Analysis
- max time kernel
114s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 04:14
Behavioral task
behavioral1
Sample
2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 927KB
- Sample260707-et1c2aex3m
- SHA256 9586c4c0d8a9e14163685f4db362d7b937fb696bbf08b8a4dd2a88b5722fc8b8
- MD5 3f761abe7c5190032b224035e8983091
- SHA1 6fc766b98b325b2c8fc8008fc95cd935c47afd01
- SHA512 050958394a1cf08fc2c06bed00d7f3bf1ab2c7a4ebc9c46588cf0d5a101fad2456bd4db4323bb3c06b6008d110b952e35edb610900fc6c97c46d107ce94a39ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aF:A3k03kHRJi
- TLSH T1EF15AF03EB9400E4E24AC1749AE65A23EB75BC52176097CF1368D6152F72BD0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/4644-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c548-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b21f-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4644-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b24a-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5452-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019bdd-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d0-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d2-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00050000000189b1-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001982c-236.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001982e-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001982f-256.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d4-263.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019833-296.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019834-309.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019835-334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019836-371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019837-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019838-511.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019839-578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001983b-615.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001983c-640.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001983d-731.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001983e-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001983f-782.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019840-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019841-839.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019842-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019843-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019844-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019845-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019847-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019848-941.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019849-966.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001984a-973.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001984b-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001984c-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001984d-1091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001984e-1111.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001984f-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019850-1161.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019851-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019856-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019857-1200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019858-1297.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c548-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b21f-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b24a-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019bdd-60.dat aspack_v212_v242 behavioral2/files/0x00040000000188d0-203.dat aspack_v212_v242 behavioral2/files/0x00040000000188d2-210.dat aspack_v212_v242 behavioral2/files/0x00050000000189b1-229.dat aspack_v212_v242 behavioral2/files/0x000300000001982c-236.dat aspack_v212_v242 behavioral2/files/0x000300000001982e-249.dat aspack_v212_v242 behavioral2/files/0x000300000001982f-256.dat aspack_v212_v242 behavioral2/files/0x00040000000188d4-263.dat aspack_v212_v242 behavioral2/files/0x0003000000019833-296.dat aspack_v212_v242 behavioral2/files/0x0003000000019834-309.dat aspack_v212_v242 behavioral2/files/0x0003000000019835-334.dat aspack_v212_v242 behavioral2/files/0x0003000000019836-371.dat aspack_v212_v242 behavioral2/files/0x0003000000019837-480.dat aspack_v212_v242 behavioral2/files/0x0003000000019838-511.dat aspack_v212_v242 behavioral2/files/0x0003000000019839-578.dat aspack_v212_v242 behavioral2/files/0x000300000001983b-615.dat aspack_v212_v242 behavioral2/files/0x000300000001983c-640.dat aspack_v212_v242 behavioral2/files/0x000300000001983d-731.dat aspack_v212_v242 behavioral2/files/0x000300000001983e-750.dat aspack_v212_v242 behavioral2/files/0x000300000001983f-782.dat aspack_v212_v242 behavioral2/files/0x0003000000019840-802.dat aspack_v212_v242 behavioral2/files/0x0003000000019841-839.dat aspack_v212_v242 behavioral2/files/0x0003000000019842-870.dat aspack_v212_v242 behavioral2/files/0x0003000000019843-888.dat aspack_v212_v242 behavioral2/files/0x0003000000019844-902.dat aspack_v212_v242 behavioral2/files/0x0003000000019845-909.dat aspack_v212_v242 behavioral2/files/0x0003000000019847-922.dat aspack_v212_v242 behavioral2/files/0x0003000000019848-941.dat aspack_v212_v242 behavioral2/files/0x0003000000019849-966.dat aspack_v212_v242 behavioral2/files/0x000300000001984a-973.dat aspack_v212_v242 behavioral2/files/0x000300000001984b-1022.dat aspack_v212_v242 behavioral2/files/0x000300000001984c-1065.dat aspack_v212_v242 behavioral2/files/0x000300000001984d-1091.dat aspack_v212_v242 behavioral2/files/0x000300000001984e-1111.dat aspack_v212_v242 behavioral2/files/0x000300000001984f-1142.dat aspack_v212_v242 behavioral2/files/0x0003000000019850-1161.dat aspack_v212_v242 behavioral2/files/0x0003000000019851-1186.dat aspack_v212_v242 behavioral2/files/0x0003000000019856-1193.dat aspack_v212_v242 behavioral2/files/0x0003000000019857-1200.dat aspack_v212_v242 behavioral2/files/0x0003000000019858-1297.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5452 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe$ patcher.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4644 2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5452 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_3f761abe7c5190032b224035e8983091_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4644
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 927KB
- SHA256 9586c4c0d8a9e14163685f4db362d7b937fb696bbf08b8a4dd2a88b5722fc8b8
- MD5 3f761abe7c5190032b224035e8983091
- SHA1 6fc766b98b325b2c8fc8008fc95cd935c47afd01
- SHA512 050958394a1cf08fc2c06bed00d7f3bf1ab2c7a4ebc9c46588cf0d5a101fad2456bd4db4323bb3c06b6008d110b952e35edb610900fc6c97c46d107ce94a39ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aF:A3k03kHRJi
- TLSH T1EF15AF03EB9400E4E24AC1749AE65A23EB75BC52176097CF1368D6152F72BD0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 edbd67d6eae834e5179b00ab310b1af6b3d2d5904136dc55bf51291457e139f7
- MD5 a245f1d57ed38ab27bcb133869ac0f5c
- SHA1 9a3a5b919318e365a1a722b7f1702b0380fca2bb
- SHA512 73ebae7cbc5cd5490e99d6057f9b4913af854d5420be17607f450fc267bcc5b73cdb559a431e7c084ae9aed63806348bb95e0504b2c837cd9927d02e9862626d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aB0Le5ji0hmxNrM:A3k03kHRJiPji0Aj
- TLSH T144658C17F6A402B5D067C178C9E69A5AEA7138421B308ACF1358D7283F67BD1DB3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 942KB
- SHA256 f2ab80b5d986b97335ce76423a71d046c743f0bfa4a24b1955a64397f43b8ff8
- MD5 339cf5c55eef1607c574a02b806f3f55
- SHA1 383ad58a2bdd8110cadbd00bb0230fe7415a3dfc
- SHA512 a3c79ba77b7dae5df48054880a81ad9546f3209765420bea132d164f55af9ca8f04d9ce6b631168da20da064415e8ff797667964c834acbcfdd2d15e9144ad91
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aDa:A3k03kHRJ
- TLSH T1AA25AF03EB9400E4E24AC174AAE65A23EB75BC521760D7CF1368D6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 975KB
- SHA256 a194fde6245cb7154ceb03034c65e60f4dfafbabd6d7e9f4054804928f3477ae
- MD5 ba84190da9a0b970c12664a462bdbf52
- SHA1 5db936005c1e13add45d9880c56a14e5dc100fdc
- SHA512 1d4a0567b116e5794242941c8ae60740f3d44f793d2612991678a154bcb837da08a8012192764a386024c3378cfcd2a735775b2745ba9ef711a16024c116f0b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aQb:A3k03kHRJHb
- TLSH T12D25AE03EB9400E5E25AC174AAE58A23EB75BC521770D7CF1358D6152F72BC0AF3A3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 951KB
- SHA256 0e2798b74475b7b3c313ef8d7797313d2de39aad78bd58eee5cfaace31fe8c75
- MD5 0136748477bd72caeef5d34f4b06fed0
- SHA1 cef3a9e003488143d9eb6c7f64a5caefc1ae2d68
- SHA512 b3fb9e7e65952685fbe444748ea7b8997951e572f02bcdd54c7089fc744e5ed4787c5cd8291f6fce78877b3004d9e6ecd116a425159018843d130bc4f4ed8603
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aLZ:A3k03kHRJQ
- TLSH T1FA25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 951KB
- SHA256 f220a2f0a80a47087025d14c22ce104e3f4664907e34f4696fa2e47f9284d159
- MD5 5875a3310e0942655a0a6ee52b90d0f6
- SHA1 193926f73f2acd83bb8ae1c6c4d4d6388057a128
- SHA512 f440244a9a4b9406946290e1e70cdade42ae9678587c41cf576b11492d0940d41937c70a8cfac20b7f1aa2938aea083cede8b9480bca8a3065f19d1a34c4840f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aw1:A3k03kHRJn
- TLSH T10D25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 951KB
- SHA256 82149fd30c612d623754f147f496a4a15c124fe47101308bb90e95d587539b5b
- MD5 23b79cd1a2374b7628c506bffe572f65
- SHA1 3513db3c1bb096ed035ae27b44b8d07519266f7d
- SHA512 37d0d6223e84189f7cd81c499c6fef80c16ec078739d240bded318c6535a9ecf6f20de9d17bccdd4a1965f54ac597d8639dc8de090c9eb4e02fb2c6dd9bcd787
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+ai6:A3k03kHRJM
- TLSH T1BA25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 951KB
- SHA256 676906e4a4152ca999b1192d6cf800f0f328a259b15b6ff8876ca8259459bea2
- MD5 58c94e2d7d02804d157877ea9eb65fe7
- SHA1 6b39d9c57d73432738e566bd2eafc1f2e7b11f04
- SHA512 a83996f86e188ef55d10f8fdca528238d74e1ae91313ce0c46f322000748e10c1436589ad1b739b0ebb72136af0cc796ee1041d15334ef822b277ac131106cb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+a6N:A3k03kHRJx
- TLSH T12C25AF03EB9400E4E24AC174AAE65A23EB75BC56176097CF1368D6152F72BC0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 951KB
- SHA256 41565db185909658d3b7d920088cddbd70d9537650dfcc8da86db0d1bda983ed
- MD5 8bdfeea2fdb5358150013e06326c0028
- SHA1 dc2c66c74597d651868e1b87ada0cc1274f1cdae
- SHA512 dec69421a8244a0653b92b306074053c85c49d35832b02c4ed3aaad21e937583c2c5a0503357d009bc4d6290d11fbd3ed1868882e86cbb18a799f53e0ffef89d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+agf:A3k03kHRJx
- TLSH T16325AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 951KB
- SHA256 31a9ab1709f71fe6267a44f3ef868e04c4a9c3a360ca2594627f6481ed1b9a8a
- MD5 efd7944688101d575d1915e6b4ed578b
- SHA1 491aaa41a46ee55c9a2188a7292d6138f5c906ae
- SHA512 cf7aa6dc8fc2edc831043d467972e4b4be7de70aa53bee23dba938a466f208f4294ac9399984917d9d2bf3184507bfa9bfd8c60978d69428c496dbe3ad6976bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+a6o:A3k03kHRJE
- TLSH T13C25AF03EB9400E4E24AC174AAE65A23EB75BC56176097CF1368D6152F72BC0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 951KB
- SHA256 9477a00e292d451e5bb373ec0da197a2a9fa9326726e85612b9c70278d697273
- MD5 73f4b9edabc8dbca87083042fe6da70e
- SHA1 9393954502e71bc7d0cd778aeada2ca32c2827f0
- SHA512 0e75748a1ea3ad9a40701732f003dccb92a887137e8ecf39727357f146c993c28a07b194b51d9459668a1654057d7d97dde02840e095ac8cd8e6f929bba4c905
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aOu:A3k03kHRJ2
- TLSH T1E725AF03EB9400E5E24AC174AAE65A23EB75BC52176097CF1368D6152F72BC0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 951KB
- SHA256 3d755f126f1e3349ac381682a6607907b2f44a9f8255206b9e687361e6287710
- MD5 a44d84d2855f3ff193a741e9f96d5c11
- SHA1 0b4ee2b0889f7c5955f2ce15f8656422c597df02
- SHA512 3d461822c788175cabb33b8c9aabb601fab6f0e0b01b88b6d4dc752c71ef2bb873705319e646eeed925aa2cb493ac3cb90c2e1355eb69a5eacf1984b855a93e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aC9:A3k03kHRJX
- TLSH T19C25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 951KB
- SHA256 4310d94c55fbf244804e06f542e01b31f861982dd91c75b54fa9cdd723098360
- MD5 42572e5669594aaf801ed5523c9cb93c
- SHA1 9f8198eb6e7da7b9c67a2bc6eee2d8fd3c797d5e
- SHA512 95261f2435589d2cb2705356459ca3f05de884f37e41d6c5d1fb767811982f091bfc0b942d4570fbf8e391e1a9093bb7c7539e6191f5e65a13e28da0ec956690
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aCc:A3k03kHRJm
- TLSH T1D025AF03EB9400E5E24AC174AAE65A23EB757C52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 951KB
- SHA256 6e9eff899bdfdefa03d034798af8be6e52acdfdbebab786b56393af6060f7302
- MD5 94fe601725efbe179f326c4e223806ae
- SHA1 8d8baced2b650dbdea3e87f7425021dee7d5c0fe
- SHA512 4ea017a68c42e7263bb5777d848dbbe6a9ac70da549250a5e547c40c88cce5856d471ab0f52982c6a939d57cfd65239f27d423e8ba367fa91592e43f44ad0dbd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aLp:A3k03kHRJ0
- TLSH T16A25AF03EB9400E4E24AC1749AE65A23EB75BC56176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 951KB
- SHA256 b24b77a51991a0ff55b62396481dc077db6203b0fd6fb3f65c32d45e709e286d
- MD5 136e350cd6b4e2d9af003a9b0511ac8e
- SHA1 5325d83bb6d9459f83f7d989b6951cd26c57fb01
- SHA512 35ab447c78a2e76fe83812c89f41e1802186b33031953620a0d5523fdbc00da998248ffd8ef6ec398c4b0a0d38dfc84c93c4b5043545615b21fa0309780382a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+acN:A3k03kHRJD
- TLSH T16B25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 951KB
- SHA256 9d02f89e1539e0eb10fdd49bf15775af30f0abf67aacc05d2343cf7c4c8c6b3f
- MD5 13819836e054203ec7f90bd453aedfb6
- SHA1 53dca488a76f440ccee46603b34fa365586e6bc3
- SHA512 381107d9eac0063bade611bb5c7e263eab68764b2366d73503dcc7398e015ab3179d44cb1db5370d809a12adfe96776154c7a6c112bedb717322077271e0b651
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aEF:A3k03kHRJV
- TLSH T1F825AF03EB9400E5E24AC174AAE65A23EB75BC52176097CF1368D6152F72BC0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 951KB
- SHA256 674757bd78ec198efed390750aa24ca34f53def3a296891213ca1b6cf7fe42b3
- MD5 39af1f7df1107d383fd9bc159825c8cf
- SHA1 cff5792d3bb13cbcf5c95d67c33eef64595ff9b0
- SHA512 811eb7f4125d89c3d224717706bded998a9c81d7a7e01b8ed667f7795f58b3ecbcdc38991ad0cfce3947ab6b4495a09446b58d29d4f2c846f90b3e13b50ab421
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+ahC:A3k03kHRJ5
- TLSH T16025AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 951KB
- SHA256 a50c6e3712db56bde1cb84278439d235253c69bebc89028864f5681dae41cc95
- MD5 f39fb3bdd934cdd491430ff1f8a1634d
- SHA1 9ea751c6ee5e77baf3b67249fddd2ef93c3771af
- SHA512 f9974d032b5ec702cf1d676d975e0fe7d35736af40489ed891756dd04899b16d07e27db390bffb61151e8426fceadddecb9d2dfb253e7d6b4e5bb12f79b4282a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aiw:A3k03kHRJk
- TLSH T18025AF03EB9400E5E24AC174AAE65A23EB75BC52176097CF1368D6152F72BC0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 951KB
- SHA256 49cc783a65a6f99f6fa72df6f0acfb4c3cb421a482532453dffb54d2c1fd2a84
- MD5 02a7db4cb5a0ec2dcd8f6e529900d937
- SHA1 95668009d031520d7b814df397bcf8625c50bcf2
- SHA512 3f02e0644269ab1d2d50d7d3e0a3fcfb8e39f258538fcbb8cb13c789eff8dffa09ae5e1b0e0836ed7eeb8d33f8f7818d4f24069cc642d43578a9f13b806887ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+apT:A3k03kHRJM
- TLSH T1F425AF03EB9400E5E24AC174AAE65A23EB757C52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 951KB
- SHA256 78534c80a0057e7f0974e12997f70b6818799fe2abacba30e42365ce1ef1ecf7
- MD5 21d7f94304ed0594f6b6584fe31ca952
- SHA1 f2a57f80f0696b6370e999ecaabc4beb40fdc382
- SHA512 319b673c492c996ca4c9fd363c0e72576069d0c369c5c832ec979351cd705d76196cfd978a1447e29514d9e1c441826498b46a10e2f356217ac21c52d3fe004e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aHu:A3k03kHRJr
- TLSH T1D825AF03EB9400E5E24AC174AAE65A23EB757C52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 951KB
- SHA256 daa1441f4181b71dde1c82ba472333346c37c84da3d25deacd90a0a569e85452
- MD5 7141bbcd2648c361c706e64bf682faf2
- SHA1 b542c84c4abb108ee784ba0e441777d4a86b6a8c
- SHA512 87bd40393dd67283416dbae9cad2002bb463e01fffba0b879fd81961e9e579e16173cabceaa75850cdfece394b841664be769ff7b2199d29d1e683afbbc52f3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+abb:A3k03kHRJC
- TLSH T1D125AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 951KB
- SHA256 46be70fb55692ab3c0721b7050be4a2ec34d2ecca32a5127abadc20424afcee7
- MD5 a652bb4f64a498920f04317b83c0b6b0
- SHA1 5840a1db5fd2a2bdf955261025ee1a73308f1d20
- SHA512 bef07da0ca68bb20d63cee4a9534dca40ce3b31641ab902c3e60d648cf6f56b54033fd399887f8e8a0992460b776a7b1e6df4d9d5857971273d1b8d2183aa775
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+avf:A3k03kHRJi
- TLSH T18525AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 951KB
- SHA256 0504f1caf49fa1ce582e893857b95ee6b53ab0b07ebf696e70176008062aefe9
- MD5 78489ca4bad900d24910aa64b4ccda2b
- SHA1 42866370700e64632e6af2c3b4ce87731fd354ca
- SHA512 b860e84fb188222b2b68656245bf9f0d22d717116e2a5b4692614bb886c3973e89d7d9f54dacb24a4e8de2166de290c49fe0440903db7b90249b5d244bdcfd0d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+a4K:A3k03kHRJC
- TLSH T17D25AF03EB9400E4E24AC1749AE65A23EB75BC56176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 951KB
- SHA256 65bcd2dc174634d7f69c95ba0e08164a70ec3040029978e49bc4c5cc0aacf288
- MD5 4c07f08a2680e8ad2c1878f45cc08f17
- SHA1 0cac5cd98c28d0c52e51199b7fe1b2ff176d05e5
- SHA512 48a6c5ae7079f7e70eefdb93e684ca9e895213fa3b5d176ff544d736630ed0ac7edb5fe4895a8c21918180b1454a0d0940e7a8e21f11ab7c7e0dd410ea8a1d07
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+alk:A3k03kHRJX
- TLSH T15625AF03EB9400E5E24AC174AAE65A23EB757C52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 951KB
- SHA256 e128f438af65e425013c3ce29fc433923bb0489c64b9191094f71acb29410a0b
- MD5 7291359c5c207741c7d086f47b8cfd99
- SHA1 bea60bfc760082f6eb53d0f350f59fff3018ec05
- SHA512 8edd04c57c235387f19f8a7077d3cfc288c27dbf2079aa59529538354389da086cb535a4db103b7a32250d7d31dcb7b6f1795e6cb9bd7910d39e3536eb467f3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+a60:A3k03kHRJ2
- TLSH T11725AF03EB9400E5E24AC1749AE65A23EB757C52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 951KB
- SHA256 61d0fa4b95d621cfab6fc99d4ded0e9fea095f72307b421b448ae6ef5ec190c8
- MD5 e4b48318df0f99f0ab2211689acb9496
- SHA1 692b863608bd1b93c5a017d1e8adbdd288089038
- SHA512 dab01ea4a6d29092d4436ddf5ee3a79f11b0f326c27f0a540039f4b9581205b992e2f9b94afd08d6575180b390c367c4bd96a6b22acf1ca19d025fc86fb473ae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+apg:A3k03kHRJP
- TLSH T16B25AF03EB9400E5E24AC174AAE65A23EB757C52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 951KB
- SHA256 2db7357cb82eddb7b6901cddefcf5d3c0f765cd763c86fd0c9aeac02c0d73056
- MD5 c424b163772fb0ecbf6e45160cbd0a91
- SHA1 4c33573860582801963deffb78e97264b0cf4a05
- SHA512 872653f8855f6be2904353c6af84a34c087f67db257692ff08f2fb47ffa1735b7ad2ed007b726d5f667019cb25befa340456ef9052de2eaf11585ba3184aab42
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aQr:A3k03kHRJp
- TLSH T10B25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 951KB
- SHA256 b85d968500de7d7b3d01556a58ca2aaaa28e55938e6507b3ec3579951fec1672
- MD5 835f5b11a88b9f5caaa761bf0551f9fb
- SHA1 79b811f1af92ce9e8dce8a43b1e366238dd806b1
- SHA512 6aa0e65aeca97f99dabcb5960493996099919d5a532ecb46dff5bc5bb9c25e43360aaf30fccb1bb58531062bd8de583decc646f0852031b4799b1b032f5a11e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aOn:A3k03kHRJD
- TLSH T17B25AF03EB9400E5E24AC174AAE65A23EB757C52176097CF1368D6152F72BC0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 951KB
- SHA256 92f688b8ea8485c1f6ac2e561944634f1cb08c86fa11658631267c432ad3cb73
- MD5 0d5b76a52f6ae80281f18f999e40df68
- SHA1 400924a93799b1b1d44ae66fc7d420be476c462c
- SHA512 673cab070596227c688d2410fe43cb46ae7bef3d4e78fdc5c594abeb374e6c1bdaec7ac1eb52b28569f290832b5a560cce90423bbeb779ff57fa99072fd920a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aEx:A3k03kHRJh
- TLSH T17525AF03EB9400E5E24AC174AAE65A23EB75BC52176097CF1368D6152F72BC0BF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 951KB
- SHA256 8b698720330712e50be582e17bf3da7d9def836c81ee425389646b0b27e6e85f
- MD5 b078c7cf73a5d7f821127fe174361107
- SHA1 aef80e9e72f93784da0353df1a8061fc2bbfb6e6
- SHA512 10344dbd3ff0b4a30a03f69f1387359b20519cdae7e899c22736eec4057f7b294ab6bf3a590b8e3f9bcfe6712c1397fb50a34f8c1c52e86940d6b2ad3d0b84ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aOA:A3k03kHRJO
- TLSH T11325AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 951KB
- SHA256 aa50ce226ad595a9b97e49dccad09994c1d71ffc7a5fe6db58d69920181d772f
- MD5 1f209af310652c9f6bc7665db741519f
- SHA1 2ec9d69b75eaf164083b44af68527be85ce3fa12
- SHA512 4e2fa7b14ae9b4de3002120b00d6425557d0a897835f3ff3854392bba3cda60f2345332ed0145a230a89c6ad799d589e5e85439459a23d443b33471a5df2773e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aH9Q:A3k03kHRJT
- TLSH T1E825AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 951KB
- SHA256 ae7b63e9a3f6e3036d92cc7c24205996181bb97aa8f77b334e6b21b91c9d667e
- MD5 7f0cd310ad60818a44822427ea267438
- SHA1 a2ae930684c432f789b7a66df8f549ca40a470e4
- SHA512 99a08ef2b8d25ba76f6eaf10e56a4771809f98dc90e0b04f7f79da7a62f975aac47415d1c1316fb7520643c52fe647aab53938e1f3f986e7ef9fe7c11aefd469
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aO4:A3k03kHRJU
- TLSH T18D25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 951KB
- SHA256 d3001f5b2e966fd71a11766a75f94baab13bf77f4ca87fea8c26f8f35438c69c
- MD5 8f0e1484ed70cb647db540aad06108a3
- SHA1 390ad05330a74f6f70a813dc6fb9e1708a81f325
- SHA512 e629be81220c4a2b2eaa1ac0fa5308c2945c876d30238744e35d4bade8e652202aa8045975f75d1067f0687c1858286885c5837470c6da08ded4d0dccd959a95
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+atu:A3k03kHRJF
- TLSH T10D25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 951KB
- SHA256 1fe7fa3949b571d7c2587a5e88ec5e4bd634e3602e43f68f2ebd0559f4b5db55
- MD5 de15476e3a8ad566cab03b36a666682a
- SHA1 42038c181e0b015be6e3eafd82c21507fef51198
- SHA512 489733c4e3c20ccbdeb07b25833218fb04f288888998bc1f87fdc34bae7f1307cb1b84269b023ffdf112a9f2a3719b726fd8f56945184d0df598f72c17a12f16
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+agj:A3k03kHRJH
- TLSH T1C925AF03EB9400E5E24AC174AAE65A23EB757C52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 951KB
- SHA256 821bf805c1d6efdedf65ec669078f4625173f0e3621e1e242d4d79567ea16bfe
- MD5 42a21fd04977c2985cbe03a2512e8575
- SHA1 334293a8c13323eaefbda8df6abde2eff221f9cf
- SHA512 e76eaf2e86b3a3dbcb5bc26c08b3a5e55a7fe8ad7fb7bf344f66735c47ca0c6ae22f4d0a91a0a8997ce79365cfae5b04a72f711fbff31c8c81019e990ae94b82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aRg:A3k03kHRJv
- TLSH T1C625AF03EB9400E4E24AC1749AE65A23EB75BC56176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 951KB
- SHA256 3dc211d3fd6efd638ee5732d975f26d809e4a193a6fb23eb487f58d9dd775cc8
- MD5 c4a1004f6f3d3f8032cc6d0c34a32f67
- SHA1 1a699aece44294719450347d2f7f1b7b33900af6
- SHA512 887536a1c6118f99bbfb0d58570126a77e7d8775609839a34a8b38085115da79a79bbc4c2c943f88a8e784c0127012ccae75d99f47f50facc109018e558719b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aII:A3k03kHRJ+
- TLSH T16425AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 951KB
- SHA256 9281efb7af60772e5779505f65afc90b6d397d5ac0e542330b482a32d9a9d057
- MD5 b886732ed4681f34941c8bbc09189d1b
- SHA1 230252183402915654db536a04505db02492055f
- SHA512 35ae134d7232db1f6efd4f036db3a03a0a1f518b5dc04af579e48f44ac5053f8b90e216aeebc4aba8ec66604c238bc1e63e74ef9dd6cf6f710959b0b171cfdf0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aqo:A3k03kHRJ8
- TLSH T12B25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 951KB
- SHA256 5befbbe298fe5738450fdc8d9a1935cda2d04a35298102daac043d0d61f7c094
- MD5 c7a4c00281984faf3faf89ed91ddb64c
- SHA1 e9064531d55837b668b65fbe9fec72509394adb0
- SHA512 30f43a8804fdffcc0fe046d604da2a37a41d62e614e4009d76ae531d08529b94863a2ed9e529f75e7fdc941b7dd429b62785d3c536395e13a42c93b5885e10c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aB+:A3k03kHRJx
- TLSH T18225AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 951KB
- SHA256 6522e40ec3d9cc27c61a6a84c308de75aaac8df1d65bc18eb42ccd9f291ad5ba
- MD5 68d082cd99cfb423d4afd1fb6fd5d8d9
- SHA1 70c60d7b18cd52d5005bb90bd0c63eb073a80174
- SHA512 a9ba0dbe17d88a5ca050eaef2506473800ba17c19fd50cd53daa294123157883b8000cd3c6d3d27e11b541350bbfb66ce30e9a61aca577ad7578a613a8b41323
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aPQ:A3k03kHRJx
- TLSH T1A825AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 951KB
- SHA256 fe005ac2583e770e587361e7adcaa538605dc6834855e0f8141a05f6e2cd9476
- MD5 b480a82c001b0570649a2dcd8489f242
- SHA1 6d52ac4e18531ae68a7fb0c34c2d79838d877280
- SHA512 bef25287f26a4073d0461323906241c9f6a95f61fb10b61694a3afa6d8c1a2ead77597947994845fff4d0639d55e441f140846b7637affcb13f64c40f1e013a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aUX:A3k03kHRJ9
- TLSH T13225AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 951KB
- SHA256 2ac16a91146a93916e8e8dc3d52f3d84d40c3551dae2a9c35f0a590812739f10
- MD5 6f2d861d3abca7c1f930ec69dcce0b12
- SHA1 6abd43bab0cb240eac11528de8ba026a4f3cd317
- SHA512 14ebc845401db4f0817ba5e473aacd14e268dca3c08ef3f0d7ff8bafd03fea1dcf3bb600c88b8c0c0f474144ac494b4400ee954d52c28514b734de707feac6d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+ayL:A3k03kHRJ/
- TLSH T1A825AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 951KB
- SHA256 4fb6dd1fc690d12e02dd0cd38e4716dfb236bbbfa551ef92ae7e5ba940493347
- MD5 b01c43495ad65312c3b9dd8f91472bd7
- SHA1 ebd19d365cc103b9697808055dc20a184e775367
- SHA512 0a33f55eb8c47dcd781cdccecfa1f856445d5414f288038178e21e3adef685cd513002cfe9a2b326be70afdb386bb4bbc31815c8c7faf782ba54b5720e7301bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+aWM:A3k03kHRJK
- TLSH T19B25AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 951KB
- SHA256 30b8b4d03dea51a552d7ff6c3696ef54e5e5fe96623f625513f635b217f8910b
- MD5 1c6f8563f4de23164b74306dccb6c028
- SHA1 bc2eae1001275d9e4bdd967e203ef3fe461f98e8
- SHA512 896929c42a7219791ccf8b3bdd42b272f88a0d5317f720f9e7c98cd586724be0914c9cfa533f5f9551a85c091681804644dd182774df954c56ffcd16e1f10111
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bRaRac/RaoFs+afh:A3k03kHRJE
- TLSH T19125AF03EB9400E5E24AC1749AE65A23EB75BC52176097CF1368D6152F72BC0BF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH