Analysis
- max time kernel
108s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/08/2026, 06:31
Behavioral task
behavioral1
Sample
2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 862KB
- Sample260810-g92bdacn61
- SHA256 7f124eacf11ee4363ef803c9cc150b02935439c077f4d81a6cd1138cf4c6f408
- MD5 557b54c7964fa163862228cc42599c50
- SHA1 567d43752c433d455c9d6f88a8d58205ad205578
- SHA512 595ebd568c19748584337a44a72728b056313437a5ff15944d9466370bc22406e8a441d67c4ad4d557b6ccd7c99eefe549a03dea2efe6e0741ad2909b2098b71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGF:A3k03kHRJN
- TLSH T17D15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 37 IoCs
resource yara_rule behavioral2/memory/6032-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c470-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-9.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/6032-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2280-34-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c473-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00210000000170b9-279.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bb57-299.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198eb-468.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-500.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-580.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-642.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-936.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-955.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-986.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb65-1047.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1054.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1296.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b1-1850.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c470-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-9.dat aspack_v212_v242 behavioral2/files/0x000d00000001c473-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-60.dat aspack_v212_v242 behavioral2/files/0x00210000000170b9-279.dat aspack_v212_v242 behavioral2/files/0x000400000001bb57-299.dat aspack_v212_v242 behavioral2/files/0x00040000000198eb-468.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-500.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-580.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-623.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-642.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-911.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-936.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-955.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-986.dat aspack_v212_v242 behavioral2/files/0x000200000001bb65-1047.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1054.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1097.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1140.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1171.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1178.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1186.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1296.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1333.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1346.dat aspack_v212_v242 behavioral2/files/0x00020000000066b1-1850.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2280 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files\Windows Mail\wab.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ielowutil.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe$ 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 47 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6032 2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2280 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_557b54c7964fa163862228cc42599c50_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:6032
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2280
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 862KB
- SHA256 7f124eacf11ee4363ef803c9cc150b02935439c077f4d81a6cd1138cf4c6f408
- MD5 557b54c7964fa163862228cc42599c50
- SHA1 567d43752c433d455c9d6f88a8d58205ad205578
- SHA512 595ebd568c19748584337a44a72728b056313437a5ff15944d9466370bc22406e8a441d67c4ad4d557b6ccd7c99eefe549a03dea2efe6e0741ad2909b2098b71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGF:A3k03kHRJN
- TLSH T17D15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 961KB
- SHA256 e725fb7c402802bd1ed56a16a1df19c897927233312a8dcf4375842eaabc084c
- MD5 2f2dd71f038dab4c0e7f085bda2551d1
- SHA1 a0aae343d81a6547bbe971d2333d9d06071dc863
- SHA512 e98e3765fddeddea0036d84bc4089f412a685d649d9a91de413be75dc5b0ffdf2ceaf83df0d6680b6938311196cc374476db4798139577e134cee3b772fb89c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGy2MqDBxc:A3k03kHRJxMqlxc
- TLSH T1DB25AE13E79500E9D10AC1349AE59A32FB79BC52176097DF2358C2152F72BD0AF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 80ab20cdaa683c7dbe411772db368f33877ddd2d93b0d2c4ea9d42f61f50dfac
- MD5 c980a912fb7c3d4e967bccdb92b3b160
- SHA1 3b0236afa47721cdc17472d1fd68d94802721b03
- SHA512 c5bc171bb9962bbf4eff6ebab2b1460aa356125757824bef3cca5400335314f292a92dc19dd76412174cd55c34fe78cb443bc9ebb89aa08022dff58f7f8a4d2b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGB0Le5ji0hmxNrM:A3k03kHRJZPji0Aj
- TLSH T1C6658D17F6A402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 877KB
- SHA256 3e0a766f5632d5816400ab4dc2e8fb726e7bcc4be7738c6b5043d54e160a1944
- MD5 f23c6a2975d58f8fc69b52b008bda18e
- SHA1 9b0f2e2c62def110065866bd8a333dba6ca35622
- SHA512 964d10996613c2d9bad2587f62015df4c19e541425a53f4f622c707e31d19c15a46bc74340932def85101c05dd2103f9b9ffd0ac9a4123a4bd9ff76f4be62401
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGDa:A3k03kHRJ
- TLSH T1B315AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 910KB
- SHA256 5d8f0a395fa27ac8c66fba357c18c8c95c73c57a69743fc8ecc0e1b3a47d3df1
- MD5 7168e792cb7d6aebd24d09ae2933dca8
- SHA1 bb52fabd796d9a69254e2a5decf974bdfe1bd787
- SHA512 a10ae860882b0bd407d1a1c327583ddb63dfaeb123c53743e5fcb3a8a25b750dd32dbcae10ba72b4601cb276ff9fe3aa2d7d178554703de9b7f113e99189a0a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGQb:A3k03kHRJIb
- TLSH T149159E13E79500E9D10AC1749AE68A23FB75BC56277093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe$
- Size 886KB
- SHA256 0b819cd0e1c417211ac859490d1b043f3cef03de57b7c4dd4b7f52aaf7f4045d
- MD5 301c9a3375097e63024dc6fa6c21b8d2
- SHA1 d62a625c32be28aa01b64ff51ca911cd75e333e0
- SHA512 d46e5ca2ae41bb719c961ab8169998aacd636e12bd6c5d41a6c124990f58af27d4b017de25efde9f0b89d4a281a3bf95309157cc9e4482e34f9bcc94565a354d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGLp:A3k03kHRJd
- TLSH T15515AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 886KB
- SHA256 8abdd9f1d82546d1ba061b424c5d67a2438aa21231f218de15ad2a5cd02e5e4e
- MD5 cf3e33d104b0ca2fdafda00364f002ba
- SHA1 3f965b22d4992afc0c0ab9fae6a007ed749c6b04
- SHA512 6139140007ed0c79a6b6988b9a9f78fabc994a3562ca8de7e8554a63600bf7a787e31047f57067f6be63ea53f169240ee2ed5808368d3d740a2cf98015519a92
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGEF:A3k03kHRJE
- TLSH T1D915AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 886KB
- SHA256 11601ca827b2f8d855d1e55ff47e93a6f548a6a30474a356639bf09e7a5d5f11
- MD5 900c5a7f7b0e896ac67177ed803681d0
- SHA1 cb36ac565aa491b4247e9be93d478e7161948dd5
- SHA512 6d34e5b392981449c5f6dc9168e5cc6d6ab4211926ddddf5c2a5f596b3ad004906591610cd748ab91a578303d1e332fa65a9e327e56167bf6c536c049fff3d59
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGhC:A3k03kHRJw
- TLSH T1B115AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 886KB
- SHA256 407f697e74d9e619fd8313d1b34d822434ab65f1a459a6e6ee43054dc494dd2e
- MD5 5f29e0427adb9633f0f0d3a18306e52b
- SHA1 991bb11814dcf168f2060f23640cc278edcfc574
- SHA512 7ff604796cbeda387924a0e9148f870502455ed4e2f9b6c6e06e59c8d5a0050216b9eb5a81e7f355104ce936abd2df63dcde33ab7936ec3aa5907ede7a144732
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGiw:A3k03kHRJN
- TLSH T11015AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 886KB
- SHA256 23a44b941c56ef7cd9ce9e5f524dc7bd1b501d2b497fc987cc854b427e3c2feb
- MD5 153845cda28d5fdb475d7275cf0bf731
- SHA1 4d8dd1a8243521d3a4ba07aec4a058f387a7b2b5
- SHA512 94b0056099b12c72b8d7fc2b3934865cf7d9d8476aa770f5b462387186ca0a8eef8f2179800946bf1819f6aec6681d4aedbd0217fcaa4c88173675a2ec42189c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGpT:A3k03kHRJB
- TLSH T19515AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 886KB
- SHA256 eccbacd281c31ed7b98224acaea029684d7648e05fa32258722083a64d45e7c5
- MD5 a743c2dba061e00664ce1c649a6114c3
- SHA1 18549cad85f915318704aad50f384436f6cc4fe5
- SHA512 9b55911e9b07310bddab5d7e36e2d7ea86f15a177936f61a18062bb423203cad307bc96542ea36d5e1b07b3e8b2b6ca8022420862dfc79af39e17a87b28e6056
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGHu:A3k03kHRJ2
- TLSH T19115AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 886KB
- SHA256 aad381c8e18445ee996084b2bebee7e2639abcc2c6b250f0093d6a825c72aab7
- MD5 3aa91589c72c625bcb4bc3e3f8df7af7
- SHA1 ca5a7ed29eff837127d11182b62b808c90c90f5a
- SHA512 2156b11d0786420e4789bc5de25d8776fd00e585570cbebb0693e91fbcce232b93c26325e94b9441c5343e14051484eb8a7abb7f8d8c6fd1ac0c32b1f738e483
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGbb:A3k03kHRJH
- TLSH T1DF15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 886KB
- SHA256 e8af62732204526209217355db759e14cda4dc0d016d9ab89672c8d6b5f5ccd7
- MD5 2c85ed6fa1baf757af0acb1368f1edda
- SHA1 efbcbf97d2a84027bbafcc3dca3b288879663a4b
- SHA512 79fdc6b429e5213295259b8ddc48e61980270e9af8f80aebc135b9e406280e0a2ccff52f33bad40f3a8c9c75e6cfa241132a21d5b82dc3aaed3f04e6d4ba8755
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGvf:A3k03kHRJv
- TLSH T1E315AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 886KB
- SHA256 8715b4ef750b075bd1e50542d3e4f1beac42c92c4bea306e8875b0da33047837
- MD5 6f44fafd9da6b6f8f79c12085b797eac
- SHA1 61beba605cc9111183603094f0f68ced9ebccad8
- SHA512 082fc70ac342bbd231674b515d8272b9ce5657ebe195e0f1be6685462bb2837cbe277b8ded5eaf0fe10ed07c032fb461fd13046340d4494123f4714224e59fb9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVG4K:A3k03kHRJP
- TLSH T13D15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 886KB
- SHA256 2ff4535e09a35091fe0972f586c434946bf41c3d431fda35aa03246a02d032da
- MD5 117e8c0f4aadf08ec91e6c1f63edfcaa
- SHA1 8bcaa4b0afc86e4087a39a8b19b7577bfbb2b4c2
- SHA512 7cb3cea15de21690f01085a871f170ba8f5c8ba0b92d21960f7f58cdf7e7fa423a6ef5af52eaee579ac4fdab719b5e5ed18df9d71b9544593cd28b93be0674d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGlk:A3k03kHRJa
- TLSH T10715AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 886KB
- SHA256 e60881cef22bed769952a7c06287b134623f333683f750cd43f46a9b25060323
- MD5 314b7bbfa803475f23170325543a10fe
- SHA1 e583d0c834d6da10a852b5d7f9a5687218709a17
- SHA512 7598106ad7e2b52779df514d73280462df09d49a17a33e3073bbdb029d92bb6ff26298089b4e6e1578c8289798143e2631f049e25ce2ee8b4a450a01584e5c82
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVG60:A3k03kHRJv
- TLSH T18315AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 886KB
- SHA256 bc586cbc84ef3c0cd48d003f4f090cb615204d630bab0023b9fcf5ceefaa8cdd
- MD5 0e8049c0d3fdb6100cddab188521eff2
- SHA1 8de5027a28771dde666e30accc2b5ac19daf2230
- SHA512 51a39aca273051824deca546d32205a9b5cf6fd1854ae5b34adb12efe3f8c8e9b25a1122bd759dfe37c028e8ff44c939dbf644a81a107d3e90a37fddb7726ab8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGpg:A3k03kHRJy
- TLSH T13E15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 886KB
- SHA256 e7b99786cc0e80bc6de1d32b2028f6471b879e14a415eaf3ce266d304c73ff27
- MD5 db6fff7a479bbfaf8a6d2adac1e83621
- SHA1 0315942ca7e74083af67d07314c41eb340c5f011
- SHA512 9a4c090c9f93500245b057404a0a6a319c5543ebd520c2bfc49df5669422806a86d78111fa03cf4e00cc4a86c6316c57ffa40ca48100420e8a8775bd0ad67c5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGQr:A3k03kHRJ8
- TLSH T16815AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 886KB
- SHA256 3c4ae82485f3f1619c178036fd1292d09aa7ae5039ed8fd9cc39b09233a40727
- MD5 1901ae250ca7634f2313f44582a2e308
- SHA1 ee358f5b40d83de424dbeb74f06d44cbbe4ee944
- SHA512 5f780d533c1c2d87c218e167ec12e76cd69713047d11a0653cff6dcc925f7d097a878c8c3493dd9bd94246ad965065db4e7a050d965a8e5ad10f0ac5f13f4b2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGOn:A3k03kHRJG
- TLSH T17D15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 886KB
- SHA256 e30484a6fb4526e13eb8f9fe0a349e0d40e11dca90d4b2b43fe832ed59e11256
- MD5 bd3a5df0331fb4121d15c5fd9343fcd9
- SHA1 8c981497bf0974807ddfbb7fa700d18b98ce57db
- SHA512 10858c4fb05ebf6665551e7315d8a0e6730817cec3973b365aa16a8800972a62674d45605df9ad31850ce35a29a41a5c7eb3780453b737227846edcce477b98d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGEx:A3k03kHRJc
- TLSH T1FB15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 886KB
- SHA256 c77de0ebbec07222a6a67413e299738a86cdb1169db31859909efc19d9e326d5
- MD5 4cd795f180a05a2baea729a9f0da2aba
- SHA1 6ba1ff4158e86e8948aa890cf685db64499f9566
- SHA512 714e8078d335b3982e31579c621e611c2bb9cd8c56d5053fcb4a85277ee246c21a2d86759550689f720358eb320628e421803efbb146b57c6eb1d7439d1d475f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGOA:A3k03kHRJn
- TLSH T1C3159D13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 886KB
- SHA256 99745ac935e6a6a1d93dccdd865c0e01fce0ded0682ba873da21ef42a83c9675
- MD5 cc6afa7971e5ad43b52b5f8a191e1f76
- SHA1 7b4e5ceb139407c4d6e920d29b4b7e96d244defa
- SHA512 a0706728e8b538f3b7db06f28207744d8b18736d95a16311407a250806e0666e38f6d603aa3c82f9afe87a83842eb4b45259a5f98a8e0f00e3c8f0390965f9ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGH9Q:A3k03kHRJK
- TLSH T11B15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 886KB
- SHA256 f4f52976573e3839f740ad2c555f9d25651d009756d4c54d98996616f12e78db
- MD5 73c8d6d7040107da5a1513514445667f
- SHA1 f470baf1a0c0a02a2e4ba22d29ef011cdf25bb56
- SHA512 bde6b64ac43f44377ae9c272984e280a5d51577e6629bdd9cb4b389002bd8a50952b6eb096135c48c2baa8faa941d2e1c5826071b95e9148f301f643521f92e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGO4:A3k03kHRJJ
- TLSH T17F15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 886KB
- SHA256 c4de0bae2c4034443511c414af04b7a53a430b021cab1b02df1bf296dda1dcd8
- MD5 9fe962784cb1a6d828213df4bf3309a2
- SHA1 40f98ab91d24aa2e79ed6caa958ce6caca2fcdc9
- SHA512 3e858a8ded6f755da6573a74f63c0e9cdb4a5d4b7430f8775e08bd8e834138a5637c0d68076b8c9fdae9768d563023f6a7a6b6a6006bdb7281bff1f12d6199d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGtu:A3k03kHRJU
- TLSH T15A15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 886KB
- SHA256 4ea68491dbdae5b18793fd573c2226e7bfc5ecac49eb5dc93fadff75ee5d6f84
- MD5 c4d655eb814277fd78a53a37f482823e
- SHA1 d12956da76ea703c68d299cc88335ac223f28a00
- SHA512 dd2844604233d8493a4dbbefbeda385a7345aa9fc513ac7df880e9601704887b5890a78c1dc7d3346a043ed9295852618f4d41d627a3154b75b16a2b4fb038ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGgj:A3k03kHRJ2
- TLSH T13B15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 886KB
- SHA256 fd4cdb8f6172da793b335087a7e619b5beef5cb1540b894f3fc122f7d3b353d0
- MD5 8c3a7173c41d1ca2db9d1bf21eb4df5b
- SHA1 a45d2f5e5b2ab3b8b8a93a0e086f835f374b29e8
- SHA512 a4088e1094921306682b3b3feec289757a4232d331475aa22df2519b6209b80d14dfe1d601cc8ffae098cf995fea3fd9361bba339564e1972060a7949eeb2337
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGRg:A3k03kHRJa
- TLSH T1CE15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 886KB
- SHA256 a7f10746241550f960bc1c70b51b685d58a783be5ba9d2f2dac240e2d7ccc227
- MD5 df0c55d6fd360021eee7692d571f1c39
- SHA1 1871344266884c476465be39fd5b95c5a106a14f
- SHA512 7abb3d3fcfd34d222d8da5d6024c1cbdf5499eabe6c3828f6bcab0cd796afe4b5020e1b0a488efc2391447a52afd4b2977e2a9a2091bb720ca1f374a9be426ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGII:A3k03kHRJb
- TLSH T17015AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 886KB
- SHA256 02213d1dd557ca1a2f3f3ebee70d3598bd5a7ce0764a0a5ce57993bb15118b14
- MD5 7441237597a846071977815070b01f4b
- SHA1 159eb6c42f7c954919077485fdc1d4bf639c36a6
- SHA512 0876e185d412a96260b844b0996dbff0a91cd80253fd0cd884f23acc8b20fe8f65607daefed5a16fa0d06e221709d2ed8bfa6a844f4183983f6dde534884247e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGqo:A3k03kHRJl
- TLSH T1A415AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 886KB
- SHA256 dcef90f6dc1c940e155e127336dbad0859ca3c6e6fbbd76da295bc59f3386a4d
- MD5 d9085718b6ff781f624b429c4143fed1
- SHA1 aa350ce800f04d8e18dbe32f6cc7129cce0674ed
- SHA512 14922a5f1df96d6f0a840285decc124ed3ee6ecb89deb8518bdacfcd184f0166cb7968077a50a5ac6f5b7110a2375c484d4a7837dc6cd257232f1248ca77c0c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGB+:A3k03kHRJg
- TLSH T16315AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 886KB
- SHA256 4cef7ba101f0a48219bbc4c6287661d3bd18f76edbaa483b8e6d60159d91979b
- MD5 bb987068463814ed0bfa5b4df5e55ead
- SHA1 cbebe3e33cd094a4c6db3e30c4836ac9ebdee53c
- SHA512 adf6aca1a89ffd9684c567ca3711019e18698d447659b762e2e4a5e03d605ae09afae3d57217af3fc43f19a186aac2ff71f3932efe9a2efb2ed07966d501b9b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGPQ:A3k03kHRJw
- TLSH T15D15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 886KB
- SHA256 bc0556e0551604b5b9f74651fa1da0bd0c43d6a6808f10bf5554589c159141c8
- MD5 bdbbe550f66f05776b5a06f7ef15c416
- SHA1 fd7ed1302ad10c381e61e36dea3290fb1e6ad00a
- SHA512 823749209fe2492c5779ac9a199e5737f7903d0f0b359ed8b68aca5acfc99aea1136f9bca1d964fed5eddd840d8566bb4a8210b2c71abdc71e5338953983b8c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGUX:A3k03kHRJA
- TLSH T1C115AD13EB9500E9D10AC1749ADA8A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 886KB
- SHA256 beb59807c12dc9554d2bb69e933de821834acbafabb2c70d7f134046f687d9ae
- MD5 b6e283d68ac54891a95779bac864241e
- SHA1 ff68e4139a121615535b05b363d5e338f94837f2
- SHA512 3951df998e5de15d6bb504d13ae4f3692af89029f63f661dcc873aaf477805da85a01e92e132cd3984201274c6cbdd5dab2c492dc4df4ebe8028351eac140a4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGyL:A3k03kHRJi
- TLSH T1E115AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 886KB
- SHA256 f6fe531c03f33aa2d26ebd4969765d87b8f35f200c850ccef8c01d0f622dcdb8
- MD5 a065778fe506b250074c7e3ec5e93c79
- SHA1 14cf14f66a45deef24af16524da1c871404f986f
- SHA512 a3cb5eb59116a634c78bf017313b762362d661f930b674d7dfbabdb33f50fd375a6b47c19c2e4c8376dad796e633c7fc0f4024fb1cd984ac99706afa90087e77
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGWM:A3k03kHRJv
- TLSH T136159D13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 886KB
- SHA256 3a0ff72456fd5d1ff2d127da7097ebbef842ba55546d4c2600a1875fc3330d70
- MD5 fbbbe398a657a07bb8a8d2e7cc5de44a
- SHA1 44e5a46f93ce81dcd045e349f8c40bb3be354652
- SHA512 c75941e99cbe96b2c9a72eee12c024cb3fd506d19c0da60612090a641c18081006d6e3ce92ee91263fadb649c54c171611d3297d979d510835bfee8b3922ebf6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQfJC5YLfVGfh:A3k03kHRJh
- TLSH T1DE15AD13EB9500E9D10AC1749ADA9A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH