Analysis
- max time kernel
128s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 13:35
Behavioral task
behavioral1
Sample
2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 936KB
- Sample260702-qvs6wsft2z
- SHA256 f0bd265b4f9dd330a62c0c1600bf235b2de91b028ba84852e9658c73742d7a15
- MD5 1be6a23d9f451a490a0f6657a1ca9b09
- SHA1 bd3396640b17868b39a03ef558ba78c487a56feb
- SHA512 e07f9faa6221565c949046010864509429a365888423628226339dfdcf0d61a793bf0d2f45bd34a692f83cd1ea054ac2d1cc1dace28b0dff1abe8049af3bc4cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85:A3k03kB56r
- TLSH T14A157B03E6940FA4D10F81749AA64A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 36 IoCs
resource yara_rule behavioral2/memory/5996-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c724-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2bb-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5996-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1676-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-236.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-256.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-438.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-445.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-478.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001998f-600.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b96-631.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019af0-652.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019ad8-689.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019ae9-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b31-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b35-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b12-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b67-754.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b3e-761.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b72-762.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b0f-763.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b50-788.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019b53-808.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a4a2-1016.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018903-1462.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c724-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b4-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2bb-39.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-236.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-249.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-256.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-401.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-438.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-445.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-476.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-478.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-485.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-508.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-509.dat aspack_v212_v242 behavioral2/files/0x000300000001998f-600.dat aspack_v212_v242 behavioral2/files/0x0003000000019b96-631.dat aspack_v212_v242 behavioral2/files/0x0003000000019af0-652.dat aspack_v212_v242 behavioral2/files/0x0003000000019ad8-689.dat aspack_v212_v242 behavioral2/files/0x0003000000019ae9-720.dat aspack_v212_v242 behavioral2/files/0x0003000000019b31-733.dat aspack_v212_v242 behavioral2/files/0x0003000000019b35-740.dat aspack_v212_v242 behavioral2/files/0x0003000000019b12-741.dat aspack_v212_v242 behavioral2/files/0x0003000000019b67-754.dat aspack_v212_v242 behavioral2/files/0x0003000000019b3e-761.dat aspack_v212_v242 behavioral2/files/0x0003000000019b72-762.dat aspack_v212_v242 behavioral2/files/0x0003000000019b0f-763.dat aspack_v212_v242 behavioral2/files/0x0003000000019b50-788.dat aspack_v212_v242 behavioral2/files/0x0003000000019b53-808.dat aspack_v212_v242 behavioral2/files/0x000300000001a4a2-1016.dat aspack_v212_v242 behavioral2/files/0x0008000000018903-1462.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1676 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5996 2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1676 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_1be6a23d9f451a490a0f6657a1ca9b09_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5996
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1676
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 936KB
- SHA256 f0bd265b4f9dd330a62c0c1600bf235b2de91b028ba84852e9658c73742d7a15
- MD5 1be6a23d9f451a490a0f6657a1ca9b09
- SHA1 bd3396640b17868b39a03ef558ba78c487a56feb
- SHA512 e07f9faa6221565c949046010864509429a365888423628226339dfdcf0d61a793bf0d2f45bd34a692f83cd1ea054ac2d1cc1dace28b0dff1abe8049af3bc4cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85:A3k03kB56r
- TLSH T14A157B03E6940FA4D10F81749AA64A72EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 965KB
- SHA256 586a628330d461e97e552174c1136e1451dcc90405daf7695e84915bfd979a6b
- MD5 4df6fb6191680a1e4d7f92d247ec1cc7
- SHA1 936fe94d13223f86f75ac69ec1f9af92cab5898a
- SHA512 4b75a0339fe9f76031d0ca8369a0403ea2a72737337103380bf45e24f149ef51ba5dc3826c6e5a660b89ffcb3c7a562fbd167abff2632786066e383b8bfe0938
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85xP:A3k03kB56rF
- TLSH T190257C03E6940FA4D11F81749AA68672EA737C125F2097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 eb42762003f4054d28086dccf8ee907c58b18ca73d9001a22401c8bd7343b8c2
- MD5 46e6077ab649e31ade7d3734e9868157
- SHA1 643c8cc011a374fc40968d747965637f51ae49cc
- SHA512 e3e2fe104669ebc4b4d38c81128e72ac63bd398a2bf3eb6abbe932e52bbeb2ab3879f877c3b5eab8885af4ef206cfbd33da08974a1a94f082a4550a3ccf0a860
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85P0Le5ji0hmxNrM:A3k03kB56r3Pji0Aj
- TLSH T1A2654A16E6A44BA5D02BC074C5D29666EA733C421F3087CB1354EE283F77BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 950KB
- SHA256 3c66c572857ebd53917af51321d7d4d74ba378504463cde6396a05e0e9b11666
- MD5 32db3b004e242b16a3d48e7a30f56ce5
- SHA1 065fda3c5cfd0e5f25b66ab189c302ecd5c6d1cd
- SHA512 eeb0b316f89fbbd9e011aad3d74e511a846e8171db62c41815596dd65cf6fd55896417ad05c60da63c81d2e030d3c830c3a7aa77db5b9f14d486fd03f2e60978
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85Ra:A3k03kB56r
- TLSH T139257B03E6940FE4D11F81749AA64A62EA737C125F2097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 959KB
- SHA256 1bfb73601ad7dd42981b869d2770da63135e12ef8f5d88b285804496dfa5d1d6
- MD5 af878575a1d8f62366d07b0efe6b8a37
- SHA1 4ebe041d8677923404173eec1b59d8e1733a6580
- SHA512 3b046ba88d9b256e0f4c13a6f5baca8b6c4830a345ab8e9aa4cd67aad59bb3b02ed8453783c0f87574e94c50e3cdb4f387a07b29b502dfed77afb136906104e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85o6:A3k03kB56r/
- TLSH T1D5257C03E6940FA4D10F81749AA64A72EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 959KB
- SHA256 ad43b5246a9d74799f594a29534f8f4510fd9d77d24c6b17151a64c8520c136e
- MD5 ccccdd9ed53b83a3c34cf5e223e4e8b6
- SHA1 2991de336415eb11f69e6dac87bdebff5a060d88
- SHA512 0ebe1efe375b1c233b23ca6e6af9a3d02fe032e50845696f84f6e5c67e52af8cb004d6328320bb160a438ce3d71c2ab0ac824bc7f2710537ba785824ac266967
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa858o:A3k03kB56r/
- TLSH T17C257C03E6940FA4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 959KB
- SHA256 a470e6665102e15cdba565f9e65c64667476047ce0509313388b09dc1f94c50d
- MD5 b76b20f291bd4cc02fc15837a89a3916
- SHA1 bf8c067cff5f3f25d53ae5e7b0bada05389a7d58
- SHA512 44f5c49ae3f6eec729e7d4851a22663cb5ba583e3d199466f8962424657acc46fcd062b4ea2dae0cf64391ecd999666dbffd1f79f6f9425b969de7951bf0afd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85cu:A3k03kB56rR
- TLSH T15A257C03E6940FA4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 959KB
- SHA256 b71e7ff1f4d4a9f09a7b4a32ebf649e57582a41bedbb16af94d42746fcb721b5
- MD5 f5889ebef88dd46b4ec47a38fbbfbefd
- SHA1 5fc89d48a49a8a7bf041d67cf307165de958f75a
- SHA512 cfc1a6877a48adaeb39c453436abf4ea3620e94bc1a94058c6229b60fab33f59f81a75eb16290705c4f5e7469fbb73dbdc7db205083432613294472bfc967e39
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85Tu:A3k03kB56rq
- TLSH T103257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 959KB
- SHA256 d10cad5125618cd2837d05a4bd6b127787531d1bfd55586287fef5828937832f
- MD5 f0ad98922b876eae8ab8c5c47fa94dfc
- SHA1 ef9dcb59b3086f6519be51f443477afb9f8f3602
- SHA512 bc9cc93aa6358000112e202eda5add5ba726613b5376326a3dc504cfdf37e420596c1a425ab3baf2e310f45bc31365f17025d3492ac086385abfdea75cec973a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85Oj:A3k03kB56rk
- TLSH T11B257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 959KB
- SHA256 8974add26feb4bfc80ab3b51b674eb3ba31a14438a43089387564e4853d17811
- MD5 b56adf4f6bfed93aa87bb0c20313954b
- SHA1 165e98d00dc45f83381cd337ccaf9fdf81466aae
- SHA512 a9646736e6ff50941c09d52dbbfdf5743188beb858a8c110cd3344f655405868b9ab1f676a4df238083c433fdf8d00e602a1ee4743709a69d37e5c6109b52441
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa857g:A3k03kB56rs
- TLSH T121257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 959KB
- SHA256 64ee4d8ef86b1f42ba8fc33bf734f77b529ea89c1c44bac39a9be95cd781c001
- MD5 a4d7c7b21a7145e21f6123b07ce7dc77
- SHA1 04836cc86aaa6cae911fbc29f70409f453a5e976
- SHA512 970e674d1871619f9c816c3ea28991aaa57920921c925904bd4bb58cbbde42ad2e956f2e0a198b6e1a2cd05a5c94df7774ba03e6bf9acede5efe72eeeed03403
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85mI:A3k03kB56rl
- TLSH T106257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 959KB
- SHA256 ff0e52abdaae31b26f0e1ef31aff21d8fa12f9cf42b517ba12160b67537bc8ce
- MD5 14759b59b6dfe8e10ba2d4623b4fd2de
- SHA1 a83f95f233a1ff77c32d52d2ac31c6b32ec2ab16
- SHA512 57fb8fc95195a709343c260c19f3f96a88cf48798cd1ac53cd9698bd5e266a86723b9bad101cd18efa08bcde11151652713ca543019720bf4402291b346ba6a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85Uo:A3k03kB56rT
- TLSH T170257C03E6940FA4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 959KB
- SHA256 7b7d8d4d41dc39134d1a352ab160d8c478ca15ca760cd7249b1ed9e0c984e3e1
- MD5 2c25cea118fa222fe86c6d1f4501c41c
- SHA1 4e460f6ce69746d994af158aedf6d8975265ef5b
- SHA512 c4620b737173cc1c8c562700c08a84d59904e34124a15069fd8187ec6c92f3d521386242f8feecd935ccc3d9a607926d98ffd8b54711a6f6bd44b828ebc2a170
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa853+:A3k03kB56r2
- TLSH T187257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 959KB
- SHA256 d8c942699e855b006a879198e58e73ba3f98f762d1ab5dd8523d6be0df8a9d2e
- MD5 c0683f125f3fb2c217c8f8b7f4fec5d6
- SHA1 3f44f8851d61b880848678e0131a0916706d618a
- SHA512 b3f72fd336c7fe3f5fb9d366470aaecedf923d8bff1c1dc492d8502bf55f0dedb8bb8f36ab6c4ae365a0d25c70eeb27dc549adec46667617074506e1c779ae56
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85NQ:A3k03kB56ry
- TLSH T174257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 959KB
- SHA256 170c3984b046ed76a72a34b622bb326f8f4331b2b8383884c525d29b7c94358e
- MD5 e863847c21d7a2450d26bc928e8c9c67
- SHA1 42f24e731206d3a6178fc57919231b520b45b48d
- SHA512 4d4d3f4c5289b697ec37dad97112c785d66329d7cdba22d27fc94f9ab6c8289c949628970dc579727e6ada20c318dfcccb8bd50e0a5a8e7c431a4448165ef669
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85CX:A3k03kB56ri
- TLSH T115257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 959KB
- SHA256 6b0b4852b0c8a68f4e44f2195e7033aa30aa2855cc5cba15a6352b4db9f52c5d
- MD5 044684105c27858304d076a33a7b1e14
- SHA1 2ad0c5e33420ce8acbb08c872c49789a1704c014
- SHA512 8c41443bd762156ca17945d0b144a6b71878379b5dcf89c9d2c53b38f9c191045fe7a76b4c48b1a85dc412daee4b6bd8656917cc5638b818dbae8b31e825d935
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85kL:A3k03kB56rM
- TLSH T12E257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 959KB
- SHA256 66d754973894fcb824dd0a2816eedf38ea7d529ec53e5fc17a8445e69e9f9567
- MD5 70703993f4c094fd3bfe307d07f9a8ec
- SHA1 74b9339f7f106f48a184e6f17c1fedc30839e3e3
- SHA512 c4313b135375f8f74d1046f837d798b8579c71b60838813399e00d8ef400dd40e401ec62c169f033ef4bc09ba41246ba2770a5bd13f82402fd8b95c334809688
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85AM:A3k03kB56r9
- TLSH T127257C03E6940FA4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 959KB
- SHA256 08abf1e54a3a4ad38dc452dbdaf08ce7dbadf822c2ac6f4605968643904c8204
- MD5 4b2c8214ef5be463e1a31c74d1f89ee5
- SHA1 4b6086a8ad9a220a801f8740cbf60f060f90fea9
- SHA512 f5d2f45131cc034b2d339fa3d315e682de9f48bfda5bd73fa23f6aea1508af27db5315f9c18e254e56884714b06eb6301dd6fd57f4e2424628ed960ab10eab5b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85hh:A3k03kB56rX
- TLSH T167257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe
- Size 959KB
- SHA256 fcf853a747b0a4f6faa49351dd7c73097b0e9dc22e292fd1a26ccec5bc737a60
- MD5 f659fee3805b20289a5ec0de8b8e7fca
- SHA1 340c9c025e0085ae311bcc8aaf3fd7f2acbd70f6
- SHA512 44052e816dd216c95f8bd6ff2aaccaabde5bb1a009958deb0ed0c1c6ccfe24adf81ac95cd9bf4cfd86128683ab10fb7be60e4e4a034de5fc9bb3ad6bab9cc7a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85L9:A3k03kB56rx
- TLSH T143257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\java-rmi.exe
- Size 959KB
- SHA256 718c4bd09fac606347b3049fbc239e42a46d5c35046ca498d68d8ae51acf3c80
- MD5 88880884f171efd4e8410a9a2931aae6
- SHA1 cb70aa7e563b5c4d2f6d3d1a0e6240773912b931
- SHA512 1a50aa890724d9a995c333d1111d00dbf4078700ec1f9efc9fd4c1b5ab8e31b2609df0884e2b6b2f878e3f384ef0962d0009a04051182def3c6f85d8cc556e92
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85IM:A3k03kB56r1
- TLSH T1EB257C03E6940FA4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\jjs.exe
- Size 959KB
- SHA256 038be945cc834037fc29aa33d731ede1a1613b7742ab257556274707e024cd3b
- MD5 5f5572871fc8eb3d696ff580fc58bea8
- SHA1 262d84a325c8ca349cd77ad8392436eb0bf23273
- SHA512 487f1094ddcf8f3997eb7ea7155ec70f04b28badf05a674ad762c2a25449257acc82ce8cf6d4a24c2f0d294cfe5eca9a4a210fc580b9b8a56396c6286fc2172a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85PY:A3k03kB56rY
- TLSH T198257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\keytool.exe
- Size 959KB
- SHA256 fdc268cad112fd148d2f0c6956a3ff1c0bb8c510d3249c1030e5e1adb905d9d7
- MD5 54078236de91ca1c0acc1c4325722ed6
- SHA1 0ccc4cd7ba6fd3b7c37f3470f820d4aed780af63
- SHA512 689842ae2a788782cfc94e571405bcdead7fff42ae8becd8949d0ce9b9fcd27562cb78bbcebc40cb3d2c6b8e6005b7f57b6a071fe10c5a2929b6f51355d8c8eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85LQ:A3k03kB56rE
- TLSH T185257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\kinit.exe
- Size 959KB
- SHA256 2f30ec876ade6f5f6d6e84d441767d82f49f6dffdb33d7cc72ce4bdaac7a38c1
- MD5 2a38e84f9bb8851fa92ee41b933c9473
- SHA1 e019ebf90d7c6ba47f6dc6920ba9a92d03988415
- SHA512 126b196ad576af7b397068a3c51fd11af70442a1bbabca41bf15df5d0e24b5418ffcffb6e8dbd865a9b45796338ddd79e8d9b913b383ed05dc23bb0e38a330a0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85Vt:A3k03kB56rn
- TLSH T122257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\klist.exe
- Size 959KB
- SHA256 a2249e9c11db0240ac77e6bfc8c326ed11c25032fae35970b153532e33a859b1
- MD5 839166b5cc6dc6f7617acd28d7b94dbe
- SHA1 54502f0d487a55c14802dcf265f022ffef3a302f
- SHA512 f87d5b11de442808e94a094913527ddabb48f258f210b31df3d1ff8bc4507e2a114c384c249bd553086c78684df1b1c7b85ef81a2d531739955f10fb7d1b133e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85QQ:A3k03kB56rP
- TLSH T1BB257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\ktab.exe
- Size 959KB
- SHA256 a37916edf8c342c4bd8ed0382acc4a34921cfb71f5569e68ae9971282beddb47
- MD5 590dd35853578979923906d63239b8db
- SHA1 8a227aaa1f07f996f93e7ef5d5d3460294c2bacb
- SHA512 1307c9998ded57597a147e0c2cbbe0d661153b642f3fd81c1c99c088f8b740aff10e3cac1151918d42d0551e9a19d34626e6f838d3922edf8253a67fe3c3e0d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85BV:A3k03kB56r3
- TLSH T15A257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\orbd.exe
- Size 959KB
- SHA256 da955d74c2ef72fa893d94c45b8c2b302ee94b85d2c17fab30a33bdfc9715b50
- MD5 43959ef5aefa2b0414dddd8cc41bcc25
- SHA1 13c0152d0768383afe5377d36fb5c429273c0b61
- SHA512 abeae3341c6755ceea68088b1dc938f67fa24628f8a0b177922070688fe404327b2b542f08e030e4c9691ea54a887a7fff350c5d13cbdf854a507a7017ff879a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85u9O:A3k03kB56rJ
- TLSH T172257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\pack200.exe
- Size 959KB
- SHA256 8268223f9a2f3e2cd8d985a6cf221ff45862472d54604d4bfa700e0b097758cd
- MD5 759ebbd76c082b3721de7799401e8837
- SHA1 348c55a591fee86a04d7deeb0df8806ad9d9d6bb
- SHA512 5de88e57bed2576290dc4d54adc6c437092bd0135bd89a34ab31f7276a131a9dd83fd8f88a85807eb3094f19cac65f4c85b0a4ed5d48cdac9c52519d7ff6fed1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85p5/:A3k03kB56rv/
- TLSH T1FB257C03E6940FA4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\policytool.exe
- Size 959KB
- SHA256 981c1b6311d32aa44dd8f06c344bf4362ddf9ac8bc2e38e64691be338c62c45d
- MD5 46842304c7efc689c074412b109bcf92
- SHA1 96ae0a856eff5e3b9fcb2415a3c9fedfd0474d63
- SHA512 5318309642f6d1928ff25e72d812c839d2864ee1d0c2e9410a41e143c4ac11faf06e8c3b1b615c1183fcc3c5f600537283099f8d7d855a9fa7aaee32b7089c9c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85hT:A3k03kB56rt
- TLSH T105257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmid.exe
- Size 959KB
- SHA256 ba5230d72a748c418b64105d4c8f14a5caa71bafa4d6165cfa46d859e27592e0
- MD5 9ac324d4e72b389062489da96fbfd050
- SHA1 4576bb4a4c3c7e61965d6b596342956138561892
- SHA512 f2826ae683473efcdbd7c310263fe0e445294f936696be3209ec2d391c58fa56bd4bd924a0fbe93bbcbee47038e4aaecf45fd6757a8486d2ae2d3f830f63bbd6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85Hs:A3k03kB56rU
- TLSH T1A7257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe
- Size 959KB
- SHA256 b982fa1a7cd6f9a1f71d5167c8455486ab08702a65b72279373aa3652cb271c5
- MD5 3778fcd5182e8ae11c0f238547de6201
- SHA1 753221849685806cdfa09545dcbe824cd1d48851
- SHA512 6b9550f373210ceb0bda6c02601c7127cc6e8ca284c8758e30d211f5da401b2b4f3c3d0619909cfcc0546b07d31c478492d1f12dbc5b5327328db4a87e49dbf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85yC:A3k03kB56rf
- TLSH T147257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\servertool.exe
- Size 959KB
- SHA256 31fc16176dad05d79ae50c965ee7198cfee71b58f164b0c64fbc84f3dfef8cd2
- MD5 ce4b60c71a02009fd11171d560287f44
- SHA1 9f9cc577afd7d8c38c08c8366650da0d6df240e1
- SHA512 dd5ad0b8ea012dc1bf4c6bc9743141b513c57c083d6010b045ba5bc9fadc5f5cbf3eacd89197105a5772300d3b7e6261168eec9798a2f22c0c9c2a0699379fd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85wI:A3k03kB56rJ
- TLSH T131257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jre-1.8\bin\tnameserv.exe
- Size 959KB
- SHA256 4995be622b0418b98598b5b4dfb48e4af9a6e02763355f2342e21c2c3be34e3a
- MD5 d1f89b93afc6d07e7f558d08168c3b33
- SHA1 34f44ae98b6aae6d3643e74c9d29c5ebdb7e83c2
- SHA512 55889278bcb3d666efc90925b0e0bbefdc003f34f1b213e5954095fe11907969adb9cf620fd0b565600715f2ff0de81af74f33797fe9548b5f625b3817360d86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85hv:A3k03kB56rV
- TLSH T199257C03E6940FE4D10F81749AA64A62EA737C125F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 969KB
- SHA256 b10965f99959ffec8bfa3ce1d798ce305b03c50ce5f53c4287cf8d112d362944
- MD5 265a69a970f33f1fdad75a67387a1cd3
- SHA1 83d3cc9cc49e3cb756a788592c7fae0862e932fa
- SHA512 32de4f74841f8113d134c7b78df9c9d5d06b0dd94fb8e13850b14d516b7ebf9be98decb72df17e185cfed666b430016835f865853943d3b09369efc2ea7d2cef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYiw9UyaRa85O1:A3k03kB56rm1
- TLSH T1D8257C03E6940FE5D11F81749AA58A62EA737C021F6097DF1354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH