Analysis
- max time kernel
103s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 03:58
Behavioral task
behavioral1
Sample
2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 948KB
- Sample260718-ejkjtsay5z
- SHA256 fe37efda4b2bc4bd292982595e493c6e866822adfb35ac6125011efadbd78ac4
- MD5 4dad214253e3f6e1df0cb17135917d85
- SHA1 3fc2519c2cd904976ba6bc9a8d524fe96a9a9b00
- SHA512 b991a34378afd86a01372d09007b9cc77f570c0ec3d469d242a40ccac2d48197025f1bc88190edc7a1477007227dafdc9d86d8cc9d1d10630d0965cbd8dc8c80
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8:A3k03kHRJ
- TLSH T14025AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/3348-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4a1-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3348-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4712-16-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000017649-97.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-474.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-602.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-628.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-726.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-745.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001babd-843.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019912-868.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-913.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-1051.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1088.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1137.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1168.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1322.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1374.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019929-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1399.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4a1-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-41.dat aspack_v212_v242 behavioral2/files/0x0005000000017649-97.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-320.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-474.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-499.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-602.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-628.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-726.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-745.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-794.dat aspack_v212_v242 behavioral2/files/0x000400000001babd-843.dat aspack_v212_v242 behavioral2/files/0x0004000000019912-868.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-887.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-894.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-913.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-933.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-953.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-1008.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-1051.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1088.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1137.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1168.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1181.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1212.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1322.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1342.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1367.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1374.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1387.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1394.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1395.dat aspack_v212_v242 behavioral2/files/0x0003000000019929-1396.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1397.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1399.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4712 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3348 2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4712 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4dad214253e3f6e1df0cb17135917d85_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3348
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 948KB
- SHA256 fe37efda4b2bc4bd292982595e493c6e866822adfb35ac6125011efadbd78ac4
- MD5 4dad214253e3f6e1df0cb17135917d85
- SHA1 3fc2519c2cd904976ba6bc9a8d524fe96a9a9b00
- SHA512 b991a34378afd86a01372d09007b9cc77f570c0ec3d469d242a40ccac2d48197025f1bc88190edc7a1477007227dafdc9d86d8cc9d1d10630d0965cbd8dc8c80
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8:A3k03kHRJ
- TLSH T14025AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 673fc886c739784b45e616a2cf508a9071912c3502a0c38995a951aa46aaf920
- MD5 fe55f480c9a2fe0f3abc02b2e3d8babe
- SHA1 aa2973fd1a0a5a0b850b094c3d2fcd0a286768e7
- SHA512 b2b35f97041b0f087ddaaa34840de6aac9de26c440f2e45d1af3cbc3a8133f34f0781135a8333cc2fd813c57def9f93f3d672e91a6c336fe5743f5831792cb3e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8P0Le5ji0hmxNrM:A3k03kHRJMPji0Aj
- TLSH T1F1658C17F6A402B5D027C1B9C5D69A6AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 963KB
- SHA256 e25959850f19e12bcad01bd7acccbde4eeffa625c5c6999377867b3fd4df49d3
- MD5 d103a90ff50ed6dfa507a87ff69f3ac3
- SHA1 5e378b1ce82c42c6dbff5f6ad8bc15f07e79f358
- SHA512 fa24e71e9ee3bb63888c392a67e460189d0c60aa5d4ecc3b01eb829facdf1356473da9b3a1226f476996e6d88c53659739f15576f36b18f164c2deeb6287c637
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Ra:A3k03kHRJ
- TLSH T16725AE13EB9504E9E10AC174AAD64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 972KB
- SHA256 704a3c5d6b0d221e619da2b79e7ca3197dbb84d1ed72210ba2bf607cbb134867
- MD5 287040d696258f1ebbba740bf3542dcd
- SHA1 2352a16a9148b0a44399eeadc424b4cd37e2cd1f
- SHA512 8d06859f2a0144748fd17a5c92f5d20448104330b718e855f494457b50d5989ae604aa65cca0cc349b9d60c26d8cde60f78a32635d0fd268bb4539700b5d990c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8g9:A3k03kHRJ9
- TLSH T1D925AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 972KB
- SHA256 3b5baedfda5288dd6b8b9062d463213f28f0eb8630c87d41e46c85aab32df9fd
- MD5 cc8537fcc0649d3bf58552d7144bbe4b
- SHA1 ab35ecb88ff70445ce4862d9dec70cf3092ffce3
- SHA512 b16f1d31a451d5aa268586cb497ea9e0c161c462a167cf78b17925565a4628a8cbad948a2cec2110fe8a196df31f6dfe37bbc945f5c27588390509663e5cae64
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8oc:A3k03kHRJo
- TLSH T19025AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 972KB
- SHA256 7821a4b30bac4b33bf4fe4e9807fa7af91c16eb5016bfec36e02908b528cd391
- MD5 1d61985af8858c5cd7935e3a90dd0dba
- SHA1 8edc87b754ffb241fac1fe927d799ab428a3725d
- SHA512 d102bba9c673865710542e0903adcb2f74cc7f493de1445c2580eb1e6f94c1d31df76cc11ac9e7ff34fdcb634adbb43f73056d9793a1e7433b7b4d5b933d48ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Bp:A3k03kHRJ+
- TLSH T1AB25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 972KB
- SHA256 7805f31258137e318a3e116e95aa1154e5b475b67b81a8c6c022ec89d24d9c1c
- MD5 5129c2ad007f3bb2bd5935e06ba0c48a
- SHA1 645f043a18c9f8a6e64e148e2314e8d6594ba1b0
- SHA512 376de8d5a49c273c8dd21914d12c89b4850bb60b2c0e9eea05eb0b9f1425676dd05855ac03fb48dbe73f202a3ca3146ec065108992d0a50bf48959a557fc7721
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8WN:A3k03kHRJx
- TLSH T16F25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 972KB
- SHA256 6e61091c7ea546aec1fe8cd7313fa179d736a01ff0b2aecc04e027c196fa2090
- MD5 339dadf2bd10687c4071b9d0966e1654
- SHA1 0005722d5558e7d43b13744372bccf4e1275ef9c
- SHA512 f6da1cac81bd2ee10bda7fe34069431b6adfdbb145a73250fcd2d305de931d92bddb3bd3641e3a34160104f8d7fa2a06ce8d0b71ec4d6e6003b72931a32eee78
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8aF:A3k03kHRJD
- TLSH T1A525AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 972KB
- SHA256 14d1a81dd4e77da974dda59f3855d76c81c2cec0f0816760cf1a8846ebd3dbdd
- MD5 c83426ba470f388e04a57f891c36122c
- SHA1 ae92e29651acde2030f99489e48eb1308055e93d
- SHA512 9fc90522db672a93898e29995b78eb6b2cf8fb76236f7e7951b32c39d7c8176b23139370b909b7b6d6814cfd8bccb19c8fab26dcd387681e0f0d9774b9ed4420
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8vC:A3k03kHRJ/
- TLSH T12325AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 972KB
- SHA256 4f2b8a41f5ca825879218d42bee70723ca82f530b7bc0b054f592f1b9914a8e0
- MD5 8d1eede26257b6419c71225614203f4e
- SHA1 39af2cd20560a473989fdc05cc1b808a2e5cf742
- SHA512 55005107963688f55a63463d41f0022bd1dbc8f7805a79e0c6dedfed9d86f89a578def4ea4c92704d749b39bfbd091a8b6d933d9f3c793aadfdb7a77a0a96860
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Qw:A3k03kHRJa
- TLSH T11425AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 972KB
- SHA256 c38675df0a285346fda9842a669f64b3857b59c0fb63c00b67575c53270478e0
- MD5 6d2632869a15a7f3e571989210831f00
- SHA1 05b439cfd90e5793cad8c827b0486500e0851328
- SHA512 88ad90ab8c68fce597762d68765cb2ea4275156eb8e06a1d297d79b3dd265bb280d3f35db38e4acadf8c6f9cca008d95ffb0f0760713bb250d3d37a2264f72d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8vT:A3k03kHRJK
- TLSH T1B725AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 972KB
- SHA256 1b646ad984277a2ad98ab7bb9c0fc71a8963902c0ad3ee1814e11021dcbc7b7e
- MD5 1f585612553343e324b4912e2cbb3885
- SHA1 6248d0305c749945451cfa393824b39d33339484
- SHA512 452166d70b7f2f10ab1b5f51452f099efca13608361b08d6dec17f58eea7b5b6407cac18e4d75cee08f52b70cde03ea1abfa3119bd25016ea6e2929f67adfad6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8pu:A3k03kHRJF
- TLSH T10E25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 972KB
- SHA256 a9760a98c3ba7fb9788741567bc35d014de0d3d2fe5d9611782b36d561f5622d
- MD5 15b9feae8cafa98877cd53822f341809
- SHA1 f4cd8f395b4481381011dcd0d2617ff44d4ba768
- SHA512 899f580683fcc940d4d07478e26c91085497b998b45c63b82383ca1808804e5b0427685774d06b4e8098e7c6f4a2493ba798e2fae73dca3aa557e5bb07962cea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8hb:A3k03kHRJk
- TLSH T10F25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 972KB
- SHA256 2f14373b743d013668a1162928d8d56a72fe7680343ebe567ea316eea5ce5917
- MD5 6a11fca19ad8162ef3e3788f70f6496a
- SHA1 bf7f25b180c1cbc0f486254cb1a56954ba1fb8ab
- SHA512 7098600680a4f05aa1586ae9f9e300c18acb0880de84e72735da5261e9db17dd8a3e797e17ecf246d0e9379a590a2727012be8048dc25fec4f61fb3170892869
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8pf:A3k03kHRJ0
- TLSH T1E525AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 972KB
- SHA256 5176c9ffb31c324990674d8abe921af8170b6df90452e5ab3422f27d6609f1b4
- MD5 75c04f63421de4e5a28e060891e4e776
- SHA1 9b1398b7d137f40789c0a094c39792d344992bcd
- SHA512 8bd477218f0072523bcef60f06696119ff97a17956d816b59586cdc8e79a5942314c766aa65cd2de55fc9d49ceb84c725b7d15570d88c366e2dd505c578eead5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8SK:A3k03kHRJk
- TLSH T11825AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 972KB
- SHA256 44db3a003e90bac65d0e9a4925731eed24b0d7b7993abe17002fddc36c97139e
- MD5 19226e6bf0635ece8a688fbe465da0c5
- SHA1 0538d303c96753c990df374b4402ad75d302a982
- SHA512 d2553940d9a5f9938166e92c0d0c3ca955d70f590ff391a2dbd45c5521813febced33ae9e7e90d7202c20e48da1f199298093ab0665812eaffdc3d8a99290c9c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD83k:A3k03kHRJ9
- TLSH T11F25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 972KB
- SHA256 5da5bedd9aa4e4d80460ec1b798b99f0b2cd9f840aaa5b4b28ee7b9ca78b4615
- MD5 6e2c1d8f5244d6e469bf5ec671e685c1
- SHA1 6486c62b1dd9100cea0e184cabe37db1b408593f
- SHA512 7a7a003700a15050e742094b8d33200fd559dc36822bea8d28dd09dd54d8fb0233750bc71e7d8d6b8f9c18fdfa972dea45d7c0c8f159a7062aadb72c818aa2de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8A0:A3k03kHRJA
- TLSH T1DC25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 972KB
- SHA256 0e104e129f1c2afdb9d6c347c64d8da1003c291e80e1774ad6c5a2777d304816
- MD5 a4e9b15f02689be0b26efe6b4011c74e
- SHA1 90342dc017667c0e1a8d145fc71fdad3e6f3279b
- SHA512 a00efcbf38eaf8a06d2c922310544dab74b148f250d294c1e060871ac3d4ba8bcaaeee3a5431160232fc30a4339051a51781ab8565f0e0f89579c28c2c50ef2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8bg:A3k03kHRJ1
- TLSH T15725AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 972KB
- SHA256 109ece85728d74666752caf2fb17e9d67664d5b639f06c4d9f7ca1a6ee79320a
- MD5 68c1cd52e644ce92ba57630021f63e76
- SHA1 638768beb5b3f74308351deb75cc629d72f6aa9a
- SHA512 99aae559e8c899e6071d024c34c13b7b37863b7c6098db5c23a119f60f822b5bea219ac321ca63e39da40385e6793e11dc8770fb10a799294d7fe98ba6dfdc7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Wr:A3k03kHRJ3
- TLSH T1F425AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 972KB
- SHA256 034e9fb8bc6fe4857dcfed3ddd74307d542e977d46b3b00b793b90dbcddfe9e8
- MD5 655a3bb39cec436eb985a42ba2a34d01
- SHA1 0ab4d2cd386632a751f099912cfe04f0a12956ed
- SHA512 627f4ab6b95bc7837194378542773a18b4bd9529fdbdc8e83a4c9d00af34ee20c9382a28f7da547b814ad0a289d7a52229c7fa63be8d4938e99a3510c867e01b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD88n:A3k03kHRJB
- TLSH T1A725AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 972KB
- SHA256 b710ed5bf6936171c06cfd7ef809834bdefed757474d33f04bab01dab5058a6e
- MD5 18bd8fe251373b3a298efbca3995b833
- SHA1 5e0e92ba81bd957e6ced5936bf1371caa7d77fe2
- SHA512 84a558a85ee4823a5a9d421429571326fd575901982adff0780f04464770cb033483b9996701223149a7053765d619d1a75bb1fa71a9e272aeb0ec04e3e686eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD86x:A3k03kHRJv
- TLSH T15B25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 972KB
- SHA256 907a10d1f3efa2aa03d69978b60337ee8f0b8dce2ae63eeaa0e12d944fb56875
- MD5 addeb144f69cd95a874d2502fba63c87
- SHA1 1e51b46246f8719cb914b94c730adb8952e31b91
- SHA512 0b0d19fe82108e3a3a7438fbfc11f309de5c9194f76ec500f23672207865b0cd845b54c4ff64ee8d64044b842e38244e71655521c962e3d3d52b4bd4b60f29ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD88A:A3k03kHRJw
- TLSH T1B825AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 972KB
- SHA256 fe3058700b941421286933db37e10920547ac0b5a91bc1928155ecae570c8f8e
- MD5 f44b25d12402c06354de3e4b9ddeba72
- SHA1 c225c60d03ba44aead403932d0dc1d3f30d664e6
- SHA512 6b41e898f5e9e1919a991a91047d738659ed51e2fb925b5eca2f025dce101bb44b08fafb11f13e7ab87ec9c06f0847885fe9aec5116a6327aed9dac215d50c01
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8l9Q:A3k03kHRJJ
- TLSH T13325AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 972KB
- SHA256 b826b7a28e76b9bc0ac8eb32fb44e9537e331c993bec65db709ced95667903a5
- MD5 0bcd9db9e4bc240d88eda372146f5201
- SHA1 c95f24f9fad56110c7d9e9727c2d3ad0bd84b6d3
- SHA512 5dbfd2a3939fe73d987052e85e8a3891c1a5670e87c4f4615307dc967cfae16659298f3b6ddd79de487678ab891c5f68c61343da1de0d160bfcc7e1dcff4e55a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Q4:A3k03kHRJe
- TLSH T10925AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 972KB
- SHA256 b2115d7087a2b18afd0651678099cdbc06bba78dbc1b33adb581d871c6fa156d
- MD5 e586f7ab15db03c4076ad1d7d3eb21f2
- SHA1 082aa7cc41a6c6409ae9b03866cbe929a83aa9f2
- SHA512 fd27a66a7526f3c6800abf7cc975e46e4517dbf643aa9b27a31254e2c654e4e660e6e6938f8e08423f2a4ab43f5e89857439cfbef653f78a6daf894353b4bec3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Tu:A3k03kHRJ/
- TLSH T10E25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 972KB
- SHA256 e92cc2a8e129541874d2bb3770417fc6191a628a29244dffd345f86f5f799671
- MD5 55281cd1fb8bd8fa2f69fe23c94bad69
- SHA1 de4eb5af2a7da283cfb27ddf11607f2d69435ba0
- SHA512 44c17fedc2d126dcb88298f6a4bedce9019352fae31e258e1b1e9d2eb2f254218030795873b28410bf42ce771ad7a5f20bb64c494dee2df73c8d708bbc4ef065
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Oj:A3k03kHRJh
- TLSH T13225AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 972KB
- SHA256 a50702e5a0e7369037fcf9652c438fedca6a5f22e931717425aa310b2e22c3dc
- MD5 396bb605e03d9d574936bcde2a72ee1b
- SHA1 62a846329d15d1901027fc98b584cbafeab0ade8
- SHA512 4f2bf4713b0c523ffb3e0c4af380f383fe146c0dcd22ced0fb5cc2558be7ed0e87b547db6cb7a7b112f94ee8efb4b515f06f5ecbb77c2d1dcc2c53d7920abc95
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD87g:A3k03kHRJl
- TLSH T17825AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 972KB
- SHA256 43b401d55e6e4f802d68d7367772a540285741c84f6ec517c27996897dfa10f7
- MD5 70679c3fb0f978359cb6c36bb37c4468
- SHA1 d1d344e50b32980076b46391e3017cdccfce9693
- SHA512 90a0314b4ff1f7d0086e5d12e28f1bc70aed3e7194cbc8b2a95daa968369bd4d2cc5510c8c71d6dda38556ef5891ac6c6a4f00ba98598965852c64be09ca79e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8mI:A3k03kHRJM
- TLSH T1AF25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 972KB
- SHA256 7b7e2af92a96c01a65592f077d99c4c4b296e59c0cf5abb480d766296f36f356
- MD5 109cebaebb84aa0a836f674706b94464
- SHA1 b463de29e751dbe65f7b166556b3402d805d9036
- SHA512 311632a2fbc5f6a47043299d7a652ed95cf8a6337d75167c2c16fa8cf531516c5bb0bd83958c891bc0c7e1806963c3afa76fba70d13e2a0f27626ebd919f3f1c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Uo:A3k03kHRJO
- TLSH T19C25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 972KB
- SHA256 89d37fb9db1069199f78b41ea8eb566469de1deeb1293929ba27deb3d0f2e61d
- MD5 3cbbb36c233eb8e4a77adc647d0089e4
- SHA1 674bb12fd74f46c9f7d2471a1bdca19a5980b759
- SHA512 eacd9daa10ffdcea6b8fca254c573162fbbb19648715f5e7ea43d2b1020fb338a03a382f5cfdf320ddc6e1af63b983a1e1fba60a4881820024e485794bc662b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD83+:A3k03kHRJb
- TLSH T14B25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 972KB
- SHA256 2d882d1d5f2274f904b4f6df8e5ca0df924f5d23a556fffd7910ad8405d5ce20
- MD5 55d858611660b946586bd3c81bced817
- SHA1 6ff9861f347c6df6a0c547c39e247009c00e8c4a
- SHA512 df21fc1250a28848696eb534e4401e0d515b5a1d904fe1f6b822f9f2aed2061fb252b0e2f90606c3cdb85df7e956721dfafb5905e46b1174ea061515942f028d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8NQ:A3k03kHRJf
- TLSH T17F25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 972KB
- SHA256 6c7af16f7001719186f44f33e80cd8a1c74a5b48587929068e84059925dc498d
- MD5 7e4bdb2b4b3fe36f7857c54f6498ba33
- SHA1 aec7958b2394a26ac45d3a458d383ef242c786c1
- SHA512 80a0d58b2f9b008a622767b7575de3d7acfc352f62be8d0e5c46e31ee24a53c929707e674b782566ccfa07c2f933650328be2da5681ed1caf048ae68c77ed1f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8CX:A3k03kHRJz
- TLSH T13825AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 972KB
- SHA256 8146bd81e69c4ed9788d64b343ba8856570952e925cca0c908c97eb1338ad75a
- MD5 5a1b3dbfc52543167b3329f270928eaf
- SHA1 f68a27b52ff42ab25a9799b0eeba47406551e93a
- SHA512 948f926c4c279ed82347cbab4aef2cd8c4b5b811e109fe50db4360b76408d8cce3d9a61cfd38a593e4adbb20046a89ab835220d22bb1436efc145e4369b76f5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8kL:A3k03kHRJ9
- TLSH T10E25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 972KB
- SHA256 8defa8f7bda6c752a4da031e7649c51a631dcab76a0bf4ac168ce8188d4d8305
- MD5 3a457b30b53dfb4bcc5d56788bc7ba26
- SHA1 8c8e666e3356bd752f486ec6b781837a62e60a39
- SHA512 b8f0d08b6826beb059b001cfdd45cba0cbdd8afaf660109b931ca2891cdbddc96de8734eb7f7a0d191fc22e29259e1a87e5bb834467ec55e8a8edd34eb4f7315
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8AM:A3k03kHRJE
- TLSH T16E25AE13EB9504E9E10AC174AAD68A23FB757D56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 972KB
- SHA256 772d11ebb01b68ca6053b90f3b1ccb2ddc84183ec1be753aa6a292c1378c5f96
- MD5 9996527c596dd8618235c6a896f1959c
- SHA1 e3dfc2165574ed6f84078132e23e5ba63e8793d1
- SHA512 9a2a1bcbab3cdc86faa998cb23feee7e5c8236fcaa2b5a09837654e3e955d8f8f016e3a2f199e1d885fa0e01175d7dea021ca1d02f20f67de09ce3f047d154aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8hh:A3k03kHRJ+
- TLSH T14B25AE13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$
- Size 1013KB
- SHA256 38937acb1651504ef1285abfaf65934bf2c0a68a87196d66439b207e5e7ecdb4
- MD5 74720404554a40a57202c49bdc23a07b
- SHA1 a3b870362733abffd74727b015d31314450d582c
- SHA512 e83d9a21cb0ceb4ac80d55e8343e666447acd1c98d86843f866ed65e87b0bda7bc27a47907921c090b9ef17c508cea5e83f1d4f6df48eb6124c3580e268c2698
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscECqbLD8Uj:A3k03kHRJPj
- TLSH T1F125AF13EB9500E9D10AC17496D68A23FB75BC56176093DF2368C2152F62BD0BF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH