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCtk:A3k03kHRJARJW
- TLSH T1B5259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 969KB
- SHA256 f643eed4d1346657d0502b777a877e7770ea402c2f81b672918e00fab14c1048
- MD5 8655e05abea3bdaa392b505c6320362d
- SHA1 65f1f984c3c7327fd37d05ced048a72a40567533
- SHA512 240edb8772118c5838a582e15a55c22470ec6a3a506e5ee62020112fd47b31d1170b348ad4d90364808fddd1262c96a9f4319ce28313b5bb4e3b762eb17ab088
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCy0:A3k03kHRJARJr
- TLSH T14D259D03F79800E8D15AC2789AA69A22FB757C56173097DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 969KB
- SHA256 65901f52a663ff9798031fe0c1cabd0cd4d65bd0b1d1e9059fab2398c4ec9e59
- MD5 6076eca170908cbbe3e457e180f8f4b7
- SHA1 187c9279a956fdf222b112dd6f7bb40aad772139
- SHA512 2c8a38d28db50599a4a3c4e0281c1916bd59bc6baf901838c11122a96415eba89ba5ac78c36589879ab57822e8c1686fa9a9cd5c189d112114a19fa387bf7466
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCBg:A3k03kHRJARJe
- TLSH T1A7259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 969KB
- SHA256 f470dad49eb6abbb98caae44110dca353d9564bcd1648fec0f54f23d00c0749c
- MD5 73ff8bf683474f79cff29db889b93171
- SHA1 f0c7936bfa49b8b3fcc378cedf0efdf6b7655b21
- SHA512 70bc27348e11456a5d0d2bdc8f13ef6c296c341a13e1a40fbd486de0a268a30ca2eb465d30baa34980dab2dab26c206fdd3a6dae08e85c171a030b244f2c023f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCor:A3k03kHRJARJg
- TLSH T146259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 969KB
- SHA256 b4917bd5e261833571ee072b956e3b19104cc11a7b6d13999d06c44e6dd27bff
- MD5 6831a3f9b652384bc299942d85c71993
- SHA1 498b9624918a9c7440c34168e740bf2f5602c5ad
- SHA512 982b182f3c58077f2aaa75b0b1b9fea5a01aaffd51e6ed6d4185ec7e9b6500f55f88012bd2a73ffc6cfb0f41e1bb96c0d8de74b0604ccf14cd04bc33e5a723ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCGn:A3k03kHRJARJy
- TLSH T146259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 969KB
- SHA256 f5d9a2720e1ce349159e2f70711a9d329353e0c3d36bcc420353aa90cedfa245
- MD5 b7de1a99b0cacd532e2d75f4cd66847f
- SHA1 9e833c108b9965f600b23132964ed2ebca9bbd5e
- SHA512 b89916575bfd3135d351b6b3247f64e6b01827860d4c141726cd3720576a24e43261caa6ae75c0e735baa28797ac87b9ec5ec73f2f39a9a765206174c4afbbf3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCMx:A3k03kHRJARJA
- TLSH T1E3259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 969KB
- SHA256 a33e978e562904d70243248a6453560c429787ea597224ab0064a7f9ff151f8d
- MD5 3ca030ef308b198a9497584fd4e6ef0b
- SHA1 347d6e00b04c1cb8bd2b8b1b77198f9171ed4778
- SHA512 ff4d9e6a848bfb193a3b132ee8931b3e990f2719b5c8f5ad4f4a5551c6c4e6814ba4a4d395055657f45a7b82e681ca039222730f2fa270ecdddb662759e085cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCGA:A3k03kHRJARJj
- TLSH T1C4259D03E79800E8D15AC2789AA69A22FB757C56173097DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 969KB
- SHA256 983fbf2d2f6dcb488ce0f13be017df06a50006327534e56bb11ced77bd24f213
- MD5 6ce99aaf4d5965846b381a83ca729804
- SHA1 30cd0d50fa099ab9a65ae7c23d2fe6f45b6f3637
- SHA512 ddfac444fda87aaffae32fdce9090cc8d0b6c2a290db810a7c46999933a016b9b46c45b44e41b545c4cc3b615831a6d12cf7850bb7bb7e0183af9aab4e2aca6d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCf9Q:A3k03kHRJARJu
- TLSH T161259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 969KB
- SHA256 60cd6342c2dbfa4db81f787d9abb03344483e0f6274efefcfb8dfa7fd82fecae
- MD5 0f5c3a3e81f6b39240f9d1f625565581
- SHA1 60236b771ed9310c5be5b43cdd7c09b2031f72ac
- SHA512 521bfd7b8a418f5f88c99e6c6b29a6b321e42022f09dae0491e5c4cce83722bf4b42dd15c0da0730206baedb4dcf14cbffdd74f878fd00301653b2d991d686af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCW4:A3k03kHRJARJN
- TLSH T1A4259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 969KB
- SHA256 86af1162b06788c695f7f3741ea6914178dbf01f7ffc776202c66f895c99c653
- MD5 1c964b05ececb1986d9d3cede28bb108
- SHA1 40265dfcf2122e84944a5a442137a2df661d6a08
- SHA512 300eecdfa530886d5b32cfd9ff229c7ebc1d4e200d027c33293e9b30d2779ecdf4990ab736e2d2e1ae78be3e31abe1864dbf9e874c8665ccc5aa4c60cd478af8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCFu:A3k03kHRJARJo
- TLSH T1E6259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 969KB
- SHA256 e344f29e6f62e6d2cd9def302205f4f07489c4a35cea33f4dd5169b9ed855b39
- MD5 4be92c815833bbf8252edabcbd90b367
- SHA1 5073f5e650711307836d8f2f52d568480c4d3627
- SHA512 95445dc541046c6094334e72deb747d86bb92e5fa73c54917e5cb8fdca724a1d66ef85a11abdfb577849612d76d2c75aa20c46e5ada1180afb0c7d5079d9a5ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCYj:A3k03kHRJARJi
- TLSH T144259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 969KB
- SHA256 11acd53a91164c0fbfbb1f072cc1e2c124e6e44f88f17cc1c3b359de07a36499
- MD5 efe657070f04ed75a3e21e612d2d2bb7
- SHA1 a63fac87997c58a8d4cac9e67f72032a1a100b4d
- SHA512 d13da6a36f829d279b9fbe3060760342ac4fd7c348451c915417db7612e43894e66df2ad975be6163039645e3799e0df3e60127a931941b345fdad48fef7e40d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCpg:A3k03kHRJARJm
- TLSH T127259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 969KB
- SHA256 6e26d151ff88e68c3a5625814dee5ad0bf352abd9d352e72dd80f2362131c74c
- MD5 c9ae88de85850154634498adc6b12d70
- SHA1 9e8e5a01555ca44c0f7050add6fdd8a58517d7ed
- SHA512 50183d34ec08ea93ab6767ea8504638bb452b5abadc649d4335fa942212d6c9c6d525d8e0630e25f27b2899c06086a0a38d9d242974b29c47f4ac76303d9573a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCwI:A3k03kHRJARJv
- TLSH T194259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 969KB
- SHA256 f298cc51f3d220d8c7fe9bf2a850f4245c64a5de252f45fa8f2d7b7fe12a8e07
- MD5 24555e14a83d3c23e0decf77a4932dd4
- SHA1 accd600ac1d7bf620e740b9a8fe1ef27437b14f6
- SHA512 cfb992de4ba527e18ec3f758aa70b090829b6b947228a279f3f9f939c357b6ad6ecb0563b1b907baac34fbd9773793edebfd1cc63546e6f3f199094413a0d455
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCyo:A3k03kHRJARJZ
- TLSH T1D6259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 969KB
- SHA256 e93787b4a9144fde16086fd024794ab271f5d457a109a4c8371738c9ab44f417
- MD5 c6b3e88d956783b0202983579e90c18a
- SHA1 1e04d72e5336d2c68ce93a5cac82f0eb42117d27
- SHA512 d2b02727a6fe37ccc61bdb13f6a7984994c85d34be01163668274bd68cb0e46990dc64bddb36a226bb0d3576ecf7996f40f4996147d45de02a801e5b250891b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCp+:A3k03kHRJARJc
- TLSH T197259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 969KB
- SHA256 8683cbc60e4bd7b553cbf8f29387f9043740f934d60dbf504ad7de1f2b03e7ca
- MD5 40a48ae5c3adeefa0e92636e494b6517
- SHA1 7109c68d065662d95b0a2eed61685728361d7232
- SHA512 949255ca86e2a4ac200a9f12e77528bdb698af8dbd4449ad5896d4ffbf768aae3fb46a3f226d2a922388d04fa19e56c0b70668c258a5c988e1e2dc7e84e7d998
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCXQ:A3k03kHRJARJ0
- TLSH T144259D03E79800E8D15AC2789AA69A22FB757C56173097DF1354C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 969KB
- SHA256 c37c1c36e18d931f64cfa76bff5693d9e4de85310d5974e278ac4b1be47adc35
- MD5 842c50e7fdf41e3579b80b5afed30ebc
- SHA1 82bd1b3ac48043d40c2c9d288e5a3bfb23300732
- SHA512 7af2971ab5075c9da973598eac45766503f928ba02d3d5d394c73938a3f6279cf70b92ebc38f7d0e86124d3216a056b8c2e7870e618ac68cc1795d20fa19e330
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCsX:A3k03kHRJARJ0
- TLSH T1D1259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 969KB
- SHA256 0ba33f7773ce90ba62a3de8d034c0544278a2740656a4e7a61351351b2edca55
- MD5 49ee9f72a489c68d4ee77eea238d759d
- SHA1 f94e9c5e231a7ff35553965c4c6d5393efb58726
- SHA512 da59144395dd3c95a941a0313c95febb1e2ac312ec2465df4af069b9054e5b52da5ee607ba44ffc728a1b0449addbd2a924011d62cdf9739f4d83bd4da803459
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCKL:A3k03kHRJARJO
- TLSH T15F259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 969KB
- SHA256 6e9eb515057181376c96219b82c1e14e0da6ee1e979ef91edc23b384e1ef678a
- MD5 42319a0fa3181b60dd3af1febb5ce71f
- SHA1 0c4442fb66814212d50861b38ec7f7c8427d651c
- SHA512 09ab4e7e7fdc650ea52dc0fa5060314c5091a1103f64a80664d0cde035e60fd8a9bdc4982dbbf3928c3aa4b85b20dbfa7221613fd271854becf40bd4a0cf010a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYCuM:A3k03kHRJARJ7
- TLSH T105259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 969KB
- SHA256 f15775a3abb6dc4430baab15fb4906ae456181f796be052cd8f46556e0c04ba6
- MD5 bbc4451b9ec311e460c74550055929b3
- SHA1 ce6e7bba58047cc1230efb4c3b254a71feee1df5
- SHA512 4be4e7ff690fe01029e7d3a649a3e55b0c4ae168e3645d8ff48f0fbe037b49aa153933bf528ffa31de7a5f72a8fd8ae7f4bac2a5f87a4fcec57c60706237f9a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoB3aERahBYC3h:A3k03kHRJARJ1
- TLSH T18B259D03E79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH