Analysis
- max time kernel
93s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 18:54
Behavioral task
behavioral1
Sample
2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 931KB
- Sample260802-xj9stsed43
- SHA256 6dade54c766845e8370b0158b29e8b670e01638cc3944cadc3f0f0c54437a041
- MD5 3eb5716c3d04e08602344f84cc26891e
- SHA1 dfffc1005f4b46bbff4e56298394d331fdb5d361
- SHA512 a1e142a9d38ae6bf786fce8890d6b4d9fd7d8f665930f35507ca7a09a9f8c4d323fa58f8546ea41ec7a5e138f462d7b42729b04af37c91afe633804027fcff0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2c:A3k03kHRJARJ/
- TLSH T131159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 29 IoCs
resource yara_rule behavioral2/memory/1004-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000019cc9-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1004-76-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4300-149-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-469.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-597.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-622.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-720.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-946.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-984.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1040.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1059.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1120.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-1145.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1170.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1177.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1446.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x0009000000019cc9-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-39.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-330.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-469.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-597.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-622.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-720.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-740.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-789.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-820.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-863.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-882.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-889.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-902.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-921.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-946.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-984.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1040.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1059.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1120.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-1145.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1170.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1177.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1446.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4300 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ patcher.exe File opened for modification C:\Program Files\WriteConfirm.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe$ 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe - Drops file in Windows directory 46 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1004 2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4300 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_3eb5716c3d04e08602344f84cc26891e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1004
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 931KB
- SHA256 6dade54c766845e8370b0158b29e8b670e01638cc3944cadc3f0f0c54437a041
- MD5 3eb5716c3d04e08602344f84cc26891e
- SHA1 dfffc1005f4b46bbff4e56298394d331fdb5d361
- SHA512 a1e142a9d38ae6bf786fce8890d6b4d9fd7d8f665930f35507ca7a09a9f8c4d323fa58f8546ea41ec7a5e138f462d7b42729b04af37c91afe633804027fcff0a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2c:A3k03kHRJARJ/
- TLSH T131159C03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 960KB
- SHA256 6970e1e0b7f0180afc601ab99e325bd679f469887bd4bbfdef4e74e0eb6336b6
- MD5 f81e34d8292d99d81fd43bc883b2b720
- SHA1 d634d01319f032ba1e4d242deb227d34bc833f48
- SHA512 5c2ed143d5e94dd569948d252e4088f24138c1ffe2e5d3be7b22226bd8f6f8975f90e355d5947b5b5df06be68e9bb8f98d8ef0107951fe441016467b5161253c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2GP:A3k03kHRJARJZ
- TLSH T1C9259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 c953ad3cc44821ee2e847abfc8a1e63f5d1083df2c779e2ec7ae0a79f4db1e7a
- MD5 cf1c4dc4b413345b0601c48f958cf738
- SHA1 86d3f4241b8866276f06d99ddc4769a6345042c3
- SHA512 c5ad91363389d8409d99566667624c5b0b72e8bfc5c47555ec536a2ab256e9b310326c09c683ff584f05cd1ac14ba1e11d41fc8a1d66f3f5b3fc408a2565aab9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2k0Le5ji0hmxNrM:A3k03kHRJARJrPji0Aj
- TLSH T13A657C17F6A802B5D067C1B8C5D29A5AEA71384217309BCF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 946KB
- SHA256 4358f89644274c7bab910d9dbed1d50bfe650302a91dba3a1da7f48ea3bad3de
- MD5 f8274ff699cf858356f6fef29e482243
- SHA1 e9a3ef91a7a40673d8e5ce490c22afb388740016
- SHA512 51cdbadff08326538a4b92f52d6189e8fd8503f9d2c59616dba53baa5bf372737e925e1e35f3567d2556259a71ad2c3b13a84a7fab74a6a8c1a71ce31ec7e35c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2Oa:A3k03kHRJARJ
- TLSH T185259C03F79800E8D15AC1789AA69A22FB757C561730A7DF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 955KB
- SHA256 d4c34b3c11cdeca5363b391e66c53458c05a9aa594de59fd01f5ad629987e9a7
- MD5 e2eba360bd07ab30d3b56f50090c0486
- SHA1 f1e227f00f70e2e75bc433a7603117711cf97118
- SHA512 2fc30cb48cb5305342bec4e81fa49f5365c5dc0d01430d0a6cd1b2dd0f5528fcd378a28dd02107136b0c8d97b344f63ba70d2d7f5e1833cab19b3dc67cbca8f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy24f:A3k03kHRJARJh
- TLSH T149259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 955KB
- SHA256 3fb95eaac6dad1369605c1c95d5020e7ed3a3cf836001f65362108a1767a6ebc
- MD5 182f2559908c69fb36307eeb67291e5e
- SHA1 5405337ce7b096ae603a96c2f2ea1c6a4180b054
- SHA512 d5799d08c1d6a26da4e5a7accd34d7562f9c90dfd950c9204108776343cbad5cf05ffa558f07a9e4345c39aae320165687366d13b1e478e019a8ed591456ac61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy21K:A3k03kHRJARJ5
- TLSH T11F259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 955KB
- SHA256 06affa410f9be87eae2e22d82b5799cc2d54c92d86ee66739a9a1f98a4aa5e64
- MD5 881328188077bd6fdd277388552f1641
- SHA1 6860e5ffb070d9afbad4195c031917e5942bc8cb
- SHA512 68e76141febe4a02e89e1b34715489faabe090d895396fa9fe54017717a4330878e02a5ab6cc5c8f2a6b47945967a0710fa1cfc269e3d7e33ca93f4987550118
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy22k:A3k03kHRJARJw
- TLSH T103259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 955KB
- SHA256 17c607293a4195c023ddc1b3c65a05913689d67e0909465c33105f13796aed95
- MD5 e17d78287b79c53f625baadf0b0b20b0
- SHA1 c56f305b16aacd92dc55586a53e55a9b87e4f5e3
- SHA512 e247204da76e1de424610f9ff61f93a211fdd85abf5613cdfc23bcc0a0f9456bff1d5dd52251bb3c306900099cf51435354434a9c15e5c2e286c35f51a271651
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2T0:A3k03kHRJARJZ
- TLSH T143259D03F79900E8D15AC1789AA69A22FB757C56173097CF2364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 955KB
- SHA256 05acddca16af3f1c88f89054639760cf41b8747433039e90b43de0ff88e76787
- MD5 0d77ebbc006077b6703e9399c668443c
- SHA1 0355aa6abb231dc8effb20cb1061aec615509cab
- SHA512 51c03226ae61af0e57b6e4d2c4d1b88b7e856f163124580bf860df23e5c16994ffd19a1a3e3f523b9d104efe1ac34df652d97220547f861a0dec33e9155babfc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2ig:A3k03kHRJARJI
- TLSH T1AD259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 955KB
- SHA256 0328e84810952ac024527f1f81ca01b69f9a8c4f68e710ab85c7e5d762d9475b
- MD5 db5b24f4b83d65f918126fcbef60ef7e
- SHA1 21b2e8ad4f620943c02dbcf7a1ddf0f86570a83e
- SHA512 0ff808e3c064ce7217dcebd45baa6b2d38a0e66509adb54864f6f3451dc1aa1bd3a10b0f2149c2418075ff87a115225cf7ada993641fe0f9e4836081aea3ae2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2Dr:A3k03kHRJARJy
- TLSH T151259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 955KB
- SHA256 221ebfdf6a2a92939b7efc23a414c4a2334cf0be321018819233c0b3711d5cae
- MD5 36c37ff48a8a9f22c03e1836107d876f
- SHA1 d346f17a5fc6deb2ca9ef2eadc231622eb3f2abd
- SHA512 39baa9c2847ccd24bcbc2c651d36ab309e665cb7e3dbb83a8e8ac1f3a4f59ee7bf79530522832615391961645a4b74d8583d9594de20bdf086de6aa103f51177
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2ln:A3k03kHRJARJk
- TLSH T1F2259D03E79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 955KB
- SHA256 71b22a3216f929f5d83f00f0a00564c5e424972de92b50f1fc0d5337cb68abf6
- MD5 efdd4cfe462f951e8a75f46ab7d36b8b
- SHA1 0cd6f51d594017f7bb04b52f8c3829db7cf92523
- SHA512 29d99b32552d3649e7b2e68f51e3dff0b0c3df4207766dc62b98f22c6d8c18742ce0ede411db4bbc1d95cf38579b7759eafc009c400474bcdef980cdb6dd667c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2Rx:A3k03kHRJARJC
- TLSH T110259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 955KB
- SHA256 0d101e8bceedd443b6d59f82f3c27ee21f37013251168b4603ffbecf4a94b094
- MD5 bdf67cf6dce941a255f52f5fef3e942f
- SHA1 711763b60febd6879e624dd0d1c3d6aa1b6069ad
- SHA512 87604b4dee14ef6b2dbc00cfa51e8f7c741d2c03e9e90e39c24aa1699159dcda4d306b4f62a7b4246ea5b7f3615b90b69e0270490422f7a0e8f2440069fbd01f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2/A:A3k03kHRJARJh
- TLSH T195259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 955KB
- SHA256 902abe9d735aa73a3e5211b8b8fe01c0644fd3bb89fbf1f5d1f39b5ad751f961
- MD5 18a2d4fc90e9d09dab31d362fc1fe256
- SHA1 3f44b46b02d02790a4dcde3a4d4ecf0854eab3d5
- SHA512 9f26d157704a0f5a487a9ca41604923346a3cc82de7eca6d9d46f09b335f2f7cd159083366a4b6f11730d01d03f93429519f49dc8e3c9bee8b47a299187847a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2Q9Q:A3k03kHRJARJY
- TLSH T1C1259D03F79900E8D15AC1789AA69A22EB757C561730A7CF1364C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 955KB
- SHA256 759ca640054e98ff007aab0ac6feca01aaf2bc55565422f32ca37cb9813b91d3
- MD5 19a593825c46d645172a123e3be7e310
- SHA1 c0a0b03d42a52248be10f1bbe45bc011ffa11f99
- SHA512 8c973ab88ba353abb3e55d74b779cae9741d0ea4eaece679a6ed9a96a4d4edc7bda9f3d946fd4931202be92d19e3e9a0a7e57892afaf418893d860a314f2056a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2x4:A3k03kHRJARJj
- TLSH T1B1259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1354C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 955KB
- SHA256 5dfc8f1031818eb280806adec945097532523b9415784bc13c3bc180a0734001
- MD5 73463940baee64e21a9f88636b390430
- SHA1 b31aba31f3593346173ecd8aa70e38799a96fc39
- SHA512 e338128feb065fdb4927f700bd85f74a9ded05bbe8fb1d3ecc5335e71f5d31f0c93c0f9e97e14196d4cb2fe61c37a66d3fda8478ae6d699e74c3a74d61f7ba17
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy20u:A3k03kHRJARJG
- TLSH T16C259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 955KB
- SHA256 fae9a5a3b609b64adb8b961a2f75346d3ee28ef9565873c5076672c8f7634b3f
- MD5 39e2a00388a9f081f22d1b03a9748a9f
- SHA1 9cdf8e9ba434728dae57a796f22fc46ca7512274
- SHA512 f43797b699ad5007f99b407c0b18a9767d1e1991b48220bc8314285aaf371c38ed570999dd418862b57d6ebd3eef99b4adc9f82673ac700c09313822c89a2033
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2Fj:A3k03kHRJARJ4
- TLSH T14E259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 955KB
- SHA256 8dcf315702216878fe08800b29d5f93bcf4067a9328c1c87008bd323747ab6f4
- MD5 c9932dd9193dfbd581b38dceaf22a08c
- SHA1 191678c85861113db93d0df14ec4087458b3a08c
- SHA512 54e73c092bbc542bcaa7f3ee3f87fede66f021e44faaaff7e35748d926db7cc6756ac0ce63b1fe43501dbf069d743d5c744d0cb7ab049a27b9feed9a05fd3f29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2Mg:A3k03kHRJARJA
- TLSH T112259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 955KB
- SHA256 a237a5dd267dbd6941a39f51f5a50c4a0478be94b60b3f258a63a388370c89fa
- MD5 01307ec3874abc29bffb1e8f10f8baa1
- SHA1 a472032bca70341186ccb2fc8f1a7a8796aba35f
- SHA512 4808c69b59fe7d836ddbd7f64ae8fc321157ed40bbaaed450d8f326cf685221276166b030839e0d8e40c18abed550c58a4c8152480d34df28ae6c4cbf905bfa7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2TI:A3k03kHRJARJB
- TLSH T12D259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 955KB
- SHA256 b47ee1bb53f416b3c6ee0736632e7051d58e322e022139583f34b303ddbe7458
- MD5 76ca14886f175c3b38d902151ddcc508
- SHA1 bbd8cec79b2de9a03850116b205a4be691746d44
- SHA512 f1d67d46ae95689927f20aeda1dbcbf3d9358588440dfead9129bea156d2d31af74a8e8670911750658df324fd8f0fea8a89361da8f7941d7f5bbe0dca2ef2ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2po:A3k03kHRJARJf
- TLSH T108259D03F79900E8D15AC1789AA69A22FB757C561730A7CF2354C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 955KB
- SHA256 4647a8b92327fb4dc0e33cfc8aa09ce4dcdb1cd915e97e9859fc09995600068f
- MD5 1b915d2e686448e3e502c94087f8fb02
- SHA1 af2b4c2dfcff6ed32e8d61b47a725e3ac1ca1214
- SHA512 13062749c75664040b00e868e87e3f5f86ddb31e1f5d8697812635184fb8cb389a925fefa1474d011f2c54438ba811ca407005ffd61bb25b1cfb112031f7d2e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2a+:A3k03kHRJARJq
- TLSH T11B259D03E79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 955KB
- SHA256 38b62c5b9ee020b74029688604446a0a33d9fade0ab37cbf69b2aaf03f3cf7f1
- MD5 8c21470ac43432d6163505e53bc4bce3
- SHA1 4ea3685e49cdaf06913f600812312fd3a5de31cf
- SHA512 5db1efb97e67fa668cbbb38657edae91b743fac59f0df26f800cf5afef77be90079930ce324f49e80b91f99eb8bedfce39d6c232f43b5821351119267c540e0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2aQ:A3k03kHRJARJu
- TLSH T161259D03E79900E8D15AC1789AA69A22FB757C56173097CF2364C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 955KB
- SHA256 f57bd9c9e6c9dc150f5a02cccb8ef55c95145299effc6ff202016a33bbe5efd0
- MD5 b6efe319d12b1e6b221b366f5d57bc7e
- SHA1 07a5638827874dc2a8c142348e7ff211a1c567a9
- SHA512 7407339bd6aa2999f6f705e5901254a3fc89adc4cb92f869ecdaa1ecfe72ffd906c8b940cba840cdc9d98976802e5475bd895d4e255db141453163f43b62e179
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2rX:A3k03kHRJARJu
- TLSH T156259D03F79900E8D15AC1789AA69A22FB757C561730A7CF1358C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 955KB
- SHA256 72efc6858957a042dd4d1af5b61966aae44b1b06fd8e9eea9df321ec250e0fee
- MD5 a358486f8f0a7c164fbcbb80556c6880
- SHA1 be91e3d31123d2a45a86119da2beae840bbdaf20
- SHA512 55976855aab54ea241593fa9f53def755b3cd0b754cfe0b9c339c3d3776d9382fc8313b744941474d03a60b15aee7ba5bef231eb0eb3bdf79cdeee6964620e8f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy25L:A3k03kHRJARJA
- TLSH T128259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 955KB
- SHA256 c47b01d23e276b614c7be8586e5631dc0bccfeb05647fbe801881444e6f0c776
- MD5 e48b70001184d8c8e5f95b6e6a4cbf79
- SHA1 e4215d6477656fd0377789d93534f927c5099699
- SHA512 1d20f057b5ca7919226b4e17f324b1634c64c57b199d642361819d1f98657b6c14bfbadce810f5bd8af74c467a667c211c645cf87c144fefaeb89a185ce54f27
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2nM:A3k03kHRJARJR
- TLSH T178259D03F79900E8D15AC1789AA69A22FB757C56173097CF1368C6162F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 955KB
- SHA256 697b76c62ea997603cb4462ae0cd0346ba07296c3a991d0b2ff6f7bfcb7fabb3
- MD5 228c3fa77247727e1bf0b4b34acedfbc
- SHA1 c90516f358a3de9e3cb045a4df2dae436cb86e3f
- SHA512 e491f2d9d66a35912fff049070f429c674db40c050035d9a6c464f27fb020a0e0213ffd12d3da16ec119b2e342f046b6398ec724df3a6d51fe4024bd92aff268
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoojQyavy2Qh:A3k03kHRJARJj
- TLSH T11B259D03E79900E8D15AC1789AA69A22FB757C561730A7CF1364C6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH