Analysis
- max time kernel
105s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 17:07
Behavioral task
behavioral1
Sample
2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 907KB
- Sample260728-vm2waa1bma
- SHA256 06055b486e4ba4cd45b9b59bd33ce03d85dc1ef9cc3545c7a2645b208f5ccc0b
- MD5 89fd90327c9815b30666e98efdb71464
- SHA1 58565647036cbdd85aab1021128f18b9bf5396c6
- SHA512 e4acba746e3709f0a8c9d709641e3e8672f0c3adf30f0a8a246bc4fe735b29f22145271f060d4efae44a7a8ba637817d66cc1051dcc6313fb8505f049aa7a494
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+:A3k03kB56r
- TLSH T16D157B13E6840FA4D10F81749A968662EA737C125F2097DF2354AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/4500-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000001b8ab-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b311-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4500-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1924-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-273.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-454.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-582.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-619.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-680.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-729.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-778.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-823.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-918.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1093.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1167.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1205.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1358.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1373.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1396.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000a00000001b8ab-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b311-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-59.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-273.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-454.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-497.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-582.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-619.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-680.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-729.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-778.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-823.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-873.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-899.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-918.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1049.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1093.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1167.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1180.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1205.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1320.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1333.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1358.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1373.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1386.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1393.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1395.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1396.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1924 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{F9EB52BC-12F8-400F-88C0-E0E8FB418737}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe - Drops file in Windows directory 31 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4500 2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1924 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_89fd90327c9815b30666e98efdb71464_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4500
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1924
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 907KB
- SHA256 06055b486e4ba4cd45b9b59bd33ce03d85dc1ef9cc3545c7a2645b208f5ccc0b
- MD5 89fd90327c9815b30666e98efdb71464
- SHA1 58565647036cbdd85aab1021128f18b9bf5396c6
- SHA512 e4acba746e3709f0a8c9d709641e3e8672f0c3adf30f0a8a246bc4fe735b29f22145271f060d4efae44a7a8ba637817d66cc1051dcc6313fb8505f049aa7a494
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+:A3k03kB56r
- TLSH T16D157B13E6840FA4D10F81749A968662EA737C125F2097DF2354AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 87b707978d1668c1aa42c1bb6cb2c3b556ddad51721b4c9ffb0225fcb997332d
- MD5 d694950da8d70a07db642ea66c187ae5
- SHA1 f343dc907ce4f423daca6c96533f15f961f1b1b1
- SHA512 0596bcea8489b62d0ec74edcf83554e418b39029b362241184787b6ce176862ffc661a0fd88be873d17c9b9d2b7956685cc40f4c515a1c5c5f2eb40ffc21c95c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+P0Le5ji0hmxNrM:A3k03kB56rvPji0Aj
- TLSH T1CE654A16F6A44B65D02BC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 954KB
- SHA256 b97d99852e0e2984aeafe561b70e89e5010a0cb07f0241ac2a4da18be46bb906
- MD5 3075d26aa7eb85ce0d3c25481044c637
- SHA1 55a0134f8a4377029ab9705e13d16ed56e72ab14
- SHA512 5cfe0a9e714bf63d7506f2e670dfbf7617ac84bbeb7222ae557c6f7ac937df6105596bad329cfea118a23b1631b368d255b3e6df075489fa2eb5efabdec11291
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+yb:A3k03kB56rSb
- TLSH T148258C03E6940FA5D11F81749AA58672EA777C421F2097CF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 930KB
- SHA256 4999fe31ee2a8340f6209ec729370e5c2d807fd04ba72e0c6019aff64459c418
- MD5 047343911841abf88c749443c3c68658
- SHA1 2acba1586dfbeed544c53333d40c6612d97d1006
- SHA512 43e88eb241ea4bc3e04e3dffb070f4c01a1c97d8b3f8653acae9ddec1e7b3ab1fa8951be17bd0e0a74e8fe13a5e09328e53755998618194025aef11e187a75e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+g9:A3k03kB56rE
- TLSH T1F1157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 930KB
- SHA256 cc07ef1669b5fe13fe2147e680f6b6b047785240b08f1acdb482367222445407
- MD5 7f030763c2bdc88d8a8a6537296d7c26
- SHA1 031529c487abce5f2d23887c2bf02fa96ae5454c
- SHA512 b99b531136a1e516986dfc60d8f4145d473c5e69319f91c9779052be6978aece08e23e562d9a4c92299c30dfb623d2216bae28c02307907ea213d9f754a9e552
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+oc:A3k03kB56rt
- TLSH T137157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 930KB
- SHA256 14a9b65ef5de9674b7970d98fbb7f759187c12151f1c277ac285672ea7be5393
- MD5 8906770662172b02c8b2bf1f1d8dcaa8
- SHA1 847c76d8c0d7323744a6a4a4a27ec026da6a7196
- SHA512 93da3fc4a6775e83a9e7dc9c0a79d37daefe05c575d641d969f5c4b8404edb4f281f9e8c5e4a33eb0ff0f05a665097c355e2d442dba4c78495d8b77ff68f4725
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+Bp:A3k03kB56rz
- TLSH T134157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 930KB
- SHA256 9013dc85924f70f34bfaee749f11623143d95c870c235a35762a28c74d6d9f73
- MD5 f3b2c49cefa912620df7a8f1f165f21d
- SHA1 c14e2378e2c238d174a35f70d9797dc62ff4cc01
- SHA512 5f779d418384ddeb5ed040fd7887eebb633cd97175799cfb590530269d32764d406618a6dcd2b6585f4e6a6222b3dabbbd6cda3489a5ee64989783def6347f0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+WN:A3k03kB56rI
- TLSH T13B157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 930KB
- SHA256 5141353ec5f6cf05fc9667782343438dba688b77fdd4431c83fae7bc927d8b95
- MD5 3e0aded78e442564376e97d7e0ecb92f
- SHA1 7c70ac3ad7716bfbb9202c9d215d4339421f298b
- SHA512 1e767c3889a30e14c77e550954be22e963460d7c25d5b1b326c309fb8af58e7d7de7a64b1165922653fbe1c501f93fab77876070aa56b8b62bdcb2ed0cd67410
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+aF:A3k03kB56re
- TLSH T185157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 930KB
- SHA256 b8cad4a25391db951968ff54e7a3f1884157e51d67952598918819aec7bb3ba6
- MD5 ca001ed6d46ffc5e9dad7ca52e91707b
- SHA1 ff10394051b5036e9e6277676047214cfa2e5a68
- SHA512 a618070dcb5d683d04138e418e8d3191137f8a85fe3b7c4f443cb9180e977784d06a4cce7046a1712cbb5a04094fd0e28df6f7763e2cfb37893a6804f9287935
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+vC:A3k03kB56r6
- TLSH T1E4157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 930KB
- SHA256 313250ea540aae96b650fe805138cbf1427ad4c2570347ac78d79bbcf8a88902
- MD5 baa63a541e2c9d8614dd525c601bcf02
- SHA1 2343887d8c463a61d4e27297997e9cd22a22d041
- SHA512 7b96febec8ed4685092d11e37fec45753df2d35fc8887562673a8b9b9b91e077893f9bae1d8cb75964243d48f51651b798a4f78885ea8923966dbf050861d554
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+Qw:A3k03kB56rP
- TLSH T1D7157B03E6940FA4D10F81749A964662EA737C125F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 930KB
- SHA256 2a8fb930e0ed3248b72039b046fd5dffa52ffc4e5a556e699ab1d185ed3b48c8
- MD5 16defa7bb186a5d16f4f3453fcb730cd
- SHA1 826766d213eb3d0c00c53eb5bf354220c32e3e26
- SHA512 799fe4dbffaee0f9c166ae5c1e12398bc3b4b003803d05e0d4b6d112c37ed6c1c2aca89b01ea3c834053f5f2c262636df81bb23071b71794e2d9bf6e3527cd17
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+vT:A3k03kB56rr
- TLSH T18A157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 930KB
- SHA256 06f2a85ecc9d79bbe9a0bca577b4a3e9353aef232c7c4b697caad1889c2823ed
- MD5 22604789bbbdf320ef8ecb844f3d110e
- SHA1 59371c10680fc24a751912df4a1ffc6f9ed88d8e
- SHA512 090bceff811c59325c833d8290180cd4d052f5c6748f7b879059ee82a5f06e0517f7d085b6e695d78c4e17ea78ca43d861fcd00bb42c29a340456fa82e05630d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+pu:A3k03kB56rs
- TLSH T1A0157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 930KB
- SHA256 8e11d40a7f49ee125e1069afa6e750bb37ee9332a351ea0bf1ba10df33ab1403
- MD5 cc2a6974bbea5dca7fde1fa432abdc20
- SHA1 316d422695504cc4d9f7e2ac5eb27b9a0f01233c
- SHA512 ed10e4790462d5dc0e447817ae64c8259ad7fb80afdc8808566ccf0f0a4c7e01068c79981e40ea3a287ce935ca245353ce4e39bde56c1a51582721657687a690
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+hb:A3k03kB56rF
- TLSH T13D157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 930KB
- SHA256 201134df3c9957f9db1376bd02a0bf53bea67a9c7eec360b7be12e04972d593c
- MD5 fe68043b109a47249921fea274a67cad
- SHA1 b9e5964780a26f150c1e36e1bf5b309867b642ca
- SHA512 ac73379351804c488afadb8413de0d5ff64d2f2a2df4f3305abf00e3f347722772619e114df4afb0fb3370503a6eb5d64876e50ffc3c4fbffefeb858b9232664
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+pf:A3k03kB56rF
- TLSH T1BF157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 930KB
- SHA256 064df3c723e99e1dbd489534fc1dd0b348bcf35ec3bc9be57316fc3450bbfcd8
- MD5 adbca311e64d8d06331522c0560d6eab
- SHA1 fa298e815870c43953dc2c0dbc620ff96103d0ac
- SHA512 4252503feddc05f044897fe529fd784ddbd75ad339a99071b1d3ac1328e5b3aaac78e1ead746e5610db3516f4d8ee0bb70f387b40a07a9607974f5f540b3110b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+SK:A3k03kB56r9
- TLSH T1FA157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 930KB
- SHA256 2be1bfc78a84f8035ea34adf74a99caa6ebe0be84eca35ecdfe9620b91e034f2
- MD5 d173f2c0399a39a12ffef34bb8ea5027
- SHA1 33728cb16d5efd7589f3510ab638fdf2cc006271
- SHA512 2868cde965be398c8e80e3089d4446941e1b0c5e94cedf7a5e59f134933c61444dce087c344749023d91bac4f14e906c06b0f3dfdfa31a66a619dd36e4491e33
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+3k:A3k03kB56rU
- TLSH T121157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 930KB
- SHA256 921f60241bd6c5d0c3f1869d80b2729de2e54737a6eb1a00d58dd6310b6549d9
- MD5 16a027a6054bfc3054abf91d008e9f69
- SHA1 b94f3945ed1e3b6852aed0557966f573d0f099a2
- SHA512 5fe1f76a0c5bede1c486b1fc99106e58698294e255e481f462e444d764a38b8adfa274d34cb58bcf9b16a23307e598c4baf6624a3d404e77ef35701ca313fb47
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+A0:A3k03kB56rd
- TLSH T163157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 930KB
- SHA256 1693f8243f6798a12668e973edaaba531fccaf743883839983f8c728d73e98f7
- MD5 23e3673fa43de6931c2d6941026575d4
- SHA1 f9b9df4047d2a043159168a17188957f05e6aaab
- SHA512 4290d51e1681295023957d52c521a5f1f8d2e1298fcddf6dcb5a61d79d033ee053edce0417b94bef98e2a490637ff082003962ae698de5f373820223c666f720
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+bg:A3k03kB56rs
- TLSH T1C0157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 930KB
- SHA256 dc9265f9ddf35b6eaa655c1df10ed1ce5d698144c2c4ec136a429dad521e170e
- MD5 e7d3f296562aa3c38e2428c1167507fa
- SHA1 d7009e14698a95c3eab71722124fcb3761e597ae
- SHA512 45de4ad460502b9578b0665a06b52f60e182fa42e242e09ed90c153123b47ce7aac8f3361f484f9e31d1f753d2a1729cc3eb680134ada05e7d637f9610d5e82d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+Wr:A3k03kB56r+
- TLSH T1D1157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 930KB
- SHA256 04d3943d0c7530dbef5749aeec466f50ac0cbe9fd2c87c7a0f363fe6ed08900d
- MD5 bc23fda04d2c3e2bd28d37ddb0e75d51
- SHA1 8160697b7741f928ad3e0e8634ac302690f6ea90
- SHA512 a67ef0de73940a33e298c53b4a789b8e9b6019564d4a43057834b4056c1fd2f6e3b5221dd0a172617de02f0db0010a2e9301d49bf3a34925cf09c31c79eb00ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+8n:A3k03kB56rI
- TLSH T15F157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 930KB
- SHA256 72743328f308987915be6213874acfd7ea4f9f1c8b93531c26919e57503c0274
- MD5 a1a7b36cea14694ecc9c0eea9b2bbc71
- SHA1 df6bd54f6a0550ab37387cde905f2258d4442a3b
- SHA512 e09ff1dbd1c5f840842331f1bbcf3af32eab8c66535ff849e093508085288adc59f4bec7a2e9186c360cc1efb38805fc3e287895ac760654a808da8e23f4553b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+6x:A3k03kB56re
- TLSH T168157B03E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 930KB
- SHA256 5675e011b8e4c458cc100fc0855c46880671f977aa473c25ecf2c3f089e8faef
- MD5 136ccc669ce20fc90e53deb690697d29
- SHA1 6ff633eecbe2b51a600e5f370b5fd4290a782457
- SHA512 59a34c3e9642ee14ce05814d0e38f65be3e57580b97c8c67b66e2dd589835dc3bd8e8e62838785a1fdb5d519948804a4085c753c6e733dda06fcf3dc34b23843
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+8A:A3k03kB56rV
- TLSH T154157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 930KB
- SHA256 3d5b984cd596ef0cfe63e088da0c08ebc4edfe4a27beda6a0e6acfe63ddcf232
- MD5 abc80f9cee5ef6cc768fc9466d85a2fd
- SHA1 6b3879d0573fa1958942898bded0cf993d69d844
- SHA512 1ea346c30eee8a5f947cd8c2f381597620cba74a050a6f5dcedfd3ab0ab5c5202b5d16b3aea04b5ffb257130d5604bcfa6413a38b089c69db78d73a06b646de9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+l9Q:A3k03kB56rU
- TLSH T1B2157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 930KB
- SHA256 50dcb2e909f9948fa6e2b715bf58bfed6d6551cc76e85bbfc6f038ad6cd0e570
- MD5 cb573861bb5a41687a0484914bf0850c
- SHA1 063c4557900c20475131fae03d49eaf106bff747
- SHA512 8e7dc1e9a81714b9a332c070b6d0d18c1867c90dfd22b7bc065df7282f46153b5ef028337aed2ce245999e61d3d4ca2f619844a2f3ff3a567e90c95ca2669b17
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+Q4:A3k03kB56rf
- TLSH T1F4157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 930KB
- SHA256 ca86b9ddd96d36f1c0a8066eabd014a26be047e4cadac3acae163f0e8e87ea4e
- MD5 43b8915fbc5317e6c6ccd7641e6c4a8b
- SHA1 b44513755e6210962df7e8d688c9e5dafeadb2f5
- SHA512 0345b38ee42a9e0e493772550ca7bbd7363ba14741183a56a4c2f956aad16f8a40e2f8f55d6bceeeadf41922d263dc04fd15907e5dff35fb0e0654e22f1947f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+Tu:A3k03kB56rS
- TLSH T1EE157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 930KB
- SHA256 09404f82d5677d9c5e60a1ac49d666b6c1a4d21b7d04c579cbefde8bd2bb0085
- MD5 8064f3a97caf13de4e94e25e70bb4f38
- SHA1 0c26cbc37a12956c55d550302240a936d84bb108
- SHA512 ef047b902b5616c2b96921d22e6119282818315eb63524a532346ec6ac61f04d6124de2a272df4f170794531ada84675ddbab507872a3e93e0c401a7037a3e9a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+Oj:A3k03kB56rM
- TLSH T1A3157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 930KB
- SHA256 721e7188343740c405f029a95c8280962c70f96f8c71a9c32bc4887dec2df712
- MD5 423b8108b3dc511c45c1546c7094191d
- SHA1 fe638bbc17d3932d5f0b84c114e46758f9c0da58
- SHA512 f15801cd004a78ee540d5619a17c33345aec67afb2af6c8a5a7f7279829927dc7d46ceb3e09e30b3a4d3962c637b3050a48b8705ee665d074526eadef1d48d7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+7g:A3k03kB56rE
- TLSH T1DC157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 930KB
- SHA256 0e71914624436ad2ea6eea4e3fa946704dc4c4f30b3efabb03b28beeb889427e
- MD5 17cde235544d4867dcb5b0e81168038c
- SHA1 402e21a0af824a961ec67ec7d51eb33f6ccf99e4
- SHA512 b428d5a81175f813f5539165c3e26fa9d405918b44978c82ae096cd028762507cf3d8666a6c6552b93df800588f01e63071905962db1e8d5adf9c970ced0aacb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+mI:A3k03kB56rt
- TLSH T1FC157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 930KB
- SHA256 f9d1c9962e29526823909f43b4139b121a664faa56a7ecf0d3922c8efdff8d9a
- MD5 685923e2aa6e52b74df144ad9afadb87
- SHA1 245ef713180e367f4c1d68b36ae54e39aa9f841d
- SHA512 46589c8768b08bf0795f97013a6540bdfd4e3ac2bc7526ea60db0b829259de57f5fb7c5d3ab5a623baf448996185391f57b368e840827cd8534d6f95ff26112c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+Uo:A3k03kB56rL
- TLSH T147157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 930KB
- SHA256 ce615f62db70ba30870a4c8756eb1c6e10b11d83f12349ea507988488af0b6b7
- MD5 1f0fa4c4c0f1a8bd762360c5279c6e72
- SHA1 05198f2ba6bbb62b839940c0d2d54c924ac8ba95
- SHA512 1d96604cb661c519d45e76d0c429109050c93a6245dd0e35a0fa970a45b968649d7b7224ca06d59dd094afbc7ee03f8c7181edee45e011d5bfee3a0998b3ad87
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+3+:A3k03kB56rO
- TLSH T17F157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 930KB
- SHA256 adec894d0c67b0d637f5a9195309a7602448659b3dbe5a62b582f7e740b0061b
- MD5 234a25e1848d9ac967f8e588a54e1f17
- SHA1 56dc770cbd6afcd80b252bc6899cff2ec6446d17
- SHA512 14704b62ad45d13913d03c1a6b8068cc04a8ac550219f9898d658568fe57e5c04f94e9fd89e32799f6811387c1a2469ffaac1a31c4ae98524a30e461ee668ff1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+NQ:A3k03kB56r6
- TLSH T13D157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 930KB
- SHA256 dd8862c4dffef3cdb31da616361bdb25d93f87cce11329c7a8e80867f7bc490a
- MD5 0cb8d781f390f366dae2e58636e85718
- SHA1 5374449627dfb360820ba0db8e86fefd4ed3239a
- SHA512 2ad982e54338e0278b27e0f72e759defbb7ee135b052a0f749684c312191b1226ace8f3013935767cf1d480a79422d83cea93fe9c85a4903511d21524ef41a11
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+CX:A3k03kB56rq
- TLSH T107157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 930KB
- SHA256 6d36bb588034477ab6929c481868a9cf5aa6d95db6f97b5435c75e1edfbc606f
- MD5 50a178ec57a509eaaf167b199b884445
- SHA1 985f3d5ed1f33421d22d6907f8fbf1d0f43ab2c8
- SHA512 5de178ffa561f1519c48e9f5c4179f59f991d47e441c6ae1ad1bcc1c19a23fbc2d725e7636c1a39af3b51f954f45650b52912d8e0bc419521f40bd0dda38c286
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+kL:A3k03kB56rE
- TLSH T111157B03E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 930KB
- SHA256 5ddb4dfc4fbecf6b5a5389e4c3713791e6fdb90784ba5dca2632e2d2273df5ca
- MD5 ff7fafa76d20e5a7f9b9f964e5404924
- SHA1 863560c727f0a7b63e25528198c6c92aab65ba4e
- SHA512 d6d320b72e8f140f7445705e5541acb9fe148004feb144722b673d39480e8cb5dd820eb078e4c6b46b9d5d94bba37dde4c2ffac319f8243374a2ccf3f2b3fcfc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+AM:A3k03kB56rF
- TLSH T199157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 930KB
- SHA256 b1dc43f21a872b3100655bea9dfe76a0004e0937fc35a863c4d3a55123800056
- MD5 82e093bb9fc66e1f85c81e46d1b2f669
- SHA1 7b2095b23c0127f4d3b59a1146e70b3968150879
- SHA512 05509232a19bd7f18b9d091e16d62098ac9a978a32a19bca728485dc106188dda7c6e6acaec256db7056bf6db632d2794c9e96e4756b45b9e91f9a736d283322
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkEL+hh:A3k03kB56rf
- TLSH T182157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH