Analysis
- max time kernel
100s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/07/2026, 21:37
Behavioral task
behavioral1
Sample
2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 922KB
- Sample260717-1ge28aev6l
- SHA256 3db080eba89463c9faf74f0dd731b1f18e18abaa8993ad122738bace3ddfbbea
- MD5 a93a3e2d591c9ffec97206e22fbb7ad1
- SHA1 1a9b9b5b6f15d74365162d502ff3fcf93e78e2c9
- SHA512 014ffc7f46149b2a90be55564b09e50386d5fb7b7a18178ff69e7404a480ac672a8a35ef80dfa9e6fbfb034e7bf0a8d418ab3ea6dbe574d700c92a9191e09dd7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa:t/sCv7rTiw2RYwZCUsjKpcba
- TLSH T17C15291766EC0895E566A13489B54606EBB2F8551B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/1324-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5da-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bc-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1324-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2de-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5776-41-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7a-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001896e-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bb5b-257.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4b-360.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983a-475.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-605.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a4a-630.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-721.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-979.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1022.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1114.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1183.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1220.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1405.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1406.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5da-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bc-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2de-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7a-60.dat aspack_v212_v242 behavioral2/files/0x000400000001896e-202.dat aspack_v212_v242 behavioral2/files/0x000400000001bb5b-257.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4b-360.dat aspack_v212_v242 behavioral2/files/0x000400000001983a-475.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-605.dat aspack_v212_v242 behavioral2/files/0x0013000000018a4a-630.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-721.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-888.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-908.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-979.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1022.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1114.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1139.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1170.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1183.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1220.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1324.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-1344.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1369.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1376.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1389.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1401.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1403.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1405.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1406.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5776 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1324 2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5776 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_a93a3e2d591c9ffec97206e22fbb7ad1_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1324
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5776
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 922KB
- SHA256 3db080eba89463c9faf74f0dd731b1f18e18abaa8993ad122738bace3ddfbbea
- MD5 a93a3e2d591c9ffec97206e22fbb7ad1
- SHA1 1a9b9b5b6f15d74365162d502ff3fcf93e78e2c9
- SHA512 014ffc7f46149b2a90be55564b09e50386d5fb7b7a18178ff69e7404a480ac672a8a35ef80dfa9e6fbfb034e7bf0a8d418ab3ea6dbe574d700c92a9191e09dd7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa:t/sCv7rTiw2RYwZCUsjKpcba
- TLSH T17C15291766EC0895E566A13489B54606EBB2F8551B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 e599971642e0dae6cc87eba0c4b648212b402b8848db2bfe839370a144d9f98a
- MD5 e319a4a1ff43812ecadf05c9b68f1f12
- SHA1 4868196e04fdd399d91f80b835bb4c6b125af2a1
- SHA512 8260fcc5c1fb167d05e6eb97e77c75a3e70bfd0da249271b8047b99756ca6b286ed4c2ba9bac8ea4f6d2f2d005507b6a6193bbb487e09dcd2041cbf671609642
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKpcbaP0Le5ji0hmxNrM:x7iw2FPji0Aj
- TLSH T1C8654917B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F23BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 937KB
- SHA256 05b4214c294332b07dfe63c3313c36453ea361564701d5689165d25f39f869b1
- MD5 10785e14b923d963ec666f0c0a1430a7
- SHA1 f1fe5ca9f62950800792bafc1769bd7ea10af288
- SHA512 1d1b2f16f2e60df5565a690cfc45d0f1cc04ee4274ef5c82c81cbdf69d8f68e43c3f1fa1a7562b2ae5347a171b54cbc483c6fdf83a000d99a9236412a1923bca
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaRa:t/sCv7rTiw2RYwZCUsjKpcbaRa
- TLSH T12C15291766EC0894E5A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 970KB
- SHA256 d8bbbefb6c6d74628da2cb4c8637c0907191f1847fdfd7b37b406a7632edd423
- MD5 c2b3b905e24c77a72f95c10f149baddd
- SHA1 136c91b2ec53a68836f3f8a1173da1a7f9292072
- SHA512 651c7edb8deaed8e20e8f7e7d7bd99bfd7e7c5768426faa94462c1d7ab4231038caf6f4bff9337840c72b851f7201d301dbc26fd27b63234f33d4e7aa2878391
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOayb:t/sCv7rTiw2RYwZCUsjKpcbayb
- TLSH T143253A1767EC4895E467A13489B54606EB72F8561B31C3CF12688B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 946KB
- SHA256 5a5eddbf8b9174a6c5b6f4b5aad234c5263db0ec05333bd61107630147c09527
- MD5 dde93b5c2def4ea0293fd52a7d9c44f1
- SHA1 e27fc3b0e89c951f6ee5bf8afc1b080d982e2974
- SHA512 131f7e8d2d103bde6b2e943ec80752de85a2cb8743e831bbe99ef37713602ea7bf683598f75290380baad325081d719a318fd138a68a6cc33011fcb0a3e988b1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOapZ:t/sCv7rTiw2RYwZCUsjKpcbapZ
- TLSH T154253A1767EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 946KB
- SHA256 3640d4779e178da9e5e4bb287856dedbd6902a7e8dbd2a66cfe26d060d08f1c2
- MD5 ad45dee1b5d5dd1368f3dee480b3ae21
- SHA1 ba31a841c8b8b00967cb76dab61d2ff2ab5d2486
- SHA512 5dad6d036e5bec3211a2054864f5adb23e12f75c333f1ed1fb308aff881e40302d76f6cfd5499427bc088cd1d3f404d4ec1d8047c155bffa472417ddb0f069c0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaC1:t/sCv7rTiw2RYwZCUsjKpcbaC1
- TLSH T136253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 946KB
- SHA256 4a74e7f7d5bf94f1be55628d47c9e39a8aa94d8277cd095b195680871901fd27
- MD5 00b47dc9d86a6ea26f479b223676e8b1
- SHA1 977966bc7b4ddde9f6a720fe70455ead454f5098
- SHA512 2aaf3b28b035696e7937d28d4c635c0b6795550f48201e67206cb89fc6c69e5f26f64711ded4b416f9d9f8f869eb4ab8f063b3d769745fa96fd47804fd386bc6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOao6:t/sCv7rTiw2RYwZCUsjKpcbao6
- TLSH T1FC253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 946KB
- SHA256 0ca0d0bb7c0fed1208026140d8e3109e24293b3bbb8fa95c0a560d68f90de5b2
- MD5 12b67c4d4bdded9b5df06dedcda1d804
- SHA1 21f09e9b160f80eb71f2e5e2b21fdb7eb4475fb8
- SHA512 0bae5b3fe37a2dd6f145b66ed0b182673dc76df848293112ef57ba03c6c88a1a99f75f326171628560e0170e008122cf750536b8e2061a4141c1dd51b77bb6c0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOasN:t/sCv7rTiw2RYwZCUsjKpcbasN
- TLSH T1E3253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 946KB
- SHA256 904a23d517435d04390e95a534668dc87bf3c47591b4682c4d8ab62ca103344f
- MD5 35e98e0752caf9b01cc0235a2d9e5edd
- SHA1 e6d97039a8683ecc3a945764407b280a79512783
- SHA512 51a9adcc1015ea194c2b09afe538c9c933cebc87efb8e4e5d96a645a0e9cb7c1dd7dd57a54494953e53d9f60f26d645f0e5e5000c2ac358cf253632b1b176295
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaif:t/sCv7rTiw2RYwZCUsjKpcbaif
- TLSH T166253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 946KB
- SHA256 a58b3283ca42f159b4fdb32caccdbe2ffe4989262e5737cf196bc49701272d7e
- MD5 f4f1b0a2898efe8d0320aa0edff9f83f
- SHA1 e6fc5cc3ed4326d5ec0691c3d108e7c798690fc9
- SHA512 91cc2724147dc51243d44697be5893cde02654eff6f3633f502bebd132525d05aacec8927237f6811fd8c8bbf9b93a1a32981c13c24ebc6673f4392b6932cdd2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa8o:t/sCv7rTiw2RYwZCUsjKpcba8o
- TLSH T104253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 946KB
- SHA256 f51a7276a0ab7dcbd73a60db897fb654a454eb2ce56eb1e92d39fcc0c16ee7c2
- MD5 8c5c609c0fe9d674b2c3a19d68014aa9
- SHA1 0c6d66755db2a7a7b06e146d016cd1fec3bd3dc1
- SHA512 a7b42f6fc05c21320e83f57f03756dae4b77cc8b4416c2c3debe71ad8c2cd87fc49aa818606d30b14893ed0186301007256f22d72cf4478194f0ad5a17657338
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOacu:t/sCv7rTiw2RYwZCUsjKpcbacu
- TLSH T110253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 946KB
- SHA256 699c7813541cc316c13b39c28fbd56cf13af8fc95beceb5b05ad15712203a729
- MD5 5e99f3a09a6a1fea70e1137ecd8937f7
- SHA1 4687b0fba1373f04e3529043f2f7e3102c85030b
- SHA512 f850b7c6101a7e43039438ac4b0086995a6c55ba8bee3381680aee61d5a4c2ddecb8b57d5ed258881adffd8adc5faef197d5b1e6333c663cffacce962159b45f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOag9:t/sCv7rTiw2RYwZCUsjKpcbag9
- TLSH T16E253A1767EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 946KB
- SHA256 95b8a64c6d8d16faf00e4879c6db0246196c12d6e704055a1338ac06982d55db
- MD5 f4fcef2e0004ae01b89f5a1485b1ac11
- SHA1 914af030f7b272e8fb26ee017008e8c479d54b70
- SHA512 e604afd18329b4673384cecbdfc1062534cbed7cea141cb8827b1a87ff43d16c968a6435d23bc052215736d69b6169b75bc7a2a8d3a282845b2cbaff22b785cc
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaoc:t/sCv7rTiw2RYwZCUsjKpcbaoc
- TLSH T114253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 946KB
- SHA256 d00f442dd362d3044726516db656d07c54e3b1e99c35fc66ff28d5aa7f0d660c
- MD5 759d47103aa6acb97ebab4fa543c3946
- SHA1 753ac0af2b8cb66b241302ef04cf3011f4034203
- SHA512 755bf5d7eacedb6dbfa0f82d0293a2fcb5313fbf4b0dc3d95b0c0044ab18dd4d5b31e7a94bcd9eca5a51503ed9ba3e3e31661d88df366539e28429601cbb5993
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaBp:t/sCv7rTiw2RYwZCUsjKpcbaBp
- TLSH T131253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 946KB
- SHA256 df6c5529a3450bdca8886a45c39aefc00ef8eb34cd8f3b388918fc7e614cd270
- MD5 2ca7350913649021700471c0435482d1
- SHA1 97fb0e86cee99e0bd90c6463fd34c94d9caccbf6
- SHA512 fba42fd66a7a41086cbcfc4f03d0035f960ef5505f2b789db8b8fd0cce4835223ab4ca2bc5ebd3e3b3cbfb0a08bfb150b56bc09f3059f999bc9d27c4edd8908d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaW0a:t/sCv7rTiw2RYwZCUsjKpcbaWN
- TLSH T1BB253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 946KB
- SHA256 9bd5474fda4ebc2e9fb1bf9ce8c55f46c6354ed543cb6e45d72103db7610d057
- MD5 33a357f2e4a364a4d0e66e67ce74060f
- SHA1 7073f7f7bd13c9de961603bb4a022d2a4ce70adc
- SHA512 60b17d696ea520fe5fcc742cb4c576016be6e04b651196be320e7331b7342f01a57668e2585cc561ab2261145c8a826214366a20ba28832e6c84c5ce089ecfb1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaaF:t/sCv7rTiw2RYwZCUsjKpcbaaF
- TLSH T151253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 946KB
- SHA256 b6996119a5bf56e59ebc78323b3cecd80cc27d5b04dcb52f5efc3a254410b311
- MD5 f78c3fb71a9066d7e22f7a292521cfe6
- SHA1 25d512f700d5dce1db30b1a74e36a9aa7fc0bb9b
- SHA512 7e7127e123a1c8141cbaa48b5c289d81bd8f1e83c6304c806938b5b26483647ee96c88984dd87e1276a0a38fc30e1109303535ea451b58e8d69ef0874614dce1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOavC:t/sCv7rTiw2RYwZCUsjKpcbavC
- TLSH T158253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 946KB
- SHA256 35646a032688a8600f56280d92c4b262c5297763316dedd3906ecfda4fa035c7
- MD5 4ee85225c3e520ce9271f6ac39f16a37
- SHA1 0e622b00e00bc4cb14820dfd7674cd993e110f29
- SHA512 7b4dd70770729f76fa3d78be248e0c39016287dc6b567cae788aa068c96d07a1ed82c0d9d1f7d7eb29c045ec020d6296b9f251b47bf0e4c0642f9bcbc5cb4c2b
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaQw:t/sCv7rTiw2RYwZCUsjKpcbaQw
- TLSH T18F253A1767EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 946KB
- SHA256 236c8054f76ff41fa11492aff30a6abffecd0a138bbb084c82c9cc952e5807f8
- MD5 7ee3e6b43a6b1887eb8cd9f55f7ed034
- SHA1 3b207960b7a01f8b99640bdf828bf89a8ab11295
- SHA512 7149377e3b4e3f870e9fa9a10bd25469e7b2a1d0380cf2973f3c09db983d9cd5145a257146b6e1a63a9d072e5d35f82be7efd523e72b2d9d5b8155f00e0a4a1b
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOavT:t/sCv7rTiw2RYwZCUsjKpcbavT
- TLSH T1EB253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 946KB
- SHA256 d2a9662dce8d8cd5254a29c4a3ba16b4f59bfdef759bce2662af23d61695c2b0
- MD5 0f309e277a5a8144865dac3d9eb3cdde
- SHA1 6d686d2a390be3c68da41eab0018d01e2775159a
- SHA512 13d42ec22c1470c40666770e9a50d0147c935b8b3dd3802167e2368cecad6b22db9faaf229d1985e4f55f4753210ec96abeefc01d16bae160df4c6bdc5709e1a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOapu:t/sCv7rTiw2RYwZCUsjKpcbapu
- TLSH T1FB253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 946KB
- SHA256 c1c60f8629b71bea06b75bafe10035b5b3dc50a5dcf998b0c354775af515115a
- MD5 da7804a3dc0b2a278b34a1531cd1e86f
- SHA1 23486ae2bd1a01f6d87e998632e97edece23dc6b
- SHA512 dcb3784ad10d987182c98b01fbb083ada658d51b2f5351684d4a6dbfddc1beceb4ec245434f1896a38c1f384bacc8a2958ae7824fddc7bfb47c15da225a49999
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOahb:t/sCv7rTiw2RYwZCUsjKpcbahb
- TLSH T133253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 946KB
- SHA256 6d6193b8618869d3099adb47708ac9cfa134c106e2d045c006ad25e037ebe4a1
- MD5 4ca356b96dd49fa0521e619e3bdeec1d
- SHA1 2470f52d80417cf17a421898267470b5a799a187
- SHA512 51d66aefc90f4870499cf3d104f1c5512340ef863d95ea3a91f9ab4567fd7e8c56d244ce0bfefe528680906db490cbbde4ae6ca1306dbc623d6c5248fb7c7ab9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOapf:t/sCv7rTiw2RYwZCUsjKpcbapf
- TLSH T146253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 946KB
- SHA256 fc3ae5fc3ff405f520ec29ddead43a517e166bc04cd5b2be963755daca2cb0ec
- MD5 fc3415ca721ca195845fcf124b15e5f0
- SHA1 833d113c2c898ef36a79d944e03f828b7e02b093
- SHA512 d2a1aa98521e9fd06426dda0420717ad50857cabf23d12c58033ca0f075e42f32d3c30fde3083908c4f8612535abafb1516515b8807f4f76b1b77d07ee682334
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaSK:t/sCv7rTiw2RYwZCUsjKpcbaSK
- TLSH T1BE253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 946KB
- SHA256 3cbdba17ee6a3787c49ec0bd6ba5c38412028dff0ebaab7c533bd11d2f0a7be9
- MD5 f36a16d5415445c79dce4395f3c319bd
- SHA1 4f539ee3fba7df8106d6fafb82c67b93bea662eb
- SHA512 d9d0b640748fa3fbff6d6cff86f51c3feb69199e38c4ff880900f8bb99231b6ea5a6e969c7072c71ffdf9ef39aa8a7b9c30bb5af69c9e5fbb3866fd09ec9d051
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa3k:t/sCv7rTiw2RYwZCUsjKpcba3k
- TLSH T19D253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 946KB
- SHA256 a060176462479c7eee251b2911eb8e59f18a167d8551b5c7c1f31b0f72ac0542
- MD5 860e752e811d253f1d6c42c0c3dda1d1
- SHA1 0e9f491f01ab9a0b78b66ac3b0c2021dc7822dd7
- SHA512 376c5dcc36f5955698f9e468e1cf6c447c23ebdcd1f214c7c773d37ed220868947e0e37d106d49bd89de6923a1d0dc89bb37b1799b6049e5f4cd126c4bea7fca
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaA0:t/sCv7rTiw2RYwZCUsjKpcbaA0
- TLSH T1B9253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 946KB
- SHA256 cb841fdd861a45fff42bc7c2cb63166aa398dcc1aa86fe34052160cf324d9a40
- MD5 e9c898399df5e47d11eb0a0912f8dded
- SHA1 cd57bdc595518af342c63a2d9783a306a223be8b
- SHA512 d2cbdbe99dafa349039b39bce7a0da3f7c0370e4a04de5427ff038fa3afbb44e831aa6ade7f205fffecf8ce6e8e2bb3d0518b018083b642c3265e20f27cb4da8
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOab70:t/sCv7rTiw2RYwZCUsjKpcbabg
- TLSH T1FF253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 946KB
- SHA256 567a7eda73cc7bc9687a1d9ebfc9afc21f51ab7a8f747e14c040d55f7647b2af
- MD5 8c406ede816ddbeb6e2d2bfb28a03d7a
- SHA1 7133157397856e035e4f853d558737ed3b8f8437
- SHA512 090c746749a714d6dcf564c9c1cf43115ec7de99a3eb5ad853edcda0a62bc102b69a661c6071895be57b8a6aace42e4585b07181a5454852e01b50f937f55bda
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaWr:t/sCv7rTiw2RYwZCUsjKpcbaWr
- TLSH T1F1253A1767EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 946KB
- SHA256 283f178c3eb62ef7cf226519083efde08b583e1f3b29440633f5aae167115322
- MD5 c34a1c4d8e63430ec860b4eeab0fc8cf
- SHA1 7ba3cafd2ad56351005abeae332d6058578c17c9
- SHA512 5ea1bdcdf9183ce286131afe586606f705f7c1c0b3616292509e77ef8fe71343b5f5aa137abae53096dc52988dc779d46aba48b7e2ad50a1f2054305b127a611
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa8n:t/sCv7rTiw2RYwZCUsjKpcba8n
- TLSH T18B253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 946KB
- SHA256 e113713f84cdfba74a1fd2fd8031f95e0eebb392d4e6a468741b5be4ea46433a
- MD5 8aba3efbb3c5ff8f2b16ddf015491583
- SHA1 a1c8ec8f17f64806a951040568c8a1fb64970672
- SHA512 a8884bbe24895d6a3c87eae0f08b5861518c846f7eac497d81e195778d0bc0dda74e7f967948ba8ff391f048a58d6ed19988c8acbf16375b881652c311b65131
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa6x:t/sCv7rTiw2RYwZCUsjKpcba6x
- TLSH T1DF253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 946KB
- SHA256 ae2ac0adf1c91b2f0be4fa7ca45967accae5ad8690419dc17ba66001a4664da0
- MD5 7db1d468812a829999a983f8c0c51f21
- SHA1 d6fd649a651bfa9e69a514e594c2629aed3c516b
- SHA512 ef0d4be0ef677a8c031d971796f8ee1b492e3364b0c15ca5c51de5846b5fbb3e5db090819cffa4b4150cca0782212077ceca06d9e784f36c379ce3ae96ab01c3
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa8A:t/sCv7rTiw2RYwZCUsjKpcba8A
- TLSH T16E253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 946KB
- SHA256 5f497a3e07d10bb4fbf96eaaf0e8c7573c5512871d48e9977450df2cf4cb7c08
- MD5 135e9e151e565860f610fe748b490a35
- SHA1 aae1d37560e6b7152dceebeb4e3b902095ca4357
- SHA512 2676c9aa3a1bab5dc347e97e6ae654eeb62ef9cbd5085279f0ab19ee708232978290c78c5dee412912a53dbdc004836fe604abb28676ac21e5ea2389d60351da
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOal9Q:t/sCv7rTiw2RYwZCUsjKpcbal9Q
- TLSH T149253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 946KB
- SHA256 63e94ac49bb71dbe7b392984b6bb57983dc7b5cddae35c0d59b97b235877fa1b
- MD5 2a319c3bfe44a782928a929e844ed1a9
- SHA1 3442bc884f81041f1dd6afa003c68f55db56557f
- SHA512 8f83c168c10324a4bbdd5d444787748c170d8a63730e738709ccd7ac3a55b1221817ef43ccb25bd0af816aab3cb37ec785db504cbebe817155c04c7ab73e4a06
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaQ4:t/sCv7rTiw2RYwZCUsjKpcbaQ4
- TLSH T146253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 946KB
- SHA256 2a9bd8184eba6aa933140f17154d43255901ebb9092c56c2ed7363dc3f6706b4
- MD5 fd13b1d04109805398a9272c764fdcba
- SHA1 d8d54fc9a4fe4243bc20224480f631524524bed0
- SHA512 ca253eef0df5921c7ed9de44e9e3b875c2e8a03a9a90941fef474c12b6a57dcfada5c15e4c54e4ebb52c7349aa4a32a3f2e14ab5474b9104ff637ef33c32b265
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaTu:t/sCv7rTiw2RYwZCUsjKpcbaTu
- TLSH T1A1253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 946KB
- SHA256 294eb06a5007aa21826be944974df7bfa64a31a36856e549d07e8c64c096a042
- MD5 906bc2ce82a07843c80855fe5fd15746
- SHA1 ab116319e8279e46f34db08daaefc567ed85b85a
- SHA512 9cdc7807c3a079931059195594982cff460c0687b24e463f06d630bca046e6b4edef5e3e4009e2b764e7387f50bf865e2db518e745df2778570a5f3a81bfcfb0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaOj:t/sCv7rTiw2RYwZCUsjKpcbaOj
- TLSH T12E253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 946KB
- SHA256 4fb0375082d10af87d49410b22ce3adb842dee08e880f35992f453ade259a464
- MD5 5c0851c1731e0cf87a366f00564bf130
- SHA1 d33fc686113d6cec2fc1279cee488638eead673a
- SHA512 2a103402cc8116fbd27fe02643b6b4291ac71ab8cdbb0a96877e3771ab1f48656eee72397e8a5a9644877578cdde7a6d9f5eedf58ec350045213a29aec592146
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa7g:t/sCv7rTiw2RYwZCUsjKpcba7g
- TLSH T195253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 946KB
- SHA256 86327586baa355aac9021c6c982ef9b90a1db816314e8835c2a91f2f1661bc0e
- MD5 8a4b9125f85f782ae170527bf4a56824
- SHA1 59878f39bfef06fe54e2e805f53ae8663ff62dbc
- SHA512 141476c7593fa339479c0b3185845a677270562cc309709377014bad685fe8de6661f69d3db610133cb03e64a565bd3f4e94104378c9157af564c7b0fa68114a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOamI:t/sCv7rTiw2RYwZCUsjKpcbamI
- TLSH T171253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 946KB
- SHA256 1d77d2a7d6d922055d6365e8eb4e4ded689e5c7eadd167db626d447d8fcc6bc2
- MD5 108934ac6b04f9b4b9a3662088d40d77
- SHA1 38ac179e43252906e22515deb06ab662f5fdf758
- SHA512 c3e76998b348cde7455b5df765025c326a3bfbbfe44fbf9dfde106bf876710379825abcb722223bb67cee404a682b22d89adf747c0edb23b933acacf10267666
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaUo:t/sCv7rTiw2RYwZCUsjKpcbaUo
- TLSH T132253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 946KB
- SHA256 c4be5e60701b554a9e2b4a31bec9556979f4f8d4b66949545669ec7bb657067b
- MD5 e47cfb2597b460c3c80d90a75fc98cdf
- SHA1 ac0b3c463ed65095a82e4c753ce5ceb4312a3d36
- SHA512 7e4f26da864a4855783d734b93665a00db84f6ac27515df5ef3f320fad0b5ae1c0ef3035db8a79cca12fa409915b5411ce22b511c3fa7256072e48bf722a6990
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOa3+:t/sCv7rTiw2RYwZCUsjKpcba3+
- TLSH T17E253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 946KB
- SHA256 20df6e468c9a5ee58dd5fa97ac46d0c3093766654bd078c105f14658b0167a21
- MD5 e2acd8334c7e4536efb6fc8a7605c7cb
- SHA1 1e7b59c533a56bcbef88cc6986fbec26363c5baa
- SHA512 6b3b458dcb649707f8d383ff3756a90fda6529a0974f766d36b9d98d00e48eb5e04e93200278aadfc7f4b7ea5db1cb56c773936d130a4ee5056c92c43088e525
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaNQ:t/sCv7rTiw2RYwZCUsjKpcbaNQ
- TLSH T114253A1766EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 946KB
- SHA256 80bf1cbe9f048a2281b087085705a95a51ec1049299f8e7cf3825e12716ffa59
- MD5 260d02b853e6c7c119d7778fc795e07f
- SHA1 bc7858bea7b1e68ae1439e0652f0beff195ac343
- SHA512 db69281724ebfe3563e41af703a14035695dee446b8b208e49cdfacb5fdb3fbc249db4de571fb8a0dbdc8b121b142025160f9c5e70b680417434bb9a086f4f27
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaCX:t/sCv7rTiw2RYwZCUsjKpcbaCX
- TLSH T1FA253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 946KB
- SHA256 5a06e76acbe7874b3b2fd6508bf7d4b8266e777cdc1a1c8fda7de1b90b986901
- MD5 92e6dca5c05d4db3e1092c93c00017ae
- SHA1 f72ad4c0bef7d1f1be29052eb28dc871eca1486c
- SHA512 a0fb2f5c686f232b7c14bced4237afd4a84d26a80f5af4dc9729e3fd4c2b94dbbccb241b853e9141bb150885d82b4f5c69a43e3e19e8797f1033189a028915ea
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOakL:t/sCv7rTiw2RYwZCUsjKpcbakL
- TLSH T1E0253A1767EC0895E466A13489B54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 946KB
- SHA256 72889b00b0d5bdc55dafc774baa11df0c66de90332e7be1cc3eb65fb0baa3dad
- MD5 6ecb9baac0a5a4327bd06556ee30082d
- SHA1 b2af475f83817dcd1a7fc3f9a4c96a50d542c444
- SHA512 6b5f003f7fc95f02c86139d643dc3a8cd9f69560dc6965adc46a49d086648feafdd7459f62b0d774fb7b921b1bdca89c6e3d15a5abc9c7b7e420028cb8cf2595
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOaAFC:t/sCv7rTiw2RYwZCUsjKpcbaAM
- TLSH T150253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 946KB
- SHA256 e1ba7979ab22176ec04e1ed441d50430c7d28e80b69d85afbb7ce278b0d188ce
- MD5 3e610a8a3911c1c866e08af16951d5c5
- SHA1 44ccb22b4deaeecd1add2078bc1ae0d85b2f1b51
- SHA512 86fa75353e638d368e6f1990d19a1116def37a975088c72df08f06ce7b648dd40076d7483e673b630cf16b304ea07418465d41fa08e28636cdeeaf3a782e618c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVOahh:t/sCv7rTiw2RYwZCUsjKpcbahh
- TLSH T1AD253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH