Analysis
- max time kernel
103s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/08/2026, 16:10
Behavioral task
behavioral1
Sample
2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 940KB
- Sample260807-tms3ps11bw
- SHA256 18ffc92e28adb018905086996892601652442c5aead19c6e9511a86fdfe03a6a
- MD5 4de6b62d392c8a999298e07060f51a2e
- SHA1 5347af9d910618a568a657e5d47be997e9d3ae4e
- SHA512 e7691b1a8a459c2f28d43989331893cfbab0bcd680c303bdfe6817942426495338791e3faed6b56eb44b014cab54d6ff95af6b108f57846635000ff45e8866ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaF:A3k03kHRJN
- TLSH T10625AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/4872-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5d6-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b311-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5124-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4872-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b316-35.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-453.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-587.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-711.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-822.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-853.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-891.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-918.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-981.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1036.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1061.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1122.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1135.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1216.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1321.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1365.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1372.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1395.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5d6-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b311-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b316-35.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-272.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-453.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-496.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-587.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-625.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-711.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-736.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-822.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-853.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-891.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-918.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-981.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1036.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1061.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1122.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1135.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1172.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1216.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1321.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1340.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1365.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1372.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1385.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1392.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1393.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1395.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5124 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4872 2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5124 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_4de6b62d392c8a999298e07060f51a2e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4872
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 940KB
- SHA256 18ffc92e28adb018905086996892601652442c5aead19c6e9511a86fdfe03a6a
- MD5 4de6b62d392c8a999298e07060f51a2e
- SHA1 5347af9d910618a568a657e5d47be997e9d3ae4e
- SHA512 e7691b1a8a459c2f28d43989331893cfbab0bcd680c303bdfe6817942426495338791e3faed6b56eb44b014cab54d6ff95af6b108f57846635000ff45e8866ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaF:A3k03kHRJN
- TLSH T10625AE13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 3c0f87964aad220461292f38fe93ba9ed557e3c9bb1aa811b0a53de760b3b1df
- MD5 473a2a740cffc64b4f5ca5da9b06f056
- SHA1 ae52089cc63befc8633ae7613028d9217681f73b
- SHA512 388739b6b28a61a5551edd3039b9dd0e1587bc7809e8c1737b58eec77fc58dfafc496cd1ccd39e6f17c9d57fd19bf64cf98ffadbb0b628ab3a461c91b596190f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaB0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
- TLSH T14E658D17F6A402B5D027C1B9C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 954KB
- SHA256 c8750b11b54292371ea3f89664f6be30f9ba9037340467795ab8b3ccff05d34a
- MD5 2f74d2540793f50200130025db7a3c16
- SHA1 7ef5320673a7533ebb0eb36968207267909e115a
- SHA512 939eea31f58a395dfdaf6237d27f94cbd27b0d538fc5828b643405d1f4834a7ec041b531105e18420c58d9110a93460268c6b1691b9802572e1019af38406888
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaDa:A3k03kHRJ
- TLSH T14525AF13EB9500E5D10AC174AAE64A23EB757C56176097DF2368C6152F72BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 963KB
- SHA256 1eeb25b71919acc95fa8d80ec96013d27879cc6d562b9f2b158bcf70df0fbcbd
- MD5 abc374482037ae483a3fe52e49227b92
- SHA1 b8e2318c6cbf0a61fcc748669111dccd49c9c6b1
- SHA512 8dc48649d1994fecff1f56b3c19d3f56d94acbbd5db1c6b397e6f4792c7e97db3f5baeb5a5368c76e474061c7f8d5d959f0edf0efc02b7939a9255472bda2bc3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaC9:A3k03kHRJq
- TLSH T1A325AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 963KB
- SHA256 5e66f273d0d16a45129c541ebc8bbe52faae4821ce411d814dcc36caed2d9dd9
- MD5 d503710324ad37a24d4172ef7ae112e1
- SHA1 fc0824e83f9fb8f3c835e23aede645d7e048a90c
- SHA512 3fe9ac701535962566b9e263a870d7914b712cbcf61f3582a6a8060b3306a5ca47f06cd31838eaa0fdde1c804e936eea7ab4880854ac9bf1541126bd37661a77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaCc:A3k03kHRJH
- TLSH T12625AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 963KB
- SHA256 c52a056c64c576fadfbfddcbf86e36a663202bef2ddc20ab7be155f2cbbc4b89
- MD5 5bcf456eb82eeb9bbfc6ebf4a862a7d6
- SHA1 b401456f2d580b0518a22c186c83889000b54b93
- SHA512 efab6e10b48b89119bf7b524f4b2a4d0ce0a4c673fad22a744d3cd4edf595ec5111122dfac786e87ab600942e9f8e7e5830efcd3490c3f9f5582fe0374d02395
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaLp:A3k03kHRJd
- TLSH T1B925AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 963KB
- SHA256 8989e0fb690c10b8169afb2d347468d915f2a4fffa45ee1b1870629adaa833d3
- MD5 7107f07cfca946cf00bdd9f141c3a1f5
- SHA1 6794053ae79ad49f384d04b9b0d50bbc99434bb4
- SHA512 48f572f5137d48ee2a4fda2c5009aaa1e72ff1fb7d6abefdb03a67df76abad2a74e1cc1fc180dc6e685df6312dca5dfdd44d5298e2260b72aa81ff35a94fb68c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCacN:A3k03kHRJm
- TLSH T10625AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 963KB
- SHA256 bd1473d1edcf94c0940ed83c10bcef044a4763ac11c557fbb88c7a3b17197680
- MD5 9a411aefee43ff35e6b83fd1dc3f1b3c
- SHA1 75774ca6e2d224defffe63e69d40fcc009d95087
- SHA512 0ec03f30d6a4301210f92d1df1b33e78ddd8fca41af7986edcb4d95c7e792c778e8a9d039d018ad28f84e5e9982ebfa949c18dd9ee2ecb6b152b4c135b4f203f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaEF:A3k03kHRJE
- TLSH T18D25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 963KB
- SHA256 f274b3515b417bbd6a3564115a70f9e82accb1e2839cfcc78cf53d3b39a1fe17
- MD5 e863ebe801c47144a44693c51c59d29c
- SHA1 824d88128776e7cef6cf363b562c03f87811a1b8
- SHA512 dc35438e2e35e9bfaf0cea01245164b3f5d34c1bcc90be570958df3e007f593bc91a7c0e728c9b5f73620572264a5dc4bbac552a6e3c500be06e4f5361d564a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCahC:A3k03kHRJw
- TLSH T10825AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 963KB
- SHA256 dd4dc223e6107cd0bbb72dfd6e72d238b0064f8451297481521af907c7271fae
- MD5 483c258155f82de2ddcaea0441a0a357
- SHA1 5132df3ddce8586112d9f06b1f81c5bea351b542
- SHA512 ee369743f4cff00fd6abf56d17f74404b4ac51df018d145f07fdc20d84d9eb61ac406a48f29d63b49e657412bd073c37ec6c202af6c9fbfb6a62df20b20f7cf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaiw:A3k03kHRJN
- TLSH T14C25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 963KB
- SHA256 89f52ea41a4a141c1b4f2e945a2801e52b8c3dafe3911fca7b84ee4706d1dac6
- MD5 736dee404482540a4591a9cb0fb05241
- SHA1 844124809b1e249d0779da52572b7df67e2e530f
- SHA512 4e35d96308cd4232056d188bbdf2019c6ddf80680bc270158ef8ff70d5896ac4e563f2c5cb065bb9e32288e3906aa35fd9b12b929b9cdc38ba6a4a317fb1c6be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCapT:A3k03kHRJB
- TLSH T11B25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 963KB
- SHA256 5a9bd858782bdd193f2579ef896cf4fc676f2f816566b58e3b479b9a458857e5
- MD5 5b2f6edda6543f9f4cab64a94719d420
- SHA1 93dcbab92ce157940e7d885a885e95d57c85fff0
- SHA512 d8942752f1dace26dde400018bf2071308f9a9fa44738180ceeeb3e64208bcc10324534be10add60f881686a1aa609b50db5227af36f8d5f921c2f9cfd534da1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaHu:A3k03kHRJ2
- TLSH T14725AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 963KB
- SHA256 984238e61f43cd7b7351eb217128c9e8df6810659ee56053972dcd828a266bdc
- MD5 980076cf194664adcaad93ec4a113617
- SHA1 8c8f637087a9f337c50a81b284060b109f80a708
- SHA512 318bece6e4f2b32bb9cdcb9481c403882b891686213c84649213b846380999aa785a944e31ec9d9698b014f28c15ed807692854be3836262bc78c2ec50179ed4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCabb:A3k03kHRJH
- TLSH T11E25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 963KB
- SHA256 06ab6f102f93acaaa0bf0f6672935f89acd0b0a8c2bca8588e5c8a50352729f7
- MD5 122735b722f3903d863a9501a1355371
- SHA1 b6e0f5cc6c7f8e9a64e0c732fff162292f2e9794
- SHA512 b9294bcabcae9fce22291cea5fa45ff5f51db390fd679742d11b0ec57a0dd43620d9e7dc4b03b52aa223386157d808171229beb6bbefac2ce5a55d5a052ec36f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCavf:A3k03kHRJv
- TLSH T1EE25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 963KB
- SHA256 5ba9f85b9374f6f3a6625e61ff75dbf9e3ea3b744b82788ed85350f3a289f10a
- MD5 d4cf426b9c7ed869d7971e46312c63a6
- SHA1 b814dc103eb1fef457116a274f56573f26e6f677
- SHA512 92bbef932e1517ae7824dc2b2ad3b54af6067c6653eab3734fe38b8210149b09afbabccaa50d99f5e2cbe83f6c7bc400c12d967f843190924ec0f9722556ff9b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCa4K:A3k03kHRJP
- TLSH T15F25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 963KB
- SHA256 43a0cb922f6e69758cb47bb18792d4f896b413e287791087a7d29d0f2f0fc224
- MD5 c482c8a359deabbbb9e95876ed01353b
- SHA1 d6f3223a8a24858c3b8ed1b6f22572e9a2f34c92
- SHA512 5ec5ce35f1b728bcd2637396022a04c278db3c770c6738e9d03188653d3cd230717e418c4de544b27094b024f7b9461fa471ecd2e76434a444a6acf164531436
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCalk:A3k03kHRJa
- TLSH T18425AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 963KB
- SHA256 271c95755f2a58a1def0cb1801aee894518a5601221cddde2f55ce6cfd121b8e
- MD5 49ed47008a25536c5fb9b1cb47073fef
- SHA1 ac674ff3b041de6eb1d921fac939f61fe00d5da8
- SHA512 dc440f63226b261777c5e329edb521ed07cff676b31e0b0fcaafc44337e59647642ebd588af17fc92f2b0b2ea2ff9e83690a91b2419921ff13a5a792a48050a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCa60:A3k03kHRJv
- TLSH T12025AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 963KB
- SHA256 bbcfc620908a5eceab944995801e0779d9e990e06e46d5dbb0316f8463d5c060
- MD5 2559606f74644766d799e73d1e36fe15
- SHA1 57d94b49f6b2d287337bf909b3e61c66c013a720
- SHA512 2c39e6089654cc599db4f545e8b7cf747b0cee4348b48b55fa77bfc488ec69bdc00a43e30c5743404001c802cc75cbd44d8a77979f9af772c3f13be2c9ec5849
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCapg:A3k03kHRJy
- TLSH T15025AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 963KB
- SHA256 18389b41715102d0a741954eb3ec7cf16e560b8f762dc1295af1f1cbf04f0379
- MD5 dbe34dcfcc5b0cb51c2e14bbeb4dc638
- SHA1 b7786f884f3a5c1d9169053c5043cccba1788307
- SHA512 8c02c09393859a77039ef742764eb08a37ae2e5ac5befeee314f471c08a7c9e11ae573e7c1e79e5e5cf641d1398cfef9615ce4d093e830c938e066d5eb002189
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaQr:A3k03kHRJ8
- TLSH T11F25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 963KB
- SHA256 1503974a6235ac88f124545d10a261f8ce7a623fae2cafac9f7bab01cf32e8f0
- MD5 f260e2c3e0a3da8e8e985cb06c91c98e
- SHA1 8a9106fd92f76031f2bacd8c18b13571b02ee1a8
- SHA512 8ffd92cfcff19cc2a381773e3ef38e51744ce33f63bf6267691e82623a416fac7945b3ccb3b66415882ec30639832c15a7f243f96608be69602e50d682080e8b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaOn:A3k03kHRJG
- TLSH T1B625AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 963KB
- SHA256 3d05f8e8abcd63e5260f498b3cca331a2cad59f5f10c5c56877a1f5c91a331b6
- MD5 25642a120db2805b1be1d0a5e37c9960
- SHA1 9847319126ff5203c0f939942c4946b316255aa1
- SHA512 bdb799dec7b04d60d553f450ceec03890a90aa92c12fa3f3140b3e5194aadf0a2ba93914ad29d61be87cf7e6140157202f1ad9b9c65e2e04364113770eba4e71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaEx:A3k03kHRJc
- TLSH T18225AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 963KB
- SHA256 f36e313be422d7feb8b067ca9a3df4151d7d2a4f03c4d572cb60705083dc1b70
- MD5 2b6f83e6ad9e2613904af9d26d6027d9
- SHA1 6ceebf70af70a217c1bfaaa6176f80a76344e18b
- SHA512 225d2ef7b5231c918097164e5d9688db43b40bfabdbb41d2342b1706381af41ca6db9e1d44ebedb5ff1b4731e5a7d2dace6ab38ac2229204947113676a6913f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaOA:A3k03kHRJn
- TLSH T1AA25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 963KB
- SHA256 de081f0068738de7088a0baa88013d16ec40d996061e5fae9c5a3304a42d90f2
- MD5 3e08b61b82848205058d8eacfadff55b
- SHA1 72d9bcb047322369fd31bd0a4d56c25e512f4572
- SHA512 3e68cd25034b8f3191b86b7e21c4afe25f70a362066143ed50c9540fed5fb06c00e2594f6e072c0c85610d6319e21b14254cb8eabe944af73f5a195996a7f7f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaH9Q:A3k03kHRJK
- TLSH T15E25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 963KB
- SHA256 5affdd401d2ba0b94124f528c660e7347163098f1da2cf85aa42a8fd3ad86dad
- MD5 45365cdb97be57f600675fab2b3dba98
- SHA1 940444ca5fbf8a4537285acac94cd0d30bca19e9
- SHA512 0ee842ddcd8a1239e1d71a7cca26f5c41c9f070182b06972f23305651808c9f9bdb6e554c2b81aee1fbf655bf26e0ee4184656babdb62e9113a4343015ac258f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaO4:A3k03kHRJJ
- TLSH T12F25AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 963KB
- SHA256 3d2ffb672609e936a8a7721e3b4710705622ce38fbe8d5d57f920b92d9f95ad0
- MD5 91ec20646229f0ac9345f601ea349205
- SHA1 60effe67723b331675c225cfa38c5568343c92ef
- SHA512 3c8a0f74d2f5e4033a83498dcf605fe8e096423c9549085ac0287f05fd7bf5ea35edd03d7e4fe4a2a553f60fa23d4f601055347bb0af266ae2bec7e1ee5e6347
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCatu:A3k03kHRJU
- TLSH T17825AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 963KB
- SHA256 3ff56b730e439ba0d1f76e2ef7957dabd8b36ca13f5e9fc7b4a986f9a08b41a3
- MD5 c103bffddbd695437ed9190fbca473ba
- SHA1 5224c9dc3de8638b8bb4b7ee93c6f7c1dbdc8870
- SHA512 32b49206d7b4056d726577717b534a8994c439fb58ed644dd5e47336a8baa6dea0d0b09342edc9eed67af5f16ffbf7834a9fa75c97ffdd46b241e0a3a96a5e94
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCagj:A3k03kHRJ2
- TLSH T1A425AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 963KB
- SHA256 000313f9151ba71e8cc76d8001874807858a9666ec530159d7adec14104156c6
- MD5 4353a79668296b96c4b3aa8bd2a46187
- SHA1 97e4de25fb4f5fed1560e06aa527c312f3277a81
- SHA512 7077a80e7e1598306a5237ac017c0a96bd5d3818ec38f8e0a1cfca493f2a54a915d1ba56208b88e8e683349996b02f0f4023bbcf7ea928db54e0a20c0bfacc0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaRg:A3k03kHRJa
- TLSH T1A525AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 963KB
- SHA256 9b976a89d4d75f427663c27087a6fced442675c385a822752af8d7c0b94e2817
- MD5 b132cb60f0b2cd386e105dfd90120a6b
- SHA1 99c5815abed0764b7555d78938491a6edbd41d76
- SHA512 a50dd7a4a4df361a5cb5fbdc1f981f547380bd36a342c0056243a48c7d67164ae0a2ee7d40ce8627b6eb21913f182b153fab8d388638b1076c38776613595e93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaII:A3k03kHRJb
- TLSH T12E25AF13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 963KB
- SHA256 a2725f0838d89e44692aa684d65e229ddd9543683a9b2a68dd1361b91914086e
- MD5 a060d624102251c2f71ece9b3142c04a
- SHA1 005da4326b65f4719c976515cd368ec7613998b3
- SHA512 13ac52f7362a4a127256aecfba1f66524636414c1f5a4dc35a181ac03d1c09ed088d01b6a669718e4ca7c1d7d74f50255782e8c4ef2d2b01f9eb904e0a5b2c9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaqo:A3k03kHRJl
- TLSH T1B725AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 963KB
- SHA256 0933231738dc27d9014d38268a1290287d9d81b0653b12a046f253d3f256ea65
- MD5 7344c7f6a99789cd233a19ee96a0f087
- SHA1 458430ba9f9ec774df0a9e75702dfbf366b0fe69
- SHA512 b5727b90295a6ebff80c5f9cb501056bc95d80b5b1969d46d5a01044844eb97dd6a76f8111f622c5f18547df19a4eff466e81e0ff9cd4d35c298b53eaae9040e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaB+:A3k03kHRJg
- TLSH T14825AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 963KB
- SHA256 33f7fc882421406257ca959f1acd6412bd7b246538aeadfbbd3fed7774696d67
- MD5 fdd5cfa172277c0cd549f4655461388e
- SHA1 35e4480ea22d8ee2c2c03d7eb23b4a3aeae13f59
- SHA512 c479d6618347b2dbbd5e44643b66c1603268fca64bfc92b2532fd0783e2337e41715e2e883973ff7a98b62aa400f275392652cf763f7a7afa926e8968b5c7ffa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaPQ:A3k03kHRJw
- TLSH T1CD25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 963KB
- SHA256 5be39bf04f25c5bf349e3d55e9f20845f2d6b3d4e43ab8202891d34deb3bae46
- MD5 a92e663e4f4caae0f658fbbc60cdb8c5
- SHA1 e9bcc181980a589d249d97018be3940f3de2940e
- SHA512 c05e91ee43bc37ac0cfb84b0689aa56986bec8bf730fcd85da165e662093aa4c3aa2ed5b55968c92b873c8c93b51f8e29ce8dba42b291bdefe5b6acedf80af28
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaUX:A3k03kHRJA
- TLSH T12C25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 963KB
- SHA256 87c25c353cc6a8d147d13f6c869cedeb83347a95296a6ee180a7c0e41b8b7962
- MD5 4190d27f5a1039f337785a825c22da2b
- SHA1 c824e498700f0d4759db345a3d7106d95d8143da
- SHA512 27defb7bb0a7583fad081b1e848fe800a10c0cf58b3545c498a9cbdbb7759be2d69f4309b8910d90c589f58b4f1c1134e3267183a2e9a78795af0573105db5cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCayL:A3k03kHRJi
- TLSH T10725AF13EB9504E9D10AC174AAE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 963KB
- SHA256 b9b6980ea4df5725f72ddd2144037cab556f447ecf00825b7a83b81a8a6c64b5
- MD5 82d05b952198b256eb4371d4d721ee43
- SHA1 ec5cc44e22e56b2d55382c9fe5911aaf4013a13d
- SHA512 be143a51eda394cc3ceecae78d1c619991d10f66c190400b1c30b81a2874fae75de37de37ac1c84455c224221278935910a4b6a8213f743b67dbec3844f366c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCaWM:A3k03kHRJv
- TLSH T1BF25AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 963KB
- SHA256 ac6ff85534889c1a613aacd493885b259cab74b3cd03cd5909246c76232a35e7
- MD5 bff5ec42a2175e4c504705440d6365f4
- SHA1 a2b21d372d094423be23bb0b5649f83975e55f64
- SHA512 8cbcb45f8d62ff0380d14106e650ba8bc657a31f5f6aad7fe25608791ceac18ef4d739f8941f698583dc307e4418f5c7491e2fb024a9d58b873371f5e84f47bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahCafh:A3k03kHRJh
- TLSH T1C325AF13EB9504E9D10AC174AAD64A23EB757C56176093DF2368C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH