Analysis
- max time kernel
112s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 14:06
Behavioral task
behavioral1
Sample
2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 901KB
- Sample260710-reet1acz7v
- SHA256 46ad5e5a110f6f3ebe87148b8ed87a1d97835c1b7dfb3ec66901ed76ea2d1aa5
- MD5 c08d21716760caae25780b743cc5fe4e
- SHA1 7a19f313d589fb724c1a5c33cac4773f82cadf3e
- SHA512 9e8f7e4ce78cd55b17dc022b432ac8fef3168409690ed66007f8816fea060f77710330101fca989085bff09103d1f46d9c46f96a5b1427d41ccb592eb1c0b0ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTp:A3k03kHRJu
- TLSH T18B15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/860-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c519-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/860-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5516-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019cb6-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000189a9-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a83-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019871-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-266.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-478.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-577.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-719.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-769.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-807.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-850.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-875.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-961.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1016.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1110.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1219.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1316.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893e-1494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-1537.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018953-1574.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c519-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019cb6-60.dat aspack_v212_v242 behavioral2/files/0x00040000000189a9-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a83-210.dat aspack_v212_v242 behavioral2/files/0x0004000000019871-229.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-266.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-369.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-478.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-503.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-577.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-609.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-634.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-719.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-744.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-769.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-794.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-807.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-850.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-875.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-894.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-902.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-915.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-929.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-942.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-961.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1016.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1053.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1060.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1097.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1110.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1141.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1160.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1186.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1194.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1219.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1316.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1335.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1354.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1379.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1386.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1387.dat aspack_v212_v242 behavioral2/files/0x000800000001893e-1494.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-1537.dat aspack_v212_v242 behavioral2/files/0x0008000000018953-1574.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5516 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 8 IoCs
description ioc Process File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 860 2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5516 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_c08d21716760caae25780b743cc5fe4e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:860
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5516
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 901KB
- SHA256 46ad5e5a110f6f3ebe87148b8ed87a1d97835c1b7dfb3ec66901ed76ea2d1aa5
- MD5 c08d21716760caae25780b743cc5fe4e
- SHA1 7a19f313d589fb724c1a5c33cac4773f82cadf3e
- SHA512 9e8f7e4ce78cd55b17dc022b432ac8fef3168409690ed66007f8816fea060f77710330101fca989085bff09103d1f46d9c46f96a5b1427d41ccb592eb1c0b0ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTp:A3k03kHRJu
- TLSH T18B15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 930KB
- SHA256 ff59b3d6b7703255e1cb852bf5eb5adf3c76d733aad4dd536dd1ef8e81bae043
- MD5 52ad85a5e0e9ab62b433cdedc6a19290
- SHA1 ca825d32b9ac12a463c33ab2f75dffd7ce3720de
- SHA512 da0161d29ae79d39c3437c223a7a06e0903c9a29e9077924e90fe8ca3d89ffd3b234102d35f5330e9395ff193173e76e35fb093e1ee19af4e958f28b3b8c8773
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTvP:A3k03kHRJe
- TLSH T11015AE13EB9504E9D10AC1749AE68A23FB757C56177093DF2358C2152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 947KB
- SHA256 8cf2d55b43130b297ae5210025aa3c37861977d0dcf5e9fd868f50029e23b2be
- MD5 95797c00ddc5f6cc321a62bc708fe77b
- SHA1 dc2172634932ba6bc508f99d7ec758c805924dba
- SHA512 c7ed717ca4e3e1138f0bbf0e9b35edb48f565a8e3720b101f5e130da057a1923332b92e92e87b2aa8575469b059e08a54d9a193b77d75758eb200dd82814135d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTc0:A3k03kHRJP0
- TLSH T12E25AE13EB9500F9D10AC1749AEA9A23EB757C52177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 953KB
- SHA256 b0a4f28cd6da06e3dab7f6d40b7f4a38f0fa0258dd349dce6c5d5ab444c7bec0
- MD5 65e6662dd9fc586d60038687f60e10ce
- SHA1 86026cf804ccf88f3af9d2ed01490dbad020a9de
- SHA512 9554772dddfb1007898476f8a32e86951524c08837a1b22d3745785d375b6a1ac2f85ca58f54a5498210c5b42d6e25b6fc00a4a3f71f4bcb68e268df4ee370ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT4fj:A3k03kHRJBj
- TLSH T1D125AE13EB9504E5D10AC1749AE68A23FB75BC561B6093DF2358C6152F72BC06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 c8925ec75e1da1885faddaa5d02514967c46806af6870d290793160e2aa84fc2
- MD5 bc94c7f4b569d839bb4e4d4d09bb96f0
- SHA1 7fd82cbbfb1e3fa7cf0c0135c9a6d3578dc7bb17
- SHA512 fd3ec47b76dfb4badbfd3b99d0a574238e6c7732f8665e19a458be29646e14f00d581275fe33808acef5247c03ad58730f8cfe43ca72f878a3b8aaf492352469
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTV0Le5ji0hmxNrM:A3k03kHRJePji0Aj
- TLSH T18B658C17F6A402B5D027C1B9C5D69A5AFA7138821B3086CF1359C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 915KB
- SHA256 455c0d55337ef782bb27498d9ba308874e74c829a7f9b357e6e66129219a8383
- MD5 975ad923e23264d19fdb10fefe2ee258
- SHA1 e2d7d843c7643f679d795cabe021a6304012454d
- SHA512 c18da0ac55d052f7caa9876821ca69f0e8a2e1d108a1c60bf6c9fe28cb71ec99c1153b340e64cd57fffbc5f51bc7b665f77d91db41d837c2d33e135077bd041e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT3a:A3k03kHRJ
- TLSH T12715AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 948KB
- SHA256 dc5c6f031193dab50bc2dcdc3896ac1ad7a9b54c83f796aea4d1deb538fa7b26
- MD5 f07cc57f053943d352d15586c3162a1a
- SHA1 cf25eb498a70f0c89dcf77547c337d3470a1fe3d
- SHA512 f77abe55bfffe0d6bc35f95afc3cd694ef31c3724962013c8eb1250ab2815cae46a692783b21304895a03c5cef30f45b45b37d6492ba17c7c7fdcacf88a38b3d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT0b:A3k03kHRJTb
- TLSH T1D625AE13E79400E9E10AC1749AE68623FB75BD56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 924KB
- SHA256 686aa662af6743b1bb6f113856c3d47f193ab5792c86abbc463b6d8107767464
- MD5 10e1bd369560835071d792d9c78ba2ed
- SHA1 34d1ccc4d3253266602a7c226eb9fb90c853cbb8
- SHA512 4287fd824f8e202b13a5b58da7b95677032f7bbdcef43fc29e93f0b85cbcb6b0ca5f2763e4c16beaee39118e21c39b573d546c1b47cae1a8a6706890bc557039
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTHZ:A3k03kHRJs
- TLSH T13615AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 924KB
- SHA256 f180406d093c0dd00de32e2c7fc169421ce02c4f08218ea9092262fb8ca8ab7a
- MD5 a0732542a3c7263f34972e50b348732f
- SHA1 5660e4c514503bc67a8b5d9290950495dc70aeab
- SHA512 410f419d04ba9791f98e8fd972a199ade5faff095af6d288e7b50f1106ea949eea679369ecb21fddf425f3283239d3d696845a0d65704e532cab9f277034964a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTc1:A3k03kHRJj
- TLSH T14A15AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 924KB
- SHA256 92d75f690d9fde32083cbed3c16c096a5328a3efa9ed11df22570124524dcd3b
- MD5 e7fcf0e7915d0bba7bb9c9696af780d9
- SHA1 79aa340588dd4c634c8dea6f07c3ec092f7f03a6
- SHA512 69867d5ce66e80530aa5b47b218fc1901bb83e007649bebe2770e5cbe2a0780e572f2622ac294f2d152611ff259fb9e660a28656b3054f9e3f9f05258b481a2b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT26:A3k03kHRJI
- TLSH T13115AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 924KB
- SHA256 5f54196b943b9a7aab54d2e63fb1f84e58ae65591c4eee8791ee5c2c017f3c05
- MD5 4f9da9353975ca847a0fdc56f3fb1504
- SHA1 99f9eab84d17efde9fdc3bed88024351214adda0
- SHA512 a9a32d3ffe40c03188ee91c6862e1b620a402384ab43109de46078d740226c2785afb00813b52eb736baba0182398c73bda9bce34e2d0622cddfafdd6f3146f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTmN:A3k03kHRJ1
- TLSH T19615AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 924KB
- SHA256 19df8b9726059da84f8517bc992b6abd4e8761e2ed962e869a16f20539ea6c9e
- MD5 1128d3bb81b27b5c27c63aa506804cf5
- SHA1 4de44eb07f02adfdf852ee57614c68c357d55262
- SHA512 82dfa7f1ece186c4398b7e1ea7f51632acc7cc5cf153809b97a6d75d34493566b86976f83c2fb1c44e71ee516d136afa767927f03556702a845d5d1bf30aea60
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTkf:A3k03kHRJt
- TLSH T1C115AE13EB9504E9D10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 924KB
- SHA256 f9b14e9db233039b6e340ff286394c75b5bace8851e7cf1d04aa6317642634f8
- MD5 018d882eee86dc129b09fd9631aa9094
- SHA1 7fef0c642c457b9ce06fb62f3fc18f2eb9846f6e
- SHA512 acc36030691089f6c693842534d5e7e7169b821f5b53faad63861635f001f66ca5f04c510c1a09b1ec3addcbdcc82ea18e98d8c79c23241921faee297223cd76
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTOo:A3k03kHRJY
- TLSH T14C15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 924KB
- SHA256 149004657403a3fe2ce762926f9092521be5d86edcb55a4a8a10d23b24a6400f
- MD5 be8a2ec5f0a5fba8e820f25fbb5604c9
- SHA1 9cc14e7b46ca361ac178a3bed1a9d4d6a13d3a5f
- SHA512 86cd7b54dc76651e8749e381575017d783b8a354fa0ddbb9bdb10b711fd791ea656cd70e2098d4ce731417e0b2705a01088422ff427d8a0fded108b08557cfe1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTiu:A3k03kHRJq
- TLSH T1C015AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 924KB
- SHA256 a03b2b967ecd24c4c6cabf3276812f9cfea9fdcb4cf99508a83e526abe8bf9ea
- MD5 20a9f5d05dda56953d1df49dbfdd2400
- SHA1 808e39f350dc09d9db4d8c547848ff71284017ab
- SHA512 b7082610272fc8c63a7b13d8042d215c8cf6db52227b60ee1671583f4aff42fe6bb796e41d41a8fa4977b3406fb7f04f2bc34f13f12b1c90a896e352199e259c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT29:A3k03kHRJL
- TLSH T19215AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 924KB
- SHA256 9375227f526cb6f6449b8d94527ea9b33c10d9a253f6ef53621e49600b7487ad
- MD5 4ab71d2e7eba63747b77f1563cf58aef
- SHA1 71b5e0177e06a626de7101a79e65c7ac1f3c2930
- SHA512 931b1e891fc4cd8e20651b2abaf090c2284cb7d6f11b14f76c972806471470396032efab000c862086ac26ad025f48fb54c7362b31e9eed4ec0ffb0a02981323
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT2c:A3k03kHRJC
- TLSH T19815AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 924KB
- SHA256 48080ede61e3cb36a7b7e84992669c5504271503b37911118451d7a2d8d0a1fa
- MD5 5e842ca06bec295ec44eb7b1d2e1c9f0
- SHA1 ba8cd807fb6bcb933fabbfdb4ace89f5dfe9c675
- SHA512 d0888d84a97192ef258b9bc871de5d539bba2292641812dfebb2d402c17c3af003fde240ac1d92e0790e19868609a9e9c6457a65b4b22f0ff5912aec46dff2b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTvp:A3k03kHRJo
- TLSH T1C215AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 924KB
- SHA256 e5e4be42a27df7eb0da708ff8ea849e79869c9b77511f0b68a13e4f4a29a1356
- MD5 8f12713f077889f192129086e4218d7f
- SHA1 29b529a8742a22b53926f259627c88649a12c83c
- SHA512 0bce62dbc47a4d0e1c0610d11bd5418243c85a95ef6b55a8c0ff25907618179232933347464260e13bb7470532a31aa536522d6b8df9c61e6a0d743ffa741187
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTQN:A3k03kHRJ3
- TLSH T12115AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 924KB
- SHA256 8783bb83aa1cf37192c5d1c5ee89f8714bf378bf04804e4f9e0ad484460c1205
- MD5 2759c0971cd631316588c6348e96d935
- SHA1 f046bcf68893546a6d8bf627172ced52a7167a0f
- SHA512 50fde51c0dfe6f9690fcc56fc7d169474eaf19f6cc9f363247a3f29f29d5ea40b14e56b24586808e4011f15b3b695fc78f03903744c1d0a3f276ade3f9634432
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTYF:A3k03kHRJx
- TLSH T10A15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 924KB
- SHA256 c5bfcc36b2cf90417343f71766615d1e6fd8eb5c307aaa4144d5823058657478
- MD5 6ef181c5dab9a9f8697a905611cf5b5a
- SHA1 5feaa8a0ae01da8753ec4063535f20d356ae2068
- SHA512 59c3d447bfcdadf5c585b3e34fbb327b2691646e9bfa63ac6801fa1ebfdd4baa8e97e66aa1810aa910b18df6cb58645eb5493e63910440af379e6468b4fa5561
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTNC:A3k03kHRJd
- TLSH T16815AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 924KB
- SHA256 0f88d2c327c0c19bf4cf5329fcb0e6656ff306d248e3a19ca62b3bd60ce8b38a
- MD5 f06c655c6d7384ef39116428615d5f1a
- SHA1 a0a33608da0c97543fec7821665af0c8956b0e79
- SHA512 1ccf0b928587db14e191ba816b3f2f3c2a33c4139c7bf1d28ee8f949f091dff624329e73c54a9a48db0fe10cca406d323a3bdb12a999dabedb260a7fc66c1e71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT2w:A3k03kHRJg
- TLSH T11315AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 924KB
- SHA256 455f8a613fee9d4a5eae9f908a183adc1c82019088b289511561ed9a01918b0c
- MD5 6da4d4425723bf0aa265d97fa3a11809
- SHA1 0bcd773c5d4eff78cdce5549b99a420e97873218
- SHA512 47f8cd9e1c2a3498a7d1544fb98627330234229f368e36662666bec4b6954f35f40bb3df47020e86513bde3180e78709e329bd212ca905f79f8e1dcaf8e0a948
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTlT:A3k03kHRJ4
- TLSH T17315AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 924KB
- SHA256 28a5a73e2187fd7f08d1114aac60429b7364d7fdf0fe75d780bfcec424d0e2ff
- MD5 18c5791a4e8d179c8ab7763df0267810
- SHA1 e91ac476fdfaf365e50aaedc178704d5215213a8
- SHA512 b0bc714be38518771816885f3208c0324079c657f94b1813ff6ce4faa838e49bac9d294c075068821ef164046da8ec3b9bdcbbdd1c74c55069c25646ae426184
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT7u:A3k03kHRJH
- TLSH T1FF15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 924KB
- SHA256 c9f15d017ce3bbaee9769e5ab5183fc3d2848c5a9cf6f0c0cc9a35190bd23c68
- MD5 34adff8f91cfdbe2953d5e3a6d41fc04
- SHA1 51df15c5d183f8132919a2d1cff1f8d11759bce5
- SHA512 931e8d6cd87aecdf8665f053c27adb43dc0d3f4a067f2e79b695665cc38e2154e582bbaacaa9a495db66c64a8df465dd0125d190b2953c36f522229cb98b1817
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTfb:A3k03kHRJ+
- TLSH T15E15AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 924KB
- SHA256 984f573ffa98bd8b2d7b21a4addc8edf050647083582233d906232601c469a0c
- MD5 0636547d9a6e8d57367f67952b984a61
- SHA1 e2996521c45a5b29964072ed0d14a52320d97461
- SHA512 db60bc5a0bdc48a44adf571a3cd43742226464cd16a8b9c879745f8b1b25acd824d996c2f8033b0889802b32749aa27209f724dfe9383c5953d645e3cc050658
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTbf:A3k03kHRJe
- TLSH T19715AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 924KB
- SHA256 22b65c7a15606cfdb47549d32958b1e9145534be0b0dfeabbc45766e083083c5
- MD5 3fe70094ca98b2e3ce3d752fbe64b7c9
- SHA1 1ad12cfab6609a5dc7ef476e875ed22317b8eec5
- SHA512 c29811b01dd3b31d44f8209ad52f8b96a7541d36258d9f2349b3b16c626132186ace4033313bb1189736396f9fd04c4e7bdc1725f2b729a09a3bdf29010a5116
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT0K:A3k03kHRJ+
- TLSH T19E15AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 924KB
- SHA256 43c843367fea0919643f3462ebe5a889fa6371731643d358466f260076d77cc4
- MD5 6011391c43cd2a2a53ce13affa2a4281
- SHA1 8c634a0f3fd5ba7e41f9409cf3c90a76e43eb7fb
- SHA512 11dab0b29ed612ebe92723a8ea3a7b3c44bf7453e211e1a1f998bf8969987dd9c66f539ea4399c7bd3e0926de5fd5e5eaf72f6c4b9ea164f4f042fb89a07f4eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTpk:A3k03kHRJj
- TLSH T1D515AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 924KB
- SHA256 f7d98cd0676f86cd179289d648dd50ec8386fb66311f1f8e50b1ae8b1b6686ec
- MD5 d3a58993ee53f52c3006e70363045eeb
- SHA1 beae85d861f9a9f3e6b12ca255438071e9596064
- SHA512 93d11463648f25d690bf3d58247b5e3bbe7e5e6471883aae4f26763d0bf886023e73f0dbae81cae93d184a077f6c18832b308adfccd9f147407cd5cdba568265
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTG0:A3k03kHRJi
- TLSH T12115AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 924KB
- SHA256 927121fafe6e19e480597f20ea4cb73e4659902dea0c0c699636650a621d11ec
- MD5 ab082c18846fd0f05c03f0b38cc68fd8
- SHA1 60becf267d51073d34d17819523b5f18c8a59f94
- SHA512 e6eae03a609e5b9ed1384d2738236066f2824cdc1a18d0214a96e4d569280e579a07ee11a585a731e206bbf4786cdd834673ba43a9b7238976de3cc6bedadc57
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTVg:A3k03kHRJb
- TLSH T12B15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 924KB
- SHA256 be87b280198b1c9410322d2456bcd14fe7f7a1898b98c8bc54b3fc16c2bc40ea
- MD5 e42252f1a13aa11b6a7c2b1fde970394
- SHA1 ce7c471db7809bed03026fbde87e23f306b46373
- SHA512 d6c546657c496d8cda5968e8dadeb4489ebe5ab92fe084ff95a07f2d1b75db7626f0163f19abbad6631a963d957f1ff64795ca50f36a016dfba36e2d544cee37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTkr:A3k03kHRJN
- TLSH T1DD15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 924KB
- SHA256 10938fca8ed3a7e2ac3e337d84ca95aeda7f6119678041c29c725f307cf2ef2c
- MD5 4d842551be1489a8180e4d16165ad138
- SHA1 b1c18de1d8bca6b73ce136dafa8bc829539e0da5
- SHA512 0c6c6718090b8e6af812d78ce8999c3d8988e5e603b1071a29b05090111edd3baa86afeddae6991c3d0f499c509a9e4480ab9cfe13187bd1ec60fa227855ad23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT6n:A3k03kHRJP
- TLSH T1D715AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 924KB
- SHA256 7d428868b31d79d87fee0d1bff4e032d2f1fcb560eb3437c7385da1a8ce9c6ac
- MD5 b44cf7490af2e1dff80e46f2ecc48b78
- SHA1 d1338cd6641b42716b2d6475e187e2a9715a7ef6
- SHA512 fb8f14035ab9157935d658fb618bf1550336fe6cfb9647aeb2468b53a99b5cfa002aeb58b4c2499d2cadd20d04f98648a656a92bf0797c4fe53a5bbd1a07b375
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTQx:A3k03kHRJ1
- TLSH T1D715AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 924KB
- SHA256 0559d18ef83684015ab094bc01850ffd4cb54aea53bbac485bd7da5ff1b2d4cf
- MD5 564c9842544ae86303009e81d8f2277c
- SHA1 15f623adc0507125ce508cadcc9dcb10ed59a5f7
- SHA512 5b72bc1396468bacc5b24011f31faf657e32976ed0547717aec48c8d48488d3f519bd323d67411720728014d7c4fd8542cf409c4ca110c81b86d96b07c074dfa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTSA:A3k03kHRJ6
- TLSH T1D615AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 924KB
- SHA256 9a8c020c3cb6f0a7295f596d6bddceb628453655d948bebe03aa4fc49ef573af
- MD5 e1a5cf1d9d4450f86fe5eb650454bbb8
- SHA1 b4185cdfc09dc4afce55781f62a2a145a4c91865
- SHA512 a1382784f69836c99e702854d82a49ecdbdcb63db42bf6fbd0e2f779babbbc9eb77b93417b868eec7f5e397a4dbafd3af5e8bb10d1b9ff25233aacfd637ac439
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTr9Q:A3k03kHRJH
- TLSH T1B415AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 924KB
- SHA256 8c586a8c6ad9a4a70b27f7960b3e03c59f04b1776a65a2f817e238563d9057e2
- MD5 9cc2d4bdd1c10e60ab1a24078c8f31fc
- SHA1 7fe5addb809d3e9c374cbf6e3881436fe1666c54
- SHA512 b7b9c9551043fa835b4c6f3194163b37709651d8215fd788196102218533f02c77d06dcfa644be2e86fd6e0e2304605082363725cf3747ad698dc0d6f8848d17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTa4:A3k03kHRJY
- TLSH T19515AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 924KB
- SHA256 d35de1225fa51395c99f66b8a1c24587f53f357e4b1c64a26fba5001dba4b86c
- MD5 7f1a1a7035d85b783c414694df6bf098
- SHA1 31921a7d69fef084fadac41ac3ebbf56d995de3a
- SHA512 77fd09c49e2e307a151b1c3af57f773e5fec5946eb46aeeb27c7b1526ebdcbb85255ac4571305c1973ab2d3ce2c50282a6f60b464988abd524fc244a503a8852
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTBu:A3k03kHRJp
- TLSH T18715AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 924KB
- SHA256 61bc25a909944d9f89e2759c7e56fd62e41965016ac86bced87926ade6d17bd2
- MD5 076e12cf6242699aaf04fc8a27220645
- SHA1 a37dee223e5906a6fc5e306f746c29f427592045
- SHA512 cdc15a2f917fb607c910bacb2ce41fbabdc806ac6553361a2a14543e26ddf866d4f49c75448b0eb04bad0e025d9fd5e5e774e34b97473b207d466e69a1dc6f4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT0j:A3k03kHRJz
- TLSH T1F415AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 924KB
- SHA256 3a1bbf38b8018739f5a5082db3cea425915ee236f6c17e24a085d21709312b42
- MD5 97dc6d1f82f249de1375a6913c35f80e
- SHA1 03597140cfb231b227afbaa6428b16a87398e0c8
- SHA512 9f223b0bf61de2ec29662e8eae6853ee4cb89ec037ce4caefa26eb603a110c3d041e5698c95db8fccd441f9ff7ea9a3187aef7d76ff44f6683efdb64a37716b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT1g:A3k03kHRJb
- TLSH T19215AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 924KB
- SHA256 8c12137ab2dbf911f2930600ac621a60662f082f9546d9003dace0f7352a475d
- MD5 b5684caf3ad32ae0e34b8c8335c2bf7f
- SHA1 055c282c89e0c1f5ce87c8b1531f4f3f62708426
- SHA512 835fd9ae26bf6e83b857ff7cc33e15116b81575d869013a4f24dc15e09408293532fc85b95394b1e9463cd505fd44823424c01dd6d93326120473a4783dd0ce0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT0I:A3k03kHRJS
- TLSH T17615AE13EB9504E9E10AC1749ADA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 924KB
- SHA256 d8a31c699933a115624089825e943c172f4aac8511384ab8714e4e5b9566d49f
- MD5 a71af8288354121f7f67adefa44f01d9
- SHA1 14b9906768d357a56b1692fa942fc35476c33a10
- SHA512 b6aa9fcf5a1d0235fa4847eec7dfe8a634bb33b3f46564da58c76990631c0decf7f07648ac4cad36123601e1540f99c577016236fdb6d1f0c2e81159337e4483
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTmo:A3k03kHRJw
- TLSH T19E15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 924KB
- SHA256 3cc594684f670aea861a18d85638d9aa77d6f108f971e8543ba156b23956a7fa
- MD5 367653aae91c66e1bcb37573671eb8ac
- SHA1 d5cab63f865a223bbefe4f2da6eb7e544e902d90
- SHA512 5b52fc4ae436fd09fe9a1ef5d960d34ab2fcf0adc865a5fdf23ea1edee252ad31ebfce092f5ebbeaea95014b546b5c129e3ab0ff71db01583e75944bb6b3664d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTN+:A3k03kHRJ9
- TLSH T17415AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 924KB
- SHA256 9ed71c32184a4a05930c009aeb5f386c4fed3f9f3aeb6cb4e7248dd7ea2484c9
- MD5 ac14b04fa06c752bbf4f31cdf1c01cc1
- SHA1 63d92bc4dab50e3d71c2b6b09d5273250528f445
- SHA512 bf911d4eca6407fcba4e2aa6becb7fbccca09f0c6da8c4e07b9a92b47e173a37cecfbf0021bddb25e9c2dde91fad2c43ec762488a1fa53c7e8c7d610de101b5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniT7Q:A3k03kHRJ1
- TLSH T1B915AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 924KB
- SHA256 27b9aa7d36c4efbf1c525680e371fd43265e146bb52a72c2a9c5aeec252dd0f6
- MD5 d15c2840f6acac030040c7830693f94f
- SHA1 4b3253df27168e8edfd17ff7a1e3bb596e2980b4
- SHA512 0295bfa5cf520931b4d8629e81450fe1722829a559aea57f442ef3edd8f2d4a8796815b0b46b78b663124a6500cafc74e72f25813ad51aa242ea845179c5841e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTwX:A3k03kHRJh
- TLSH T16815AE13EB9504E9E10AC1749AE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 924KB
- SHA256 52ade3be248d58ae8bbbaa7d42c13a742f1a88882836f270546ab5ca98f0a563
- MD5 7dbb3790c3afd06fb173bc0af146304e
- SHA1 6d82aef5a626aa2482e7063107dd906642a69a65
- SHA512 13166522c77c94ece2550ea9d569c791ab0c91cc73c2d4115369b8362ea0b1d8d5a6d201ee570ef86d692a105becd4c9bb5f280ec7e4f9e1dec80f8436fbcb54
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTGL:A3k03kHRJr
- TLSH T1E415AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 924KB
- SHA256 57bc9403318491bdb3c8e9842316cc6e9bee03a2751e2965a1cd8781d2613827
- MD5 b700195f9798229ea1ae06c04f210794
- SHA1 915a1f4648bec2b2f0292b7d48057b8c08528cc7
- SHA512 69cc8ed4279cbb0cdb7e144a017ac60640a511ff8256197705336b0741c852a743e045bc26967fdc577cacbef9d6d87a65ed5a1c28c4f45780815d271a1be212
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTaM:A3k03kHRJm
- TLSH T19615AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 924KB
- SHA256 dccbf89bf93dd9f105db41aa7c12c69ef7622850986b6383be812014c608e7d6
- MD5 f1243b21ff1115dd3c84bb9bb0bc2572
- SHA1 2991c89ba1c7950a1ce6dbe3833805a8e92f1943
- SHA512 a9eee3951dfe8ee341caa9dc3add16f0f00d39a3a0219b90db55e3b29167dbb496c6f24714b18da03860edc61dbf08583028bef423753b57690dc371813387ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8B2qniTLh:A3k03kHRJ4
- TLSH T10A15AE13EB9504E9D10AC1749AEA8A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH