Analysis
- max time kernel
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/07/2026, 06:02
Behavioral task
behavioral1
Sample
2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 945KB
- Sample260705-grq3pady8p
- SHA256 b3908d9c62ae6c34e10a5f162e5693b0c8a271fea8888782da226eb45b9a8318
- MD5 ddc82a5af2d0cecacd22b607a9d5f50a
- SHA1 157bed1aaf542a02db7d7756637df47f348b0264
- SHA512 7eb87529f3ce2b80e9a3c37e39a7f3f84ea1c8d3540cfe42ab354c6a45538d3bc8fc437d38aca4a15eadf0c276c0bfa352d934a59f6ec98ce822bfa964b7a5b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a:A3k03kHRJ
- TLSH T1BC25AE13EB9504E9D10AC174AAE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/5924-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c5c7-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5924-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5956-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-244.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a65-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-284.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-430.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-485.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-510.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-681.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-805.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-849.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-875.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-914.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-927.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-958.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-983.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1089.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1108.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1159.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1191.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1331.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1363.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018920-1482.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c5c7-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b4-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-244.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-245.dat aspack_v212_v242 behavioral2/files/0x0004000000018a65-258.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-284.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-430.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-485.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-510.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-601.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-632.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-681.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-736.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-749.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-805.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-849.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-875.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-901.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-914.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-927.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-958.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-983.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1014.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1057.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1089.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1108.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1146.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1159.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1184.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1191.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1228.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1331.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1344.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1363.dat aspack_v212_v242 behavioral2/files/0x0008000000018920-1482.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5956 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5924 2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5956 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-05_ddc82a5af2d0cecacd22b607a9d5f50a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5924
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5956
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 945KB
- SHA256 b3908d9c62ae6c34e10a5f162e5693b0c8a271fea8888782da226eb45b9a8318
- MD5 ddc82a5af2d0cecacd22b607a9d5f50a
- SHA1 157bed1aaf542a02db7d7756637df47f348b0264
- SHA512 7eb87529f3ce2b80e9a3c37e39a7f3f84ea1c8d3540cfe42ab354c6a45538d3bc8fc437d38aca4a15eadf0c276c0bfa352d934a59f6ec98ce822bfa964b7a5b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a:A3k03kHRJ
- TLSH T1BC25AE13EB9504E9D10AC174AAE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 974KB
- SHA256 33b57c8eeff76e337200bd07dd288bb718549aaa1b98deeafb4631801e0e8b73
- MD5 a546a59f4b7e4003efb3aa529438345d
- SHA1 f48b611c7b202c7791d8da4c40cdf56fdf4ada17
- SHA512 cb57c196790ab374598171506b35f2808e29de9832b8814b72e9b0b184a856e360921c8dfa0f1402a0825058c2e1c5e01e60ad905a164bf1b32dd65543280583
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3axP:A3k03kHRJv
- TLSH T12D25AE13EB9504E5E10AC174AAE68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 ba130f868d04eb0d8022229a80267088f7898bc1df2ac35e3215d00d41e50c9f
- MD5 9648bb424ed5078de1e40c805149de34
- SHA1 cdde77d11ef4bedbe64a08e2c09b704fbae9f066
- SHA512 91ac7bed305ee2c7acf47507ead8a093e6ad89ad1d48a325688c29f507714198cebb6fef750e2a28906c888b379fc0f67a78bec2db55258b62f0da3e4d178628
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aP0Le5ji0hmxNrM:A3k03kHRJ9Pji0Aj
- TLSH T181658C17F6A402B5D027C1B9C5D69A5AFA7138821B3086CF1359C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 959KB
- SHA256 faf067db6a676394cd91f71ab63bb667c9602eaf4d3ad0a1586995775610e0b1
- MD5 534605e1c030fc4d38efa0ef1afd3ff9
- SHA1 5b0910eee19f19e124bf781506c6a8cb2d80ac64
- SHA512 c20a30b7eb98dc9274fdad618a253a44461f6089440f434d0ae68667fad8856e4d3b217eb7e39124da60f38743aa8a3d4187f7c6ee0e6ba0c90900fe86fc6f2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aRa:A3k03kHRJ
- TLSH T1DE25AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 968KB
- SHA256 4801a210176fe442f39fa9100e73edba68c98d831af895452936b554dbe04dd0
- MD5 925824ede2fa47ac1fbd27b35343f48f
- SHA1 f3576246b29dbf8a8e020ca397be23528cbb069c
- SHA512 166492418b9c1a7ff53bac0f3069f57911a19f95dd57dbc29cb55d7fc689241cd8377636557f30a8e3a0c9e253324747c28e68cdcdb711da5dc62aff022e0aa7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3ao6:A3k03kHRJZ
- TLSH T16825AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 968KB
- SHA256 10223e88d93e01940d9ad0d1f573d4b2430991188feb3f6d560e764380e256de
- MD5 1cdc06461fc32529dc7383dc8ce2dd69
- SHA1 2e8ab1aee3c2d1bc3accaafce6db88e2afac52a7
- SHA512 c704b6a3f28b685f9e2bd38b94732b31d0fd157a8713a0b30145a8ec40f0c69ee4908c96fdd47ef826a71ef606a7599a040319f240d688464b3dde7386b45382
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a8o:A3k03kHRJF
- TLSH T15625AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 968KB
- SHA256 7e354cf0b5aa602e4dad499cf43025d633215af69c9b8f47fc68698017632447
- MD5 91d8255aa57be0fdf4bbaa1d82e3f067
- SHA1 74090ce6d0d4cb39999e98cf2de772c12ad1449e
- SHA512 efd7bf35c0ab178b05ac4ec04b23b3148c413d46c2877d9919a0e3a91e8d571a7637401e4acef520c731f56e11985831d2da2f45ac43b205f9e76b9ca74b5435
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3acu:A3k03kHRJn
- TLSH T1FE25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 968KB
- SHA256 595e4630e35f2719e368f1d8b834784515da75218cac1f37aaa6700fd3c00992
- MD5 5a71166d17e3ea36cf1705efcc1ea9d9
- SHA1 90d7fac2994e71cf8710a88a1bb9ff6bec3023fc
- SHA512 e0096272aada9320708888079d29250b029e85e95af8f0d7df12083f777daa041a0e789304bf7496d5543d7a07fbe30456aa65d42cc5a2c2ea668c8a1e56995f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aoc:A3k03kHRJL
- TLSH T10725AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 968KB
- SHA256 d2154369c8ada2b49d747a4f81cfa4d92e14243ca71d2bab286ae95f7ca93ee6
- MD5 201114350af0ec942863489008c46de6
- SHA1 7018b1c59435b1dd95b202814ec7edde822f91f8
- SHA512 e39ed5a3564753811340db8dd9cda46614906189db3b811154e24f552db7af4b3d1314b8dea743bd1606b43cb4c3bb4d4a6e2a6bdc9c6566851515e18f71ea75
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aBp:A3k03kHRJp
- TLSH T1D025AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 968KB
- SHA256 12c5a1967caddaf2f1ed33e00a4835e0f49f4982f36eafd011ba6a126c53e758
- MD5 e9458e7f33643845d0392070e64f0fc5
- SHA1 013d4db34f3666809c2c351a4069912f0cca262a
- SHA512 c0b11767da628bba32ecd07bb0ca2461bb462496976dbd94b2b773bdb2d2111113a2d995513e8afa2c34bbe3791cd7edfc6bef6f42e3b7725201e10121d2ff61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aWN:A3k03kHRJy
- TLSH T13225AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 968KB
- SHA256 4c157288715b9958128314d22d9676864604a0f72612d9a0fdfbfc3c9da39d0b
- MD5 5f25d1857e7c7a1fdc0857aaff5b29f6
- SHA1 0e80497c49e9a7e75484d27288f7b70e6d660cfb
- SHA512 413f57f8542b66aeb8dfba199eeffeab140c78d69565cf7efe548d7e991a675a84cd3e9b574a9e352c0940952cf86fde9725f99acb47502d3f86f4a093da6e09
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aaF:A3k03kHRJY
- TLSH T1E825AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 968KB
- SHA256 8c6fa6512cef5f19e60d2eea7c340223a190c7c749e76ea23cfbc4a1808c49c0
- MD5 ac74d63cbd9aec2940ee701cb9538133
- SHA1 6d08cde1249d43d5d4404db7722fb24f30686468
- SHA512 b6933efce76e948f64df1dae7da1a1b7e5dbe50a8b69d625cf0752605681491f0efbb21465f51ff36ba39ee0960154a43e2cdfdb395733bf28a8bcc025313ef2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3avC:A3k03kHRJs
- TLSH T12425AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 968KB
- SHA256 9f340c40309c1ea3ae653977f3edf78105aef48f81b564a5f3ce32c042782a77
- MD5 c259b52266f4ba6d051a71ce455d4d24
- SHA1 3b65a2327a624fe09e52f5f61cd3a5746c219f1a
- SHA512 269f7734ca40c506e0952e6489b3d0a6dc73e46c403a3f2a793e91396a48cb7f618621601521b62700545305fd89e0b7bb450fdcf67faae7cec2351cfbfcbb8b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aQw:A3k03kHRJh
- TLSH T1DC25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 968KB
- SHA256 c7a24b6eb1781e52c8c695744137174f3d7f3bbe65409a7c6dd57c8dca262d6e
- MD5 246b4bb1d4a6c1f1e0ec7aa8794ba94c
- SHA1 01b926c683993048930a6ef37041093724c2283d
- SHA512 242dc02dfebd5195a21b80f36b178a216d2dbff0049d61fbc7002677fac6c0c02f4422b0c20d1a2042c1f827dba01a0f766d7decc1f8e3c279fc48337d21f235
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3avT:A3k03kHRJV
- TLSH T12125AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 968KB
- SHA256 5fd4c962f508495634d3d10c5712ad72826c7253fecf9c9a700f0478144f3f20
- MD5 38d3d7e241ddd77968adffc6437590a1
- SHA1 d9c4caf8978ada719e7e947c87eb49b05f59fa34
- SHA512 21d046882c7be6fa21a766539fbc4a74819751db75d059fe532909a55049e408dbeb34659a7bf8fe07bec1acd9ac73ff4b3d5d6296b7540d25f26a3a1248d160
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3apu:A3k03kHRJK
- TLSH T15925AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 968KB
- SHA256 de6613995cd8332638945b2c9074911cfe3479235b27e7de35bca3ff5df4ee77
- MD5 8a382807c177af075dd127f2eaadf504
- SHA1 68cc2198955a04333db0ac6760db84b213fe9987
- SHA512 6f2e5c5ffa5dc2176e1720eda05cf319770ce8fd803b5c389e13d85224d3cfa9ab24823dffcfbedc74015b6df534db7a9dea9d01d24c042b51ea03d5e717f664
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3ahb:A3k03kHRJr
- TLSH T1A125AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 968KB
- SHA256 1d1ae740d1c0bc89b6ad5d5ff6bbf43c9375fcd80e6049988cfec49b66d9539d
- MD5 b849dce08a6bc06f9e19a9de1f348972
- SHA1 9123fe521cc820b54c4f6f50d7ceb5b433aaf2d9
- SHA512 e0526096bbf354dfe10f947f5e98e03223272834ef197862a1f860885efb4cb92adb0d8c1f5de4189ec05416e7de098c8bc96e2a3aea08c9af4f1b59e254989c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3apf:A3k03kHRJz
- TLSH T15725AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 968KB
- SHA256 350a0e324c0e6f4fdb099c262acc09e680f604b527bf540d5e4243c3f45a4baf
- MD5 92e3879aff774edb7fb03b17b46d9c78
- SHA1 97d78c7715046c83c3553d1ccc337c775becfe33
- SHA512 5d5b4d4d861a22a87fee5aba6ae9ea1ea55141549f9fb8d6c0de3193476c8368e871d79b048b0ddf2713725646845c48136a65e1e03b8cd22733d818e6402731
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aSK:A3k03kHRJj
- TLSH T1B225AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 968KB
- SHA256 ae02f0579e829f29b05c2ddaeca990b98ccdae67c242a23776586ee215d901b5
- MD5 94df93040b903219b40be6602caba4f6
- SHA1 414de3877baefb401e4bce4bb7b5e24936f25777
- SHA512 63007f6a5929292f240aaf4bfd22672aac617825cbf9039ef3e9b6a899600d9d07022204c921156ff9d2633ae47fd2b40e13189d85b0a20bb9d2e5a037d17777
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a3k:A3k03kHRJO
- TLSH T11E25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 968KB
- SHA256 f819e86d11cbe13771fca19c017624a866dfe5292cb7f1118de4539f3f8fa56d
- MD5 bfe46412931d4cfac00ad1473d1eea1d
- SHA1 c911c81fa80b9ee330813ea064b4645b4142c646
- SHA512 7c42fb0934b8b7e6b4d971787e368808d4726e1cd3c4ebbaef291876b74e97b0cf865f7ef1aae5d712c5b0ba64169b234bd90bdcacc94e1f05c553ba654b0f56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aA0:A3k03kHRJT
- TLSH T1A625AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 968KB
- SHA256 f8b105a973d0baa69372c731207a338e81084589e5e283215f18105843338a98
- MD5 d52d3c7930682b03f71b876ae5a5e680
- SHA1 d9671e6469990a53c4a2eb534cbbd2adcfac2a4f
- SHA512 45d3f86717f89bc449c284031b6195254a83a683be8fd3e515b06562ceee67cfa75813aeba1a2c9f186853bea6e00bcefab077e2f658daea862b53062d0d2387
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3abg:A3k03kHRJW
- TLSH T15225AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 968KB
- SHA256 af18e85402295465bce29e8724d492fc455925835915df43ab8085190859dab1
- MD5 0e319dd14aef873788978151ff1eaad5
- SHA1 0d5ac601f6f348edc1433e2337ee7af687d54471
- SHA512 2a21f6cc8492e23759ce2a17470dc42f6f17ce92793035a2f2d04a8709773bb2bbb7ddc8287dfe894d31f25434debef36a180b6552436b812e63c2a93da540ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aWr:A3k03kHRJY
- TLSH T11525AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 968KB
- SHA256 f36a532a487130953e2a734d3fb29b19bf894f457b9e82a46dd5320341dd0b79
- MD5 2134e9be7d469583d840be37a834de8c
- SHA1 3681bc1cef08c2af0ba04b9185263d0dd5021fb3
- SHA512 5b18d875fa58d53fba5072f99d349b856e39025ce2db4f242f72a856ec44b77e69d6ce03b2aec134cb51d821f119d0435eea433d42ce8dde732afe6d2cd57714
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a8n:A3k03kHRJa
- TLSH T11F25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 968KB
- SHA256 5fc53212396d1dbcfe0038180229e758a26d552d6dfb2f34c5e6712d126f3099
- MD5 927d7e83bc3d881ae97e316b5db3c206
- SHA1 484bf7cc4293c559a7c8b37cb5a1f1386f8882cf
- SHA512 0f7507b8b6ee5b99bb001f8223592393a9cdd14aeb38cc70f4f958a6c0997603204d13958ae191f8d81bc1dffcf5fade20fecfbecb46c3c2d74d6a98ecd801c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a6x:A3k03kHRJY
- TLSH T12A25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 968KB
- SHA256 4886e0dfa0dfee06334239068409b8270185bd271b64aa42b664c8fdba269180
- MD5 dc423177570d2d52d6a9e0e4e1502713
- SHA1 02df0546ccbac83ba2a8d129fbac703c4ddb9d7a
- SHA512 04b4452c20f34f31dbd31bd5fc8adf97a461ec6891d670480a60b7092e8d8f3edfaaad5efb5ca390811bd19febc92f0950d9bd6711223c51435f58820b5cff17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a8A:A3k03kHRJb
- TLSH T11525AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 968KB
- SHA256 95a44e519719cb93cc8ac7d4454715c05e68784566ec4fbb41c476bc7ff18160
- MD5 2c75153c4f37355077dce4d950e8d89f
- SHA1 d11c08bb55b827db3ea09bdc986486f882fc3dcf
- SHA512 d9acf64478bffa0f83a381adeb2a0b439d1eab422f10f8ee66a5c80d23a4d81b4b8bb585473e36ac6797ca25d1276e45c30f343b1aac3603f54ab0f1011404e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3al9Q:A3k03kHRJ2
- TLSH T10125AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 968KB
- SHA256 4181968ea8dfd4a8bf2bd5a005bf74241b9f7e7ca1d7a845114d976660963bdc
- MD5 695bcb7852c0c52f8021f00953cad122
- SHA1 5e82b48e9e95ec05983948247164a5180161bc86
- SHA512 e8abc12699ae68154e05c12cb1c071548fbf7a0c6fd363c5f8384d55a8a19bb11426457b38e68a2f709e584dc1957554b29a81551b21bdfe1244a76dda6b51ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aQ4:A3k03kHRJl
- TLSH T13625AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 968KB
- SHA256 c37af2776d3e887c2d81cd4c5bf2b526303e29e8fc1faa6949e9f123c1eb29b7
- MD5 36d3c0716f2a8a9a6d4c5c4dc7aeac25
- SHA1 4e8653fae134669435d71e15056d2d0f09bbc80a
- SHA512 98ed276dd3deab42cf44602bb6a22bd5d51066036d8fe1a5cabcbd8cb73871f0118013d09c46dd4ee0fa1a69b7ae1d5366dc7e10861d72fa7d6723d98dedf921
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aTu:A3k03kHRJQ
- TLSH T18A25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 968KB
- SHA256 5f0fa10cf4435bb562d565a60c504c9dedfc2936d02edd11f20b8d0781c95ac1
- MD5 61ddca15de2116d2a173341668c7357a
- SHA1 fd1e5783e25dbabe8dcf5ca43969c8a8e336d268
- SHA512 6a52d5455a8457cdc142a6f0b6be41d40ccf81b204eea82e81a6c2a7c46556fd00d3b3ab859a8da0c808a39147108b4691cfa15345c209db30e021a12027ee21
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aOj:A3k03kHRJK
- TLSH T16225AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 968KB
- SHA256 4d882ac079ef770e18b4d9a5d3aaa9e620b28731516e0ac66a38fde6690b6a3c
- MD5 8195e17518b54c36aafbb4d49a77d8b8
- SHA1 03df89da7bcb95e003ade871062a9ce659e776fc
- SHA512 30ba0f24183fc72bafd46e11024bdb697f17facd41332ab7b897978c505030fc9d54486e81c9d8ca126001baef021125a38bfcdb2690a41e56d53ad82cca4bc6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a7g:A3k03kHRJe
- TLSH T1C325AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 968KB
- SHA256 8d664a89b43b419ce7b56b8a4d05caca4a74ac7003849ea666a262b503bcf71d
- MD5 dede0c503819e2ff3c78f70574e2b053
- SHA1 0d3f91061fe2b268e992d428ee30b2c130ea878c
- SHA512 f4f574db1a1cfbf3238b8b0e224125d723f6b8687020cb7c45f59114277c9b412ebd5eb48388c8da0a4ad22725ef8f0243cc5da6966d880c7f885111816e503d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3amI:A3k03kHRJ3
- TLSH T1DB25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 968KB
- SHA256 dc16563788339fe347b50d192a90660fa74bc9905c76727d8be5dbc98be0324d
- MD5 bb266920aa77eb3a76fce6a13c4155be
- SHA1 7279392403c1c0c1cefe85c86f4c46c8d4715850
- SHA512 2639f2da09167ccf18561fa9b9021e09658d9990ae2e1a0e243a177ea13c6fe69f61d16416cdbcfcd3c9f895cb4bce8c7110f2c5b6773eb815c27cad003ebf2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aUo:A3k03kHRJx
- TLSH T1D025AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 968KB
- SHA256 e96c80644ccd1e272b1201560f38a65c8aeb9beb7a58e7db138af6ef0782475d
- MD5 7f1d864312fefea787e37e02692e3203
- SHA1 ee69440521ca3f76edc0a20926d063b9a8054b77
- SHA512 1b97da2ba02135a81afb0ea3435aa8e292c0fe0cd950af0ba605ae5900670c8ac5b29ed08849e21e3c93775901738cc36f02d493b1e8cab09869606fc15f8deb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3a3+:A3k03kHRJU
- TLSH T15B25AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 968KB
- SHA256 ccdd8e57796617b30ff63cf70652cdfcedbdab08afa2b6b93c8be1b5e4a076bf
- MD5 a728527021a1cd59532acaf00506c9d0
- SHA1 ed2bd95e2438b045935d967adb9d3b33fba3bbc6
- SHA512 d369ad1b26a25f0937540574a2e341443fcab0ad13cd9b87bd6cd7df1e30ddb6406f8d936f2dd3b5fed24b5574ee512b35d5242c4b68a208f3db0683a74502f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aNQ:A3k03kHRJc
- TLSH T11325AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 968KB
- SHA256 6856c674307d72539422e9b5660805b3d8caf2cd5157fa59924591f47aece2f7
- MD5 bae71960ec1e6c24fe849612f867129a
- SHA1 99a429312be628229fb69e27d55b4eecba7ccf47
- SHA512 0b24fb501dcd6411920be983001956db366f4f25042f75999a891419bb68f030140f5180c32ba09732143f84499ab345d4ef65ae6aad9ebe2c8ac30b2076598b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aCX:A3k03kHRJ8
- TLSH T18025AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 968KB
- SHA256 cb33493c5224b5b3f63f2b8a923b4ee5d0f2e90bd43ca27e262c7832c427fbb6
- MD5 f54c56298d9a0f50d9f2d4b92782fc91
- SHA1 df3d2ded17c334bad95b911e020eb71c1f63468d
- SHA512 b8600902455fa1d078a39028662424aa17cbab3f282b606b337f6518ae7d52e691d1504830f9282fceeb80dc46c40d0b62b60cd3a7ae849ffd4cc7e5988819a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3akL:A3k03kHRJm
- TLSH T10425AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 968KB
- SHA256 134821cc505fc133a8c9ddef0e9cbbaa27fa890fe11d7d7430e20c18ceec0fa8
- MD5 8d1df86ebcc20c223b1dedeabc045fa1
- SHA1 82f9a517dcc4e441b3edb85608ceebfea83bb1e9
- SHA512 d5ee5e837367b135f2ed422666aecc392869d69cadbb2ad9af39ab762be5fa96d1c94f4ca71428b6622e466dd459ebdb437634d60c9544f1ed9f5dd40ec55afa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3aAM:A3k03kHRJD
- TLSH T10725AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 968KB
- SHA256 d25bb6162a7807a4f20777978291afe482902350dcb24cf2c56476279d4ddafe
- MD5 cddca54d3db433577a893a14c3ca5ae2
- SHA1 b23c45b62590833a92c4b4a8c21eba2eed030d01
- SHA512 cbbace120a9f9e13765b820475ec29dc19deb6136412dc1b2be668c8e52a01f07d5bd2ee9b9caf0e8d13e351d31fa51abe543ecc49d3adfdee12e1f36159f259
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfR24ZL3ahh:A3k03kHRJ9
- TLSH T13325AE13EB9504E9E10AC174AAE64A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH