Analysis
- max time kernel
102s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 02:54
Behavioral task
behavioral1
Sample
2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 946KB
- Sample260801-dd4vvace93
- SHA256 fd9408a05630b54cc838826d72e41473301cef1763aa0fbd74b09ff97c6487f5
- MD5 9ce2ed7b215ee3ed556cd457e052b062
- SHA1 1e7c80d30c9c735d56822afceeb9ead990401364
- SHA512 b15a5090cb2711858f20a3ca2f52da773bb3bb12803bea0386a2de71795c04054ee72dac09506475ddf517d0a32d1547b19dd47489936394d6597ef0d13b018a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasN:A3k03kHRJARJ4
- TLSH T1FD259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/864-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c574-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/864-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5392-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2fc-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-272.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-435.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-478.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-588.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-619.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-668.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-724.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-787.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-843.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-881.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1008.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1046.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1090.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1127.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1326.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001885f-1482.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c574-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2fc-41.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-272.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-435.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-478.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-497.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-588.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-619.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-668.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-724.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-787.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-843.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-881.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1008.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1046.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1090.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1127.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1146.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1171.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1209.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1318.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1326.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1345.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1371.dat aspack_v212_v242 behavioral2/files/0x000800000001885f-1482.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5392 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe patcher.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 864 2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5392 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_9ce2ed7b215ee3ed556cd457e052b062_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:864
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5392
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 946KB
- SHA256 fd9408a05630b54cc838826d72e41473301cef1763aa0fbd74b09ff97c6487f5
- MD5 9ce2ed7b215ee3ed556cd457e052b062
- SHA1 1e7c80d30c9c735d56822afceeb9ead990401364
- SHA512 b15a5090cb2711858f20a3ca2f52da773bb3bb12803bea0386a2de71795c04054ee72dac09506475ddf517d0a32d1547b19dd47489936394d6597ef0d13b018a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasN:A3k03kHRJARJ4
- TLSH T1FD259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 975KB
- SHA256 2db9f827eaaba25f94ce2bdba0ba28fc8ef7f9357042cd2f8ec434a4df181a31
- MD5 ea62bd952a23fb0ebefbaaec11cf2b24
- SHA1 88d058afb6cae393418a3317a489468a8523e6ed
- SHA512 6f3fbe04a192ba43ebc3a7ce0429ad56d0b3cadcddd37c552792bd7d35952b7f6984acefc8bdd83a86f4d7a0d7796b1809f2aeba1f8fd2aa6ed9da351ad2ce60
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasbP:A3k03kHRJARJ8
- TLSH T1DD259D03F79800E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 9c35b46f1bf4f7d65cfc63c65d369207c4295f4a8e455118816b29c50ae20124
- MD5 7b73377c0274859beb3b7fd0cc6cd8d8
- SHA1 0c1e02792803214648b2897289e3dc5c7211af63
- SHA512 6804fa4ec1958d722907135de977b2a76b4d556806a014842fbee2caac07a9c9f1c624b386e2f1ef3950dac7087906cf794c548528692f079bff9efaa547b203
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasZ0Le5ji0hmxNrM:A3k03kHRJARJAPji0Aj
- TLSH T17C657C17F6A802B5D067C178C5D29A5AEA72384217309BCF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 961KB
- SHA256 ea4327827deaa33f09489da8b903a9903c53c7a2504e1a628dae398bb1a9a35b
- MD5 1e3fdb97270e33947e4cf50bf868f53a
- SHA1 63a3983724d57ab607e7f3f91c2ed2dcf5421f50
- SHA512 4629862ae9f1a7da4185aae66a980a611e861c939bf75d6b1dd38aa52e8fe49206953e8867b6695af3c69fa92a5b7662cd16d4fe1caf9f016b3d93334e6f29a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasLa:A3k03kHRJARJ
- TLSH T17A259D03F79800E8D15AC1789AA69A22FB757C561730A7CF1364D6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 970KB
- SHA256 51a8133ac35acc69665636dcd2c43dda926bd89109b099c5ce564b0cf4e5eb87
- MD5 8c88d822d2485142a7610fb3bcb18df2
- SHA1 1085b4673865af96b9e0b5edd4c66e56cca0f0c6
- SHA512 9eb858915fd7648b7f84370ced444f5affa63c68d0f7300a92ee6740849c803146bf3ea6b0e38c499664fee2ed381d329cbc0b2fc831ec9a80638b1685cecb86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasa9:A3k03kHRJARJZ
- TLSH T163259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 970KB
- SHA256 261585c8d220a767e1b8fbb942b5312d579fad08a3a6635d406135bee283e9d8
- MD5 47bb4a65ca10a19decc148356150f6e4
- SHA1 a5142369ed30c3c3a13c547d2a5c098136ded397
- SHA512 d9d93edfc9d66a6e2b7754c6e4b71f8d6f13f67deb171ffe3e7e7a49701bf43c9b0ac57d8fcfc522077348e9a951a58ba904ff1b482b9eab90f1e98289e6f8b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasac:A3k03kHRJARJc
- TLSH T10D259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 970KB
- SHA256 b256e4de11cbf159934a881c9e7e40bc6e1f29bc69ac3c41ad22c16cad881f0c
- MD5 00ffde8eaaab921215a38a3962aeff30
- SHA1 b01fd37ab94c3072e148b88d2d3511865a544d59
- SHA512 7dda77813f7c2dd782b0cf5160921bf714527c513ee1f2ffd577a02652c26a9e2f831aaab1adbf5406595e4e0ac848ca146894bce4983cab8b1d0873efe7a582
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasTp:A3k03kHRJARJq
- TLSH T1BB259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 970KB
- SHA256 8e6f5eef10df1ed2d9833120216e437401984d883d122a64592b9789917e716d
- MD5 bb11822220e5972408f755ee14d9b4fe
- SHA1 6f7a9a8cfb61b254ccff4b7a23e92e0a07e62143
- SHA512 edcb1ec4e3b35399cff9a2da364e1e790e584d5b352aad22961bdc5f772a02198c96030e4b2b5e73c440c80e8d89668314e940051432b6825a37f9625d3ade5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbas0N:A3k03kHRJARJd
- TLSH T119259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 970KB
- SHA256 463189c5ab3aa7120d6c379fb89ca3a769ae91e070247d6b897fb21c9b6ade79
- MD5 a03e1ba39b5ffb10bc2dff5d7ee75baf
- SHA1 388c28be399b91b1d3d4480abd7b729a55ed8ef6
- SHA512 fbbce248be519365624eab2d33a4946ef218df7817d3fba7cd42cf0aa13bbba34d63e62b859adc306e2bbd168b3fc84882952f8fa57273fa36a41e4a5b3c7510
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbascF:A3k03kHRJARJH
- TLSH T1B7259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 970KB
- SHA256 8276b68a8d5060089940f77ff72b3e4fd7cb0467c3c7f44dcb81e66fcc49973a
- MD5 cc31192cbe446aa19fa2a432b2df0912
- SHA1 9375d944cfc46405c371aede9b65c3e748ae180f
- SHA512 f322ccda9d5da68516c1ca860fb6338faefb456154edf5ef69cb70e01d39a5d36e7e4a5355a752bdf0a1ac486616a0c85ea5aac169f1facd48e1a266596d804c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasJC:A3k03kHRJARJ7
- TLSH T193259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 970KB
- SHA256 86031140f57fb9c0b47151b990323a88422099abb16f9b6942ea57c28172b3b8
- MD5 fb41acba3a7e9c058df9ec68da2e0d8e
- SHA1 fe11d19f4f6bbcdc74a2b8f39ba51cf0f3aa0611
- SHA512 fba36c94a8dc8bc39936174547ed5079699335c4ed63f636c3d2fbea881e88870d3aa6194d0318dbf480f9613cc74674ddc554b77b7c37cede7cc20e59151acf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasqw:A3k03kHRJARJ+
- TLSH T1C4259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 970KB
- SHA256 1d8aeee6c0be13903b2730b7a4970f7032ed1159134f351ccf5542f38f79666e
- MD5 8442bd794f1c55f2db8d852f2baaec7e
- SHA1 e6a30c6682e8dc3042bd0dde3e82e07ab45a4c91
- SHA512 6e8a4beb85d46cbf63d390cff176ae88ddf18cc25311ca549f59f729c68af5d1c93172ad02245c3a54be0cd9a39c75c60e0ff5dcd24891e9cc9bb1a2acb53b6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasxT:A3k03kHRJARJe
- TLSH T166259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 970KB
- SHA256 f61042d2e2294f64d05ad5aa8ef4cdfd89de95a745b7b526973bf591eb7e0d6e
- MD5 0c3e56783d75fa27bae4ff2decde1e27
- SHA1 512ccc8fdd4fa37fb4d93229e290084101194094
- SHA512 564428adde57dbaeeeedf971c554001503bc06715e239ee872157658f1d9ab86bde72bf0ea23fa586d6e9dfa1020bcd772991b545a35094ae396505b18a86232
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasfu:A3k03kHRJARJJ
- TLSH T13D259D03F79800E8D15AC1789AA69A22FB757C561730A7DF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 970KB
- SHA256 383cfbaf0ce302c0d07c43711a139e3d38154291cc95c59b98ad0b5ec8cc3e0f
- MD5 90455cead7c84604ad142d973c3f4d9a
- SHA1 08c73ba51637b9e67594b734e445d2318ce2d6b8
- SHA512 812984977da08e81c8a6c9341c8aa91960e1837d03194b5bb451d38e3fb196288dde9fa5dc451c76ff92b9ef8e2d1b7403f28e63be5b546b480f330be75c9528
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasDb:A3k03kHRJARJ4
- TLSH T1B3259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 970KB
- SHA256 127ebc63e0db0a509f4c47662dc2801478b2a9d388dfd963a375337f4c21d97b
- MD5 22b128460ad4a3fdda225717ee546280
- SHA1 7c8eee4921b405ca6a860da0f5c0ddf3f56552be
- SHA512 3b8c18e0ba369c9bc2a5b4a0ce419aee9230dac2ef17d4d93e53d2e7e4c62fbd64a8c45bc157551cd7233a005c73f588dd18265e9518761467c600ad6877a539
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasXf:A3k03kHRJARJ4
- TLSH T167259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 970KB
- SHA256 e76aebc0071419818f738f731172d6349e980c64f94712207ad4835ed08c6979
- MD5 0cc0ebde07abebdde0535e6355ce3e66
- SHA1 a276a79b7380ea68ac7d09744d4c6395c6493d8b
- SHA512 64cb8723fb2324ea1f9dbb1afa3d5c34167111189d3a747db51b04acbbe93771b81738855884bbd23fa5d040639c0e6f3df1e94ec1a03223412d9332a5306bd5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasgK:A3k03kHRJARJ4
- TLSH T1A4259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 970KB
- SHA256 3d5c97b65d47d8df7fabc1cb9768cac652d47b76964e945e4db04ed91080c166
- MD5 ff1ff8cd6fd115b6fef76a09ba26c963
- SHA1 8f5f83af701d3c920aedfeed884382155acd41e1
- SHA512 ab22f4dfb8b3f1b2f6dc16355507dbe125336770ae0e3320672e40c57a3820fafc2dedae57118d52332d91c9f92f8ebfeb2890968c6eb890e80a561c9656f4fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasdk:A3k03kHRJARJR
- TLSH T1B1259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 970KB
- SHA256 9a5880129aa653dac933069bfc9dac9bb3a503d503e2ec84c464fd04c1d856dd
- MD5 a8ccc297b0bf88cc969ad44694ba7bd7
- SHA1 1df662f9e3a9d391058813a79d2de59700137866
- SHA512 1575ca1a4e8922eb8fe9ef1e2aef5d9e066b62838dd961c5e32c964d776e82f3fba43824f84f98e4baefd7974e41d17ec8b086823228ad11b698de8981cb7cd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasC0:A3k03kHRJARJU
- TLSH T198259D03F79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 970KB
- SHA256 2c068d17330e219d96f2bb1695e7ff6492b2610c144622c98379e2e21c94b3f8
- MD5 3a873db6ebdfbb5125df9195169da5ed
- SHA1 420d2e45c3f5e6a49672c4095f6312b1bff6d83b
- SHA512 b1a7aae435c9bf5dccf8932ba56d2936f156c977a1b602faf738e5c330bd9e73e91f07c3ab5d087a585aa1438907806cd550318a6ac3820c5d4cc0811c0e3453
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasRg:A3k03kHRJARJp
- TLSH T16D259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 970KB
- SHA256 6a0f1d45e130b45a42b8505c3a5a6068f9fd6c1e668eb7273871095e89f50910
- MD5 3f9fd6d2f3354a5ae385e79bfc7e851d
- SHA1 2d1c81382fe018e837ec4ad3cad6ab6a7160c38e
- SHA512 b0417e2698753de01bd1ed33a818929efcfd9a059157aa77067284fde58af5be8e9e04eff0234d656703dcb2ef5bad7d16f950e53a1552d1c5c05641d35b2c25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbas4r:A3k03kHRJARJT
- TLSH T1E5259D03F79900E8D15AC1789AA69A22FB757C56173097CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 970KB
- SHA256 d093cd7f91443d8feb4a5f4232f81c4e7d14a3842305b433a3922dbb028a55d1
- MD5 09fcea112535d85c10f37ccf82dfad07
- SHA1 3a4a4cfb983ae173a254053402d43b102a57aa40
- SHA512 2568c8c0113d3d634324ee1d3a8dedd46b6489d4ff2d0b9440ebe01dd95c0dfa2383f549dda2f4bffc10e44a3d4c24db13a4a8f9c36bb1b35e2df1a18c3f2c14
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasWn:A3k03kHRJARJV
- TLSH T18F259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 970KB
- SHA256 6596e4e5b4550c7f68fb922608ccb6633e9dd9f1d530ef91bd39493352e7e559
- MD5 f8c5d447b4b360dbbd0a5a1133cb8314
- SHA1 888555c7a6b494dbdb9da3b3bd51c469bc4109a7
- SHA512 4ffd99c13289afe95adee14d0e0198c2506dba73426db6956274b885c1ba847d2a90a54f22cf9f3415449d1384589b936e8bf1289b26bbc668c05458cec34efa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbas8x:A3k03kHRJARJr
- TLSH T18F259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 970KB
- SHA256 ab48bf56e59018b20aa3fe2d009a4bdc11f885101f6d353837c5e3b65ed4daa7
- MD5 a643b284979e4334911b297a63e9de9f
- SHA1 34a20f012bb16d691d35750fb6b5c30cd1ef15f3
- SHA512 b538c3b2231bdf531d093cf181edf69fdcc5b0e43cb82a21eb1d25b00dc8de7f5777489c7245a34e25d9b89b2a94580314c504548588e58f460c9f782d539b73
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbas2A:A3k03kHRJARJE
- TLSH T1C5259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 970KB
- SHA256 295b197a42f62987b1cd9f7944df6e6365483b47c2e28bb565800ba16da862ee
- MD5 9b543c60ba2d39161ae3fbe373942576
- SHA1 96b655792ad09d7157a074a81becf61ef267bb77
- SHA512 373998d9e736be668d74ed5a82cfff7519c519bcced12bc4266640454ea24582928dbaaa200f03e4f9fa72ea2c7832cbb200f3eaf05621e1b42b7f9b59f7572e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasv9Q:A3k03kHRJARJ1
- TLSH T132259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 970KB
- SHA256 a6058087de2730484d7c48c462c41942649e829244b48cbce60ed19c54b74870
- MD5 4b2678bd8de1b25962b844b154146fc8
- SHA1 b540c49018a1bf4f8f9ddf22bdd33916fc9901a0
- SHA512 0e4a950199ed90a276543d6a599f362ef2bd1b07892f975aeb34c25072b061653b838145748d5f598b0d8fd01d6b244e97f28af826d4d4da0c46f923e5a13e68
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasG4:A3k03kHRJARJK
- TLSH T123259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 970KB
- SHA256 9cb13fbb4c9b3b1dffbfa752faa5afc9671d249d79a884876ec62655b1f31d2b
- MD5 e119a59fb8dba80bca3e90d9ce4d0dbc
- SHA1 8e69efb9c40962e62757c1576ec523fe7cb0c595
- SHA512 3c9ffc9445def375b15748603cfb26d8cdeec98a4ebedb4417cee76b54c1f0d738d3daea8f7214a81d5a94d373cc8630b7cc3decb89c5930c946fb657ec8844f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasVu:A3k03kHRJARJL
- TLSH T14D259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 970KB
- SHA256 c7fb211748cbdcf632ea1d06fc273041e0da317d972c45b8fdd9df09d5e0cc56
- MD5 94cfd6c5f1d821aea8a7471eca58cfe2
- SHA1 32b64173945d1f66d0cbadc862cf87cb4926cf8b
- SHA512 6bedb37e745237f0ca4573f3ae8457d6e91954f0d66bc04b7dc66296dad85b4dfd054a8beb4d0328b475efb4977d304b69f5684001211971680bf87772d20cd0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasIj:A3k03kHRJARJV
- TLSH T1DC259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 970KB
- SHA256 b7127ba0dcf9a5880e743c54ed60e21c58de0758390b2cb4de554ef219883453
- MD5 e64c47efce9450cc3d0f599876a2d445
- SHA1 2ed085d674ca20bff9b6dff10e1878037a2b2149
- SHA512 e1f93989f2893d3b2dadd0bbb1061aa1e05e991c629ccdc15839ae53c28ea079bbb6aea3216f6dcf92ed5d887ee6507e74b980574f12f69c749a4bfab0af5773
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbas5g:A3k03kHRJARJJ
- TLSH T1C4259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 970KB
- SHA256 16a40e7a9eb31fbc029f2743c4a8d3771c992cae7345ffb9707dcad569d78275
- MD5 7ab4b76c623e651260eeea72f54f3a60
- SHA1 f0aac8219f73fae53bb55bb84e79efeebd620421
- SHA512 aa994401598060176eaffd8ebef5fe95d26e44462d58f81acc5c78ed1249301935e7cb18cfa1e5863438938546765f393d8c43655f44ec5a746154a4c38c94e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasgI:A3k03kHRJARJo
- TLSH T1C0259D03F79900E8D15AC1749AA69A22FB757C561730A7CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 970KB
- SHA256 d9f81d17ec57e2f092fbeb76918e87f9d908de722b8b490bb97af4a5d50da281
- MD5 89814ef5ae2df4513ef035e1dd7ad84e
- SHA1 e113136cf0e07b594d2ce5fdb0081e63f4ba89d4
- SHA512 b291d06302c95f94e4d91168a7b6013a147d0f806822abf873d3a34ddfdce351f40bb48370f9d851b445bad493d77db3457acbbbd0d17ed6398b8a1e2055a83c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasio:A3k03kHRJARJa
- TLSH T10D259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 970KB
- SHA256 c9a175ae92552e489be142b429466005c6fdd0886b678471a88cc62ef441960b
- MD5 65855e013d339c966c7bac2d355128a5
- SHA1 e3a802378a66137de9b0adfe4b25b23c57b9245c
- SHA512 5cd3fe494c5dc24ff3501a21bfaa6293fe2f03c9191812893067af79ee65aa49c30bd4ab8d3e0f2da1954cc9ff3d8e5f0aa97c72087a64e3c88d0c5076b43885
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasZ+:A3k03kHRJARJ/
- TLSH T199259D03E79800E8D15AC1789AA69A22FB757C56173097DF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 970KB
- SHA256 2e31c2050c761f6a9b5dd7a8c1eb019db6fd5b45f40a1fc0b3232af9bf4631d2
- MD5 801d9f3a3b403bb7e3ebb84364fee720
- SHA1 83c3fed0cde7e3eb14203b689e62e6294f2d2183
- SHA512 62edf4a100843e59d0475f02b2e019522ab1496641527491d480c0609de72aed42879951f7b13e6d4d51fd7f1f2bd2dc23c7f4b4eef8c8cb1258ce8c98d0c664
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasHQ:A3k03kHRJARJb
- TLSH T1E1259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 970KB
- SHA256 aaadc81b18f9a8cb088e077dce8d63f9eeede82b6480a860b2c1d4982608acbc
- MD5 dde15d125433f692d6164f276ec9df7a
- SHA1 dc3f21d610558c86928f10666a8bbf86f8d1e48a
- SHA512 1c4b923a986bfbaa824813e3f2ed42e7aec679452bfc70e4adbcab3a2de9134b75803ef9eb181ec64b58283b4a8dd3e5fc6bafcb280eb486f8a677d12fa7e788
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbascX:A3k03kHRJARJv
- TLSH T1A3259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 970KB
- SHA256 e597e0e7adf127ddcc388321780b11d1fa2a33d776cbe68751b84e047df787fe
- MD5 c6e5d481117053b03c6656103fc2d7d0
- SHA1 7cd1b79264b330c0c8aaa3d2fc05d9e6f27510a4
- SHA512 c6cd625ebf4419a66bf4da27a5ef6f98e4380065d8aa1cab9ed5112143c0385101338250ac0a709a58bef152b7ebe2dea380493d8312ab1ee2c7aadaefa88a2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasaL:A3k03kHRJARJB
- TLSH T11E259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 970KB
- SHA256 2116a1236e6e49ad7928e58cd3ba492dd935868ecacdcc9fa6b90fbeeb70d299
- MD5 ed2b83b9a9d93787772d05a58c063370
- SHA1 bf045fc1ce031b383b19a83d4b2b3e00c016e7f0
- SHA512 e13f521b31eeede29c70886b1e819049acbab49aa9dfdb51d23bd94343dea804d4854d3d0326789ca3ff463597c7e2dfc0712a061c8d6b6dd3ea194e0c309916
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbas+M:A3k03kHRJARJY
- TLSH T1FA259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 970KB
- SHA256 03ea568a8ef059d427f538db58fcc5a5e809b9c97ea7dc3bc8325477df216bb5
- MD5 6567546c1ba1278a36b6281d99627593
- SHA1 b982a1199e413cd059c622df036b595d4a25fecb
- SHA512 538e88f52010c795b647939b2b5b35f19ab2fbf2a314ffc22bc131bdaefc01e72048a6725a4d4851aa524ddf8779c1cd52c6e9e91bc83e61d488aac6a8d82433
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlius+g2/gbasnh:A3k03kHRJARJK
- TLSH T155259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH