Analysis
- max time kernel
108s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/07/2026, 17:56
Behavioral task
behavioral1
Sample
2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 797KB
- Sample260709-whze2afy21
- SHA256 ceff84942de5155e750d555fb3720c15999a26cb02788ae9660ab0606c284de9
- MD5 23395e97708dcb2cece7c8b6a56c68dc
- SHA1 b135cc503ef0abc28d0106bb8e7c05b6f1f2466c
- SHA512 8b45704a09c7b8ced947002ad964d9676e6059730ecfd381a855a548622cdac92e0dad3fe40505ea99e44b35f4c28cfaab36e793cbf96f98582c83299b5c1ce6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoif:A3k03kHRJe
- TLSH T140059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 35 IoCs
resource yara_rule behavioral2/memory/5516-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c597-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d7-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5516-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b302-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1948-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9b-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-474.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-560.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-603.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-719.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-738.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-764.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-802.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-845.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-870.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-985.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1040.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1098.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019e17-1323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019e16-1367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac65-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b683-1907.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c597-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d7-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b302-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9b-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-323.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-474.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-560.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-603.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-628.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-719.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-738.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-764.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-802.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-845.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-870.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-877.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-896.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-903.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-922.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-935.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-954.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-985.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1040.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1054.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1098.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-1141.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1160.dat aspack_v212_v242 behavioral2/files/0x0003000000019e17-1323.dat aspack_v212_v242 behavioral2/files/0x0004000000019e16-1367.dat aspack_v212_v242 behavioral2/files/0x000300000001ac65-1383.dat aspack_v212_v242 behavioral2/files/0x000200000001b683-1907.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1948 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5516 2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1948 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_23395e97708dcb2cece7c8b6a56c68dc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5516
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1948
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 797KB
- SHA256 ceff84942de5155e750d555fb3720c15999a26cb02788ae9660ab0606c284de9
- MD5 23395e97708dcb2cece7c8b6a56c68dc
- SHA1 b135cc503ef0abc28d0106bb8e7c05b6f1f2466c
- SHA512 8b45704a09c7b8ced947002ad964d9676e6059730ecfd381a855a548622cdac92e0dad3fe40505ea99e44b35f4c28cfaab36e793cbf96f98582c83299b5c1ce6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoif:A3k03kHRJe
- TLSH T140059D03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 896KB
- SHA256 e3e601a9701f4f5f11fb2582ef1ceb6197e38eb325a5d6bb31ad908c04e9476d
- MD5 6e0745a1acb2dc6effc5397e70cf595d
- SHA1 2335ee13d2afb4d4654b464f59b9fdd4221eda33
- SHA512 185d22cedf56ce14361cb51d8f519c8a2fd3150cba4297fe2c3f78686e4c3249ee51733934e78ad5bc350eaafed2b8583f8bb522ccc2736c7df863756707ff11
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiRbBPzBAU:A3k03kHRJSBPVAU
- TLSH T1BC15AD03E79400F8D15AC1349AE69A32EB75BC521720A7DF2358D6152F32BD0AF3E7A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.3MB
- SHA256 cdf0dbf65cbb0b8823656843b1e9e4350583fec7e67ffa03c815efd67c1f0a80
- MD5 456fcce1bacc46486cd3a08ab6da7537
- SHA1 f98b75f5db2d04a0fa1dd7dcfafb769f6fc7858c
- SHA512 e4dd83afc97aa360f60f85fdceec96bcff04db98baf6d598ade73e9d0dc1d26bd0e53b7bca579bf489e67ba43aaed4e3869ee000bf11ce2ad5c47149f816c1be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiL0Le5ji0hmxNrM:A3k03kHRJOPji0Aj
- TLSH T1F1558D17F6A402B5D067C0B9C6D6A65AFA71384217309ACF1394C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 812KB
- SHA256 6c3992ea2f5063311b6c3e09e1e2ea72b3a8c8896b3c0c2839f7a9ee0f041472
- MD5 9500eb512713811d6541d85cdb6b6b26
- SHA1 6326babac26033f486f4919dfe250bd90392d60b
- SHA512 a20334debc65d9595403922b4b022a1de028f6353cbb52f15d9f614fb18b446b48bcfc84b78bec1062645f41c068a4938c1dab9261b0feb7dac9f12eb7aac7ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiNa:A3k03kHRJ
- TLSH T167059E03E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 845KB
- SHA256 81f091c405a447ce288bd073283e0a883e45f5488a0e2a06922d76c5eb12e41c
- MD5 78a1d51adb95447f946ee713cdb7ff47
- SHA1 9a81d52bd6f2334ca80a1c42a061409ead4999a5
- SHA512 8eae6206b2c71018f11d5214cb404f2a498308b229e2b0c6481fccb476fae4c3707d79297385d1f19b7ea4dec538292fbcd772dd896dbcda012e7d0ae38f1257
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiub:A3k03kHRJDb
- TLSH T1A005AD03E79400E9D10AC1749AA69A23FB75BC521730A7DF2358D6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 821KB
- SHA256 0fb22a822c5703a9ac74f51b349e1d720427b3bf204f8d844ea5af0c74c1e694
- MD5 e4bb4b64d8bc994acd486acb3e0926fd
- SHA1 3a45aa520ae9c2dbcb9f426963ce68fb24c52f88
- SHA512 79f47fef2e34d0594ca30e5a05b177f33d8f6572c039589fedb497c0402de2d432ef78015f04648a7b769bf0b6fa2b2e59852aa7e5980536ec26d85beffde0ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoilu:A3k03kHRJX
- TLSH T10E059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 821KB
- SHA256 4c93d7dff8f67f8d540f2bb08a67bc5a5382f8fbfa0fa5ffd372f36d833718ac
- MD5 d610f7022084ea3757a152e967955c23
- SHA1 1fa16fb4bd6bf255251265045308357c3396654b
- SHA512 2caabdca0e9068c25400b11e4793eaa24f325f99115143e89088fdb28a08d1b3f68d24e55a6afac8453c396f61fca6142164e5308d9bbea62ddd0315d7b68233
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoitb:A3k03kHRJO
- TLSH T10F059D13E79500E8D10AC1749AAA9A23FB75BC561770A3DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 821KB
- SHA256 e38a8e4d9479a3973da38605e729c34f651c7a3ea6beff5172182f63cbc6295c
- MD5 79d482404c7c8a20f6f69c920f566d2b
- SHA1 ad39a50432919ef53bf0f56959ac9cec03fe9885
- SHA512 4ee76d3a3009b812cd7f6563dbbfb81315cb8fd9c2f1d257a73dce7e375a018ec3d97670ff8899a14904c9bce913cb0b5bcdd1f580e808b67de9ef27fa2b5780
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoidf:A3k03kHRJu
- TLSH T1E5059D13E79500E8D10AC1749AAA9A23FB75BC561770A3DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 821KB
- SHA256 1b51c0b300c3724e2991614b359d318aff376aef8e256a4da362916d8c177780
- MD5 03d497c6e7cd63e6ddfc843107bffb1e
- SHA1 4ad42a5560c2a6496226ec6cfdad9bae51de302e
- SHA512 d0c06e8e78b80af0a1f84ef12d31aaaf69c6cfd8fc06dddedf4536db5d83482967dddef93f5b6efcece7291d7ef5f3a5e79366f2c3ebcf7d5565dab03c3d1f0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiGK:A3k03kHRJO
- TLSH T118059D03E79500E8D10AC1749AEA9A23FB75BC561760A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 821KB
- SHA256 1026e16a228b757c9d2cbf38daf6ffbe2f831ae261fdd00bf693ab0742ff3a5e
- MD5 8cb7173a237375439b27e522fd96a141
- SHA1 9e2e1222d6fe451d61ef4ec8cd7d3f5fe6d8c9e4
- SHA512 d47c7323e7d21e23dfc98dfd23dadbb55aee3e22454c20e207cc1fcd3cfdd758b5c02fa960b63fa38de8fac429294df93a9ecc3fe0e42f089257cd49cf06c494
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoizk:A3k03kHRJz
- TLSH T11F059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 821KB
- SHA256 f0ac894700970d319b614f1725178c6cf563198cc07af715c3a1f2a529fc4426
- MD5 c075f7faa444990bcb4d598c0286da1d
- SHA1 33aa962fa054db4813f3aaf0c08c1923f7bdd46e
- SHA512 95be8b7dc00f48b5674ce5e076af9cf4270e996303f6dd247b8a8ca29dafe4b91e2cb75386614f13ce35da06cc40a304932d395a27e8cdaf875cc37d4e038b9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiE0:A3k03kHRJS
- TLSH T1DC05AD13E79500E8D10AC1749AAA9A23FB75BC561770A3DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 821KB
- SHA256 a910b1a5a1e32520ba5ae9a6d573b4244d2564d815b2d6b094a808c27aa8fbd6
- MD5 88ba4a27ad558264fd3a2ea9406e8e5d
- SHA1 1ffc7b96a5acd80321477c711a0a71b298a7e836
- SHA512 1262154b04031694efc37c1bc3e1c94c544f26f87bbe479993ad43f666cafec94e846423bb3387a2ce35dbeccd09434d3dbf1f25537276e952ffebf7ccad33ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoi/g:A3k03kHRJr
- TLSH T157059D13E79500E8D10AC1749AAA9A23FB75BC561770A3DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 821KB
- SHA256 9a1ef6b0f830bff8e59d72c65c7d6a19b532a00c82b27f18226f0e8701d39dbd
- MD5 4576aae507928a79987a15091751f6ce
- SHA1 3b50702aa8349f32dbf75829d6a243b709d0672d
- SHA512 d5028cd221b860e3b0033b71778183a814c57a6f998b4d5df36025644c4c2ca852259eebfc131ace6d8590b0e370a40b85c94c98937b976e487e1732769c5dfa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiSr:A3k03kHRJd
- TLSH T1F4059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 821KB
- SHA256 ac8a53ec464f61355601a702b47b3d955b5162591e08db8c3913def85ee696ba
- MD5 e39dfe5dd368f064aea80de9d54fea05
- SHA1 12c989ef75dd472508df125c50daf09e204c2e8e
- SHA512 539f079907eea8d0e8938ddb3a744cb933c52dbcfccff631311972626029a784200499ce673cfaa97d5225db3adfb668190fb74b3c717c2e426f16f7eafa6625
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiwn:A3k03kHRJ/
- TLSH T1A7059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 821KB
- SHA256 ae95641b824a8f1a7ce6745897318383c7506cfdddd4c77177b43516b409437d
- MD5 8a5daf4e3c835cae4d19dbd0831f6b8b
- SHA1 31ecee4644b3dd920ecdd0babe0ae4b69aade5cd
- SHA512 e6548e6351cc7a08d2547bbc898c37ca5347bdb071d89acab4641f052c2c1a2ba5c44f9e4875a38a9f97176346427bc0cfd0e235c030a0bb55d997eeb37281df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiOx:A3k03kHRJF
- TLSH T15B059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 821KB
- SHA256 57340c5462154601f8375c9f90ec378a489a375f8003a816c00bf4c0de8df221
- MD5 4ff53a76857f9f0054a456f224f6c802
- SHA1 15642b833813d6ae4aae0ce759eb3a1f1095c525
- SHA512 dcf1273aa680d3215de5a1ccd4e7599c6455a30b09e1b230de78db4506e514fe9986363bae7b0bbcb4b897ed40e93842d765130b750d3b1943330e28836d4da7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoioA:A3k03kHRJK
- TLSH T1B8059D13E79500E8D10AC1749AAA9A23FB75BC561730A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 821KB
- SHA256 85ce5e28857f0b6a576142841f388f27202c21be7417d93e10f37bafd7d62ba5
- MD5 94568b104f869204d7eba6ed6d706612
- SHA1 c2fe46df4e7971cd2b5b29d8395ab1cbf6f35caa
- SHA512 feabd986b1cf1dc3ffa3771ae29224e4b544e3173c5174cd7a18b77f0b1a9b384e2ca3c9a9af794a20b012bc6bc40c048ac35c3a9725ebcc7f5166647d86e00b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiB9Q:A3k03kHRJ3
- TLSH T133059D03E79500E8D10AC1749AEA9A23FB75BC561760A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 821KB
- SHA256 5a8f48ee8e31629cfe748ace1085be9e96ca9d91355c35537a499bde6d730e56
- MD5 9d21a61cad68e872421e3d04a2864dc2
- SHA1 7151f48fef288797bf36f7aab6655f6fa82ba700
- SHA512 c0d4f12e0fa33da2c7771cd9ec2528b97dca67df00da9ddfe980ddae7d76bac60af791d14dc0d6cab25affe3765fef1ca4f362a5dbc88285329408850afbddc8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoi04:A3k03kHRJo
- TLSH T109059D13E79500E8D10AC1749AAA9A23FB75BC561770A3DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 821KB
- SHA256 c725adf25f2e722442200a6f785adc9c995c086ae4a4249ee9f043d8c2b8006c
- MD5 a429a24d1aa7caa89ba58ad42b9c3583
- SHA1 7bd7b4136138516474fd6bedb2e6445c7e3b1c18
- SHA512 43d1ebfb2cb01ef9a50eba3976117e71bd034eae04025595bfdb3c11f242404097679d89abdf22153dfef2d624640a4874cfeabfd910368897fde8fc10aed6a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoifu:A3k03kHRJ5
- TLSH T10E059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 821KB
- SHA256 0bf3dcfcc0dfd800a5f06879fcb0669e2fda44352cb909939efc4b08e1873357
- MD5 de3c1d40eba0f2f75e60811b2411908c
- SHA1 3c8ec42b7c860a289108cb2702ab25c3b27cbfb3
- SHA512 626830c2bac2548e2945659f79b583050e1ed3552c5673e2c3a250351f9e29d7035de5f80098d6f9e6e964b2e71f729c752e16fbbba16a2fd8c955d693d7f8c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoi6j:A3k03kHRJj
- TLSH T132059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 821KB
- SHA256 6a9bbc9a4bf0d24729d535044ea50b47f4ab5e695622630082da34ddf1293074
- MD5 6129236d179fd51d808a801f4b6a129a
- SHA1 071adba8b9f14113eb43aced6bed204218f0d0ea
- SHA512 05c1719ecdfada36bbc2232bd7db1ab09f43fc2c7bc1e51058e77c684b847cb2cd785ddf78762b974a678eb8792b6e996bb9c417d18a8c1d6b38b7d693eb161d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoing:A3k03kHRJL
- TLSH T178059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 821KB
- SHA256 47ebdaee29db5bd3d78f08f5d3d77653b9e20426d2ec6f51feddb19f485709c8
- MD5 3d4e421b665124056312e86f0493032a
- SHA1 228212bb455c0a4615b6adac14103d91133b16d3
- SHA512 1b89dbbe431aacb3c043baa0d4ea26bb0e5ebf67230f292441d6aa91a982e29c6ef57e1392d2a724013881b5d3fbe8b20fec0bfed2acbb1c0eac287110f6c4f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoi6I:A3k03kHRJi
- TLSH T1AF059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 821KB
- SHA256 f76d14eebe509975a2d9cdddab6859e47e744f6526fb7713ff6375784ba89563
- MD5 e94dd7898d51a854340c0bdbfee54dea
- SHA1 adf3d97cd4c4369cad336274ed114558ff0fdfe7
- SHA512 7ce7df85f91c917795bfadb1d4060faead5230f1295a1f4155a6e005c1b9e7d3235b578e9639e867e503bc88da1f0af7b64aaf66be02c2fcce1600eca1979dbd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoi4o:A3k03kHRJA
- TLSH T19C059D03E79500E8D10AC1749AAA9A23FB75BC561770A3DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 821KB
- SHA256 7d02f7db325a32a0254a2db696448f42e4ee775ed8f7f78566116a69fc1a432c
- MD5 2a8d1a3d405287056e2b0c020e5deeff
- SHA1 895913623c1bbc45781a611e0c14bc1ecfe6db76
- SHA512 14d41189dc62dbc56ee912f4e59c7dc7bcd9628484076f81d8903ac1e1ad3872372ca0fbf2c9b5a8f0f4e96e476983e7ab5a8a52051d25c7bf93ac9c143e4b3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiL+:A3k03kHRJt
- TLSH T14B059D13E79500E8D10AC1749AAA9A23FB75BC561770A3DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 821KB
- SHA256 4cd699f60c8a6fa6d10c7dd7da0bc23f4cd53664f6646fa7205ee446dd651c02
- MD5 b834936cf4e2fc1d3189a662a46bed33
- SHA1 43042ccab1bbc21bc0c1da853d43c58633310a09
- SHA512 e8e80ce40033c01ba2f9fcb3434bb963850198a788c165d44ec4ed99a338a6f5cb96fe46a34397c1b65966e02dab1cef9108b76fd2fd23db5c225c9a9853178a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiBQ:A3k03kHRJl
- TLSH T17F059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 821KB
- SHA256 3bd6bff625dd58ea3e845e7fd5edf45bcd4e34ab66c959a54a785b50fd06ee94
- MD5 ff3a9a2ab875583706b30f4671962f33
- SHA1 afd3f62a6ae85cd8dcd27f92e4e4acdb0b72a0a2
- SHA512 cd6bfcb675cfc8e0f4e0e406d3aa2ba1bbc3f8dd2670b09c0a19eeef07ef0bf834e4c703ce6011cdd06c2219d45edd046dcdd8cef41ac068af0d6196186a80b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiGX:A3k03kHRJx
- TLSH T138059D03E79500E8D10AC1749AEA9A23FB75BC561760A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 821KB
- SHA256 1e12a1c58ff3488d9df2815a47758f7e198d81a9e1a05e59df127398d78ca2be
- MD5 01fde37d91b54aca665652d389ef6a80
- SHA1 9113ae54798fc3a522b240b53f7fd382dfdc5dce
- SHA512 e44c8a7413d226cfcb334d92776dac505a0d2da1f3117701d9ac50f31200ca0a0d788c7a8d69f36356c242facffe01418374a552326bfbf0a13f5319a74e7d6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiAL:A3k03kHRJ7
- TLSH T10E059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 821KB
- SHA256 373dbe8c6c18313e8f4e0b12ce276a09feee20fa2e7ffe77b217684940940d4f
- MD5 cb8ba20e5b57a1286cff6202a48f4cb2
- SHA1 01c209a263d800d627e5203cfa5f3b9bcdd2d11b
- SHA512 6e26c04a597c11788d4ef919d5b9609a42c27639c8a38642e46dfccb5b7f23f831da4faa1708285d83fed791933234d97a1ffbe18fd0f7b136c69259f3cdd0c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoisM:A3k03kHRJW
- TLSH T16E059D13E79500E8D10AC1749AAA9A23FB75BC561770A3DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 821KB
- SHA256 1ba4f98151d6fa683e075f4db8186d8f5f302ddbe4b759f8e4c102cb0607e6d0
- MD5 c1ea3dea05c1ea8e0136fdac56873140
- SHA1 f96fb0d84f20003b3cdf0400665192450a8d6f69
- SHA512 9397fe7ad54a7dad68b7fd4f8fb5ec443a4f9c762cfb7a481434d00972476dbd6b540dfc096d92d8dd70290b20035c88e67afd95a0f4f4beab42ac7dfb705240
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoi1h:A3k03kHRJo
- TLSH T14B059D03E79500E8D10AC1749AAA9A23FB75BC561770A7DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 852KB
- SHA256 0aaa56083480774945b69668c41e28e8cacb11f51894c24a253798722d0c740c
- MD5 d7ea1c9dc925ae9b3a2be9527a574852
- SHA1 80dc76dc49047051def4656e26accdb1d400d625
- SHA512 472980f833deb109a0893b95022d063c460feb0441a3b9f979652c60e444d1e8ed1b061e7f70a2e8c2d9f2b905f9ddacfa11a7fd2f5a6e5047b1e6776eed1871
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiV2+:A3k03kHRJB+
- TLSH T16005AE03E79400E9D10AC1749A9A9A33FB75BC561720A3DF6368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 858KB
- SHA256 5968d90de09f2ef8c6322b62cb79ba099f2e8b56b75ec98146b815e25fc49dab
- MD5 a3b158603fe30d7b3f6a5eb2508b8cad
- SHA1 fd84c5be1116a1e8af526bc0e3ccdbd6d06a8adc
- SHA512 8ae13370022fc6ac09e613b1f8c712c5e0256d2cc49839d0ae25164cb5699ae9786e41b311ab894959cbc6b980226970477ff0535c188ca42fc3c94f4930cb5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoi4:A3k03kHRJT
- TLSH T1B0156B23E68404E4D10A9134569A9A22EB35FC0A176093DF277CDF152F66BF07B3D7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 876KB
- SHA256 aa294db196e568cd19600557cf16bfca8bde9891eb863644fa544f40c2b6ca69
- MD5 6a73bca909bd196f7dc2d445ec7c2f57
- SHA1 3f3b33becd72255284d568ddd35154090bc261b4
- SHA512 26d2469a55839bb2c731c2adb7f15cd03ea7693fea956192819211bdf7bc7c6ffd92d2a164e547006d38416614405ee7c49a8025eec1f55f918cdee56a898707
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba8KasXoiHF:A3k03kHRJ2
- TLSH T150159E03E7D500E5D64A8134DE9A8A22FA35BD91072096EF1368F7252F72BD0BF3A754
- MD5 SHA1 SHA512 SSDEEP TLSH