Analysis
- max time kernel
113s - max time network
122s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/07/2026, 21:26
Behavioral task
behavioral1
Sample
2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 906KB
- Sample260702-1an2jsb14k
- SHA256 ab1aae6907202e68ceda6b605a28eb17207c17cdde19a3995ac489c25d936f1c
- MD5 11d750ec015bf943646b5afbde3fc9fc
- SHA1 4a639c90b976af6d48543dd8adc41c2fcfabbf83
- SHA512 3647ecc0f648127ddee7c923403fe581f2ac2925847d1855abe40777c5a6e9bb35b5fb68efdabe2568cecb2cb72c5c051516c0ce7606e5b4e95af82bc115edb0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa876:A3k03kB56r7
- TLSH T16D156B13E6840FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 45 IoCs
resource yara_rule behavioral2/memory/4764-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001200000001c45e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1300-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4764-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cd-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c89-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-245.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-298.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-316.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-329.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-348.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c48b-367.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e0-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-507.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-586.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-611.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-636.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-777.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-797.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-811.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-879.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-918.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-944.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-963.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1056.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1064.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1101.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1114.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1151.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1164.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1189.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1196.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b8aa-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018916-1490.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001891c-1533.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001892b-1571.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001200000001c45e-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cd-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c89-60.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-245.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-246.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-298.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-316.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-329.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-348.dat aspack_v212_v242 behavioral2/files/0x000d00000001c48b-367.dat aspack_v212_v242 behavioral2/files/0x00040000000198e0-476.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-507.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-586.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-611.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-636.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-777.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-797.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-811.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-879.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-905.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-918.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-944.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-963.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1018.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1056.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1064.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1101.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1114.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1151.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1164.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1189.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1196.dat aspack_v212_v242 behavioral2/files/0x000200000001b8aa-1378.dat aspack_v212_v242 behavioral2/files/0x0008000000018916-1490.dat aspack_v212_v242 behavioral2/files/0x000800000001891c-1533.dat aspack_v212_v242 behavioral2/files/0x000800000001892b-1571.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1300 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 26 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4764 2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1300 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-02_11d750ec015bf943646b5afbde3fc9fc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4764
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1300
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 906KB
- SHA256 ab1aae6907202e68ceda6b605a28eb17207c17cdde19a3995ac489c25d936f1c
- MD5 11d750ec015bf943646b5afbde3fc9fc
- SHA1 4a639c90b976af6d48543dd8adc41c2fcfabbf83
- SHA512 3647ecc0f648127ddee7c923403fe581f2ac2925847d1855abe40777c5a6e9bb35b5fb68efdabe2568cecb2cb72c5c051516c0ce7606e5b4e95af82bc115edb0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa876:A3k03kB56r7
- TLSH T16D156B13E6840FA4D10F81749A968672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 935KB
- SHA256 c9abce8db4eaacd40ac15e3d8e0accfcad686b5dcb41f1cf1955226f3fb09e8f
- MD5 d455ea7639759822278f76e71ae2b6b7
- SHA1 eff9e7de2d9de1872ad222f97a715f61ddaf70ce
- SHA512 d1c1532ad0939fbfe664385e0049244538bb01c7775c44cd5f1605d57327444a5a1cbdf6e8f22ccb10c3590f8f73b9c68265039e9c0c37603afc40864d47b52a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87MP:A3k03kB56rV
- TLSH T1B6157B03E6840FA5D10F81749AA58672EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 953KB
- SHA256 73cebe608cd51fc2256046b331939a79b2fed02cca8b48ba336e2e782a4cec00
- MD5 2457d2fd22d00dde615acd234d19edcc
- SHA1 4051cd00c78021c97eccfba011dbf1f96dd2fd37
- SHA512 3ee7d33c9b4d595b4a7bae79841d662f0d59116d4101df8e192e21463b62661373bda6af5db57795cb1461ebe74e9e077dcc461c0d4f1ead29a60e950b084bc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87b0:A3k03kB56ry0
- TLSH T124257C03E6940FA5D10FC1749AA58662EA777C125F2093DF2354AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 959KB
- SHA256 fb8c10bbad40b8cb6dbb97fef592228e382c8284ae4f97444f9ead7c7ae38acf
- MD5 3edf2cccc7d1f588a2927c9bb27c162b
- SHA1 640b5b8c22041b1dba3fa278f42d5ed6f7ffada8
- SHA512 b60353345cc054e6169a3a89b814a91d668605ba285a8b051bfdc5e166dfcb3f7c8ac8c4ed475e4ca5b6b715697a3bf6db8531865f5ae507eeae74e0b1d47e2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87tfj:A3k03kB56rYj
- TLSH T127257B03E6840FA5D10F81749AA58672EA777C125F2097DF1354AE153F72BC0AB3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 814676811bab3ee16600f22e0bbb57e8e6b83b160092e50527fb459e3024b679
- MD5 4c759d0100da62da94c23cf51186d36e
- SHA1 edf90bca82df6ade62df83b7d83077c7fefc937a
- SHA512 e8d331f503fb8c063267ee7734d502614fcbed85f29f6d2b6061352011d2bed2ff872d7b56e2f703cad5b46f272e63f1f07f9d0fb994ae573aa5220d1b327451
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87K0Le5ji0hmxNrM:A3k03kB56rnPji0Aj
- TLSH T1CE654A16F6A44B65D02BC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 921KB
- SHA256 bf5cc1d218cb20a3ef88a713a271d5ea3720d815742fc8226096018237b85b75
- MD5 4692c82dbd321880bc23d25a9afe76b5
- SHA1 d704788c75b0fd4be5e20337bdab879afc306aad
- SHA512 a085425bd456b24f465ecfcc55ca40cebe2074f916957c6a78b365724336a8229c642f3851e0d46a35753cb21c90acc13544ea929c83269a1a5c6b2e48a736f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Ea:A3k03kB56r
- TLSH T126157B13E6840FA4D10F81749AA68672EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 954KB
- SHA256 7be257617ab8091988e1732f624103c6267a121bf01cc7b5e53723ae3bdc5590
- MD5 c901e6177c4257b946f2e80227358ce1
- SHA1 30705aa63ea20e0e313a6cb62bab65eee6f44d2c
- SHA512 30f7b1c0cb16d7ee4080c25b8f1d699088e7c15ecd442e1d57c59e75d4977cafdb68c78b529039fd3a610e4ea0f70b0c3f5b89dac00470deb1202c46d6b4ebe3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Pb:A3k03kB56rqb
- TLSH T148258C03E6840FA5D11F81749AA58672EA777C421F2097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 930KB
- SHA256 a3ee352e28c90c34331b0f41a0ad12cd82a5fbc74a6d4d3a08515b1d1ca44497
- MD5 2598068877aaa7f72b1955b9ef5fcce8
- SHA1 f48cfa80a5ee8c9842eceb8fe3ba22a87a480b60
- SHA512 712fcfc15084ba7cf7bbb5baaf20592ef167940d3361b312c5dce1f245ac7dca7e52bf86bf36c9b95445a76d041eac3fa7a47bee73924d1760d5c3d1933edef7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Do:A3k03kB56rP
- TLSH T113157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 930KB
- SHA256 4cbc30001d669053f4305caf7d82b5c8affb6ee0c4d1b69f17f25b47b94c7734
- MD5 3937e8f2b9273a01d8f2df716758cd25
- SHA1 cb733d9a533da0c41cfe0a9ba7a465aeaeb8d174
- SHA512 bb47676d5586d260eeeb1257cd7546617202e897c38987f5c8a117467cd76d01722e21e464d434131d635c7c1296095e20f76bc2610c05f6e6d9aa7452e1101a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa873u:A3k03kB56rB
- TLSH T1BF157B13E6840FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 930KB
- SHA256 2ccf3c1fae9e0dc38795642ff7fbb98af441652d994a755826fc745d490be97e
- MD5 5057deb684a730b703c149f88a6a1803
- SHA1 400cca64d7779136ed1525bdbf3da1a07da0f91d
- SHA512 2d1c07da7df2a075e2c9ffbcd74102873d47a8fa38f93247aaf821c155cc4133aa6eb3b5a452b57b4f752dca5490e58d710f4bb13b1c656d277e7de1089eecab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87F9:A3k03kB56r8
- TLSH T1F1157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 930KB
- SHA256 a3fbbe8b8985d5d63e56eb268e39231704b7146c2162759ea3cb6a655c03cb07
- MD5 5afa53358b9068a3a20c4aac4acd53ef
- SHA1 21935996592e175717e7479a9827ca7b190951d7
- SHA512 c40c42b92fb0d59c3c1eadb7d905be2afd245e41c75818032c385ac5e9a60ac7b063d35c80a4447393881d4c7cdef7594664f81ba0a407c620c792cf6006c308
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87hc:A3k03kB56r1
- TLSH T137157B13E6940FA4D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 930KB
- SHA256 a3e64172977b6c677956aca8411d12da0f1c424f257e3d4a83d03978848bed6d
- MD5 4be21e9fdfd481da20d1a4aa8c2643ea
- SHA1 60853b698c78e582ea160e6d3b0b1a9354f10a88
- SHA512 a0470c2a879b9f7d19a6e5807155e58fd1bd4307a630a72d190f8558c5ec0baece36f3b1212713bcea805f9d7dedba909186b49ee5c6dbd5718072e47f3020be
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Kp:A3k03kB56r7
- TLSH T134157B13E6840FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 930KB
- SHA256 bebb8218a66ba3cf8a2556cd632785602f5cdd6b17f44e1d63a7cacf5333f7c7
- MD5 048451c3b5d907706e7bb594bf423331
- SHA1 416970494112d0e2f83e10a1a5866aeda711e0cb
- SHA512 a219689de0bf214531637004fa84262b329c0278b4959ba993d4341dc4c5f23177532687fcdfa25d6e9b5ef1236edd80eaf9a574c150b2a0c644a22166cbcc6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87tN:A3k03kB56rA
- TLSH T13B157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 930KB
- SHA256 0528d9a6ce7c6978c07fce58fc1e39334128069d8d43219671361498569b133a
- MD5 e84584e95a60423f52cad1ee75007aec
- SHA1 ab597f6d41db53259deeb68f8a4987ee00f6d72e
- SHA512 517c695764e917c18dd3fe93daa4e5a5d1c88d3e3ea5097ec6c07938f65457086bec75f69d1f6e8fe0d6e8df0ac3e901f2a2345ed68ca5487da3d40040cd9a3e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87fF:A3k03kB56r2
- TLSH T185157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 930KB
- SHA256 cc58b634998f1fb66d55867e66fb432a4a3d271a13c91d13c8418db9e6ba13e6
- MD5 44f198f0cc0aa47e49fbdd3d2408427e
- SHA1 0f647ddcb0a553ffa0a2c152d595b88b62293a24
- SHA512 9d741b26d17839750749849468cd5b0413d19aaa17c6884c9fe281b3db23923641dd882441c119818cef0193b2489c1bed13ff764481dbdcd48c725029065355
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87AC:A3k03kB56ry
- TLSH T1E4157B13E6840FA4D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 930KB
- SHA256 b5d72d1270e372562825b5f9d097d3d69ecb6d4352cf4b92661c3398b57dd8ed
- MD5 6470a85514bf845a4ec90a8296f85a81
- SHA1 14bd55cfa3afaeab84f664496799e7b00a332d1b
- SHA512 e983bd9d4712f567de0a4f0f844f73bb9ac33c150d1b4ffd1b082bf8194e7fd930e4863970bf32b1167a9c4103f2f3184f8ad267f3dace051bd96253c86088b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Tw:A3k03kB56rH
- TLSH T1D7157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 930KB
- SHA256 3ae8f120683d8aafb87b8039946c2a3054f390f7f2f2ff6f5c4a17c3e163096f
- MD5 b501c8235ae16a6de72ab5f1ef6be631
- SHA1 eed1a20b68b875ad119ac4e1708a7a0c688a8bbe
- SHA512 cc892cb5d4d6fd0dfb7a067d1994963cf3aa4102e2798f18176d3565a7920870d5222ccec5058380a57dd27216e1da0f683c1ad2bc35c1f696e083fbeecedef3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87aT:A3k03kB56rD
- TLSH T18A157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 930KB
- SHA256 e068bc97090e219ce492c659b60a735467365048779877b39858f44b1a879f5c
- MD5 a954fad1fcde579638eea9a527bc7e35
- SHA1 542fe09bff9b8d65c9ad4219a44ca821c5830649
- SHA512 f3496ce7911ebad3f6cddfdd041672f836e017b1324691b13e16479dec07d9e1c39f5de4838191e7d3d405ccd027877a87f28f04bb0880e2cafc4d9f155b8010
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa876u:A3k03kB56r0
- TLSH T1A0157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 930KB
- SHA256 f60fcf3dab8cd4bafbb4a2e6719a3d2e929610549eb8a5b4751855f0e239db41
- MD5 fe94fd4cd11b849d5aa91e2da9835a00
- SHA1 3d280d4f1942fb697332609365491c82f42d0bec
- SHA512 5fd721266ef6aa6c243c5c25c2c06bd2831d7e2a11ea2fd565994d87c3868d7896d642e11458cf9d96a169ee82a7115159f9065f8b344bf586b00f6fc5222667
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Eb:A3k03kB56rd
- TLSH T13D157B13E6840FA5D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 930KB
- SHA256 102ec5e7e7b26f6f8592342aaf127d9d3196909ff53b01346c2d5f2d2d004096
- MD5 6950bd7a510c873a148483d8b552a107
- SHA1 b2f18df1006513a9a676075065557eb7128496d0
- SHA512 2b7c0bd2041c5c4bfcb5564e0331c5fce30fd0cffb999f3238bf66c62463c8006cbf752f4d91f0c811640ea3a4d42540f731b925ba5294d94dce1994d43fc902
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Kf:A3k03kB56rN
- TLSH T1BF157B13E6940FA4D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 930KB
- SHA256 3df71647a8d3b7511209604a7b000bd6f854a361f02bdf821fb50e92ac85363d
- MD5 0af8193397a9e6fa7f0b4be379d431cb
- SHA1 fe634226869341a9fb7a21bd63e4c4499d78d4e4
- SHA512 4d50a0ce1d96a3b0903fad6825ece5b113473943b63610ec3727348cc6860fa002c36d4eed2426eeaee247ef3cd3f75ff68bcb1376cac8eefcd2c3307497e489
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87XK:A3k03kB56rF
- TLSH T1FA157B13E6840FA4D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 930KB
- SHA256 9a47e67c8bb3054c326ea5db940494c44301ba3c38a5d66f5da20bb0259101f5
- MD5 481dbc7a0b3799226d97d274093f74c5
- SHA1 489fddb3c7c93e9ad60c6cff1ebcb84c0424dbb9
- SHA512 f9327465f9303795a5e1d8ea84f4d53841733caac84bf86a20285b9ebd2db835f2afced6207ebead7d3498c73c47ed62847388c7067e0c2f11afba9084d2e1b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87gk:A3k03kB56rs
- TLSH T121157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 930KB
- SHA256 e889e26a191fede41c5490b98b6c2777902f11aab081c7e6850ddd5908e4593a
- MD5 ee2ad0cea16452b252c69538d7707744
- SHA1 bf361ca1d8e667ca6f15810e80f0fd067a83899c
- SHA512 3eaea086d5185fe0222245b8e0505c6ef9d3ee5c0c0da108d4e51694f57ad42bf6b4658771571fa04ad02c30be26c89bef45166411f5f228f2dd7161e1f69ba7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87R0:A3k03kB56rF
- TLSH T163157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 930KB
- SHA256 9343aece3f98d846a0dd38ff54377bfaaf20fb255c03d25ab5000caedcc28483
- MD5 88a8bcbd8d7e05c665ba016a3079b0be
- SHA1 4af3724629bc9c92f897bea918dbe3e989a28686
- SHA512 3da8c7957b1330059700a97edadbe40ac6c8efdb1548c9ac20d57d5c6fef0db11d93b4c99b578dc20135a0280a13c1d37eef3dce77a0a095aca66fd3f7ff30d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Eg:A3k03kB56rk
- TLSH T1C0157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 930KB
- SHA256 9e2e7557b3934ce7e8fb604b6e4c740b273d0f4d83124c79a44d5b03e520b6ad
- MD5 212191870c8725d3c298b0751667a02f
- SHA1 ecf237ba385be88dc140c8a0b70ec221bd32f532
- SHA512 506b8681b033cd6c1e64928015c7e26cdde553773dcd9890afa61dabf314d9a3796d92a931a85515639a1127a4ebf222e79735f13cdd3663a3e7646517d6032b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87hr:A3k03kB56r2
- TLSH T1D1157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 930KB
- SHA256 3153492b41fc6703b8295d19eaceaa1487a359fae58c66d892ae6865e2b977fb
- MD5 3a3fa865f40469141b13013dff29e37a
- SHA1 c6934a197eec4d0649006ce58323fb0891994d5a
- SHA512 d78a358a0326f46d00b44c48797d25cf257c8fddc9fd0fd5d9a9c758586c0a2d305c19df04e687add54e55be627604d242e2b12cb3553d2e0d6bd97c28b48d31
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87jn:A3k03kB56rw
- TLSH T15F157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 930KB
- SHA256 c7a9b00a16d3ff1f854b4caaeca5afe0130e8c18c77121c17efad3eb8ec217c1
- MD5 d03aa615e73a3d6f7ff0baa2a6dd8b7a
- SHA1 8040176f68711ade7bb489282dc1db4bb1699839
- SHA512 a0380f4cd922f87d697ef7c19a6691c6dd045c987e2ba551dbe256f49b638db37077abba614fef08ddba256d88a4fec9df662cc6c30c1e922e62198b370c867a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87/x:A3k03kB56rW
- TLSH T168157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 930KB
- SHA256 74e074c7e89a25aacc02890dc2080ffff6fd839bd1c127536c50870ee64a084d
- MD5 47a36e87ba9e95b72b4cbc344e2a3ed6
- SHA1 de63ddc062a8b52fa68d6f76b3e6dc9c3849652a
- SHA512 6df66615f4bdbfec707dd6e77367f55980cbca6ff0244c7f276ecc11bcc62716450237b8fea5a21c5e62e8c61646d1567c42ee3aaad6b159e6d6c58a52f0abd5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87lA:A3k03kB56rN
- TLSH T154157B13E6840FA5D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 930KB
- SHA256 4fb136aedde5b2403e2a5278446154bc87e9e18bb06b2db1f0e67662bc77d9f9
- MD5 b51974503a66d039d493426d779285e4
- SHA1 ae6331396428b9f36c34c8c65253f715d71084d2
- SHA512 27b3cac8e9cf08035bd5c74dd226e1debf67233158d5f316f5cbe35d4c6b56bafe64c079307bdd4c8cb702835f01481da908ae8f08b3bb946319ec6655ae0eb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87e9Q:A3k03kB56rc
- TLSH T1B2157B13E6940FA4D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 930KB
- SHA256 416897b7e482050816a9b66e744f1b82ce16af48643a9409a5bc6db93ed99868
- MD5 6b4641567ad427ba6b7468b2ea28ce1d
- SHA1 99028f1df623db0145b8b20f911f730f2aae63f9
- SHA512 564bd3a1b80110f525f48636b2e8f8ab9eacdd931a4dfb0c97e1b6fa38d0c07544a6891f46a58f54ff488f1205f1617cddeac4d0cdd99b4362e8b311d18d1e1b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87L4:A3k03kB56r3
- TLSH T1F4157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 930KB
- SHA256 a1e52bf3a1ecece07afdf06920ced575e4544508d7be918faac770012e9f616e
- MD5 a764f372aa7085d2d728f0056123d847
- SHA1 7ebe3ef1bb9e1adb3abde8132b9b7686069c7e1e
- SHA512 8cb67934c266d40bfb1556649272cb45d9c80211acdfebd775632ad24545685aeb24dcf2dfdeacebb53a25a9251c2220054fed1e96c6e6faaee3ec90f84e4490
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Cu:A3k03kB56r6
- TLSH T1EE157B13E6940FA4D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 930KB
- SHA256 06f3ba19a87f86fc4ad2618d6296e5740777e1b9f4fe9476a14f1f6237f308ca
- MD5 aaa75759e59d45537cf042ca1e1d2537
- SHA1 70a5fa0f772d1e27f4cbfd4f2e4bfbf4d977fa84
- SHA512 3a524e09f323dfe0ffa3ddda245d753a36200248aaef973dd7f19176b299a3a45a308cb6108848017be092d0cf83f4190f94449f94bda2a5d51d6fbc7a9b2fb5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Tj:A3k03kB56rU
- TLSH T1A3157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 930KB
- SHA256 58294ef15f144f3e77dcc054c3b87ca7c39aa31d2e0fef177efe7b1bdefaae1c
- MD5 c6f0abd8e57d8888478942181839fbdb
- SHA1 81c6c4f7cd94e9a848a45e231821ceb294a0a8c4
- SHA512 52df9e75d1b66352734868a134d04ad0fe355f1f9d688e1fa3948bf49c02684fd16e705da7b3592f0d9765e8a5abdd6942871a041d68b7da4e9344052c9398d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87eg:A3k03kB56rc
- TLSH T1DC157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 930KB
- SHA256 5c12d7044393c7b640b0c4f75a333aeb4833845d9be31ef64a9c4358fee0f1d7
- MD5 481210595dfc79d0b0d7f1cd4dc14516
- SHA1 3fa32daea6642cc703e6a10b6cbb88610ae5f382
- SHA512 a6f02b273e55436a11645932058a7a0cd759f282327f4a36ead3e2abc177c3e2eb9883aa53b9a8c5f048329ed401104f5f02d482b2fb6a745811fee214b31e4f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87RI:A3k03kB56r1
- TLSH T1FC157B13E6840FA5D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 930KB
- SHA256 4632c66f59e0d59032fb5492ba39fa282b29bb1e725077cef760857bc5afb466
- MD5 e221bb39320f2bf58999e69ae8d99325
- SHA1 802ded8d06d2a2f4486cee62ce0cadc0447dec51
- SHA512 08e3b0e73105a770da5a9c411481bb8af030b78bb041001beae5ea8c8e6ad7cfa44aa75ce388714f964d1255f906c8235b6a9ba2bab78f895833554feef8e645
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87To:A3k03kB56rj
- TLSH T147157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 930KB
- SHA256 7ba89585cda2bcab6dc2c5f3c5ac89e94ca34329f550998a53aa763c62bca25f
- MD5 84f8a00579194feadf838a3ac3a9f7c1
- SHA1 eac25c6f2b1c4e61d96a60eff857a560b524ed61
- SHA512 fe1723be56ba89c5b4e720936ea78faead602eb84550372ed6df66f420325336e5c6a6629800b243939f02dbf3f0924212709fbdac8212413773e73e850adb56
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87Y+:A3k03kB56rm
- TLSH T17F157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 930KB
- SHA256 903beda7449a588977e7447cb6f78ae3b03292e83ffb3238f796879b4f53742b
- MD5 a56ac6445a3561380be9910241d2ef68
- SHA1 b9dd7bf79cac4882b0a1811eec4206f3c39e9ac6
- SHA512 cdd6a3fb1dd2bffd1d918a79c4c726bd22c6de4f45c748bef11d9becae4611ba01fa4cd5daaf3848e560d35a943b6d0ab2b1ad13bd82de0d48c764ce72ac6bb7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87wQ:A3k03kB56ri
- TLSH T13D157B13E6840FA5D10FC1749A964662EA737C025F2097DF2358AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 930KB
- SHA256 9e2902f7ba98fb5eb5847a247ea4571b7f84e88559d187ce32baf1bfc7088de5
- MD5 b49d06e9f5b5318ab3e213094ed1a3d7
- SHA1 c5bdfa44d35ad79ca70d2c6f6562a46295785f17
- SHA512 f344e915bbd6339c19342b9a0b7a657176f1ae3abacf122590b972005521654de4c6c7c8d4434cf89495bf2af4c0cfe148dea08f5c8f584a515d9bf68b3289b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87ZX:A3k03kB56ry
- TLSH T107157B13E6840FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 930KB
- SHA256 227a0d85e4520d189724960e4121a20d860a7110eff89c0d6cdd0e636a721cc2
- MD5 ea2c0088e9b6353ea0ad135f3cf21977
- SHA1 9b29c354ef1ffef1dd94d10ff31798e91510474a
- SHA512 ff4b4e56cb09d3c38ae398f74a081b7fdcb9b696d752a05c3ed097f0a525557d845b78736df6eebde8843befe3a57d27b43c940643f32532ade266e2e96575b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87zL:A3k03kB56rc
- TLSH T111157B13E6840FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 930KB
- SHA256 845fd51aed12dd8748bf8edf26bb2e39193decaf4ed8cf572a9da087bacd8a21
- MD5 bb4da8e6bfef3d69e1bb4016ca5d598d
- SHA1 0510d2032c0570ad6066aa785ed0a38ac93c7e77
- SHA512 62c7831c4a12355a8271a7eaf4a9864e10195e11f3d42363360e5f5debc09d496bedc4ca0233d474d962ba84cd30d7d2f2695b30cd2e9c0b9eb650ffacb09c67
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87ZM:A3k03kB56rt
- TLSH T199157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 930KB
- SHA256 261c2cdb38835d88aeb2f2fa7f3d31d4c1cb8fe196796911dd314d93f8d20f0c
- MD5 c7cd484b6a79920250ad1fbede3d6d75
- SHA1 5ba92a212e98ed720de8005b45990b5a7141dbd0
- SHA512 ba4be7374c4a13adbf7f7ea9c18c59537c06692d1e2cb37405ef49bef78eb83520f66cd28b7738eed4c34baf91e1bf33d897f64ea408f9772c39abf5828f619d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87ih:A3k03kB56rH
- TLSH T182157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 971KB
- SHA256 0a8925dd90a0ec410ec3b7bd4af31bd7d9956861ca10a20497c134d44ce8e164
- MD5 51838ec3054061283524ff9889c6fe38
- SHA1 aae79ccedddc083d635738fe6152e87ac568edb9
- SHA512 575cd5ab40f15476a139d0b80f497b2c424a84ea029f7946ca6bf80c6756e4252d7aed402788dd230c8b91390a0a121f2388f1f12bbf78ec644e419dfc6cc59a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYipAa87xp:A3k03kB56rOp
- TLSH T1D8257C03E6840FA4D10F91749A955662EA737C025F2097DF1394BE293F72BD06B3A3A7
- MD5 SHA1 SHA512 SSDEEP TLSH