Analysis
- max time kernel
106s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 20:43
Behavioral task
behavioral1
Sample
2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 925KB
- Sample260706-zhy12sdx4x
- SHA256 6572b3b995ca273a62b2f2c0151d99d16b941c8abab46015d9ddc2d461ce226e
- MD5 913c4c52a419412a826fc78ef759c492
- SHA1 51cb38d35fe6993490a7f77b1110c296da81cff9
- SHA512 abe63688f3bb3206efb4ae82fe9d6647d6a4592a1b5c910dd6ca3efd3ce66d5e8dcc556fd5fabb9b0bb196965ae812b4e5ab198c62a241d03b7e82f1ee7e8978
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv29:A3k03kHRJ3
- TLSH T1A015AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/2072-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5cb-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2072-39-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3396-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9a-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001898e-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a68-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018bfe-367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019858-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6a-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-827.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-858.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1197.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1337.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-1404.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1405.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5cb-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d7-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9a-59.dat aspack_v212_v242 behavioral2/files/0x000400000001898e-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a68-258.dat aspack_v212_v242 behavioral2/files/0x0004000000018bfe-367.dat aspack_v212_v242 behavioral2/files/0x0004000000019858-476.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-598.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6a-629.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-720.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-827.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-858.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1010.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1054.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1097.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1171.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1197.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1324.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1337.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1368.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1376.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1384.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1398.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1399.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1400.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1401.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1402.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1403.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-1404.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1405.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3396 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe - Drops file in Windows directory 23 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2072 2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3396 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_913c4c52a419412a826fc78ef759c492_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2072
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3396
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 925KB
- SHA256 6572b3b995ca273a62b2f2c0151d99d16b941c8abab46015d9ddc2d461ce226e
- MD5 913c4c52a419412a826fc78ef759c492
- SHA1 51cb38d35fe6993490a7f77b1110c296da81cff9
- SHA512 abe63688f3bb3206efb4ae82fe9d6647d6a4592a1b5c910dd6ca3efd3ce66d5e8dcc556fd5fabb9b0bb196965ae812b4e5ab198c62a241d03b7e82f1ee7e8978
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv29:A3k03kHRJ3
- TLSH T1A015AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 db0994ae37bb3516b58e57740b090cef2cf056d15b2bba88341f937ec65d372e
- MD5 7bd81b4155373c540c30ea9b59876739
- SHA1 2efa171beccfdbfdf688e1a75b140a668889acf8
- SHA512 d981a09fa45f171f45f6be00358ec3fa2e29254229d1667a72458a9c6a1ca66f0778fba5238eb7cc0a949c9a7fe4c66ae0b2fed81448eca9666dd3f23c87d4d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2J0Le5ji0hmxNrM:A3k03kHRJzPji0Aj
- TLSH T1FE658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 ef499769cb664f357d344578cdc8ba3f390f587d05d8a9015aac09a8256cc3f2
- MD5 c30b482e65b5a2e9df98039f5bafa311
- SHA1 faf96c196cc76a535ea0e328cf99f3ac472c70f6
- SHA512 14d12d90f274dd33c8dcad11f4fc01b4a8fbeabba6befe7ee386bddb38eec9e101c0e00920cf2a0a743781baa0ab1f355927f037cae56bf7541db54c26c2e2ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv24b:A3k03kHRJ2b
- TLSH T11325AF13EB9400E9D10AC174AAE58623EB75BD562770D3DF2358C6152F62BC06F3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 948KB
- SHA256 9349cf71c9c632687ac75a54afd1fd9a28b8ceac18ef7968a40431031112bbfa
- MD5 d4077a1d97f5c67dddcda3fe11b419ba
- SHA1 393b9f2e7d9f53a6a414d3f6bc3172b775f7ed3e
- SHA512 e68d2049df876ecbf05536e069f5d29c0027129749c7f987d309a22422e4e315ce4f50f52c54d7990a8e387c849fa1e0a96ae6f4b82f03853c86655159b858be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2jZ:A3k03kHRJn
- TLSH T11925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 948KB
- SHA256 8e00c16ab355d1a57a8b9cfe135d8c194c979b1fbd43a4fe1824aa096c6c3936
- MD5 2b6bff980e79a542824c9bb035922a5e
- SHA1 0611aa9af4e5de055cb2adec06a8549cb5d721c1
- SHA512 3dbb34a6dffc3136ebe85c0f3f3160e5937531a45b52cca5b81d5eb2418520a1e8115d08b0044002211a4761e1b55dc6dee9fec8267af85c5797d3c6aa696d50
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Y1:A3k03kHRJg
- TLSH T1DF25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 948KB
- SHA256 1aaed1113a5a218cec1c25ff52995edfd3598a5f8bb07c4d86d1fc98e78a78f1
- MD5 c2a08e323f4c7cbbbeff18946eda1cea
- SHA1 c0e50c30e522d5ddbbda09d2354fbf5643c55a48
- SHA512 fb5cc8a52721da04be354fce40fa16e7581d312229744b228d29f456e7d38adc570e242c73effe11a6d8d849965154971fceff15c309df9d0dffe85da1868e02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv266:A3k03kHRJb
- TLSH T18925AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 948KB
- SHA256 2705cf46b740ec6ab6f76e86667a3deee289b5ef18703a76119e10b86806c3d4
- MD5 f818f71575d3e24f865738fb67b766b1
- SHA1 f42574bbb12e0cb377cc2bd7367c65cf5cb190b9
- SHA512 c61e33317aed0b8a0d3129362b027e6dd4954d67c76f124dbc864473b76af4a1eaa780a7827eb23b7b1fc001fd6a673fb440655ee2f1bb543bb2f900240aff4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2yN:A3k03kHRJG
- TLSH T11D25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 948KB
- SHA256 5782425cf085407c7a43f1d23bec30d2eb3587ae8168685f7d2ac903d8514be7
- MD5 ac9239076c4a1c57839ab9cabf1facda
- SHA1 d726b82f1a57ad15ffd87a345763bf5a20b26baa
- SHA512 845e2c3933889cfbfb3dad08427ccd3901ed2936af4511a913fb669c53b8a50845a66959a64eb64c432ec62829460d044164b96220fe1a78ba7f8f3a028e1c19
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2of:A3k03kHRJ6
- TLSH T16225AE13EB9504E9D10AC1749AD68A23FB75BD56176093DF2368C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 948KB
- SHA256 120e2f192d9884aa73947dd2e4c1afea726b2572d2e3cf388756143f5df0c6d9
- MD5 457e8535bbfcf7a9945394838fcb21d2
- SHA1 7eeb7f716f40429f143d5d9e499ea6e0ad84b491
- SHA512 82b329eca9aa7be95154158342e2046cab5fb0941c51a19f5b66e045a7f8cf519c2d4337bcce6a68d11e20436d1fe98cb982420f4622e6e46f2160502323e9c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Co:A3k03kHRJD
- TLSH T1F025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 948KB
- SHA256 7bfae02140d8e0a194fff4b1c0fa652a246fc1659ebde40a4f1f5343d564a2f8
- MD5 85df45dc6b69d375989dfad2bc8eac6a
- SHA1 3c2d5d50e2de605e406f94d97f1d99a2903622ab
- SHA512 11a3970eb0fb6906a5c75582df97d569184350e5f697ec9e9f189e3a408bab7aac80b8eca9d439f4c7602d86d59c441e6b60d491f4fdf32a65447aceb00c7822
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv22u:A3k03kHRJV
- TLSH T16325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 948KB
- SHA256 1d446b694ee6d00f3b73594fdc7d950d6edc8004cdefea10222cfce51f02911d
- MD5 1efa435505234bc7020bad8ef71349cb
- SHA1 3790ba6bce3804220d013a2124615b6834e2c08b
- SHA512 041c89803d6cd4f0e3bf33eccccad14b872d2b3fce6fc457dc80819d25b6a0a0b7f652b66fee706ccbe9fae0f55f4ee61fd5f68293a5958e527f85c771c46f53
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2q9:A3k03kHRJg
- TLSH T19B25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 948KB
- SHA256 90ea1ad30b0c219d27554f25b092875409a75882343bffef97df364a838498c4
- MD5 a383acb867f3c0eb38446267e4680c42
- SHA1 a111761a41f403feeb34544107fcac262a4186e5
- SHA512 6a244fc5349ba64aacf91201d4999452b713536c7cae082a84bd2a6fad7643cdd24fac8d409cf285e6d3b5576824740ab2c8531b6ef128516329166b9de9b8d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2qc:A3k03kHRJR
- TLSH T11925AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 948KB
- SHA256 74dac146188fbddfd44c14ab19f4e0dbdb8ba7fa8b840d41e1bb63ff036fd94d
- MD5 e58dae89a4768ad64da4387075aefe8a
- SHA1 4e351ccdbebca486aff2f977c69c6e72c744342f
- SHA512 a54d449ece1cf1a3d865378a12894ff1d223b966646e65acea244754e1a3bcee66a3964fdd57f23361f7af616f79d30e8402d4c65fbc5afb7413af4879cc0d13
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2jp:A3k03kHRJv
- TLSH T1EC25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 948KB
- SHA256 f95e5c391a3c8f236f3c6043e4ccdf86de1be2734514d61fa9358dea7bc09310
- MD5 acdc38dddbe87ab96fc54997de5bc225
- SHA1 3285b63a89c27655266088887460d96d997a2b15
- SHA512 d283afc98ff0aae18d482d51be83a6fdcd743c241f82baecd7c24e4ef6e551a4de693dadc7d24e6b950bfe56154d936462c3cda329d5726f60509b7a153d3d3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2EN:A3k03kHRJk
- TLSH T18125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 948KB
- SHA256 712139e0d6f89a1e05ebb92d1628e68236d49babcd30047ccd18858a89ccbbbe
- MD5 0a7007ce9babaa334f67862e9806c8d0
- SHA1 43f26deca1cee6d72e8ff13479b310d3a5bdcc8a
- SHA512 0875f075552dbda49b398cf2f44e85c18326238dc1ddc6647953ec402b2cde4bd33f10ecc131d5cedcf9e041d747e36be770e4d4717dfcabe37d7534b5f955a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2sF:A3k03kHRJS
- TLSH T12325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 948KB
- SHA256 41a4bb2f18991cb1161c0489c4159b81a9fe9c216769dd7205ff0e30d697ca38
- MD5 730809b4199fb760ccf3f9023404943f
- SHA1 1918fb68d77ab1df4da2e93dbf5ba27b5b8037ba
- SHA512 0046d3e83c5147d32c605819818ca4912792fadbc3f358ea0590fe49a3f95b4c4049cf937c23970c39ad73cf5fcf18f03d608d2ba6540fd392004b374993e9fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2ZC:A3k03kHRJm
- TLSH T1EC25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 948KB
- SHA256 9d027695481a85287e8765a147de42c35b224251e6235a2fbeebd3008547cc3d
- MD5 2d8d8a8c09db46426269cf78bc4164f8
- SHA1 ae33353742614ff5905209feb1354a0fc00337e1
- SHA512 2479fe61855dba5aa7c97ac9838957bec5e6a13b29c357c6b711c37c412e9a8b706bb7e7b9a982fc054ce308b5b838f9741d963f2fbed51960e43c2381c801b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2aw:A3k03kHRJT
- TLSH T1BF25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 948KB
- SHA256 1e272025272a1b03999a1aeabf9c6cd4afe4d457b424dd91de27eca57ea507f1
- MD5 5912d9830af60529dd14415a37114b38
- SHA1 d4c213f7edd67a42df58fa7e23389d83453ac025
- SHA512 f1ca12e2c2eb7b02ce07d2b3a7fe63d716218652be8e2bde28b9b1cffe834867826bcf37b5d1ac19ab6c76ca48a749c71d99e944d813b45c0271b8091ca1ae78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2hT:A3k03kHRJf
- TLSH T1E525AE13EB9504E9D10AC174AAD68A23FB75BC56176193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 948KB
- SHA256 f98af9bea3ec8a5640baf849dfebf87002aea3ba01e3f932ff14bec67814a6df
- MD5 6eb2ccf4574e6ccbeb6f71987b168478
- SHA1 88d3a1607804d9ff62545e6ec26bb0f5e6003107
- SHA512 a23090436db6b74a4a2797e7ebbb21d54745fa88dce05bee016bc2a24b78bcd907497b7a64b676935eaf67bf52e9a442bef6a0da3d9b4791e69236d3f85cf773
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Pu:A3k03kHRJw
- TLSH T1AA25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 948KB
- SHA256 03d98ffd58e26d9206d8498793f7137d5141c88e92b1ddac149ac33147cbd720
- MD5 21f8d8971144bada08dc5fd9c7bbc6e4
- SHA1 8735f6dc51afa700789b56663ac840538dd5eb05
- SHA512 6f6998c6ba7c456fb19f17b4cffb86e25bf7e4a93435f50c339efd61984804b2060b875010abad3db30e695d20d3c0010a75b5d5636fec807bb88b32b0c2b539
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2zb:A3k03kHRJp
- TLSH T11125AE13EB9504E9D10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 948KB
- SHA256 777d421cb604c6ddc9164c9b7e9e4f01793c1fe2d9e5d6b0f6ea2152ebd432a6
- MD5 90a4815822083b506875660caf167d4f
- SHA1 a7ce3463b6230db149697aa1523205f124e9575c
- SHA512 b484f76d2529509f84612b83c1913764c3e81147836e70e18002d414f06e645c748ac6a278eaae7be50273394e22a882d92ee1503cc32b8b643960ad0404eece
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Hf:A3k03kHRJ5
- TLSH T18625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 948KB
- SHA256 f2a6ea1e9559baf43c9a7b21b4b3bc99880277d10a52233fa30219e0199e222b
- MD5 227e45112a66fc763de5b8a8597fccab
- SHA1 d39a7b4f08869631dd1015ca5c8d68add9f64383
- SHA512 e0433f440d5d053224f5204b8924979af550e8cc7054e3d1153af4a06ea0a907f1dff4cd098575aac18624329e4878f3d1cf000eb656ba452e9a3bf102d69cac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2wK:A3k03kHRJR
- TLSH T16E25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 948KB
- SHA256 e97cb4802ee3b1d66359cf96b2f8dee2207d45209f0c9a47216876cd8b16636b
- MD5 e70c3a7c409d05aa6803f5209de497b9
- SHA1 9a301a0dddea3c60135a91f5f398fe1518671231
- SHA512 068d2262e6b04bf309b9fa02f8607027fe13b35197c0b227608a215db2b2d47b56314d0b41c07f7ed21c439e31f693ebd88725f0ced971471a2a639d34feaf8d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2tk:A3k03kHRJ4
- TLSH T18925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 948KB
- SHA256 92b48de964ebea92b338bf67ee262205792162599b4cdb680152ce670fbea4ec
- MD5 08754c9e4dd4ace2cdade79f84841277
- SHA1 823e3f15002abc7085bbcc3f47c4a19fbf931105
- SHA512 6123b010443a989679fc88a88248f75fd9de7ccae864825e01565802856c55b989fa3b42c1df0d8955ace266dac070f6551daa55e4f74d759b0ca9de17784d18
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2y0:A3k03kHRJx
- TLSH T14225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 948KB
- SHA256 53d8b582fffad9f56444a2afeb2bdc1241e8cfbe148057ebb44e31b77b70a9ed
- MD5 bb40a89babc4ceb50fd9193404f3ea83
- SHA1 185c43ea07bd2e8fd5683cf6b059a30163a3cfb5
- SHA512 147e031db32df9c6b74d2b3e199707150accd469c71cb2325792e40475e2deae23c57f217298c0c35035fdcb336475bde270fc551033f68cd3c5949bb1dab098
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Bg:A3k03kHRJQ
- TLSH T10A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 948KB
- SHA256 2edf2882d1c1c209c2168d648871036c146cabe05c65d2361f08e0f9c91301ff
- MD5 380c91f07378a3666313a9e432b19112
- SHA1 4996a77de22d89dcf94a709c691831d027a0e5d0
- SHA512 53c9543743f173d0336d8843e3e43a409a1f8c8175ba34c34e7b31999920ac62409ec9f14f7b5c69df7c76330eb66e502332072a55fa5328cb3e697d38f9e6cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2or:A3k03kHRJa
- TLSH T12D25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 948KB
- SHA256 b5c8c70df61b69c3beae7caee6bc3addd41fee8098597e600387befde042d4e2
- MD5 d31e642bee78007aca526aea224c1758
- SHA1 cf8e1faf940a0cd967a3c5f815a4a198826d2e54
- SHA512 86c3cf20e4eb169326f0b632c921b013ab959ef92ec70172eea1ea0447efb673d1cf6ec703c84bb5155be4fc5944543c1d5d7b17542360b82e7f7b49cad03a71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Gn:A3k03kHRJ8
- TLSH T13C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 948KB
- SHA256 69637631f2c84d052bbfb72fe7a02df97ead6fbdb3e86184f1fb7c480038252c
- MD5 32d3aa5617f4914753b8ee0ea670b6a4
- SHA1 faba1f3754bdcb193426681631d6d6adaa758c88
- SHA512 a191a4a0030c41e447848d87d1b358a998d6c409fe49a3aa17f29c0d6f58e8010eb7e304044a3e3283c4a7d18b27c075fbd13d79db3363657d7b91dd550664bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Mx:A3k03kHRJq
- TLSH T1CB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 948KB
- SHA256 33f32e08365ca2bcc057f2de029eafbfed6c7f972fdb017e5c9847609fa8ba91
- MD5 48f2c8bf39364d76c6c6ee919dd64a5c
- SHA1 9172efb73bd2c6cd1d5a0d20a686b8b08d2396ec
- SHA512 563c442eb8894443052119d765bd6ffdf32346038e523b00a697b16b02e044f92c3cad39c6ce147c5e7fee371016f2f4d94019a442aa02936bcc4a592bf5c334
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2GA:A3k03kHRJp
- TLSH T13425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 948KB
- SHA256 b5299eea5fac85a5ded433930ffd914b8487a4da1500cbb1e06eeec516803a04
- MD5 3d72c1463fbf732f7d9cd5a48cb3c54f
- SHA1 b60529acf8af9a55e691970cd51622940f5fd710
- SHA512 8db45d2a1e06e19e3bc527233a00d0cf937a918d2adcac80c0ba1c72aef0f20b59883d6204da3b42e437740947f1bd576fcb57e74ceb3b73f479d91b70a3e926
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2f9Q:A3k03kHRJw
- TLSH T1F625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 948KB
- SHA256 aa777f303351d3419367723a50a9b6b08c1f891625a0e058242381e97426f7d9
- MD5 5aee573d9f00bb33403c27eacc2eb4d3
- SHA1 837bc25301da7eb843712a9ae05254be65910c15
- SHA512 6d1cfa9adcef75ed4c1efd3577e8b140505d3df42766bc3fe8aed6b9f3f33c9ddd71ed1de3da0c5f34db28b85a00e8b8d21b9cd7e840c40da0fca36bea48d970
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2W4:A3k03kHRJr
- TLSH T10A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 948KB
- SHA256 a1e94a96945f8e158b6273672d5ff06915600f14012707a0543216cb118a03e7
- MD5 91feb68fdf7dc4bf23bb0c128027c8f1
- SHA1 a046d37cf40dcf6795488abb882acefee0d73a12
- SHA512 74afd8e6e850694a0bcf47786242b4e740153a321f07a7a06e1ca4c279633b546b19fefcf4a53d61225eeb5b0a1a7d862fdced3cc3c78931908a142b0eb76a6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Fu:A3k03kHRJe
- TLSH T18125AE13EB9504E9D10AC174AAD68A23FB757C56176093DF2368C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 948KB
- SHA256 343f1f70fefc2d5a9f417d2d3584d436caf639f3234c5f9fbbdce029ec9a872d
- MD5 494ec86042fb3061359346643b46509f
- SHA1 d8f73b78410e30e222e9b56a71485f3c84904766
- SHA512 75fdbafd73d3f15a0bdba72d577bf2b6c2ad9cb132200c0a241cf3af5859a711e5e4ec936d2053bc0543fd1feec7f813886ebfb5b68aa3d5f0b676f1b515a204
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2Yj:A3k03kHRJQ
- TLSH T1E325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 948KB
- SHA256 342b68fa8dae358c2b144a3ce8967829007d016a7ea0b239b6f7fbc133860279
- MD5 31b13074298394ce7ed5552b9d83e30c
- SHA1 fbf3c9b87a38397ddd103275379018ad9bef4194
- SHA512 286a2f8ede3779887deff1257469604858e9ed2f0e0cf044e729580409990d5a76df63dbaca7f33fd6176210c53f19ef8b4251a4d6dd4457c013c1f587fe8eba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2pg:A3k03kHRJo
- TLSH T15E25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 948KB
- SHA256 1a70ace764e2123c8517f4b07c206ea815467fc37eaa4e4b758f7343e497f7ae
- MD5 84f387fd452b66b45e040a0cb63b9876
- SHA1 118e260776fd6da6731f2fdefb88d9acbd2c736e
- SHA512 e82171e04ced45056a949c7212108c3d172dd7ee8431e02cc817ac1ede7cbebd84bc557d614016e821fd17bd54e6166f2f9181db73eabefa96ea51c3f7b8b5be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2wI:A3k03kHRJZ
- TLSH T14D25AE13EB9504E9E10AC1749AD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 948KB
- SHA256 3015e05d9066dd2f91096d66b047501f84a235396cd9504736e80d2bd937f809
- MD5 bfe9c9cf8149c8c91d087e4a2f382b88
- SHA1 1a31c0b219d2c5040ef9363169748bb0444daa31
- SHA512 2d73b6164955b92fa13ba11483e1a5bc55a5618f859a17d45f666b8012b5aea55acb61eee88a3c9da51c149c126185904c923df9e299bd4d063b2ccc6c59ce82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2yo:A3k03kHRJH
- TLSH T12325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 948KB
- SHA256 2dff790691357f5b8612b6d5ca6a40556d398bb8ca40784954f251f4a7a6444f
- MD5 4dab97745ddec0fe77d4ae3aea67559d
- SHA1 b8dd927dfd211c9a362ab03906d8f2695e842acd
- SHA512 125265b2ec9a901bcfb51f7b4ad350e6faee03160ad477e2b8378e057bc2f037425309cba51a3147989bf8431a407519951dda9a44cd03b62152a1babd9c7c8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2p+:A3k03kHRJy
- TLSH T1F325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 948KB
- SHA256 acd3345d6b79597068f4878d9226f0a7c7141ed2b47c72cb60f629819d504b81
- MD5 d6c34a1f13883038abeeb4202bb5116f
- SHA1 36f55d6d8ed562d1783dac45146c33c7a6bbaf2d
- SHA512 f8e443574fdefed7d2538820e41d195d40b107c269334765769bb65ce55dd2fd41670c0ce0b5056cbe9f636d7696ed7db87c9672062aa7cc6eab07af4cc3cee3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2XQ:A3k03kHRJm
- TLSH T19525AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 948KB
- SHA256 ec836efd476fc2bad5d0597928da89579a771ae3116da69a5877c7b2750612a9
- MD5 6bea2222b3fdea57d4e79763bfe680bb
- SHA1 4144a3182a5d56f685d8196bacad852bebcfa491
- SHA512 2ef84ece5f25c80b3c461a423ed1a77daf463749ae11aff1123c803e93aeff4e9cd7c7552be8a77b27433f48d61de8e221230d498ba0b15ec6fe8889c1b9a356
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2sX:A3k03kHRJG
- TLSH T15E25AE13EB9504E9D10AC1749AD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 948KB
- SHA256 129c95700893f04aa30a06a8fbba7d2b2e6064ed62d5267b4dfa81fc1b79d523
- MD5 a7d195c2944d89202ffa46d605d109d3
- SHA1 6d233357f6f114a68d9e7ca4dd5ccc181480a605
- SHA512 c73e67303a687857b5668bdd1a34e2806d07984917f49b6351c5097359cccb0fd07f14270f88fb93d612a34c4d4d1c30563887df2b594fcff74a25d519e56573
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2KL:A3k03kHRJI
- TLSH T10A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 948KB
- SHA256 e99736a617625395a494180cdfd883897a22cd5dd553f90104eae82f5cca9390
- MD5 0a57e6808fb5d6ad19b26931c953bf85
- SHA1 1c121b85b1cf0acbade4ab70de5630c438dce88d
- SHA512 c5d42cb5d52a613936963391a94a766dd239e92ab0ee7e3f4f8afb2880e0fc56ed594d6a4f626b0d5618ff1f94933d22542e6520e99b87f1d4588f72fd713637
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv2uM:A3k03kHRJJ
- TLSH T1EF25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 948KB
- SHA256 a3af0c30dbcd12e40cf797f2156e3f492e2719830be290d84b9d4bc3e24ed707
- MD5 648cdd40eef184cae16df02646cc07e8
- SHA1 40432a0a36bc3fa66533ffe0bab3240570d855a2
- SHA512 bf5e0dbf47eb28a63a38c24f5d4ef16d8a2aacd998ba215f69572cf78daf95ae23004dc268bd5596f7354ba9df153615715378647f9ea346cf3d33615e086d7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBv23h:A3k03kHRJ7
- TLSH T1AC25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH