Analysis
- max time kernel
109s - max time network
121s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 04:18
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 938KB
- Sample260707-exa8baex7l
- SHA256 c9571178b2733836f05a5bcea07ae75feee80ca1ac3ca9cf051047cb69f58ef2
- MD5 3cbd1df5c54e25039208aa44a5d47e03
- SHA1 8f09ca5cfd77807b6a4ad3f7bbe9f0706f131212
- SHA512 1bb3787547c7f4ea5e81f9251984943db14eb270d002b6928ea6dc3def350de6358ade2bb92c501e23a4c16431d047c9308d1318e651554968cb5dcb0ff26b1f
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+:J/sCv7rTiw24DtD+qBAas+
- TLSH T114153B2777EC4865E5A3613048F88656D976F8551B3082CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 37 IoCs
resource yara_rule behavioral2/memory/2380-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001100000001c493-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-430.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-480.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-504.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-589.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-614.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-657.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-718.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-780.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-836.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-861.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-900.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-926.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1000.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1037.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1056.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1087.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1118.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1131.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1162.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1175.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1316.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-1335.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-1360.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2380-1421-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2180-1470-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2180 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 23 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2380 2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2180 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_3cbd1df5c54e25039208aa44a5d47e03_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2380
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2180
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 938KB
- SHA256 c9571178b2733836f05a5bcea07ae75feee80ca1ac3ca9cf051047cb69f58ef2
- MD5 3cbd1df5c54e25039208aa44a5d47e03
- SHA1 8f09ca5cfd77807b6a4ad3f7bbe9f0706f131212
- SHA512 1bb3787547c7f4ea5e81f9251984943db14eb270d002b6928ea6dc3def350de6358ade2bb92c501e23a4c16431d047c9308d1318e651554968cb5dcb0ff26b1f
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+:J/sCv7rTiw24DtD+qBAas+
- TLSH T114153B2777EC4865E5A3613048F88656D976F8551B3082CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 64cee40326605556e60afe4fe7fbe7cc621060bb7f14bbe3b34d573c56d06302
- MD5 79bd5fca1000852c0331ce9481bf7ff5
- SHA1 1f60a829f67f3ab90b205aa35ae40571c9c52b3c
- SHA512 855a8be784565f398080fc4e2af2191d536bf72c30884e22416d915bca2c8334773d63c49c534d442afb759fb80e7ad3183e0270d380edbd23713b03acbabe5c
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAas+P0Le5ji0hmxNrM:N7iw2G++Pji0Aj
- TLSH T13E655C17B6E84661E0739174C8F5965AE972B4450B30C6CF12A8CB3C2E73BF1A939736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 961KB
- SHA256 a148be24f57b65b32bb37f00fe89061433cf5b419f8c7ce9bbcfb3504cfdf826
- MD5 b4f87f449dd3e4afd241a113af95f04b
- SHA1 88fca8f0c4a6734adeac45e632ff6d92c7f42433
- SHA512 891ea4cb573da5e8857318ead804f1149bc71a02fbe1353ca142de7b80c361035bd2edbb0331d62b8412b5681cae607ceb76a4bf8741eba7aa170c33096b5adc
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+g9:J/sCv7rTiw24DtD+qBAas+g9
- TLSH T1EA254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 961KB
- SHA256 b0e0e6d34662bce18ad54125aaee3f3b101856cbcf0b1ac66dc1bb5a3468e81d
- MD5 f606a0f7757c0a3cd4ecacb7dea79d00
- SHA1 8838c115f9e24c231987abb2e0716aa2fad7109b
- SHA512 7ac57ce51c520dbeb7189ee6403980128ca3e270d7ab7ba2f6398f7726dcf4c5d57f0d9f3ed0c379e6ca890460293b6e8f4954438e3def16c54eb94ed1df5c50
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+oc:J/sCv7rTiw24DtD+qBAas+oc
- TLSH T1BB254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 961KB
- SHA256 ad45eeb90b0eb86d7d3877317e2e4d404fab351b708ffbe79faa3a002a623ece
- MD5 e789370c9eb23572ecbf451275d44594
- SHA1 bb81b5997929011399df2d54d108285eabab6bc1
- SHA512 f391ef071368fc8668647c13b36ef76aff6c1b1b52c41132b06d769fc0fc9579bf423916b0ea323eb9b27bc626e932d41556bbcfb2e5c6620b52bea23dcfd358
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+Bp:J/sCv7rTiw24DtD+qBAas+Bp
- TLSH T199254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 961KB
- SHA256 4b5af40bfe714bf33a6394a9d3076bf0e45165dcac65ef272518ef5be4941ef5
- MD5 866223b4598c28a7d8bd27c4ad477769
- SHA1 1714d14cdd125bc1e8a258a1eb7f1938a0d249d5
- SHA512 e575dae966bab9f62740ddfe050abade9392507330b58df2ac8deeaaa29b9f6d7e2d74fbc09d0ee3c322abaa0b127cb4caa67aacf896d5d5ef63c97dfb738d13
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+W0a:J/sCv7rTiw24DtD+qBAas+WN
- TLSH T177254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 961KB
- SHA256 60ece642e321d40750aefb2da257ab43ed5c2fbb3b84bd1f2da95b1986cb51e2
- MD5 8812815fb6572f778f90b74d0929c346
- SHA1 1ca18b104fe763086fd400affa00aab539e3a518
- SHA512 85e9373dd3227f91a91b84b6c9453ee6602481d3b7e26e609bc3d4b417616c65344bbf567defeee0af5f88f2280d566acc239509758c55a52e3a780f08e77eea
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+aF:J/sCv7rTiw24DtD+qBAas+aF
- TLSH T1A7254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 961KB
- SHA256 63e9d14fc08cd91229a6eed22a0594a54e833e455509f16801ffba68911fb8f3
- MD5 cb630a59f37893ddafeae2c116debe2d
- SHA1 ff4819252a6d479f8c4524c736d48508614b4fb7
- SHA512 1974d6dd5372916ace824b6f42586aeff458fd19b50aeaf223bc6d6c196daf27cf1f0087d0cbdb7d05edf3242323abbaf794482f7539bf59d6d2068a5e19262c
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+vC:J/sCv7rTiw24DtD+qBAas+vC
- TLSH T119254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 961KB
- SHA256 ffed5c0a5afd35352438063315212ab7d7855981a0a35416e99363693c41db03
- MD5 32eda4eb4f48bad0353de0c63ec1cdd4
- SHA1 8cfa3692faaea5517dd9cf17927ec00c26f74c94
- SHA512 83122bd4d3415f446a3cd442cf8dbfc3fc107a717ad401fe55f989fd6cfa58a7dfe31b8acc8ef6649914675a275a26508ad3e09fdce568b99740d573d4494350
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+Qw:J/sCv7rTiw24DtD+qBAas+Qw
- TLSH T139254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 961KB
- SHA256 7b109c58b7b6dc55e0f067da5c103459e8d846a7f9376e8a6e22344718588a49
- MD5 ac41f87f8184c847c3450049e873df23
- SHA1 6752d55694650ad2530eab6076f4da0ca396ed71
- SHA512 5bfa075a7180c5fc8e0d5f32c5ca7edcc38a0bd32abd4ff8f73d9bff822d1f6d8e96524d4bfefae57c70466161629db61c03a3f9e5005badf4db9d6698426395
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+vT:J/sCv7rTiw24DtD+qBAas+vT
- TLSH T161254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 961KB
- SHA256 2f839a7b3e32b6a689b131dd1b9e500e8bb3271b8fc73e5b5b715b97b0fbc076
- MD5 c9efce0d84b338011265ef2bc062d2d2
- SHA1 92251ef4bc66da28eaab8b3e267d9781eccc5141
- SHA512 e8234f6bc16107c77b88d4bfd3fdc8e1739db35c9fb45e1705a2161deb33c9e54f2e8964d2aa0d727dfa715b8e0df1bd9fc4cf239c13943d0acdcd369bc9d3c7
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+pu:J/sCv7rTiw24DtD+qBAas+pu
- TLSH T18F254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 961KB
- SHA256 74df2e58df6a68185d45cd3ed0e2ca5921cc67970761fcf12a734d75a6dd20b2
- MD5 6f55732aa017f07a30cbda17a38c0a54
- SHA1 a19d547c4527083949d6218eb7fb6f36437e1850
- SHA512 d477953d4545c4d02300b7cd67af42d8bacb225d3f416ff432a225174d08c17a6fa5a70246a5ab6bcf3e898cbb23102704ba22b028d751e6aadb8bd27a4a57ab
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+hb:J/sCv7rTiw24DtD+qBAas+hb
- TLSH T127254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 961KB
- SHA256 be0ef62dd3d09eae0cb9029d9db89ffddc6cbc946f5f8bbbf363c0e69d912df7
- MD5 c9af8a0be2f3f899753f7a060cc19569
- SHA1 d94ef2476831c04d975658d320e0d82262fe3c0f
- SHA512 2bb2a8c745d0fbbc964dd97b306bda975c21d52f89ed67c6f5641c5b9e6982236d8b2d7d4614d374eadb07b8c4e8e2a90c517e99e1d8626e9a5e70f97ff38e84
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+pf:J/sCv7rTiw24DtD+qBAas+pf
- TLSH T17B254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 961KB
- SHA256 bcc3562355b7142261630fde65090abff0a1eda9ef80afce548957bf6ff028a4
- MD5 1d69a809d45b5a62e9e2600d5193f359
- SHA1 112e75451ce80620a6e9a300438daba01948187e
- SHA512 0ff1bdc951085cb58967adf90eb201095f770244a9a35052d7a3adca434edffa2a27a904915210eff21baa849e5df3f9f4de23c4b2a180c6946b54618cdfbc81
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+SK:J/sCv7rTiw24DtD+qBAas+SK
- TLSH T164254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 961KB
- SHA256 d7bf82109a343f0a0b58304e69aff968b6a80ef6cff297df6cd277002d822579
- MD5 2b936729373a3d57ea68c6481dca0d5f
- SHA1 869edcc441d561e27cb8c004f02fb3294eddb6b7
- SHA512 d2f030de63c816a9cb84736468589b878ce714b7efa02071fc1d30af0cb82795a5bf99ac69080bb61c254e6cb061053ef1f7deb618f594daa3977324631f09cf
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+3k:J/sCv7rTiw24DtD+qBAas+3k
- TLSH T142254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 961KB
- SHA256 0b1746b01fcb5c042bdb17bd4036cc98a311b9b3734dc661d78738a6842bfe89
- MD5 b18d77f0fb92c40da3dda7e43ed4214c
- SHA1 ad89df050bfda49000081b6dd8b9696629600685
- SHA512 86031b66beeb1e5ff88c6caeeae45f192547e18c91c01d5e58cd19ae8a07682ee6e033ac725acd6c37bbe978690684d719cc429c399f73ee35ca2c94629a0a98
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+A0:J/sCv7rTiw24DtD+qBAas+A0
- TLSH T184254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 961KB
- SHA256 6a14c26ac55f12005fb39a5fd66212d9ba117a2e1b55895fd97d0d6d0f610ef8
- MD5 77fdafcb2ec39aa230d1eb888a5aaba7
- SHA1 ce60d36f06ce9e9e96d8370528e0834e572f4282
- SHA512 c4868961d6a0933b152a5498199828668f006504d3eecbd5f53ed6ae1d6268ec7283ddf17da5341024f569b5abf1933927504608e93b512ca7031a541632278b
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+b70:J/sCv7rTiw24DtD+qBAas+bg
- TLSH T160254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 961KB
- SHA256 0cae680f9c6f900e999d085e5ed989ac41b1a7a6b83d3ed3b32d64dd6cb69066
- MD5 6260b660b29a65cdfcc60d1c32106f5c
- SHA1 223dec765f274b487a65a5655282e7938e035038
- SHA512 c28654f6bc9f15ad55e0b30493cd7a2f31a3a88d254e8a87db4bd94c38fb0e73a829bb71c323a33b5cdfad8482f3b9ea9d16df3d28311c6748f16fd4ffe7719d
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+Wr:J/sCv7rTiw24DtD+qBAas+Wr
- TLSH T1F2254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 961KB
- SHA256 daac44e70c909fdeef8d5a62470a988a77424f8abecd1cfb785925aeb64729ae
- MD5 6e0bc2a9d34bd1e6ec1321f97790630d
- SHA1 50f969334b05494ee76fe2251583f30cfe212e88
- SHA512 f6130edbe740c0e1be6f1a949a40d74d01421f8ea619a150c4531da579cc0be560959ad7722402f6d8f5eeb75096c33d1c8aceb2b39338edcde640b7252587bb
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+8n:J/sCv7rTiw24DtD+qBAas+8n
- TLSH T19B254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 961KB
- SHA256 7b0f3757c39d2df9c84195fd2ba4ade392cdc109bb653a5b0b4ddf761882a28d
- MD5 fa1672c2e84c42ce5009cf25f2211a5e
- SHA1 f9191ca8bfd4d120b98164bfca97d3efaa612cf0
- SHA512 6024cca58905e6368bb1bb9e25a4e7870c8531e59425a55b03e5dcb6b5939d2ce8aca7ad76139dffec4a68fa87806464863d17dfea48ccee3d19eb60ad83db59
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+6x:J/sCv7rTiw24DtD+qBAas+6x
- TLSH T16E254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 961KB
- SHA256 3d880b1abb51b31eac71ab7a89bce7ada6f9b82f7a6541146928c6fb7a2e37a2
- MD5 ec3718f3f56427efd7046e10edf77801
- SHA1 0dbd24d5a6f18beeda88aa4862c89d6178bb1de1
- SHA512 dda163cbb15c9e123ec32e908966c3651ef25e0438b5bbaa716d7bd367721424ebe9af8f6997e31511eb488394e18881442ec9d186d284ce0c9ba18e6dbbf9f2
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+8A:J/sCv7rTiw24DtD+qBAas+8A
- TLSH T141254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 961KB
- SHA256 4ba54f587aa89c2bcbabb00e2550db6833b770a024a396e92b61812fc0eab8e3
- MD5 e3a5ca7e17ed52ebd4768e57844b7277
- SHA1 0f7a72b9738fdbe8a5cedb6f300b60e5404b2296
- SHA512 92b7dd85c5f29220e61468660b6437f961565342c4852b7c13b85b347879a3c2b016d9c7874d0883e2d7eb86851b39e36be1814f50eb020d86546b25a75c4d24
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+l9Q:J/sCv7rTiw24DtD+qBAas+l9Q
- TLSH T12F254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 961KB
- SHA256 34ba740029ac1fcb0aeee66ffd5306d477d1a21d71e3f62811ca7f7f11b33f41
- MD5 18c624f3e11e75cedaa6021bd58ecbbd
- SHA1 1e57576b33fcf22d93631222f16134d96d08d66e
- SHA512 bb1da06260e1e502e1c541045b9153560dfd984dd5d292a0d597042a60dcbe8475e0c24411b4b465fb320428265385c62f1c233b5e40f7a84c0b766b3189ae0e
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+Q4:J/sCv7rTiw24DtD+qBAas+Q4
- TLSH T1D5254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 961KB
- SHA256 4debbc4a968c9c5945cdc17163915b4434d51fde03f777a56911f71c067bbc62
- MD5 f01a5d36ecf08a5210a0af7183681ac9
- SHA1 012ee90e5cc528eb06f9d51ed76b4eb7e7bf96a4
- SHA512 24b60b7de9038ca339d21975a48c9aad3e5636226aa8578f3973db981bf244464dabfedd42e7b7993d4bd3e16298cba36e3228deff6f93aa7729397c41337e96
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+Tu:J/sCv7rTiw24DtD+qBAas+Tu
- TLSH T1DC254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 961KB
- SHA256 e72135bcb5bd363d0904904db5684c22efc5bca60e683f62f7e9ee8167a51ec9
- MD5 ead62d47ce6954780e205a34cd89885e
- SHA1 ad2324c64345df26c891da8787a29d2348af2393
- SHA512 ffa4f5b77afbafd6eda47256b8b3eeac1fb7da76d930221c3cf0a1fed1217bcfa4917d5db14e09aafe618d3dc1002292b71615e08e3a7f09cda1ffcdf8c6ffdd
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+Oj:J/sCv7rTiw24DtD+qBAas+Oj
- TLSH T112254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 961KB
- SHA256 2e9f53f28d4edcf8fff947d904411b148aa56c1c19eac9482e631d0a5498bd68
- MD5 1b34148f253d8f8f3aa2aa508e559467
- SHA1 fa3200377245b70ddf60dca565ecaa38463a85b8
- SHA512 d52776755e92fe1a00a8997e6a87749125ad161e6d32c94f1bb3c00684064b1c3e77f1c46e7f87bd7075f444e5cb951b3812673fb46a784c3f243e0d8d7d383f
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+7g:J/sCv7rTiw24DtD+qBAas+7g
- TLSH T16A254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 961KB
- SHA256 396871e5596aa5a221d43d4e738a9cc2a45db8d5e0145bf8a39ced51b78de50c
- MD5 2b270a5861e40797c4b5a8e0191edb98
- SHA1 187a612f72fadc66e3a5a8e5ae8b6762196492df
- SHA512 14651eba10535f6ca82a9a5c2bdc0b3f7403e5ab75d5aa22c9cb2df5b3b12f3eb0b7a0fa05369144e77f83d42a818585484ad939f79c891a1d0819997b18d036
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+mI:J/sCv7rTiw24DtD+qBAas+mI
- TLSH T18B254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 961KB
- SHA256 3358256097f1d479f14062893421ecde8d5d7332f799f10a7263ffe327b7faaf
- MD5 7f5bb5cf8bda5084466ffbbabc4510b4
- SHA1 969876df108183791cf5f8e07579ac4148a08eca
- SHA512 e328e0af524499a33f95d3dc90416e4592ef67be301de474e2c09013b19217eabfd1d7a8590800b12fcd2d70900de3d5c75be9c61a74f53f6d6a49ff9b9fc6fa
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+Uo:J/sCv7rTiw24DtD+qBAas+Uo
- TLSH T144254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 961KB
- SHA256 76d41b13209dc121be8949897587c235b79285a982258d02c072653a20c5ec9d
- MD5 9108dd6b7f4a1232f2a4eddca509e923
- SHA1 40ccf62c7bffef10a1604ae99811dcd9f3e0eb3d
- SHA512 ac73281dd5f185d20e1796f2e0d24abb86e55e8df34da7968acd9194e3116bf94ca230e5baa92364dacbc58086e41c6956d0e9a8af785ca2b2b8d929e3ef1fcf
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+3+:J/sCv7rTiw24DtD+qBAas+3+
- TLSH T1CD254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 961KB
- SHA256 aec43c36ead036ea86755bc81549b1098ff27c757346ba0edef110b55bdd7719
- MD5 eebf7a39e2552469b124e5cbf6d650af
- SHA1 b708acc6bf4ae5c9ceec3c738cc5fa537b6a5ee3
- SHA512 445fb98b2fb3bc84a8f698846a25db086ab07e0e750d5deb6b371b40b6cea35d3c58a9167ba60a0a1fc5b165a2f6c71db56574f44183ff356c3bb985099227c5
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+NQ:J/sCv7rTiw24DtD+qBAas+NQ
- TLSH T192254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 961KB
- SHA256 deb3a40525e7057d61b444df886599197c0f6c02cb4dce82bad3b00c0997689c
- MD5 e11b785f98f892376990d576df411cd0
- SHA1 a3939ae16dad2c19a8064031f248e4d9b01bedea
- SHA512 09271188c3ec105359b2eb3705a8894b5aaa71dc06fa46c36cfa75e444aeeb9f5fdb2bafc0611777e9d91f0b40098ca63cde20bd71d55b0c237825fa0647a3c5
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+CX:J/sCv7rTiw24DtD+qBAas+CX
- TLSH T1FC254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 961KB
- SHA256 c96cc0cdf442a6fb2bb7aa5709636a3327429ce9f279b3749f64898e0e4fc272
- MD5 2f7541dcfb7569074a8b7e151f862945
- SHA1 9cd9c76b60d1b7cfb33fffb033076d5e0d71f0ec
- SHA512 e582036c58c301101191e0565fbb30b2ddac3baa035fc547589a3b55326f23f562b75c73a0cc1a495bfec4453294333c3f843dda17c11d713b4714199bd00fbf
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+kL:J/sCv7rTiw24DtD+qBAas+kL
- TLSH T14E254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 961KB
- SHA256 29b4bbf759e5911c8884bae39608ffe9b4aa191eec0f4eb639a1af5617e79968
- MD5 123be4f16601c2f569fb44ef0930dd28
- SHA1 9c791e8b4873d63ccb0c4454e6e6deab61ff1cf0
- SHA512 dc8bebc590d17aba0d916f93ace0b72852af83921e68dc3cd11c4306c61599e1f66433db5bf1d9f4011be08e086bb46a56f5678c853b2d4378a046f3fa0b52f9
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+AFC:J/sCv7rTiw24DtD+qBAas+AM
- TLSH T132254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 961KB
- SHA256 9f25d2764db3fce4a902b13add3eeb98d87fdf2ce384c12fffa53405ccb7a4e7
- MD5 dc1108074407d82a9d004115a8b7fc31
- SHA1 f4141af5750846be921c37f5fb5f38cf212a7cd0
- SHA512 9b0ce6d027da84897512427c4c82d2ecf277d52ded3bd35a47ce5a2733a6b846737caa97af6d23ee9bde42cbe7c7172ac09cc0b02b83497ab06178b68df20614
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAas+hh:J/sCv7rTiw24DtD+qBAas+hh
- TLSH T1B1254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH