Analysis
- max time kernel
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/07/2026, 23:33
Behavioral task
behavioral1
Sample
2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 947KB
- Sample260730-3kc35ssvdw
- SHA256 eb181485e1f2e35adafa4dc5229b0113ebcb42f33c4eaebd3edafd72624a3e16
- MD5 6d924bcc84ebf2b653a037618be952c4
- SHA1 25d15b5746bd06a268fdfbed909db3268352b086
- SHA512 f095a9e83691206405c451de2790fd5d53ae47c19441498e5ae128e6f92d81ab02c8bf0f68fc06942ee55e3e8d01bb168de6a3f86d208f85e319369f047e4674
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlg9:A3k03kHRJe
- TLSH T1BA25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/3368-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c48a-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3368-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4228-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-280.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-444.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-513.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-598.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-629.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-696.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-764.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-851.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-980.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1011.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1085.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1098.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1131.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1156.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1213.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1310.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1373.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c48a-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-280.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-444.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-494.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-513.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-598.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-629.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-696.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-733.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-764.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-789.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-802.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-851.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-871.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-891.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-898.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-911.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-930.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-955.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-980.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1011.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1054.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1085.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1098.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1131.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1156.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1181.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1188.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1213.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1310.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1335.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1348.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1373.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4228 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{442E2BAB-89E2-4A69-94D2-35EFF397FE54}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoev.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 14 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3368 2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4228 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-30_6d924bcc84ebf2b653a037618be952c4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3368
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4228
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 947KB
- SHA256 eb181485e1f2e35adafa4dc5229b0113ebcb42f33c4eaebd3edafd72624a3e16
- MD5 6d924bcc84ebf2b653a037618be952c4
- SHA1 25d15b5746bd06a268fdfbed909db3268352b086
- SHA512 f095a9e83691206405c451de2790fd5d53ae47c19441498e5ae128e6f92d81ab02c8bf0f68fc06942ee55e3e8d01bb168de6a3f86d208f85e319369f047e4674
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlg9:A3k03kHRJe
- TLSH T1BA25AE13E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 3cd9f3937d9ce21d58c1833e109be0bf535271b5e3ed0eb8ba55718e6cd73319
- MD5 7ec4d96b17fee1ff84c1c15a2574001a
- SHA1 9c2630d5cdd8b54e0b1763517baeaaa25a620e1e
- SHA512 07c7cc353ef50dea36a1230acbf8f62bd03a9399b153beee0f37e0893c72d467b6645e183e98ef0c5eb66019065f238d1565d70924dbac15e75d6bdb32a5777f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgJ0Le5ji0hmxNrM:A3k03kHRJOPji0Aj
- TLSH T19C658C17F6A402B5D067C1B9C5D69A5AFA713882173086CF1398C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 962KB
- SHA256 e23a71414f3dd34623de2c2c62e52711e2b3263077ed8797ff8ba4b916ae015b
- MD5 c8dd3dca3cbb24e4b92468eba26e8f44
- SHA1 834b2f30ab941207b9fa4734a48ef2a2400e30b5
- SHA512 4ec42c26d3b40a970ab169aa354ed098aff23d5691f4ef3ba0ec5777d1b406891b10e6fb6744df5506d0d2e60b58b1052084a8e2c201749d04a963c4dba79e4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgba:A3k03kHRJ
- TLSH T10725AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 971KB
- SHA256 112eac991ac1ed10f305a9891a368c8d2cfc496619437693f5bc7a5d4c2e04b1
- MD5 b964a37f272d03f49ad52a2fd426e965
- SHA1 c548274fb37e9998771fdf2bfbdde82b7d12ccc7
- SHA512 fe78629f86091654426bd6b84cbfc3c33d3116f78abdedc2b3da1accdf3e72ad022be0a4c929fdcd969f6cbd105a0f0384079f7d2c4b4d45094fe809aa047857
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgq9:A3k03kHRJb
- TLSH T19025AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 971KB
- SHA256 12043b62b9e63b445db98fbfff7911fbf8b4173a90531f62d816bca0ac814a30
- MD5 28f781ff607803f8e1fdc645293b9265
- SHA1 ac938d7823de2b1e60baf256cba061af2811eb2f
- SHA512 f6302c57b60981c1f229cb5d368e79ec14de10ddcd7b3db97c1270134cd0c86679c78657f54d12ce4b300f39d529918edf3eb38a469acc4983e8a7a7d13b4377
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgqc:A3k03kHRJS
- TLSH T11F25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 971KB
- SHA256 4af00140accdd44358852d192d0a8a77dd4f51ed1ec8656490f1fc955b1753f9
- MD5 40b3504e719ba9c85477ca33746d6219
- SHA1 910319ccbacf850050f7f4eafde63105271b85bf
- SHA512 235dd143761df1e0d78aea3feec4b6a6747e3106989bfe0bbadf97c58de31c2a95a7cab4b46e04c03c97817c5e85842a2e970111462eed3450b7b0a180789833
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgjp:A3k03kHRJY
- TLSH T1AA25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 971KB
- SHA256 d7a63f34939a1684aa78f0d2d413bde1b5a6e4831a4c5bc68670081adc68d2e1
- MD5 de8343ebda2e27163ab8ae94a81ea044
- SHA1 9651fa53e7bd81f3be7651eec30d8803f0c12035
- SHA512 cbbe3f1f68b18bf0e8b76de9da97f43098949ef2da75e6a6c273f62944173e9c740d1ec4850cc699c205014b4cc147fbd2d9b423028834b309f6e59018b3c88f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgEN:A3k03kHRJH
- TLSH T13825AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 971KB
- SHA256 0cdb5ef512fbfd3f799c6858bc66390cfb00597372ef6133564860d6aa6dda25
- MD5 67bce48200b2b458041012a3cc4136ea
- SHA1 0c210ee7d4f9a7e55f94e8f1f8b2ae7f975774fe
- SHA512 a51e134d7d5f15bde3b0f480d1be088dc10985729925bee6adf316fedbd76f2673dadada87db8bda2c5f6b702da71054f912e48c813450fcd022c220a683088d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgsF:A3k03kHRJB
- TLSH T19025AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 971KB
- SHA256 2163cff9417d7c9fc671f6552f4b913aef8403556801b6015fa31d9967119507
- MD5 1d506dc3ce3ea6c7e77daf2162bcd6e0
- SHA1 478c89d053ea9a487f292792573f4e1cc9bf696d
- SHA512 b45e2dd9bd3bc5d3743f0a9ac8481e9429c0c1623fa7d584bc865b9d24be976919f56fe6f7339b0d66e4cf31e6068d7acb1e7939760d8fa61880d2d34db9b436
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgZC:A3k03kHRJt
- TLSH T1F525AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 971KB
- SHA256 284c1c5819ddf307da01540955c8683371450ab74c8103e10f09137212f53f44
- MD5 158c2e2d7544ef71017fcc5336cf1ae3
- SHA1 ddfdc1012b2546c28d89edcb46642c28477cd6eb
- SHA512 336bfaf296d0444f58ae900536fc7b4f01724870cc3446cfa2de39682dc7a060ca099222a1555b059995139d985af2747848be5279a8f4436a9e392ec1409538
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgaw:A3k03kHRJw
- TLSH T12A25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 971KB
- SHA256 531ce54a30bfe1a04ca731df9673edebfd83be24be57ce6e32100622d560dd9c
- MD5 3446ad264daac0e4dcc5a52e23adf084
- SHA1 335c4ae18554d95e713f5d4d2bcdd2692da4a499
- SHA512 d384566574f4654c78b7acbd5df93f3d6f4f1fcbbfee4cc0cfbfd3eee9ff3a48dcac0f18ac790b8cccda271ce5b33f611db8bca6ac3723a5de51a6275fbc97bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlghT:A3k03kHRJI
- TLSH T1D225AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 971KB
- SHA256 c610a1faef205bb73b2a4315ae3d3675df611a26d733ebc7136ee587c295a199
- MD5 ae8d8555a8be57752f4903b5ad75f353
- SHA1 3d570db49139133183fe5c437f67e0e6b784d72b
- SHA512 ebe166bfb7ec336732718b079143c82bfc8ee6ecc35db2748ae1626fb9d686747b368a62140ab28c5afdbb9ff9c5b4f7c2ed4c0a29b53ed7bbefa5690ada4dd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgPu:A3k03kHRJX
- TLSH T14125AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 971KB
- SHA256 4c1543e07daa3c59725da2d6aebc289029c747b5b3a4368bece824435dd8ae10
- MD5 cf628144298e37d8081e806a6ac67a3e
- SHA1 25a13365c35d61a022dea01dba54b94c12b7ce61
- SHA512 8d0c5e6bff386bfdca24304f5b3d54e459470f047133ead363bb209ba43708c03f89c7d34816c5792520b57bdaa769e2647257b36789207f9d21d461e75645cc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgzb:A3k03kHRJO
- TLSH T17C25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 971KB
- SHA256 6e5c38242cbf38cf51cfc16425c6c652b8865a5d9ca0c9b32af8750f135396bd
- MD5 62f1ceae70dab1ea190a9ae9c27b6571
- SHA1 e10b4c2e7ff14fa6f051602ffa11d2a0cd8f0c71
- SHA512 a8ca6275225f7edde7eb268814fb28974cb15f021e5e4d9505a295ab6c840455805ae652414ed192b05784cdc67651377582bbb3393d31d6b69f6c4c2a84e836
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgHf:A3k03kHRJu
- TLSH T19A25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 971KB
- SHA256 9cdc9fb7d70d35eb4687bd3a5412aa163d2e2b10058c99507fda9637d24a8ebf
- MD5 a57eb8e55dc27028be7116c1a739bd43
- SHA1 1b137f3812c0a6325e880b6787ba2196f25fd183
- SHA512 22c3c9ae8b2421991f71673de13b54816aeb369c433db0df05d4b66a68608901200c114cb392ab8b0ccb6b1eaaced9f78e638d4f2d5e2673c629fe718a1b49d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgwK:A3k03kHRJO
- TLSH T1DD25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 971KB
- SHA256 bfe5163b3518d3eda4d554fed501e31d9d785b3a333be05655c5409e5d3ee119
- MD5 77c6cf50e7e12e2beaae08f211e9d090
- SHA1 38754826bc1fd4915388e7d3b5452ac9049b2df4
- SHA512 770b779c395b4b4d3574e4a7840999c821dcba2a193bbe2106933257ea3540b746a3f7a64a3d65581aa48d579ccfe4cbe54968e00b322c5f5d2f8e2a6be7ef28
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgtk:A3k03kHRJz
- TLSH T1FB25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 971KB
- SHA256 c5c6e64aae732d691426cd8c6b4880f61bdad366b320e5bb950684e9f9304d0e
- MD5 8157e7109a4920645dcdf9d068f83190
- SHA1 9ec745eacc0236f4e6bc23c790ad2dee0e322869
- SHA512 f4e4f796a2c75c8082078a1a17212ec922afb2b8787315d221991a236e868f55287ba9887e6dacb106055996b5b06004113ebd24f071777ee1c5a55f422bde4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgy0:A3k03kHRJS
- TLSH T1D725AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 971KB
- SHA256 e712547197a1732b4d8903d8e28d59ead1d79955d98f0ac39eafefabb6b7a5c2
- MD5 635d617bbec310e9c745aa0d9139bd31
- SHA1 075a60f4361e8df17ac1f619c068e4cba3f2bc90
- SHA512 2af906593536280ebd42ce1a22d6a045900b76df4ff77185b59857d67b38d685c3625f3297edafb6041c3774c859553916eb2042517a8e62ec7b928b2bdd5e56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgBg:A3k03kHRJr
- TLSH T10325AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 971KB
- SHA256 b51052feead6d3d73f05098744111026fa3c3f5ffbc4608c5f0cddc920f0c31c
- MD5 f0671299c4dcf7400190ed970efd7e23
- SHA1 6c98fa9f11e3919fb952c9b7155850d9da480a86
- SHA512 031cb3d3e81bbc08b9a230636f91a409cf9936f8b466d28e54b1625b6cef8eea2babe8d42ae42fcec9cf47b35dcc09e5378693c8bad44d61b220ceb20e3f23f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgor:A3k03kHRJd
- TLSH T10925AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 971KB
- SHA256 ce64098d0de8b469d780fbbd2b67eb2cbbc41e935d258f75afdbbe4157577d4b
- MD5 9cfe9b72eded61b571b77a526c7b5ea1
- SHA1 3db6d3a5ec94dc466f364db9bb0d81579d92e04d
- SHA512 f8785501a53111a2b1055222dcb00fc7b3e21f96335d0e44348e708035bc3d0981b76a2414d5ffd7be1da5ab3f5591768258557b412e11d31ccbd8b2c415869e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgGn:A3k03kHRJ/
- TLSH T17425AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 971KB
- SHA256 4c851177ccfc110ce9b2715e778f366b25474e9a67a1b895a27fce8feb8c228e
- MD5 be3a5ed2db23cb3e411afdf6c00db43f
- SHA1 fc5936fabf0009f567f2ec9b8a2fe3a950912ed0
- SHA512 5a4d608cae8fc99e9a4fa143707cfd5617999cebc8db6d4df435c13d042e57aa86a1bb77b0de7cf45601bf27c6720f8a5f2bc0a21aa347548b5f06f1a9c28153
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgMx:A3k03kHRJF
- TLSH T1C025AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 971KB
- SHA256 34350741d4b3641e48f7c24f4584b5799458fb3ad4e3553355d7ee97449a4881
- MD5 c823944d3f20055be606ed8c607a7f08
- SHA1 330315b5a458e87a6c3b69b12cb66c0d77354228
- SHA512 392c4c0acbea9d9aa8eeb1d9171276ef281dac01cafff5366d54ce5eb7ce542bc4a736798084745f803785d52ad9face605f37fec9f065fa05a44f85277eeda4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgGA:A3k03kHRJK
- TLSH T16425AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 971KB
- SHA256 18e2151b800688bb114ef709ef4ea59a8ab1deb3d75d32ad88e852516f896983
- MD5 520db57a6591a7849c20369d9034de96
- SHA1 11e776e3e2984d14c1fdff4430d8cc1f871dc734
- SHA512 271dd15b499988ec5520a06ac4abcd205eddab08be950d735db806b942c3a01123a39fc994df9ce5b2cbb5cd1a4dfdd2aeefbcf26cb02acf5a8e57ee74eb28f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgf9Q:A3k03kHRJ3
- TLSH T10325AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 971KB
- SHA256 0d9c43d7d5b5ea959e84915a76440c30067782cd8325b02de91263f7245ebdd8
- MD5 f88272430519f19108e50c8e61b2e4ea
- SHA1 7de07fbef5dd7dd3d949d8f533ac9f281638e423
- SHA512 813d7bcefde040811ba541000766a6202d7d2bd4695d09727772a9d6462144d80a9afab618b480d45d6044e507258a1ccba3263f900071474fc70f48fbd4c799
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgW4:A3k03kHRJo
- TLSH T13525AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 971KB
- SHA256 cf90837eac31e5610cbfcef354340e122a6670e52392e2962957062ac5883c1f
- MD5 b24cc450fdfdd84ecf111c1c7d9529fa
- SHA1 1857d42e8ab6b1694536eca29793b12f95f99d01
- SHA512 3d69a4e890003b7c2c9c48636e41cd99ccdc388feda6b75ef0d149017285d0284f6a3a5df05f4a5868ba40e9e3439690590512cc6b50cce33fb300c17b889f8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgFu:A3k03kHRJ5
- TLSH T15225AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 971KB
- SHA256 782107537a070f419a1bf23bcacd4b3f1d2088b0671aa6bd1eea45ad7811c7e8
- MD5 1dcd103210f62767d2b43d35d78f47fc
- SHA1 e20ccf825d5827ed35303a4d712f7614292af066
- SHA512 189a30385a0016bd9f661dbc709bf38879d9755b73d9a7ab3fda210f7f1b3036f97a4e00ab970dc208d8edd72806dcc82df71326e965b1ef1fc3e8ae71192fc9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgYj:A3k03kHRJj
- TLSH T11925AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 971KB
- SHA256 53aa92e6390034032273d62ad7e68e0d8ce52e64544f052f940088253fddeb61
- MD5 9743b0ed474d8bc296cd70118dd3cf50
- SHA1 d7ab4a3527bf83e910d2fd2efe0502aabda48d3b
- SHA512 eb0655736d7baadd0701b8ca30ac873d91bbf0a7a5cc642183b587716eb3bf4b71bc880a032557fad8ddab3534f8a1dcbb1b9abae7d5cefee23134b6a28d681c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgpg:A3k03kHRJL
- TLSH T1EC25AE03EB9500E9D10AC1749AD65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 971KB
- SHA256 1f1217cc42d16479b14f54b6cba6ad60c3408fd11c125e942cd0429365954480
- MD5 317edca0a85f75808c87d6131035f75d
- SHA1 86521675458ffb6a149141373745dc10ffdaf77c
- SHA512 1828f73a5fde2c31a5c59d90db3b27c82076efbb57ffa5a8afbf216c6c19673add7a4392f906e91dc8bcd3d8f62e589b8f4f8c1ec384187a1813d9df1dc44bdf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgwI:A3k03kHRJi
- TLSH T16125AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 971KB
- SHA256 32feab8d28ef99fc167ddbaa73d5436ebf9cbb30e636b42ce2a776c203631389
- MD5 d48ed36eae2b9be4180d6acbd030877e
- SHA1 ae7638866cf2cffb7fcb7073696dee914db2f698
- SHA512 2c59c41a75136b7acd790f0cfd9c81c0cdbcc24242156a63e1df3f93cf42a69f0ad05a08a786293bb9d13ea5dd0170aa24bbc1537f8e0a24cdf6317c4fe1fa5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgyo:A3k03kHRJA
- TLSH T18325AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 971KB
- SHA256 0740b24e57aaf5216fd906da2bc69374668fd2259231c5e3010f0539fcc6108a
- MD5 ffbebc809fc667784da311c3636bab35
- SHA1 7cd72674ad39e886722da27ee366eb3adfbdaca3
- SHA512 372b6d962b8ae80a14d14d6134ad2fb6ab0a15925d62ee95de228ba457670232daa5d170e61b57a00dee00a63bea095644303e33d81484945cfd6fb8dafdb58f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgp+:A3k03kHRJt
- TLSH T1B825AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 971KB
- SHA256 2303de30091f3266b8c3e72e5e7ae5a87448397082072e4210e50e79dd4915bd
- MD5 6efd170a43210af666c7b58b758a400c
- SHA1 8302aae0f3aac683cf0d85f27bdd6924fca733b4
- SHA512 dffed49e9e3f4644c87cd80eab9756efef29dec1fb4c61bc9654c5c37d127c546838328c7e9cbe819dffbcd3492a19eb871c4108e8131ba39f8ec0d41d40fcbb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgXQ:A3k03kHRJl
- TLSH T17E25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 971KB
- SHA256 45e7b15fc145f87e9040c09948d7e33c9013b1cc1964f593159159aa23b45f08
- MD5 73d11444d4589011a89e58ba7c4fc062
- SHA1 a3eafe2cdf5b9d9dadc1705017bc4da4812f308e
- SHA512 018bb026f634198072e18cfa7e32c42bfcd217cfa9718477b5c6298982b14c12841275db695c9548f653947b1c987afc6096be17106af024a309a8a0547a6062
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgsX:A3k03kHRJx
- TLSH T1D825AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 971KB
- SHA256 56bb1a858fc4daf527019770efa92b94af19a59e33bc97e44b2f6a2ba7881acc
- MD5 cae4555654cbc36a4c5237918fdfbbb0
- SHA1 106d62b49f44095750a8ebca604aa59bc291e6af
- SHA512 bfe237b63c730548bb8c72c96b67ff12a39c7848e001593de022678e152fe2576ac1ea46f6c7dbadd6bce87f6f4cbf11c78e42162d8632f6fed08ea9a2f87c8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlgKL:A3k03kHRJ7
- TLSH T18E25AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 971KB
- SHA256 a13e0b5305d9482b738f15d76bca5c0293204fa801767464efb831517527f830
- MD5 e4cf89b8af2b6b2c5a56c00c0acebd25
- SHA1 5e60a1e4609c3d6710dda7b56a1c2a67153ffd4e
- SHA512 ed05bca03f5cf24c8c30cc57b92adbe1294d5b47f54e7bdb425cd2eed452df25308b5c030112cfe9342f20a2c72f04e8b70c0acaf0fdbb7b5258eb4771e3200c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlguM:A3k03kHRJW
- TLSH T1A025AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 971KB
- SHA256 de9688cfda2e0e17c9e7e15cc008b23b8da7c8715f73988d5438cffe6302073e
- MD5 4ce7d49b6b195ddecb36e0543f3e55dd
- SHA1 454e6e9effc5a460e5214186ae87f788443202ed
- SHA512 e6ec9da01d9971fe242f2a40599f652a4bcd0c1ccc49e6771c0ee1c2df995eb742aab7671fa0396561697c1aac664264f5a9d34a8d6f430fcda155965fd69174
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOaRaacTlg3h:A3k03kHRJo
- TLSH T1D525AE13EB9500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH