Analysis
- max time kernel
97s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 22:46
Behavioral task
behavioral1
Sample
2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 912KB
- Sample260811-2p7b4stdlg
- SHA256 7f4146af28c8afe192418b75794d98bdf3335c01c3c6ed17f320d689ff57a1a0
- MD5 5e5ebe93be5650149a693a0c5ae298b4
- SHA1 447fb70bd59bd38d813b6c8957e44da7cef2a719
- SHA512 1e2f59027b5020e33f7e5da0a6596e019c18103599dd4898e074dabe94020dd7d4a5f3c9aaece9b9cf36e37609b99cb336ee6284aee8974ce27a6b64510709bc
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGg9:t/sCv7rTiw2RYwZCUsjwSZGg9
- TLSH T138152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 32 IoCs
resource yara_rule behavioral2/memory/4232-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c553-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001b2cd-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4232-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2844-22-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c8a-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ba8a-337.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e8-470.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-593.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-716.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-784.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-821.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1085.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1159.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac53-1323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001ac51-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018912-1474.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018918-1517.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1556.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c553-5.dat aspack_v212_v242 behavioral2/files/0x000400000001b2cd-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c8a-59.dat aspack_v212_v242 behavioral2/files/0x000300000001ba8a-337.dat aspack_v212_v242 behavioral2/files/0x00040000000198e8-470.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-495.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-593.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-625.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-716.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-741.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-784.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-821.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-871.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1085.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1134.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1159.dat aspack_v212_v242 behavioral2/files/0x000300000001ac53-1323.dat aspack_v212_v242 behavioral2/files/0x000300000001ac51-1368.dat aspack_v212_v242 behavioral2/files/0x0008000000018912-1474.dat aspack_v212_v242 behavioral2/files/0x0008000000018918-1517.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1556.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2844 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\dotnet.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe - Drops file in Windows directory 29 IoCs
description ioc Process File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4232 2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2844 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_5e5ebe93be5650149a693a0c5ae298b4_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4232
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2844
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 912KB
- SHA256 7f4146af28c8afe192418b75794d98bdf3335c01c3c6ed17f320d689ff57a1a0
- MD5 5e5ebe93be5650149a693a0c5ae298b4
- SHA1 447fb70bd59bd38d813b6c8957e44da7cef2a719
- SHA512 1e2f59027b5020e33f7e5da0a6596e019c18103599dd4898e074dabe94020dd7d4a5f3c9aaece9b9cf36e37609b99cb336ee6284aee8974ce27a6b64510709bc
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGg9:t/sCv7rTiw2RYwZCUsjwSZGg9
- TLSH T138152A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 941KB
- SHA256 d239dd9157896a02c93741dbe8bf518f149c4add0074d6434032c67254307843
- MD5 1c79f4bd4dd489df3c9ca00c0524caed
- SHA1 b74fd19e10d0d9b38d23ce5f24b6ee6cb6cb2668
- SHA512 fca8d13862bd5ba864e8179797453e337f44b9103ccba17345cd46635f05ba4306198ba1109089dd1b1cdf212bfe99d90d78fc5e9bd262d9d042dc9e0429f228
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgrP:t/sCv7rTiw2RYwZCUsjwSZGgrP
- TLSH T187253A1767EC4895E562A53089B58616EB72F8551B30C3CF12788B2D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 958KB
- SHA256 78bbe2f51cd8558bc0eb2d0ee49dec28df2a1af1663ef362f7b127c3e691179a
- MD5 7b9c3831ead49e62dfc179d04f6744dd
- SHA1 b2f3b7013b436ee1528bd78696f9881aec6167e5
- SHA512 035e009cf50e00b6a02c24b8e667e5e86254d29a4f2f3156dbf5f041e1cd2d79e848d68970fc0322b7d8ac74b05e3195259676612bc2770dfb6250747336eb1a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgQ0:t/sCv7rTiw2RYwZCUsjwSZGgQ0
- TLSH T1B2253A1767EC4895E5A3613089B58606EA76F8551B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 964KB
- SHA256 7bbbf6c0bda3634fe06fb52b98b5ebfcb96c655a06747d4a3d5ed202a845a247
- MD5 1589d587f24e19450ef358b92be7f056
- SHA1 defe010207083faf923f599064adf8e666795e3e
- SHA512 408e4a530e758bf0de313c50712ef5fedc537e8373cbe886aed3c338544a5863d268e1e4680be4f1acdef4ed2cf976846f883431f3108cf7b85555bf64ad9f95
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGg2Ffj:t/sCv7rTiw2RYwZCUsjwSZGg8fj
- TLSH T138253A1767EC4891E4A2A13049B58656EA76F8551B30C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 ee6398e5f4646d17b32308f15b84a0212cc5d9fd0ac7e6655bd22a3df004fa13
- MD5 af5ca77b9040a65c678fedee49c4e502
- SHA1 7bda0bd515c9975fcd7022b879358c9805e7dad5
- SHA512 40509a1785d07a1e64243d54af98691948261bb53c7790e4bbceaee175d0edf01cb3d2b9a38b76ce8a6310d25122ada98418ed31df8942c2d7a003572713312b
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjwSZGgJ0Le5ji0hmxNrM:x7iw2TIPji0Aj
- TLSH T16C654A17B6A84661E073D174C5E6964AEA72B4461B3087CF12A8C73C2F23BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 960KB
- SHA256 dcbadff974923c665e7f7962bbd52b8f5758e6384722061182d0f3c09a71ea5f
- MD5 8bbaf05a39b4e04cd18473529433865e
- SHA1 1035d3749173956792c3c102e702eb6f0608751c
- SHA512 e5a071b043d2f96f99cb754afe08ac1eec010927c3aa386fae790b970786c111ade160cd1fcb487844185d7ac5bf08b686cd1603381619811fb7c2fa51ce7ca6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGg4b:t/sCv7rTiw2RYwZCUsjwSZGg4b
- TLSH T1B5253A1767EC4895E467653089B58606EB76F8561B30C3CF12788B2D1E63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 935KB
- SHA256 5cdd8530762b770096062a30ae09e898a9f9bb1f2b31bfb8e07f0c518ad9c0a7
- MD5 598333437d8f5ce53db2497efb51afbb
- SHA1 abe53fd0313061cdb020f64c6def8f0b0c169906
- SHA512 ecb82394f2ae1c4c99de626f076ef49d0247a14063f6029518820c28d3e9ddcc51c552de343da2d366c8df5f01eb9f957e95638fd894b4561b94ae9b0c889fed
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgwK:t/sCv7rTiw2RYwZCUsjwSZGgwK
- TLSH T143153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 935KB
- SHA256 b9c9fc856bd7089f713fbf43d70f790a3df46bf51b7b166b765c5742d065e76a
- MD5 50788e65e96662fb980df2ad620d0a46
- SHA1 b2f9fc6fdc77b06f2ac6a372edcd49b798d32fbb
- SHA512 8d0cf56ebd0330b338e019615586241ffb603b99c8f0dc1a96dd6c9732b9bfae07740b9f63e3f76b8f1d1f24e58151cfda5b1f56bcb73171f1d84fe75aae3ab6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgtk:t/sCv7rTiw2RYwZCUsjwSZGgtk
- TLSH T10D153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 935KB
- SHA256 4641d9e82a68f2fd6499045f352e2a7607aa936ef45203573d21d3afa85441fa
- MD5 b5cd06367c8b57b9355e1ced1d6d855f
- SHA1 57722292d84783ed3c32fa3c677ca129057e5bd9
- SHA512 7fc82e50110eabae0ccda0109be0d5b66deb79c4dfacb7f05be876873d8800cf223f094cc214b59ababbe269d9025da7f98b5785266af9f2f78a3d6251f0b159
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgy0:t/sCv7rTiw2RYwZCUsjwSZGgy0
- TLSH T167153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 935KB
- SHA256 fabd2db697430a47e40d40e8276b542aea6a49c1656ce88e035debcc034f827c
- MD5 2ce04281b1b96bfa2a567b87311945a2
- SHA1 bca484a4ca646c3926c95e0784a22681aff7c872
- SHA512 055ac19668b027476e338a4398b345201ac214b9168e722f648113fd342e0db52c74e25a6502c6344ab4bf2196b09553fb7936ba5a9b312880b7ca3387bb6886
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgB70:t/sCv7rTiw2RYwZCUsjwSZGgBg
- TLSH T190153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 935KB
- SHA256 d22968886526f353e9a0864bbd3327b870dd2a48fc6ffe1239e70ebdba2383c1
- MD5 dda2553c443f37fb5171fc716b73f6da
- SHA1 fe929889331773c36b0f77cecee83e1ca96b2c06
- SHA512 afa1c5034c0d2bd55b3a9ae785bdda8017c8f8fdcc240f2dca8c3a0f4bed96674c4b27073c44e7df3a4ffeef4cef63d177932c3806ed65b2969fc45e9207b165
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgor:t/sCv7rTiw2RYwZCUsjwSZGgor
- TLSH T1E4153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 935KB
- SHA256 949a487bf352e9ffbc1dde7d7e0e0f450a20709cd2309285a490cdff2ee991f6
- MD5 3447ee230781f561987010ba55525937
- SHA1 d5acb050bac13c97ed16efedc67f2b1c16eb439d
- SHA512 16d5a5c42f39ddd375613126d6946d6a1a5eccee5cd7953b002f35d8da4a8313eca6706d4dee88a0a727c0d9198374e0243c0673a01aaf1d750a27e9e4ecb3ad
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgGn:t/sCv7rTiw2RYwZCUsjwSZGgGn
- TLSH T187153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 935KB
- SHA256 a7636586c23d7d7541ea60edce3e38c2ae6de5a88082a015bbcf9cf01ed96fde
- MD5 95e29972243856f63f08ba0656e1a768
- SHA1 8c27d66f5c4cffc6b99864f41ae6f45cafa39db8
- SHA512 26e5cbe53e3cc85693178be1eeaef2bdfab47bbc04c829d029726776a4c75ea3c9b2ef333d7419f338d21339cef13ea8b275714738eb1418dfdcbb1d0af5e5d6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgMx:t/sCv7rTiw2RYwZCUsjwSZGgMx
- TLSH T13F153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 935KB
- SHA256 7c9f28ddef01ffd7ce0d8fe64268a2d157a36d963e33ec0b20366f963392af45
- MD5 348e6c0dd86e0b701674e8a66bb2989f
- SHA1 1617deb65d65e81e6802294de8cb2ba041655b8f
- SHA512 681a88904d6429e452b3e3c872262b77e4dbd5bf380cb01e6526c42ac1dbb63d1500a24e06f5949a95e60c15ccff4172dd5859749ea07b272a3e8b93c8b8599c
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgGA:t/sCv7rTiw2RYwZCUsjwSZGgGA
- TLSH T166153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 935KB
- SHA256 3b73da6e934ff07c0165509500bf30996c402cfd641ed2a5c219d4d7e0c64bdd
- MD5 d717f81d0307472766738d4acd307b60
- SHA1 424f8bb6a5462df13d6b9d1fde6360b8d8007f80
- SHA512 b8f952c961dd1c7041cbc977d88f60ab55190f5a8af44b9920514cbf5de9e9bc6bc0fded50dcdcf7d8721c4094f39e152fb6d9f735ab2da16981b8dfc44ce647
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgf9Q:t/sCv7rTiw2RYwZCUsjwSZGgf9Q
- TLSH T1C8153A1767EC4895E562613089B58606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 935KB
- SHA256 a1944af9eddb7775c8061fadf7b571b88de0ef5f7655e6f31e338fdd006765a3
- MD5 859bd48310affeed272bbc65e366a101
- SHA1 1ddb0ad43e804b52c0ba859b72d366b26fea7815
- SHA512 ff0aac0b2fae428826f0dac1eb704f31e3ca2c673c8b3ea83b9d5b022b2fce10c674f9398c5e1c138a5eaa67d90eca7a314808ea4a868931078fd602d7a4a50a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgW4:t/sCv7rTiw2RYwZCUsjwSZGgW4
- TLSH T121153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 935KB
- SHA256 c8269183373b578cdc4de6b8b40c8741e7cc3723d53a6616db1762d009219d36
- MD5 f848e1475c4042e68b01859227513796
- SHA1 4430ef5a9940b47c95b35cae47c4948b494a2889
- SHA512 01932015d62bae17e96f2becb6dc341a1b6f16a9316ca0d59afb59bcaeb187f6b866ef3204c98c62cb112e635fcbb7bcd2f593184d90e29ebc7f339a37707136
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgFu:t/sCv7rTiw2RYwZCUsjwSZGgFu
- TLSH T1D3153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 935KB
- SHA256 a6d91a072a7c5948cbf7ca95b7fcc44d5493be937d0004eb86e507b542a48156
- MD5 635662b01faea1c66adccbff5b953d4b
- SHA1 cb00435b7ad0eba1f65cf192fe45c48a495cbe85
- SHA512 ab3912b958c01188fe377dd915754619537d7fedf4456413b6d921a381f7965237698d8b2d06b2940f87f8527ba1f3404b106f2f0233eacb1888e79b5e5b6f97
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgYj:t/sCv7rTiw2RYwZCUsjwSZGgYj
- TLSH T140153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 935KB
- SHA256 2e07e12dfcf8bc237cd14d1a7a4d8e9c0c9c8a5218e6e03fab895ab9e2a04bb4
- MD5 53d3b531a8c154869445bafed9ff8906
- SHA1 9715ca00c449977206db6af0df04918d41772e42
- SHA512 5b77a7abcd544910f5e0bbd583401b2e0a9d0c10047e9dc37bd66ee51262e8944cc466773d4badcffe61f6f94ce19ce0a064391d2c2d2ee83581fd601c01dae9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgpg:t/sCv7rTiw2RYwZCUsjwSZGgpg
- TLSH T1EB153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 935KB
- SHA256 663b216428d51c4290650a2e7e8768fb8b503cb60f84b9bd3b695f51c1b9d52b
- MD5 1393d9da7e5f24cf640728952b8950f7
- SHA1 f9d98c91f9e724244e54d9bff8199f68bbfeb7e0
- SHA512 e5a63ce1057583aa4bfe451cd38b5f902c86344e2c4bd0b0a41207d91ade5c8ba0f4cbe67d862b9c7615301dfb8c04ecc1a11cbf9aac9477f7c1cfb3beed0975
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgwI:t/sCv7rTiw2RYwZCUsjwSZGgwI
- TLSH T116153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 935KB
- SHA256 303086a24efd00fe0c8de7f9c61789cc49079a96fa6a5ea84779feb6669b2e8f
- MD5 b22a4cf13e138596906aa785560f2e6b
- SHA1 7ce7a757e076008af33642a3791c26d01b182574
- SHA512 53c78a0d45c4cb84fd2916ae17ac13e69d3fca8ea776da2c2a542412ff9478968ab3d43d06ce6b16b893b60d6a18a9c985bd3f337da7d149632faba8839ed6b6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgyo:t/sCv7rTiw2RYwZCUsjwSZGgyo
- TLSH T1E6153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 935KB
- SHA256 05fea9716188298add5c06dcd4827bd1b9e3ecebdb5c0582c06493c2b132ca1f
- MD5 4082163cb09327da2045b110a76f5d0a
- SHA1 475fb46a98324bff7c50b3710705ded077185971
- SHA512 6552d6b2359f4842fcb875c23dda602f5d8821aafd460725ee272c85feecc72946c40b3bbe00001cb8378c273339cb15315a2afc82eb20101ee6187f550f47b1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgp+:t/sCv7rTiw2RYwZCUsjwSZGgp+
- TLSH T13B153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 935KB
- SHA256 92597f825ae99e69d485e8e0d118c8b28cae56db3636b65d89561635d61bac34
- MD5 37f1a6861f9b08e8cf653b49e910a5b8
- SHA1 9a5558a11b09c4afc4160c531adcd4123c7ab751
- SHA512 8040622395d63d3ad1a6a138ddcc080eb41e7ae5ffa05ded0ada03598767f2872fffe283eeee7972b2c09fd8b91aaba755d56151ca8b005d76f1d9df45388b7d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgXQ:t/sCv7rTiw2RYwZCUsjwSZGgXQ
- TLSH T183153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 935KB
- SHA256 39380e65c29d40b7d40de2403e6f7a3ad2127c19ab8cdf89f72469cf1b60e7af
- MD5 7ccf00e01ec112e453c7d944f6486201
- SHA1 341068ecd8203afdeaf284f680d8d802e9c77232
- SHA512 bb9df637dbcfaa692d45f22c04bf26ccffd950de715cc400595dabf00d732d0c8e70376a6d6074c8fe7dc74c1babf86fbc276241cb0f25d7f3f82f61a1e44c95
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgsX:t/sCv7rTiw2RYwZCUsjwSZGgsX
- TLSH T1E1153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 935KB
- SHA256 71df3482ecc50776709908381d636ebf6f8b8d4ca507320f72ffad8f0ef73a39
- MD5 fa4d09c106214f0a0f81acf527ed1466
- SHA1 ded878fbcd1eca456570619d48021d0dc3726a6a
- SHA512 811664d954f55282555035581ae65f10cf001bfcec552f2da2843d63203d2e9c3a63e4ca03155de2f88dacda40ab42fc581e0869159dae2154b82e61888f9154
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgKL:t/sCv7rTiw2RYwZCUsjwSZGgKL
- TLSH T11F153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 935KB
- SHA256 4dff6cb3444da74789cf08ab966be71e7824bb7600ac027e22ba9445b6ff2e60
- MD5 836034439cdd00cfac81c14f1cdeaea9
- SHA1 cbc79ab1f116ff8d58f841a39c9e16d28966e348
- SHA512 5afeaeba6aafdec3ed84bf0a9721b906bc624f610da14523cf9cd90c261614449c92af7ba0238d4c16e44da5dc86272dff7bf8fdaed2c7532f6232a1b555acf9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGguFC:t/sCv7rTiw2RYwZCUsjwSZGguM
- TLSH T145153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 935KB
- SHA256 f03c45d4dfac43e5119b38854830bd3bf89831539be2df598e2cba64b4047f4f
- MD5 7b72ced07ede140589ee17e6487d1401
- SHA1 cad1aabf57fe1249db837cebcf2da7048022c906
- SHA512 63ec990874feb23d9f58aba2d1a32d4a42edbe890d1041d1da55e4149ec2bb59c3bc9b7874220071b8cc68cfefcf740f7535695df1cb221fed1a6325904c89d0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGg3h:t/sCv7rTiw2RYwZCUsjwSZGg3h
- TLSH T130153A1767EC4895E566613089B58606EB72F8561B30C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 967KB
- SHA256 8b72ea5d84c771df37945eee1d971cc9c2e5e4be6ad86c8882a22599203a0f79
- MD5 6f480433ed0f26f630983196b4a5284b
- SHA1 86401bc2da464348abe4feb9ef8b1315e134cff0
- SHA512 f4bf7819666fb66c2cc9f1822ca271217c551371a985e79080d3ccfaf0bfe10fe4e25d59066e30e3aa6ae37cd7c0c86233e2ea52542bd273591eb61ca75a8154
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgL2+:t/sCv7rTiw2RYwZCUsjwSZGgL2+
- TLSH T1AF253B5767EC4895E462A53049B58616EA72F8561B30C3CF12788B3D1F63BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 973KB
- SHA256 35718663ad618282a965b4cdac9995e712f4f3728c7fbe79338a2cdd550ed266
- MD5 9e470a6caccb5b2950bc28feee48b2dc
- SHA1 bac60576edbfece522fd9e820c51f54ccfc1c604
- SHA512 725857fcacaefbbb61645914dfead4b552fd10a6f17086d7313ee0d4957ca98596db8b63d3385e8a566224e1939061dd115cc1aeed7b4f2fc2d62fe58a780b15
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjwSZGgv6:t/sCv7rTiw2RYwZCUsjwSZGgS
- TLSH T1DF251957A6EC4890E562753045A98606EB72F85A1B3083CF167C8F2D1E67BF07D3CB29
- MD5 SHA1 SHA512 SSDEEP TLSH