Analysis
- max time kernel
112s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/08/2026, 05:46
Behavioral task
behavioral1
Sample
2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 869KB
- Sample260811-ggshrscg64
- SHA256 c38302a7b48971f4a28c2542ac9fda85b90bd8c277dad30440977863ec1059bc
- MD5 27c6a88f6209d71cd774d5e6aeb81a55
- SHA1 d4e97dd9ab01147f1530c5859d41628559be051a
- SHA512 e24ee02f65d0d6e46aad3518da48d6d845d1a39231e841f0a68609971393dc61dadd268dd46af192cee1711345c2095758d56669298b12075a193999bba5d563
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa:A3k03kHRJARJ
- TLSH T18B158C03F79900E8D15AC1789AA69A22FB767C560730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/800-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c529-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-10.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/800-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2600-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c72-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c52e-191.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001895f-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018963-301.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018965-452.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a41-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a42-545.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198be-606.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bf-644.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3f-729.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c3-748.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-791.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-828.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-859.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c7-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-904.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-924.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-938.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-957.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-1012.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-1068.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-1129.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-1173.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1199.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1400.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-1402.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-1403.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-1404.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1406.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1408.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1409.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000000013b-2113.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c529-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-10.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c72-60.dat aspack_v212_v242 behavioral2/files/0x000c00000001c52e-191.dat aspack_v212_v242 behavioral2/files/0x000500000001895f-258.dat aspack_v212_v242 behavioral2/files/0x0004000000018963-301.dat aspack_v212_v242 behavioral2/files/0x0004000000018965-452.dat aspack_v212_v242 behavioral2/files/0x0013000000018a41-495.dat aspack_v212_v242 behavioral2/files/0x0005000000018a42-545.dat aspack_v212_v242 behavioral2/files/0x00030000000198be-606.dat aspack_v212_v242 behavioral2/files/0x00030000000198bf-644.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3f-729.dat aspack_v212_v242 behavioral2/files/0x00030000000198c3-748.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-791.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-828.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-859.dat aspack_v212_v242 behavioral2/files/0x00030000000198c7-878.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-897.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-904.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-924.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-938.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-957.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-1012.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-1049.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-1068.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-1129.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-1142.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-1173.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-1186.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1199.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1308.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1334.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1354.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1379.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1386.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1399.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1400.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1401.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-1402.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-1403.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-1404.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1406.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1408.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1409.dat aspack_v212_v242 behavioral2/files/0x000500000000013b-2113.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2600 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\updater.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe - Drops file in Windows directory 27 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 800 2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2600 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-11_27c6a88f6209d71cd774d5e6aeb81a55_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:800
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2600
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 869KB
- SHA256 c38302a7b48971f4a28c2542ac9fda85b90bd8c277dad30440977863ec1059bc
- MD5 27c6a88f6209d71cd774d5e6aeb81a55
- SHA1 d4e97dd9ab01147f1530c5859d41628559be051a
- SHA512 e24ee02f65d0d6e46aad3518da48d6d845d1a39231e841f0a68609971393dc61dadd268dd46af192cee1711345c2095758d56669298b12075a193999bba5d563
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa:A3k03kHRJARJ
- TLSH T18B158C03F79900E8D15AC1789AA69A22FB767C560730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.4MB
- SHA256 fb2e503a9086bf6045c1215fbf8787103d4f1de10f24fa3bea46c9ac55888b96
- MD5 33e57c9a8d7b10d64ba0341a074bfe10
- SHA1 19e9c0090c454348f33d368881a71186a9802e38
- SHA512 80c0d23406a10a540c8c87b8a5a60189fe01f627cda1544efc0a88413a8ee512ec74c77346d6b5888577499084b4815b63957f0df54384a5be3602f476c9f7ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaP0Le5ji0hmxNrM:A3k03kHRJARJzPji0Aj
- TLSH T18B657C17F6A802B5D067C1B9C5D29A5AFA723842073097CF1394C7292F67BE19F3A721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 884KB
- SHA256 73fae11627d1151d6230b18e1ac9a4a9e550560a0971c234f80a79d54cdf1256
- MD5 b62471328dc3d5584d5468ee191519cc
- SHA1 91b3dbc53a300d2a86b626ea4a424ead98f58773
- SHA512 1781fac56fa3bdce881ba3ca64938fd588dd000e8d320e8e20fc25fbf4f202455a0e4dc269392d56d3607d9b3e86a4b1ffa1dbe3dfaf6361ab949f708b5ba0c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaRa:A3k03kHRJARJ
- TLSH T127158C03F79900E8D15AC1789AA69A22FB767C560730A7DF136486162F73BD0AF3E354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 917KB
- SHA256 6f9d4b5c1e64c6463e9773e5271e7ef14bea49f9886298c88c85c6c444300db1
- MD5 c9bd935a8a3b3ea1c3d38d41fda2c411
- SHA1 0940f71ae9306c4706869b2a3e031016b06d7c13
- SHA512 d78ca7e57cc0596b36c7c8923ce748106d6ee528791d357fec397cc94cd5dcd7f28c7fec49dddca67192b9fdda9a38c823492f51ee6e7703dc3f88df1ba051b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZayb:A3k03kHRJARJ2b
- TLSH T1D6159C03F79800E8D15AC2789AA68A22FB75BC561730A7DF1354D6162F73BD0AF3A354
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 893KB
- SHA256 62aa7080646aae95b9ed3cc55784af13ed33f8d601154efdf6e65746fa40990c
- MD5 a06bbc2bea7dc793a4928efe6985ec23
- SHA1 2078fb3fe9f87051c0e5644377288a96dc980c8c
- SHA512 ec83ee1e8f880f3159d2c09ff7cb921929340ee48aa2777c38e588d3155b48cc362dba773c081ddd5d1078ad5988a0ab68499e4d766f82047cffc1f533228859
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa6s:A3k03kHRJARJz
- TLSH T167159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 913KB
- SHA256 f874eb85060390bba316d3401721df694681428ba09794539a3fd43b1e4c3878
- MD5 5448fd9459775abb24211d1a64c934d2
- SHA1 58a612d342c2b1d8b090b1c685526848827ee5cf
- SHA512 fdc077dec9452ef9af0b8f1ec337136c77747b4a4cc5f194a9374485981d34d5267d794bd60f372085e2f7b6e17244ed9f80c59bc1689cb24178ddc0766518a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZam:A3k03kHRJARJq
- TLSH T14E159C03F79900E8D15AC2789AA69A22FB757C560730A7DF135486162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 893KB
- SHA256 6cc828471fe924e5eeb57f470d3e963d0ce04ec92c835e77ba403aaeac6502e7
- MD5 28af5a2288f6c25d5f8046413e383b2c
- SHA1 adaffcd6a6483044ac898c0f7cc41cf6cfcfb31e
- SHA512 12d7195ab34ddcf728c08230786763ca1971f93be17d095283a1518a821ad06a44cb5fdd7cb8d40be86a4b3fd35164487b0062a9bf596a919fcae6f08c19cd0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZapZ:A3k03kHRJARJn
- TLSH T136159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 893KB
- SHA256 405ad9a7b739ac11a0ca09157a3704e97d28d2d3cd986b9d18bcb95d9aaea117
- MD5 023b25b76d81645231376b9f3bd4077d
- SHA1 af0e99e863bd04bc88e9a63c2a629ca28dba1dcd
- SHA512 160d0892342a7118aacdf5575ab071e013ffc018efc3690278bbc946dd98e78d0798abfbfdf8b61cfad624ff6c4a21dae344ee60a5bc1405d797f4325be67409
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaC1:A3k03kHRJARJg
- TLSH T14A159C03F79900E8D15AC2789AA69A22FB757C560730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 893KB
- SHA256 55e301f62ddd1000b2ed037313500a4704fc438d8a72e9283d644294245dca2d
- MD5 130bbd9d1433a6912712aaeba1a21f7e
- SHA1 8c9e5d780a6e68834ca0edc68b87171f7c5618eb
- SHA512 bea7fe57862ca8403ce6a96b757a5468c9dadf509a5a6b55ddb3328084eb726ed35a1b2d7f62777c1b0a388d25ca7519caa034571bb77cc879c7559d6a576842
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZao6:A3k03kHRJARJb
- TLSH T131159C07F79900E8D14AC1789AA69A22FB757C560730A7DF2354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 893KB
- SHA256 f0ca11bc02bbbed2f9f29ed8e77d297652c4e432fa5153932d6d6291814073e3
- MD5 2a9caa6d8c0784b9c81a2431f8a1fe3e
- SHA1 870954c907ae191fead12f601b4ade424c438eb1
- SHA512 a28ff94699d33025d47bdae2f09de87a75d4761eeb95e8899e029260c16f825c42121539023dce85569830590775ef8e72f7e09b595ee7b8318ce29c79bb0361
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZasN:A3k03kHRJARJG
- TLSH T196159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 893KB
- SHA256 46ae6faebbae6578d466295fa8ab66dac397fa3bc538408f10ca10e8774d13f6
- MD5 71cf90cf812d6c730279221990c169e7
- SHA1 140c7d91c46d65e069dac0b73468cdb54889e059
- SHA512 fccb815b43022451b69f29095edd9b9706c8396c37042e52d1c17963aabdb5e795a9add9369ef8d41f2f6a993585f8357792bff64ef6af6ee3db43d5111256fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaif:A3k03kHRJARJ6
- TLSH T1C1159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 893KB
- SHA256 247aa0878f7952debf94846f33438fff0311555fe4d528078002152bb5f43f39
- MD5 6128c55d16a9ef9580b484f5134c989e
- SHA1 857e7927278c6795759ea2d07e20e6b5796ee725
- SHA512 8343f91477d482a6b48e02f0687e88786583f6e39781e00317af64446c090bd53cbca298ebb795b1eaa98b901b917212f2b03907bd6b8f84ac64ab060d50065b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa8o:A3k03kHRJARJD
- TLSH T14C159C03F79900E8D14AC1789AA69A22FB757C560730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 893KB
- SHA256 96f6647f7cb4564b0c192fd09a655aa36b5990046c2aeba7c3bfd1c754f7b6d9
- MD5 0a8fe14afb07912441704d89cb82e303
- SHA1 11849f629756a35ca2f117e8e2d529612d851f54
- SHA512 65f51d647daad3adbe049ffe8afd8ae7e55a36052dfa7a836b308495e54f9700bf1545ab4dbe8d454f5254fc340778aed6676b25ad1eda0f569de2dfa87a5ac9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZacu:A3k03kHRJARJV
- TLSH T1C0159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 893KB
- SHA256 4078bacc65b65d8a00199bed55d3bcb2be336c8322d94b5c1509ed22ade15b3d
- MD5 23e60bc01e3d9a8e5739568af3ccb7ce
- SHA1 7f401545d44cccbdc04b54f417995cfd6a3b4a93
- SHA512 ae20f824cddbea4cab57f8934d6d85d85c3d6905437d01f69932d9473b28d529631f68c26d9e71bde735db41c079aa1f8a4bfaf5191768490e7a21e21e244268
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZag9:A3k03kHRJARJg
- TLSH T192159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 893KB
- SHA256 18634efbe899bb0e8b2747744209f9d17107a014278f6b514235e27c68f8ffa4
- MD5 185eccb55cde34d70b67e6c6a892dba5
- SHA1 3d0cda9e1d29ba1961992cc8235d006e7afcd10a
- SHA512 d9803f86121679d611c84ab8271034564281e04d638c91cb8b4beafa186967e5ca088f67a618a1b847acbef7b3bb2c023e56d5f6a7dc6e559f2110ac52cdae66
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaoc:A3k03kHRJARJR
- TLSH T198158C03F79900E8D15AC1789AA69A22FB757C560730A7DF2354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 893KB
- SHA256 aaee893e85748b69d693b98835a40606710759681073334584e4810877e224fa
- MD5 1d538cf2deecc9f86593e72b77356e40
- SHA1 0308095fb6415fac6ddc6cf8c0e656e2ec4c56b9
- SHA512 3a140429cc62ba8bcd80752d7c4245170650b9501a9148e124b7e3c61dca77f8f236f6f132c95e4ed93adc44e40363adc671873ab236a8cb9ab0aa1e82380414
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaBp:A3k03kHRJARJv
- TLSH T1C2159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 893KB
- SHA256 8e17aae11c71573acb1c28c49a77a595dc6e028f90176b22282a060d15ee6689
- MD5 64e9c2f0bcc135205a3e2574bfefe6f3
- SHA1 1561ae300fec1665912d98e19936d12cb45424f3
- SHA512 4095843a16a59f34d3de1a0c9ca2b78f106600fc3519a9e77144500d3a1141e4c835be8648a0af0a511ff655c7faaf6e3d8805c757452247677c7c2fef72036c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaWN:A3k03kHRJARJk
- TLSH T121159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 893KB
- SHA256 d8b37fe390df30afa6854a914554c2fbb54801771d4e07c13fd5256cc37d7d33
- MD5 d6dc9d37d972eb59e7dea1ce28797b66
- SHA1 f978e41c1d1fa30096745d8e3ef37c9618ac83a8
- SHA512 f79088c481b7b0e01624da5893f3073c69012fc7d3e81bbc311bf55075073b98d2debe71227148ce5d7e94342abf01d87d7b4dfa926fde737597f88d60cfcc88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaaF:A3k03kHRJARJS
- TLSH T10A159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 893KB
- SHA256 a5affa75dcd5f4c729031068e1d7d0a58f2041b5959a18e77b7e68a3096957bf
- MD5 2efbd03c4b4e33271cf1144968627ef7
- SHA1 d2cc81afc10b628e32c6bf266b8a6248af297688
- SHA512 ff60b58b3451aa539ebed9a31466f476a0de1e4c793b4008d49b1279057d08a5de8d5dd0e38dd343fa573f39a429e210940cab838934f0338e2de8469010404b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZavC:A3k03kHRJARJm
- TLSH T168159C07F79900E8D14AC1789AA69A22FB757C560730A7DF1364C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 893KB
- SHA256 059e4542d4fffffb4c049c94ca916a5872df1f65d1701557ca7fa9bef9282753
- MD5 61ca5bfa476d4b3c9991e274637aa752
- SHA1 13b980e8527c53fde9e31abac284316b9a3ae8d8
- SHA512 23b78ded3c191887c4b2472d38e56497ab9c994c4c92e3e9281c442d6138542fb36d278a4e677ed9d922a409a4a53ff390de87986815b7a9085238347a60c69b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaQw:A3k03kHRJARJT
- TLSH T113159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 893KB
- SHA256 b1264447558f2cd26784496e666e0c70d7685292fc0a6e8641acb29559fbb484
- MD5 c72d692ea55ea89763d3ee085ee0403c
- SHA1 806eebfa63967469abe6822a902d3859bd720e68
- SHA512 4f17b7db2427fe7c962957a9e2beaeef29c6eddbdbdd923a96cc660733dbcf13cd3e8c921bc0aa7de92342c241f06e8f7b42a7a716ce9a8af4f4317d922d6231
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZavT:A3k03kHRJARJf
- TLSH T173159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 893KB
- SHA256 67816d9582343bbc8f1e943f76863c9e7b808283e2d2e0ba2b32f7895be367ee
- MD5 bad2b1138c95de3f512514c53bfd04cc
- SHA1 b8828944381365f0a19560f3f07995663b85e7ef
- SHA512 8234e50b6de5bf78143513600460c27c60126c1f1c877bd50301c0cd7d3820fd592b53eb04dd57859190e402b39fd7f4606344a0e0ace094c7dd411c379c9873
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZapu:A3k03kHRJARJw
- TLSH T1FF159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 893KB
- SHA256 0976ebdb8a3b22db76c2d3e00e12e2f41c0c2f96117e6bfc131322e849fc8ffc
- MD5 806e795d5a5cea5d94565bffe2ddfa44
- SHA1 19e7ec72e954a1542276fe2aa885d36e3393c170
- SHA512 baf9e0d99b5dea728bac8d9e8b1d8d3ad5b36834de38d50410ab9a246a5f377c9cebeca62da972d5c8da7c2bbf95f132ce1fedd8007f68fc2048124422e63917
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZahb:A3k03kHRJARJp
- TLSH T15E159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 893KB
- SHA256 afcbaebb6483bb5dbe0efd15d250cbf52333828ea10878d58f098cf4f32f2805
- MD5 8a8864f5cf32e7b97a9bd560a4579397
- SHA1 2916765e8275418466f0090c83c15f537669ba1e
- SHA512 40bdd3ef770b4526e2f87dace8f05dba14f01e36c12056e13acab426e65f56f451f55d89712b32de3f1ff4fb26e72000c9759851830607f4898b1b445cde4526
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZapf:A3k03kHRJARJ5
- TLSH T197159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 893KB
- SHA256 7ca180440f9fc7177904d867ff7e0706f5b6713f479b77b87052199fe71f8298
- MD5 df8ffaa2355ece207ed822e07f643b2c
- SHA1 8924f0ed1e3b77c6e7a5ae129bd6871875478b87
- SHA512 a9205e20025e7f22292fcc20d641f76443226cf8d34488f312d425f5d84887ab50c835873e7688ce7cf549b5536a8c160c963abdc313e645d70eff5810e8f350
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaSK:A3k03kHRJARJR
- TLSH T19E158C07F79900E8D14AC1789AA69A22FB757C560730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 893KB
- SHA256 81470bbecb6fe4d2d424dceb1ea014c3bcc732cfd1af50da9cb18cdd8a3dc7c4
- MD5 fe713aa1f4f1c1dd8e297c5dd51d1cef
- SHA1 b506533bce9ebacc31d76ebe6337deab344d194f
- SHA512 ff62bfc8eab44daeb166d4b336694f781ebda36659d5253e9e3645f6edced88d97f35296afbd3e5bfd2f64361c67081a042c5a05ad25041bd3f4d36bdda0cb31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa3k:A3k03kHRJARJ4
- TLSH T1D5159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 893KB
- SHA256 1022bbc665e122ceda4422b475a65387368df02365515a2d72bfa2115d94eee8
- MD5 f395496f14fc4cd20107336c78bcf168
- SHA1 58e192be700745a5a14cc1e8974ce46b37f97d72
- SHA512 3fc9a0d1c74afe6f5e23bceae70441e2cf6bfb4f93bf2baec5b39024462aef22ce55f0bca433ba5201dd261323761ee3f819f3d06debcbd0524acbd0cb7601f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaA0:A3k03kHRJARJx
- TLSH T121159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 893KB
- SHA256 4420c475b781baa59548cc4215c042bf9f833f9d44ef9bba216c4197820353a2
- MD5 93de472686fc16da96b73d0552f8166e
- SHA1 b650202d89d8169290ebbd458413d747bab22ce6
- SHA512 f3752dd8611c991029f9598721733bc49ade6d0e0eb06d22590ec00cf8c4865b4a97887eb0764ef138fd1d07f70bdafb1921e5ca1b3d316768e798462978e68f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZabg:A3k03kHRJARJQ
- TLSH T12B159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1364C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 893KB
- SHA256 f41aa93b0086cc8ea4f5398069b444cdc467c8e0b43c6d96ee9511f5a3e31638
- MD5 44964cf71f97255e91b3f7eeb81f6475
- SHA1 d1d18f4f8ffea651df2aedb384281f5c33365901
- SHA512 a1a8fdeb5a88eba54332bda10ab843e3d465a343227e4c4d7ec52e1c5177f2f505b0f900aad8f69e0079028a4e6f6f71ea2ed215d72200a4a5d40e3c654db816
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaWr:A3k03kHRJARJa
- TLSH T1DD159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 893KB
- SHA256 5047d5cb5d43864f1847e95745355ee0001d79bf577bab55b849323f5a403275
- MD5 d92074ebd22b08060539efacd6de9ce3
- SHA1 5ef12590ec71b91096d6286a85fdd7a74e62e738
- SHA512 38299b957e2b9641dad9d5d4c09fe2d2968c66d9e48f5586f830b51ef8807c7d996aad57e92344ac1c6ceda4390b087bb0e7c3575fb85131628cfe0b13b6d201
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa8n:A3k03kHRJARJ8
- TLSH T1D7159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 893KB
- SHA256 f3bc9289972cc4cbc74eee8a0f9acca0f2b6807d494906a39d6ecffd83729ad8
- MD5 c9c63bc90bcac4e75f14222afbf3bbc3
- SHA1 8c8f8fcd1eeaf247940cd3550e570e022e7e987a
- SHA512 91561f9df1a287d794d88b409bad46551b08296b7b0a7821f3dc42a2c5bb735a08b3dd3c9cf8211139046c3e3c948e7c80ed57bfff922a3b5e568afbd46b55cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa6x:A3k03kHRJARJq
- TLSH T1D7159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 893KB
- SHA256 b11ff5046df758815e5b3e1f27601aca277c5d1025d896582bbb14872c19c287
- MD5 486b149c4b62eb9bae0cc19739cd4168
- SHA1 f3c80e00ffee8a3539c8a672c03a3b46f95a2b78
- SHA512 43949a0b1f6d034b1ccf85c7b864acc37a95426fd89f24516bfbbbab7156f2b50c023e2a9177c1e196b077c0ec4b29e074658d1a8d43c1b016d7d1b843940e25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa8A:A3k03kHRJARJp
- TLSH T1D6159C03F79900E8D14AC2789AA69A22FB757C560730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 893KB
- SHA256 44e6b3c93446af55c8c9745afea59099fa5e8eff2d40bbfc817e61527fe9bea9
- MD5 6b909949d120c22f350f43a5771d1e96
- SHA1 f184e25a362963026589a8aebe942626c2fbc4ef
- SHA512 c0ffe487691bdf555427e6655ea66fe1b0f2ddef85847e00ace4735221ad03a5da8abb41544e2941dd94fa9a571e744b4a0c2cf1a11abb1d3bd8f74140622fc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZal9Q:A3k03kHRJARJw
- TLSH T1B4159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 893KB
- SHA256 b002113657caae446fc98b1424a2e14e3c868249d6a1abad41486dff1e4eb589
- MD5 f23f1f3901450b80e90c8b02e97aa341
- SHA1 d995b30c14bfef086616f1ede6875ab1d1ebb3b8
- SHA512 3a4c640ca697cc8030142fb448bc5580d7d9a534bc1494d71da65066ff06d5f21c97ca4462aa956b8f8a50b5253266ae7330a20c47c8934438d884dde227ce08
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaQ4:A3k03kHRJARJr
- TLSH T195159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 893KB
- SHA256 e2d5e4495718dde5effe35dae6010786e06e802720cea72e90fba67b4d6ec896
- MD5 e48ea5f47cbf63598b4889c33552859a
- SHA1 381eb75adea487a096f09fcc8e21888f0de0545e
- SHA512 d068de2cc0804c79c58f7860050f04024b65647d2fb47e365cf7e0ed36919b28287d8f03a3235ff437372eadf728b3979b4f2264edebb3b2837f60ee07cc0203
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaTu:A3k03kHRJARJe
- TLSH T187159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 893KB
- SHA256 d2ef84b08e4e91044f5f6a99cc7d85253e905712b273655fc119b89c89956579
- MD5 8e380f9aba052570b24a6bfd0fce3aaa
- SHA1 16a38cb7298afc6297108a0524ca369d2fdfd291
- SHA512 d692d7326bcac8b3546d43e52574aa7af8560ac03589a45dc22fc6531de3121c150c76ef165b5876bb59f47aed9886f9a61c2cb3b2f2a773d43aab08a2cde202
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaOj:A3k03kHRJARJQ
- TLSH T1F4159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 893KB
- SHA256 6f6b2fce0d4f1f59831a05fe19bb2767736501f0e317f9077b644c3a88f4d3a9
- MD5 e6850f3b0dbadecef84f32dcc1854184
- SHA1 eff8ecc68fcafd819cef6a63b62e34d1fff3eaf4
- SHA512 dab1971adb6fccecc131ae1e5367b333929aab1e7d2568c0f1b32e925ad02f6e950fb089dec4e0d47f4b6cf23c3aa5c27bd8a60ab2e5780084cabdf4383f5f37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa7g:A3k03kHRJARJo
- TLSH T192159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 893KB
- SHA256 341580d0bff274c6f73d8753401d10f7d73ab718bdf1a403a7378259c9ab9a2c
- MD5 97d753a685f41239deab5add28c85ea3
- SHA1 115d90be223784f715da68b2f6f00c3d03e15909
- SHA512 8f2d1a72efb034da77d0c2bf220dbc5b82222252bd33dee80e36a28fddd482a43f7f0dee440adaae6910e4bdac709d9e97426139ca8202a8043ca0e3479f3661
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZamI:A3k03kHRJARJZ
- TLSH T176159C03F79900E8D14AC2789AA69A22FB757C560730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 893KB
- SHA256 e0c1ca8fab9ed5aacf8d3a211a62c1d592c515971a1f084049e34584da6c5377
- MD5 6a3617551dce85b4a807c0a22ad8eb0e
- SHA1 7dbdbd510bed43964b69a6fce737072976ce21a7
- SHA512 5b3dfe000f8b7c343767d3ff00d51adb3c77f327ad96596daf641408e5245d72ad698c57f88ccc1fe3f0e2a0dfb68ed61b02f4205ebcb2587b7ca75dfc818a8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaUo:A3k03kHRJARJH
- TLSH T19E159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 893KB
- SHA256 0e9d918e64eb1e52e1fa5127170370c879f8e3f52b9d9847e62ce5bfc26f22ae
- MD5 6c7b5432179c38c1ef8d30f4487aad09
- SHA1 3d976dbb916a07b53e960c9bce441bb7e4389eda
- SHA512 cd56a40fc6c54aaf528e810fee2ecac2f8101935492c80344f564e9d4384abc1fe9fba2c3f92eaf8201644f0198b87f35141076875b643f332c99e04275119fc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZa3+:A3k03kHRJARJy
- TLSH T174159C03F79900E8D14AC2789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 893KB
- SHA256 1a9bd62d55719facc6a2c394e343cbafe40f815d8a17abf7c20156e9d100e23f
- MD5 d594fcf57a550b2d98e57320da6f4568
- SHA1 2d0d1cb4889d3463904820be625136bc25401a5a
- SHA512 ba06644a05f083383296b2b22924cb0bfbc512300a483bc05a228a12d737ca2ee33b85d9fb2e5c8f68f24ebdf694d0744414ba027d1754a22e493ccb541ef9a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaNQ:A3k03kHRJARJm
- TLSH T1B9159C07F79900E8D14AC2789AA69A22FB757C560730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 893KB
- SHA256 b20bd74232ef1a493c29af2ba5f5b7e06cb58052736cf8c70d29c2af6a430f5f
- MD5 e20dbbc5376f2694f5b000dc2c7f0e96
- SHA1 e714fd1a8ace45b349a3eb3744a3612be296dcdf
- SHA512 7edc314426bf84103e91543228e870a2d5781c63ba0101c144deea5a2f7ada522bb0c496dc8039bdfc832a122343573e3682aa46aeb8dee45080b390b1ad2f72
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaCX:A3k03kHRJARJG
- TLSH T168159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 893KB
- SHA256 694cbd3ce3439ca5f0c8278597e15db721123b8c89506c35a10f6edce7ea6bd3
- MD5 5de758b7d21c03148828abccd81a98ea
- SHA1 06dff2d6eececa727ba2e72c3f85ed9270708114
- SHA512 73edfb86b2cf83bc87cae9daf8cc79cee266364dd84b57e1edf99a1e926cb6438f89d9ef5a515b7bfc89f13fdc4026b9b9f2922ef5a1c70b45a8b08436ee49c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZakL:A3k03kHRJARJI
- TLSH T1E4159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 893KB
- SHA256 e6c3417506a65c8268cf439cf363588550a1e3c4a216678f0d66ba11cb0f1bb6
- MD5 b7f521f1ac35f89ce08f8b3915d34ee3
- SHA1 83b345230ce7e266b5fffdbcc08a10ca881fdff1
- SHA512 a5b3d195eaa9f0c113c84145ab7c9cf926b59e399cfcbffcdbaf8a427c212ddbe20d31748386315e0e2b17f0ea2393cd9c16e4067e8dade36b956e2f51d9b8ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaAM:A3k03kHRJARJJ
- TLSH T196159C03F79900E8D14AC1789AA69A22FB757C561730A7DF2354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 893KB
- SHA256 ad196bff10f9873a8042aab25f8f34201858ddd52293c23a6b76860c3a73de2b
- MD5 fd92c06180c364d94d20c4f2683ebc44
- SHA1 67a6455cdbebf6378113f156458171fa8c11b70d
- SHA512 6c341b7f5231056784e892e944c67a205f0edd16700e5d46d5ea85a52758c691ba5ee9b46b1ec5044cd0575dce40832b8d722fdf5be6beddcb1dca3e11383e83
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZahh:A3k03kHRJARJ7
- TLSH T10A159C03F79900E8D14AC1789AA69A22FB757C561730A7DF1354C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\JoinApprove\EnterSet.exe$
- Size 967KB
- SHA256 436dc0a33f24bf24252bcc976a9a16885e1d3301b407e14b6e86a7e030d75741
- MD5 aba6a596836b823d64c440a57fd025cd
- SHA1 48af9f8d2c4b7eae892c3f6fe54e8563381e5c12
- SHA512 f3b244f2f2a5afc9bfbf7f5ee6feaa0f5a7c05ccc2d61765c2e6f60bceb136acc4ea3fc9c3d8ccb3154da7df3930d8290eac95db3477df0d05928aaa795c6827
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlBF+oEZaSvxl:A3k03kHRJARJ2vxl
- TLSH T165259C03F79800E8D15AC1789AA69A22FB757C560720A7DF2354D6162F73BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH