Analysis
- max time kernel
108s - max time network
112s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/07/2026, 04:38
Behavioral task
behavioral1
Sample
2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 855KB
- Sample260715-e9dh7sew61
- SHA256 372420879534f497e643cec32f6116daff4038f81db609b948b1a208cd03b3dd
- MD5 8b7253771d4e313fa2f9574c4f1f59a4
- SHA1 ebc8208459241385403b625ec3066b1f399f4d72
- SHA512 715a09b32df5f5f942bde07fecfe067038fff9dc3b294b9968e42455a0a4e185c3c255bfd7adf3386a54da55622633d8eb8b090f369acc51785c313a96da44ea
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuo6:t/sCv7rTiw2RYwZCUsocuo6
- TLSH T13415291766EC4894E5A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/3744-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b6f5-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3744-15-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1068-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9f-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-282.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-456.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb37-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198f4-572.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-908.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1010.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1084.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1152.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1221.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1343.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1398.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b6f5-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9f-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-282.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-456.dat aspack_v212_v242 behavioral2/files/0x000200000001bb37-499.dat aspack_v212_v242 behavioral2/files/0x00040000000198f4-572.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-621.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-641.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-908.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-921.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-934.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-954.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1010.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1053.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1084.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1133.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1152.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1177.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1184.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1221.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1324.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1343.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1369.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1377.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1384.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1397.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1398.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1068 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe$ 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe$ patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3744 2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1068 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8b7253771d4e313fa2f9574c4f1f59a4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3744
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1068
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 855KB
- SHA256 372420879534f497e643cec32f6116daff4038f81db609b948b1a208cd03b3dd
- MD5 8b7253771d4e313fa2f9574c4f1f59a4
- SHA1 ebc8208459241385403b625ec3066b1f399f4d72
- SHA512 715a09b32df5f5f942bde07fecfe067038fff9dc3b294b9968e42455a0a4e185c3c255bfd7adf3386a54da55622633d8eb8b090f369acc51785c313a96da44ea
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuo6:t/sCv7rTiw2RYwZCUsocuo6
- TLSH T13415291766EC4894E5A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 efda2316ea3528a39bb80f11f6eb61caf4ae6797df63d2e44405924d92b4bfaf
- MD5 ca69a46e36f0cb942905bc75d3ea3eb2
- SHA1 4448d6fdf46579d63c5c55dda7379d2e19112a93
- SHA512 6a9d12a53d946cae969eac5fb27da3440b11003d512991e351c5af6130623ce76b1d60535a5e0748e0f6f4e202bc75cb3910e213d12b91b40b0f4e256eb0e31a
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsocuoK0Le5ji0hmxNrM:x7iw2NPji0Aj
- TLSH T1D3653917B6A84661E073D174C5E6964AEA72B4461B3087CF12A8C73C2F23BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 869KB
- SHA256 189e141ec8ad5fd6eaf97b40a0ce7bdd50e35705cc8d88d8dca03d9db4e3ceab
- MD5 8d6f66421040a1090094cb1a78e476ec
- SHA1 b6c85888ac09bedbf108f6a832ffbc182f5f8548
- SHA512 366573d217869e77d8dd53ae445e9b4b793c6d217baeae0b93c74e2cf9ca2af6da3b2c188fb4169111f1e27ea2e69a4d60f890f6641d9b28cb9bddcaace1493c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoEa:t/sCv7rTiw2RYwZCUsocuoEa
- TLSH T19F15291766EC4894E5A6A13489B54606EB72F8551B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 903KB
- SHA256 c94907892424394ba62b5e0b30acd8c91c5e8cca2059b4502652c81b0620c83e
- MD5 179c32672bfa3a351e49ad3085ce6c64
- SHA1 2cdf7697e313c48cc996458bfb53c936b38c9672
- SHA512 99b7eb4b3df576c464d215137257e2c13eb2b0755cb33c922519a6adc5624c5ba58d5742b54faef629565ccb8a5233350486327bce58fdf76be1bdcc9e4e92f2
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoPb:t/sCv7rTiw2RYwZCUsocuoPb
- TLSH T16615291767EC4895E5A6613489B58606EB72F8551B30C3CF12788B2D1E73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 879KB
- SHA256 a18b125d359d08c35fde66ddb33e09ad4f92e794e2d53d74fa2e612e55c09b29
- MD5 1df9f0e356c0f082920c97cc1aca0c0b
- SHA1 0b2eece7cb444cad67e8c0126f48ced0462cca2e
- SHA512 11e3dd8d0034429583515a89e00282e6a864d1d39c2afd84be638c16cfa7309355100d7dbeb01f444e465cab8151bd560ed6cb47b6fe5e31ac51e683112bb873
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoF9:t/sCv7rTiw2RYwZCUsocuoF9
- TLSH T128152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 879KB
- SHA256 2e697f6044c2af2ed111803cffe9788da7224a98c937f328854fbdf706f65742
- MD5 537b5c1f5545460144a13b3f853c97fb
- SHA1 a8733836a0cf0dda67be75c8f5fd9f430600cf9b
- SHA512 b6c7d76f9662185a007799aff14056af4e1940dc7bd17f1464b01221954f589553d466a8b41d307bcfee511ec49aee50b748b71669665f01847ea1ccf0015418
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuohc:t/sCv7rTiw2RYwZCUsocuohc
- TLSH T1D4152A1766EC4894E5A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 879KB
- SHA256 3dad7abb477bb4016db6631ef6ddb6cc1d0ffe0cfb451d5f28ddec1f81ef799f
- MD5 33da2db1968985f0a31f1d6cb06c655b
- SHA1 b505d062ef6372a1c4ddedc78d4540dc28b52164
- SHA512 0b2aea052fa967443b10cc6697e22b9c8da21e6a9ee2bb82935ec472f27937c71352f232e8a645bd858ea762b3980517af704077383e35ab7152b09d383fb6de
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoKp:t/sCv7rTiw2RYwZCUsocuoKp
- TLSH T14B152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 879KB
- SHA256 c5ec7a60ff1e4b5c0ffb80d62fd8255faae1b9b2036e2abea598b44b64453a76
- MD5 ae25b0681a3184447da682723fe20de8
- SHA1 6363f06fc2303b84e60032ebb115bce70ba2e545
- SHA512 b947c2329c1bcab7b7cdd4159b440fa91c40d0258c65eec099d325fd1773e655058907b8bc99d2b04cc86561d9527d9c0df8986311f38e9422e745d25fc2238e
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuot0a:t/sCv7rTiw2RYwZCUsocuotN
- TLSH T103152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 879KB
- SHA256 274d7168c599abc10a93ef3012bca6b56f628034975c63d8a8e9f57f43ac7e3b
- MD5 19a658f9eace6fefd06e12cea3569a3e
- SHA1 a594de6842a3f680e78847f0a6139d3569fdcae9
- SHA512 1d97edf2e1de6ff445ad94dd167531c7f3bd20196283110241f562f1e04238eee6106afec88bdd0192957658d9366373037435cbfea828bd032acf2512c87f9d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuofF:t/sCv7rTiw2RYwZCUsocuofF
- TLSH T12A152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 879KB
- SHA256 021af0ebe132bba46a892a13fe8bbe1e5e46f1efb0d1fff153ce57d68cae1fb2
- MD5 dc4f713fdeb3d11347552833a075ce42
- SHA1 0d928059d26078c8f88d9cca7a094b432d19d961
- SHA512 8ca75a793f3b2dde0909bf30ac26dc3c6afc67dc47ece431d840f50310ea278921b208570eba66918f9ab1a6406369e5031f08098d42095048a620b4f0b566a3
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoAC:t/sCv7rTiw2RYwZCUsocuoAC
- TLSH T164152A1766EC4894E5A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 879KB
- SHA256 0263cba10f2e4d3632794b4423788cc31180b4b5725812db72e43a7d397fa9f0
- MD5 89af36618cd025f614d65f26298d0089
- SHA1 b4b1d012f702a4ad20e4c7a4ee2acdcbdc9714b8
- SHA512 f6fb8903812cbbe52f4f199a3e98391732eceb93e205c97a566c1ded35577c3f8ac9ae6e142ae6892f3eb07d866b449021b9c23f8fbe5915adacf19ae8e687c1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoTw:t/sCv7rTiw2RYwZCUsocuoTw
- TLSH T1A3152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 879KB
- SHA256 e8e64106bdce37d776173f7035ba287471f0d6fbe7fc7a1424fd4032fb0b786d
- MD5 f57e7e27e658c0fdfdec5898e44435d3
- SHA1 c0dad69ef1c848e5250f42b68622140650961575
- SHA512 cfc1ebac13e0bf7788ea1c70309908b15d6260b48ef8e1c3467d0ad066f84acac24f52ca02bcf9abe420fe092e4956c565660f37a7bdadb300bfb36d4b3bb692
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoaT:t/sCv7rTiw2RYwZCUsocuoaT
- TLSH T111152A1766EC4894E5A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 879KB
- SHA256 0da3f2365a904a70f643b73be0ecdce2dbe4633fdda5ed19ee19192038153619
- MD5 f631a803fe549f5879d0b4f88c486508
- SHA1 206ab18dd1e98abfd58eed200bb65ff736f056c6
- SHA512 603a6bb0d6114d3a89501fcef9648975ae569e72097194ca3904904cc45a47f09ba2e516d9310b11d16a0cea215776b655e13cf9a2fe4cd60a69503948c5d781
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuo6u:t/sCv7rTiw2RYwZCUsocuo6u
- TLSH T1B6152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 879KB
- SHA256 fb2c6653e54ec48ce02da6c5d0ca22211c64c4d722a72ccb8fb29abbc0a30ce4
- MD5 26d335390fbf5775f6334ca66e1f9238
- SHA1 e6be064df137d584119e23951ebe8f2c78ef10a7
- SHA512 bb6db302c6831d11c45799d701ac1cdb83e143a32a818438602d308050162f6eb011ce10c67e950de5571245778836d97874ab3387ad88e3344a631964d56134
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoEb:t/sCv7rTiw2RYwZCUsocuoEb
- TLSH T1CF152A1766EC4894E5A2A13489B54606EB72F8551B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 879KB
- SHA256 508ab474afbe9ebd8e3c1ac43aef55b2df8a7b62a3bb809970882ce9daaa9c3c
- MD5 b4d8ac9562feb36042a1a59bc3bd2e40
- SHA1 cc301594f8244bec8a3dc1ffb01b61a23879a79a
- SHA512 9f748d76317d53d4156665fc9643db50b016b8e068e71579d6edbd57cec83640f002e666c528291cc193db09ca21f30a089483286a329fc6f83c413fad5d4e71
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoKf:t/sCv7rTiw2RYwZCUsocuoKf
- TLSH T15D152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 879KB
- SHA256 66d668b87b89220f5c496d75302d1dbf907689c6cb9036aef53b6d60f372c7c4
- MD5 e9051cc8552e9fa4917d9c53fd14ad7b
- SHA1 eeb71154c03014ad577ddc4500409c0fd900c5f2
- SHA512 c4bcc5fcce2718fd0b5fc7d73c6ec5eb4bdd420bb5b508c4b5a5f1c0eea1a5752fb7c505f7e533c80f8efb84608716936664ea335ead9ce3f73b68339215f61c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoXK:t/sCv7rTiw2RYwZCUsocuoXK
- TLSH T1BD152A1766EC0894E5A6A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 879KB
- SHA256 9dddba0876a5a67d94497f9d9aac3b42286b64f9df07920285671eb07a2ea000
- MD5 1934f16c25c8161553fe938f241af7a7
- SHA1 b12b8e6999c6adfdd2222cb43aacb45912fe907e
- SHA512 78ab34d66f8ea8e3fa80c928b85d742f8e57e83bf1aec7024408205f2cfb0f0388ecf666352e1fb3954679f75c0f5572bc257f13fe35805cf380fdbee9cd367b
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuogk:t/sCv7rTiw2RYwZCUsocuogk
- TLSH T199152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 879KB
- SHA256 def81840e0e7bf6b7c128dc62cdbc4d80edc014f02239a17f220c26b481bc51e
- MD5 52d210332fd144b17466c3f19d826d5b
- SHA1 6216690674e6714b9757c93fc85a6441d374dc78
- SHA512 fbc117c64476f2cd647a493c3e9b164e5e37c3faaa5981da3a0cdd69961b94b50a33c86e5a7a4e47d24c5586e5c5a4553a85c547c150cf519ca5e668dcd94aa1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoR0:t/sCv7rTiw2RYwZCUsocuoR0
- TLSH T1E2152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 879KB
- SHA256 3861a9f2aa82e4cbf924723715c72e44d792b08589296714a93455820e1cb226
- MD5 80ca817eb4deae6ef17a6c9adf0984db
- SHA1 0a12b7a84dd0b44f783acbaf4ead9e2762cc1acd
- SHA512 7b57cd627fe8e50e299de31c7fbf424cc1ecdd77b3f883c445322ddbc05af3a635d1b8689f62c41d95c26c196a5686c4786bf895304bf23ee5e8125c7b2377dd
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoE70:t/sCv7rTiw2RYwZCUsocuoEg
- TLSH T16C152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 879KB
- SHA256 170e2b62f7ec3e59793d2569690d04beb1691eefe1688b9800dace82ad2f1041
- MD5 702b2b1effd31de364ff4417eb828d56
- SHA1 01d8dd9ec2d9e11eebf7921eb359dce5efda5589
- SHA512 313889b56cf5333f14dfcc5722a2a0b6bcad4d44441e1dc3f803bfa5c311b3979df32122fa88fb4741aa01f57357be7b04eee3f567c09d487286d1866ca75e9e
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuohr:t/sCv7rTiw2RYwZCUsocuohr
- TLSH T13D152A1766EC4894E562A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 879KB
- SHA256 874bb0c81b3397e670e711192a1fa7d170aaf2553df7ee93f2d70bff7eef9f1c
- MD5 59a98f9106e3d30f3ebad517a8724321
- SHA1 30b181c95504e9b353adb97f677527519612906b
- SHA512 7fde23555e84f8b29aaa0929bf7156e5e6f037c87d799f12ee90ea8aa3bfd43ab8ef00eb334151c9d159a3dc1c7f5052ce5c131f5ada2e72c012f16187715e49
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuojn:t/sCv7rTiw2RYwZCUsocuojn
- TLSH T16B152A1766EC4894E5A6A13489B54606EB72F8551B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 879KB
- SHA256 38d32259bd2a562a9f8504d465a2642b46d2298cc36099d60aa995e9dc9da2a6
- MD5 dad65f6db73d87381a25672119b6299b
- SHA1 e152bf254865350a55889c11a11bfb8d9e047cb6
- SHA512 01f4b3d9adeaf9ba33522624be7eba64a0b2af3b725759fe596c5410a7bb8991faf90a7385a1ec5282f5b4c7052c84b80432d6d56ab2dba9ec19f4ef1f87eb6e
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuo/x:t/sCv7rTiw2RYwZCUsocuo/x
- TLSH T1FE152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 879KB
- SHA256 ae275afbe689c106dd686738a3467233dda1ea14adaca296aa6e1ce6f81fe8a1
- MD5 afac5b30250964a8b4aa0fd13f3aeac3
- SHA1 57908ed65a6b3dc60529b6e7abb8af3845c7b0af
- SHA512 98a0cde96c051c0a09768c6c3ef216075e5e592067cc8dd8a3b2d5d4d776fc2010e5d24790872bc2549e66bd1870fb2964d9067f094000adcdadccf08aa9d59b
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuolA:t/sCv7rTiw2RYwZCUsocuolA
- TLSH T1FE152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 879KB
- SHA256 08a5aa85a6ef424eb6fe5cd74a7d89016f9684d6288a24646ea092d573938aaa
- MD5 09261dbdec5b13781e2a55399d331581
- SHA1 c6d21ffb05b7ed60866ecde30f8319bf24d2b1d1
- SHA512 edb74f602eac76bfc44a1673d2e4248b1fba74f4ee4ad6a48d7637d255a2132d0decad105ef908b496b52d152c0de5b198f2bb48abdabce97cc159e30949b3fc
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoe9Q:t/sCv7rTiw2RYwZCUsocuoe9Q
- TLSH T1F7152A1766EC4894E562A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 879KB
- SHA256 8e8946cdd222f9ca3196149037ad39678022770b9c5c04131fef6e0bb46de261
- MD5 04ee4d69642b28b2d257f33f296c3f8f
- SHA1 839556a73fa3e0b5789fd8b6337cedcf58c71d15
- SHA512 315dd2ed54d1c2de8f71a7129b48c458299ff039b67c1c125d3057e6af98ab45aea427b71a1cda14c2d57dffaa4ac17a9c84fda97dc891d954678b64f8bbb370
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoL4:t/sCv7rTiw2RYwZCUsocuoL4
- TLSH T180152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 879KB
- SHA256 60f18851cbc414f375bf50ef7a19b90411e743a008e356a350730357c3c44ca3
- MD5 0bcd1e2f768bbb1d229c870ec06cc98d
- SHA1 eb09ae6f090db139655f5ba997fc96a6abcf1aad
- SHA512 86a75224c45175f1b79115396b4a15b8a6a8bdaf9305a7a11ea8d525f79b74074a0daab0b377ba0bbe1871f4a1f75a775bab1c1dbb51a0d2c813e82de2d62d32
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoCu:t/sCv7rTiw2RYwZCUsocuoCu
- TLSH T16A152A1766EC4894E5A2A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 879KB
- SHA256 69470903d2b57901156ffd4f08c0feeeb84f747fcf468bf5cbe2dde21b5a2689
- MD5 4355c84ee4155d021363d600485d1a7f
- SHA1 af010b6e57159a0079ce9d6ea08b8fde372f4303
- SHA512 1e786747499f5dbb89c3056b9115083d46ba8f790359304ba010478f34f573f25dfe6a3295d12f943789e3582539b198017279228a684fa59026c0af46ea1084
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoTj:t/sCv7rTiw2RYwZCUsocuoTj
- TLSH T1B4152A1766EC4894E566A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 879KB
- SHA256 3f414bd783344b780807abb54508c011b2ad40ad570ef89b966fb699220559ab
- MD5 7ea99700b0c6daf98203f8a18cdc7500
- SHA1 3f344f880ec2b2facc76f6e8b34122eba858caa2
- SHA512 921a4f226b346835debf1b1b11c176e02e16bece9ab694319d36639cd7724da359b2fd0e62ec5eab09e9292e03df564be788b103f8e1b0550096b410d0fe5a30
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoeg:t/sCv7rTiw2RYwZCUsocuoeg
- TLSH T136152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 879KB
- SHA256 d87cb8de8bb045f890706ad336f114f9b4887e458be46ba126d6a39060b918b9
- MD5 3985f90ed2287754cc62e1707948922f
- SHA1 af694d172f466320b0be67f5413bb63aef122173
- SHA512 f7ccbddf0de0d874298228935c77087750b0d0cfc34a064ed963c68adc2d9a68b44cde0241f72099519f589e26a5e0f52cef9d182c80526f0bde6ea805e4bc91
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoRI:t/sCv7rTiw2RYwZCUsocuoRI
- TLSH T101152A1766EC4894E5A2A13489B54606EB72F8551B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 879KB
- SHA256 c2d9e4dba0309f13c11cd62621630a2fd853e911d1e899fced3b51d8f2900aeb
- MD5 9e0be472c3449c1781f709836ca871cd
- SHA1 6059ed995c66c121782fe6aaf8556b914d9545f0
- SHA512 2be02bb28b5fdea81f0bcdbd55581906207b2ad4ad1d738f445562b0919be83a3081951f149945d78bf76e2144c9807524432a553264c2c80b5a88176a18e7e0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoTo:t/sCv7rTiw2RYwZCUsocuoTo
- TLSH T1A2152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 879KB
- SHA256 099e9a051f6232fab887e6a910b243d66d48fcdb84d915f3c316c9de7177b985
- MD5 d6bfc9b0f72927db40c8aad76dbd1b49
- SHA1 87a7d8b4bbf6ecc9ee1f6debf48f45213e137e3a
- SHA512 0d489a65bf104921082b64174241570dd56cc89ff75798609092ad89545f062857cd696c7e6e54bcbbb2fbdf2fa1ad1ae1f910cea2ec455684a8edda846c193c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoY+:t/sCv7rTiw2RYwZCUsocuoY+
- TLSH T1BC152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 879KB
- SHA256 3814ff4771308c3e46ab4c35d1475b23a46df44ea10921dc9d31ddab3cb6e0e9
- MD5 ac0b25b28b50e9c515be0f8a92e6e015
- SHA1 7454bc04f7f453ed7c9e242cd3ec51e352b10858
- SHA512 b432e748c0e174acc27c0f09b28b743e540c8fefae3061eb62a7e194698849319e836306d0921a1d6f35b9e654762d8627fa2c77a05e89f8a7da83da68b7b305
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuowQ:t/sCv7rTiw2RYwZCUsocuowQ
- TLSH T1B5152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 879KB
- SHA256 77cfcfc47aac428c8169fd3350f81478f0473df6f04903c0ae76494c4943c09c
- MD5 78bfaa45e2c71296da55ec2b8c53d38c
- SHA1 d4ea9cf8ba907c85b25cb7a0e187f4bd79febabd
- SHA512 7e9ed42a7f7b45ec0ba0c6cbed0666e8ddc5ac4fda36d3a1827504530fb3251714b9d001683fac461d431e2bac6081c2a747ec051b625fb59a61edd1aea96a69
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoZX:t/sCv7rTiw2RYwZCUsocuoZX
- TLSH T125152A1766EC4894E5A6A13489B54606EB72F8551B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 879KB
- SHA256 b676595470a83c6b237a4ff82188271c4e54b8c5d60b9d480f7fcce158313bcb
- MD5 f2d1e68e8572d8b9e5e6a4b1e6b9a5a8
- SHA1 a7b5430cd8217827c0fa74d7bfe9d8317e0e1f0b
- SHA512 c366c0b3337d03560b33ba168585df8ba5531def220858e31e826e7f060abe22dae3ef44b2650ee1cfc740637d68ecea0a8363137a9c27ebf3f3542c03635d68
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuozL:t/sCv7rTiw2RYwZCUsocuozL
- TLSH T146152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 879KB
- SHA256 34c0d9b1240a7dc29395ec347301b4ee1430215398ef670232eed3fd41dbb094
- MD5 ac45827236344acfa3fb8da806a40736
- SHA1 a5209e5086686c998c15158d8ba23d6f35c315a7
- SHA512 8c34ea58cdfe559cddeb8ce3c0e6032fc6db6a9c870f9ce7cdd73b252d765823983b4d9ab4adcb55d13f31f00b7fb87013bcdc9c0433e837365497ad6a2740a7
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoZFC:t/sCv7rTiw2RYwZCUsocuoZM
- TLSH T16F152A1766EC4894E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 879KB
- SHA256 ee59f7285899b116bc7fd9a2c33b77650be98f3845553a459231f8d87e40b1fb
- MD5 e674510c24387fbadb5b69376a63541d
- SHA1 6d3cba3f86f428fa268ebb2e8da4fdf5217f584a
- SHA512 f3b547ef1609876974fb7ba8628606df56349175b05b120590580dea616b70d682aa589749f20fe012cef43de77bd7a8e3785d9bcd241fcf645fc54e8a95b6d9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljocuoih:t/sCv7rTiw2RYwZCUsocuoih
- TLSH T139152A1766EC4894E566A13489B54606EB72F8561B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH