Analysis
- max time kernel
113s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
25/09/2026, 22:23
Behavioral task
behavioral1
Sample
2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 877KB
- Sample260925-2bae8a1tby
- SHA256 44e678edbdf38b4d68c8ad11461f10aa79df0b64a56eaec271adf73318748778
- MD5 98f0839b166b30c00fed0c7238d57d60
- SHA1 bb89936f7d66683e31737fa16753831d094244dd
- SHA512 82ebe8e5e52e32e3c1f4674878a3cb5fcb0c621a2bb179eb05ba3fa0eaf4694cce49d1380820f3291813be57e12665f1009d3a1eba0704acf3e7f5c826ea3f4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFN:A3k03kHRJG
- TLSH T13B15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/3280-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4bd-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c9-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3280-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2540-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d0-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8d-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4c4-200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018983-208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018985-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a62-234.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-247.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-305.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-475.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-506.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-597.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-677.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-739.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-758.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-851.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-984.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1027.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1059.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1103.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1362.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1404.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4bd-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c9-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d0-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8d-60.dat aspack_v212_v242 behavioral2/files/0x000d00000001c4c4-200.dat aspack_v212_v242 behavioral2/files/0x0005000000018983-208.dat aspack_v212_v242 behavioral2/files/0x0004000000018985-227.dat aspack_v212_v242 behavioral2/files/0x0005000000018a62-234.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-247.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-305.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-324.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-475.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-506.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-597.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-677.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-739.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-758.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-802.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-851.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-959.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-984.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1027.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1059.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1103.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1146.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1177.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1203.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1330.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1343.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1362.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1381.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1389.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1403.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1404.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2540 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpshare.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe - Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3280 2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2540 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-25_98f0839b166b30c00fed0c7238d57d60_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3280
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 877KB
- SHA256 44e678edbdf38b4d68c8ad11461f10aa79df0b64a56eaec271adf73318748778
- MD5 98f0839b166b30c00fed0c7238d57d60
- SHA1 bb89936f7d66683e31737fa16753831d094244dd
- SHA512 82ebe8e5e52e32e3c1f4674878a3cb5fcb0c621a2bb179eb05ba3fa0eaf4694cce49d1380820f3291813be57e12665f1009d3a1eba0704acf3e7f5c826ea3f4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFN:A3k03kHRJG
- TLSH T13B15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 5599a2faba70841e251acbfc7015b85b188762d599fef771c4a4bb6e33698092
- MD5 e007e02b5650741a73cbd57e138dc91a
- SHA1 36825f041b3c542a2cc00d36a0e15cf654dc113c
- SHA512 66a44ec9c1a4b0f15ce3ac73471ce5ea8ca5dafd6123f0d93a92eabb170eb06d388b55e5686eeb60fd7841351a8e51b85039238e40c496999e3d188de6f50fd6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFZ0Le5ji0hmxNrM:A3k03kHRJGPji0Aj
- TLSH T17A657C17F6A402B5D027C0B9C6D6966AFA713882173086CF1359C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 892KB
- SHA256 e69f351cc2e65362aa9830455844dba2b7db27c1cdff4dea7c92839566653eca
- MD5 ac20c657129e017f3c021616139f8224
- SHA1 9c84a220521ce6da3fbfba9eb6433d58b98de6e6
- SHA512 615985f7bf8cd3ab3b4d772e46ace59a1db602137d4f6849edfab305a8fc7d5a36cedc3aff18f538e8db5e01c4b62d64ea054ab616729cb6b5923495082bffee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFLa:A3k03kHRJ
- TLSH T19115AE03EB9500E9D10AC1749AD69A23EB75BC56176093DF2358C6152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 925KB
- SHA256 06b5b2116ce0e35bc3c65f96f2c3b8a7ec82c569b28f2cf1b13e496eaeedc32c
- MD5 167a52ad47d2d855d6bd6f4d0bd68ee4
- SHA1 f2f1cc6a4e0942b052d631714f1abfe2c97efbc4
- SHA512 89809ae421ea08029723e48d863e39afbd2a244f998d6dbe4d0f45310ef2dc3884fd8399dbd006ff448d8a1b7173f6a97b060bcb390d090fc34a0b7ff0bda6b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFIb:A3k03kHRJ7b
- TLSH T1D815AE03EB9500E9D10AC1749AE58A23FB75BD56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 901KB
- SHA256 51195d29131c29881c5ce73ff60d6e7d48ab34b1f0ce4164d3473b15ccd79830
- MD5 1602983d1c470e1c419cff212381cba9
- SHA1 ed81378c8fa2f838cd91d1b54041ecd268b41d8e
- SHA512 855df43754a0f6a48eb9dbd84772b2ef9ba16d35d1d1195426cafdb1885886965ea03c2ecccec4587cb66274fd8f3202abd31ba55ed981b02a8eda2e90600109
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFzZ:A3k03kHRJk
- TLSH T19515AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 901KB
- SHA256 d3eefcfedfeafabec4d614b664ce1ba7f251ff9503f8307c7ccd1b246fae663f
- MD5 a36ef0ead8f2e91e26e7ae685e80de20
- SHA1 f6f768c2c251b191af9f5ff696807833ec9bd4ba
- SHA512 8d654fc3565e19e879e121266c40d69b82edcfcd2d0ae197888e31a23577ebb3c40c58e1409726115db77bae0dcf509b5de9a9730d02a979301242afd772ca23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFo1:A3k03kHRJ7
- TLSH T1D415AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 901KB
- SHA256 18a52495f38dbb4bd90d578bb55b9ab6b504efba7aaa68f812d89384813b11e5
- MD5 d177d913cd2c54b5522ca2bb01c8ba5c
- SHA1 267abd33905152cd4df570ca211f7f23573d6a05
- SHA512 75b188ecd7a9d138e194edaea7266396d85b1ad821b9389f21dd03e7d32934d193e06341d35f0e3567f944a8b6a7dd52fb19fe3976e2d9da0b9e721b5cd88553
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFiN:A3k03kHRJt
- TLSH T1DF15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 901KB
- SHA256 10edf4a6c1c7977405b095dce231802db89d6cee7e40d907aeb64440feb3d3d2
- MD5 43ec6bf1d908ac56c3db996988ef031e
- SHA1 1f90e6153433d98cfb8b452b1bb98fcd0735fd07
- SHA512 2cc050888d7804a9a1141f0a146987ec98b019cd73b4283b5563cd913dd99bd3a54909fcb632c34895a4001c2c72fe6d95006a3a72246b9629c2d1b2d55e1ede
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFYf:A3k03kHRJF
- TLSH T18A15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 901KB
- SHA256 0c184f5c96e65521f604458f592986391c6d5861d177b3c5114ca709a4f2a0fd
- MD5 15bf935654eb3acbe56ed989daec088f
- SHA1 0fb5f2f66a912008ce81af8a2706bd4f277a3f3b
- SHA512 50ad1ae3d2f49e4109d62925d38ea5d41ba880cb082649d70bf2a547a5084dc3edb29c8d0ea4e902f3b554bd85d68a9d0397726e8ca98b8f1d9a8bc188ac0ab4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFyo:A3k03kHRJQ
- TLSH T1B115AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 901KB
- SHA256 77160f99d0f1a5aaad1089c1fd82c907456ff096a6e4dc31204dc20984c009a4
- MD5 e7d6db5f92a1ab5e4450d245603bbdd8
- SHA1 f4ab972d2666204a407bfa3829f4c8ca30c91c10
- SHA512 64c63f940d491c38348cc11f5ef97be07c0b5376e148d746290190755dba3e25582aac73582eefc5e1c15c18b5b12240f5dcfcd109bd8877182518d7c06771d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFmu:A3k03kHRJS
- TLSH T12215AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 901KB
- SHA256 27c7f662085bcd954938e15bf44cd3617a61b44fd44f89cb4f40132705629b2a
- MD5 1455457898140f2694fd775ffa94964c
- SHA1 deac2150bc1af49ee90161a03e2e9c81747e7694
- SHA512 a1548f231ad80c29dfb7d7706d9b0972a0cf3e36178647460edf55e66653620b00ebd3947815541471fa4a9aaf5600351e7e3cd9662b67a1c4d73731bc4d0fcf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFa9:A3k03kHRJT
- TLSH T11215AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 901KB
- SHA256 e09d492d701acd4b3c9d5e475b15c2e425bd7b4044532df3ea08511c99a6f9bc
- MD5 fbf9ebe8db813fb2ac15c5a37f1cf075
- SHA1 b1f8c764bb62b3fa0e085a240280b3eae836e5a8
- SHA512 eab8f5a1db110842fc3a9036f633d9b980a0968758408b947d489dc987fc0badde5589fd23ce6c8191f1c8c650163c1c3a0b53b5911a05f4f720e04dbf687691
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFac:A3k03kHRJ6
- TLSH T18B15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 901KB
- SHA256 8d4770331a2999aae8d47cbaddc0c2d1ddd21cc6a9a33c6e7c0b1993d76114e1
- MD5 5ec3f07738713ecfda3352bf8364190b
- SHA1 53491b254c35cdac608098f39722782b578ec0fa
- SHA512 371391d692dbb5f376fe15817bdd25fc836c89c653402271f476fea49f14a704394e97fc64b1534a11ea85c4fec1d0a766cc77e30bf546ff43b66b0b2c21d514
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFTp:A3k03kHRJg
- TLSH T19615AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 901KB
- SHA256 3f5e3f7ef8508ce5ac8c5421b57e45afd6b005243c4ad95c2d1c43a7e9e2b5b4
- MD5 011dabf8dd6fadd04e030311cdc92c12
- SHA1 f6942ed926f97d6d32d17c71d732d6564dc354ef
- SHA512 02e945b0b8707364d658a888d582ea84d5ebf45bafd5df994e4ad8656de87eef22b2492193ac2b0a424bf9788a21599e550c7b80f1e0ca65a39acb2cb7e0272e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTF0N:A3k03kHRJf
- TLSH T1E315AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 901KB
- SHA256 5464e18913418521b6199626d4b38f65c92c60879af7b271620031511ae818a9
- MD5 80121114e9ea9fd11bfa430ba31ac688
- SHA1 3b2799efe8fbc061995e6cc0bf268ae7319c735a
- SHA512 72d6a76cd866e8663e825c01e551d5110db92b27b73e21034cff9c2c1b83d38b2ac0b434d6cc6c8b10c34b6c20bfda4b0c6cb009ab8985faaa7194bd061f59ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFcF:A3k03kHRJ5
- TLSH T15E15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 901KB
- SHA256 b846849c662501c844c697923ad08d651a950e172b91ff268e8d296f00788232
- MD5 c65c9c9c6ee99f12085343c5f0349dfa
- SHA1 eeb75719678dfb4426675603145161dbc72d766a
- SHA512 cceca83aa6eaf7e3d45c4a9b2475eb6aa83feaea11fa4de3ee8a0adcb304ad114c7884f6cc86d198093efd93f85ba8f861b1bbf6cc0d540010a6d78ea0cff803
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFJC:A3k03kHRJF
- TLSH T14215AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 901KB
- SHA256 ea436eba86671c7dbc8ba09410d5e7367e87d0c7c2756c2eaeaccf8659298214
- MD5 ca0bbfff9fff424674aa8c8836e591bc
- SHA1 0e6e865f81cb76f715d3b0eeebca2d32f41c1607
- SHA512 2dc30b4430a0ed04b9c6e2ddcc4c3630385e1e48302dbb6b35bc90b6310111a79fb471d86d5ccf33ed11e5cc63d4c62497a1e70ee7a9fbfd0a134deb3f814490
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFqw:A3k03kHRJo
- TLSH T19115AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 901KB
- SHA256 0efc68b6abef449862c600e2d509633e7ab65fd85136ac98d7becc5840592431
- MD5 284d4e7bdf8fbf3dd7f9b8825239a483
- SHA1 c261dd5973353432a4f067dac427276067a92baf
- SHA512 fb790d150a8640e3d2d4fea2b56339db7d2037d3b9849a8b8f7673d2ed2e5e4a090b155bf210c5c5a2514a8a354f49062ee42171c77529f405182b3b685d9af5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFxT:A3k03kHRJg
- TLSH T17C15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 901KB
- SHA256 4fa28d6fde94e4cff952d35ca9f75addc93e11b8dc49a39c55f213d4558b2c57
- MD5 60183c74f56a990e23e110293855ed95
- SHA1 ce8772eb5b46ce7a8a219734b0468e84f4563c70
- SHA512 9d5915b0cacc999d7402305b2e19a780560c21f68ea3197bbd07cfac7e82f633084484ba6a47f24bed157173a085a63736f8bc3d8f09d67c47cd1597c72e1289
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFfu:A3k03kHRJf
- TLSH T15415AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 901KB
- SHA256 5efde677f0d3a199139525e956db5c3243ba91e958871402205b604ba5bab641
- MD5 810a4afe6f1629742ad8f8d5e0798567
- SHA1 a8bcdb0e8be151cf8318efb6694072fb1bc269be
- SHA512 30331b1d365c8019eadd8d90c67c52a74ae3caa069e1a1c495e286d8474cec4d79807701768d4b5c8123c03733bdfd52ad8eed8e9d1a49f70a5c559d85c597c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFDb:A3k03kHRJG
- TLSH T1F515AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 901KB
- SHA256 031e039f04148e791677becac170d52a6d3c0b451beddb5f7f5155c8f709a8ee
- MD5 1672aed27f98a3577f5f80edd0cfee44
- SHA1 49b1f979a97de22134d2449585f8bb71bccec8c1
- SHA512 0b090f81cccb248cf2c40a6efacfffd0528b3ae23052748620f6af479baa82456106b668657b7b7208e0c6e848eaca8214bc50f41ddd0aa6aa5f277b9f492aaf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFXf:A3k03kHRJW
- TLSH T14F15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 901KB
- SHA256 aebf6c642da908c4c870a821716a11f71fe6350ee23d1f74db765d196a844bfc
- MD5 3b565c17a74adcc59b135b9c2ac61a16
- SHA1 1bc45a617b13824e4568353508947d0512c90f8a
- SHA512 db384ae429d14fc9216458ca0106f1f441422ac7d80d8150f5b72e8e336b6aae86a635b7489078757a36207f6c4dcc4d99324397399e79d2d1b4786e4314a460
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFgK:A3k03kHRJ2
- TLSH T15E15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 901KB
- SHA256 31ea5260787acf5d286af700b2b90eb4e9cf599a32a878d15b4c764e59047b05
- MD5 772ad11bc255065ac6a7d8fd753434f2
- SHA1 7704f410645f60524af2616261c0490538fd0be4
- SHA512 99bd2167e24f0aa020cf5e2e3ef45110653214b8c54624c9b37f11666287afb134bbe077deec695210725d982cb8f0a10fdf0fcd41e42dd97177a8a8a2cdc9aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFdk:A3k03kHRJr
- TLSH T16F15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 901KB
- SHA256 9bd55455a5dc632510e1a38dfabe8cf0acaf0623e48658c7bf85c1e3e6eda372
- MD5 87fd7eda248c1f76754e96f769e6e713
- SHA1 ad8e4ada41e88723d7debd747e4b5505985440b0
- SHA512 3b7d8a2eb617e48dd1b715fcc44d8933c4d3060b41703ef30d59738f2aff9b78236b187e91e65db957b08b24579572a775365507bdd1504678973b8d0690771c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFC0:A3k03kHRJ6
- TLSH T1E415AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 901KB
- SHA256 4b0b6d62db3b2896a4ebf80802190f24ba4bfbe79bf9220f38681e7b3aa05c78
- MD5 51fb0f41554d63c4d358b739de20567f
- SHA1 21607b22603a75dd5eea0de1e4f5f084fc47d683
- SHA512 7490a216a9f6cf6a4acf567576e7218a5516559425b78841b99cfc1fbeb4fac74735d34618f9b20d3d37c3209fcf6443d6ff46ff2c739baf9611105227baf8b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFRg:A3k03kHRJD
- TLSH T12A15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 901KB
- SHA256 605f6c0e7dffec3574f6f5cb8b7d4b8bac965623e1634904b9c0e65e89088ef6
- MD5 b9251712bf66a691ebbb40d314549e26
- SHA1 42bfa3f9b5ea50600f58df723b7031b3e99f557a
- SHA512 27f410599c41523a0d0e32d92f6f196973391211f8b2523b7d29404332f382c5eb1fa9516be3bb70726305f6fe3b861d71b47c29877367a462379240fab5b09f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTF4r:A3k03kHRJV
- TLSH T1EA15AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 901KB
- SHA256 211e93eb01e10103c51a06d2cedb27e307a0341e702cdaaa47bd04ba2474d135
- MD5 4e16507ba11d049d955909e74b79e281
- SHA1 a767ade3f8ced2d4a515b52e8b2f9b2567b60b1c
- SHA512 1f8ce635f1f2cc85e44976d578b74174e650e56aa0957affd12d0b0b1cf798dba0b07c8afeca8bf95c5712879b138d97a00884159a9217a9996b19c0976c21a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFWn:A3k03kHRJH
- TLSH T15115AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 901KB
- SHA256 98f62fc66ac38bd2a479b8e577f3d48f151cf9156e3e18294736e6fe4db4b247
- MD5 4be2ddda07e4e0c9422e8a8081205d48
- SHA1 6720e6852e7b620114e50fd0f9214d0c99f8d364
- SHA512 e1460be2700c3e6f4921a46282c3f8c9a64725fab5701931bd0f10646551fdd4010f098fba61b277dc8f4ad8ccd015bd257dbc8fdb38321e0866e986c831632c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTF8x:A3k03kHRJd
- TLSH T18115AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 901KB
- SHA256 2714e53610e3309380ed8226fc2077e2459750a282eb4b8805d6a377b4209870
- MD5 3972370e5ccacf0085cf9df08e9bd159
- SHA1 2e279bbbaf3833995dc6ad9dd536ec3cf45e4722
- SHA512 5adcc54866fad86a184e1bf29fb874f75d45ce7750c9c52c393d7b37014f79a3f54d45c65955113ac7d784c738d3f901967bc53cb9d5ab33a347de043ff45493
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTF2A:A3k03kHRJC
- TLSH T1BC15AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 901KB
- SHA256 b42869e1a13d6a4c2f9f20d6abaf44e8b43e127a55f94aa4bb732bc6eb7f207c
- MD5 1a888a219ac1397be9a40f4bf61c4739
- SHA1 56428f2143680352163d011110e8f5e32b680566
- SHA512 ff44a25b2f7924804d159bb85b47d7d6e29bc77387bf91963e8c7aaebe38e43348ffdf3f66603091413ee06129913721f3bfb15f9e2c1e766a4df364764e5a33
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFv9Q:A3k03kHRJf
- TLSH T10815AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 901KB
- SHA256 c22f9a597ead1171f10437f97d396897e31846ccb1a9ed33b3e863d110087cd9
- MD5 34b577aa13364ff3a970de332e2be2be
- SHA1 221324300b3cd52ce21c04a1bd2e66e120fde2d5
- SHA512 74aa2020495c1464a75cc82c903de67afe841c04948e6ba5e72be6aa49cc738be81809236cb27019a92306991d7f732b058f61bc47ae63bfd33d0349bab19e88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFG4:A3k03kHRJg
- TLSH T10015AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 901KB
- SHA256 254ae3e73cd102a4adbba3288da4e7d7709fc594f940094c87ddb0fd227d4884
- MD5 01db0a330640403b8a395c8fc5462dc6
- SHA1 7182758277c11f885e330ed0f5a7eddf4d84b24b
- SHA512 a551dac5a7618f4216237a368fac47ee59ff487cbcde9cf45caf7857808030bab03f0ae6e33aea16040feaec510dcbfab2b8a5b89e4c44180408dbac513c625b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFVu:A3k03kHRJB
- TLSH T15415AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 901KB
- SHA256 77b0de33f481fda314a58db7e77cbb5fcf2e2d10ae1109851b7759d0f329b6a1
- MD5 eda77d7318dbdd21b6875e4474acdcfb
- SHA1 d44595128b724ed8e9f62da617d192d47fda0890
- SHA512 c6f2cb3efe6779d163379b3af7edc777832996dd792b3e992934501b8d64b547e4fd3dd7cbeda5a2c286572e38cee984a14e3dd14026be45e6ce354e826923bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFIj:A3k03kHRJr
- TLSH T13815AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 901KB
- SHA256 b3696014debe945a1d0af5ee25b6a988e9c52ebe350dadc0e66bab10d96b8aeb
- MD5 f533eb3810e2c370363c2e2b9b6249e1
- SHA1 06f6f846e3b62b52075d5e40a3874c8544207e9e
- SHA512 d61988286c77e6c5475cc63f046e53471a0c64444f498b9111aebbf21d484f70b058b8d96a0bf6634dc97eaa9d8a6d4118e854bba7ea6cc18b777fac1a04d87c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTF5g:A3k03kHRJj
- TLSH T18A15AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 901KB
- SHA256 966ff0aa8abd6e8afe86d7518fa0166949ab031b59e61e890572888e1027d1f2
- MD5 6a24d8a043c4a6d1309369b1d9609b93
- SHA1 a3ca8bf73c2fe04f3726c63722f584245f7e681f
- SHA512 2e62e267a88f1e4df0b83799dd0527649f0fe4083bb88ed16b13a3979cf5589d07c0b5366ec926252e0f9d2d60a1194dafb4347f7a07c989d30e2219d4a4cd35
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFgI:A3k03kHRJq
- TLSH T1A015AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 901KB
- SHA256 d89e6bcf3a4750e0f1292ff40f2d96305014e6dd8be96424be17243b899eb2d0
- MD5 ca4105eef421d8dbce8b4a1ce1725b72
- SHA1 80e8e145c8fd0a3bd40f3132da96e786ba55b0c1
- SHA512 315b2b0baa029103603fab9d834c28523c97330033ff78ee02a83d60f8eb8a31c301a4949ee7f4b933cf544878707f2c345bd08968533c8105340b5d782523e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFio:A3k03kHRJ4
- TLSH T1FE15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 901KB
- SHA256 b37c7505ae61daab1f6d4a29e7ab3d9d78eebafb20dfcb7d55da7023d2616c77
- MD5 292d1bb0e8f4ae80d109f1a06687e1d6
- SHA1 a47db9f194a717e696ac5f2b42342de77dc9729b
- SHA512 146541ce1799b57a97d5d31f3c2e2c577ca24b72a3d0909289711d6a6a879bb1c40d4acd47918dce86e16c90d612aa8fbbbabc7ad660c64410bbe6353d558e63
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFZ+:A3k03kHRJF
- TLSH T19115AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 901KB
- SHA256 65a626b6531e37b870ef0ac2432daf8c1f421dc663d150891cd78f29f4590b7d
- MD5 506e46d62ba0662780f92cf29a17010e
- SHA1 0fa65caf03f46393fb1b833f1861228e720cbc5f
- SHA512 55382c202d5e342d8bc26b370d9e482d2a2d297d31322e8c03a3261c073964ba7a612730d04db458e4bd76f9fb79977b2049e480f55963ccf24432a675e71d8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFHQ:A3k03kHRJN
- TLSH T13615AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 901KB
- SHA256 f617aac58c6b2114073f8c734bcd1124ad2f6a35cee23ec572c1c29410d2a754
- MD5 f22ece6b5be896359192d67e59ddb2a3
- SHA1 6c1c9129db8cabdd900b4e359c5e8d5485177695
- SHA512 325ba508ebde50c3c47dbc7bf28dac29c9d1746bf6f3c470c39c4bc7ec572faf8ab2fe101007c0e08cc7f5b3d38af0588c9650b6fb724eb62c4e16baf328a53b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFcX:A3k03kHRJ5
- TLSH T10915AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 901KB
- SHA256 01c77581b82f7f46cdfbca31f6e590c573a7734624c8c8aea4435e5ebd1581d3
- MD5 9b6ce4992494ed92d5379155b0e2cf0c
- SHA1 1635cd5f6fbedbcb3c2df8683cd8bb93581ccf28
- SHA512 772e16263a64a0147cb2d29c04120ab70f147c60130d6efd3d2a3902272fdf95b8102462f5d18545af7c31e7489adbf8a87b8c2d16609030ab8e9415a8d43211
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFaL:A3k03kHRJz
- TLSH T11615AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 901KB
- SHA256 ee72f34205b059c488870528b2154636e0946d74b1c0aa5abf99c8fb72a36cdd
- MD5 32adcec264cba0b35e2e43b3353da893
- SHA1 03a8e24b80f5210e1dfcc4e8fc8e7bc2e06a0148
- SHA512 f90e8c3689f8342a47cbf129cf5b0d7a6093ad0a8b846d08e342c93a8a399f9c7935d81e610e63108f1830362553e7f68f7a8a22f55d9f52f84eaf3df5c394c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTF+M:A3k03kHRJ+
- TLSH T14115AE13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 901KB
- SHA256 0027b56e25f8baaaf60088d85a77d0c14ab2e2661331452375f7f449681637b9
- MD5 94cfc31d2fc259c0364a0a439f35daf2
- SHA1 93110ca646cc688073e6548abfb9825cce06a628
- SHA512 dd02ae6c066f0fb46785fa5dc6ad6a823114a15bc855a62f6cbd2329ea2013820ccba959f4f15597d64cbf36cddc5645c9a5647df6d5f0601de7a232215806f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaQxbTFnh:A3k03kHRJQ
- TLSH T12D15AE13EB9500E9D10AC1749AD68A23FB75BC56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH