Analysis
- max time kernel
90s - max time network
111s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 23:54
Behavioral task
behavioral1
Sample
2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 947KB
- Sample260710-3xtlnafy3j
- SHA256 18e2754c5471950a33b7ac74ca5bdb59d2af7fd49071d6fac4b0069013216b7e
- MD5 6faf002c1a90aabea9ad171f6b627513
- SHA1 345116554791731d61d8d1cc0124713e6e1c6235
- SHA512 a6beb89630d99d5397f186e1a2040690707dda0b7fedf39620f41a3cf18e8898feeefd6a4ae7a8fb38d909a606f9b5486d1a921ad4a27a64e6cb04a7780ddfa5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hc:A3k03kHRJP
- TLSH T11625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 39 IoCs
resource yara_rule behavioral2/memory/4756-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c4e3-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4756-161-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2700-169-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-254.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-472.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-600.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-722.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-741.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-791.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-841.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-905.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-1004.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1047.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1078.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1166.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1319.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1363.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1396.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c4e3-6.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-39.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-254.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-328.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-472.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-497.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-600.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-625.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-722.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-741.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-791.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-841.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-866.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-885.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-892.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-905.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-930.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-949.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-1004.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1047.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1078.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1134.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1166.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1179.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1204.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1319.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1338.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1363.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1370.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1377.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1390.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1392.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1394.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1395.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1396.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2700 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe patcher.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4756 2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2700 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_6faf002c1a90aabea9ad171f6b627513_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4756
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 947KB
- SHA256 18e2754c5471950a33b7ac74ca5bdb59d2af7fd49071d6fac4b0069013216b7e
- MD5 6faf002c1a90aabea9ad171f6b627513
- SHA1 345116554791731d61d8d1cc0124713e6e1c6235
- SHA512 a6beb89630d99d5397f186e1a2040690707dda0b7fedf39620f41a3cf18e8898feeefd6a4ae7a8fb38d909a606f9b5486d1a921ad4a27a64e6cb04a7780ddfa5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hc:A3k03kHRJP
- TLSH T11625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 a244c17db0f32eb9e9df8687a3c3cadbcba08d57d10197c8ee76d027e0bf0c29
- MD5 821fe591257d6027153a4fac7b689476
- SHA1 eff8438951c950ba28d0cc9af83a2e63e2585a8a
- SHA512 2566b7ef1c1176c3abb3c55f515f5f8ec7ffa0b454d4ba21744f3fbac72ddec659372d9092add582b02faa68c8437f65c2d75d8a0efb3acc55818b983a259810
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hk0Le5ji0hmxNrM:A3k03kHRJ7Pji0Aj
- TLSH T14B657C17F6A402B5D067C0B9C5E69A5AFA713842173086CF1399C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 962KB
- SHA256 f81f3a69da290737ae5ba27be33a9a7edbf40ca01a559ea48deb3bc17ab38b9e
- MD5 53460dd0cafe28491021b9e7806cf816
- SHA1 6a0e190b63fad86a744300dd3fb4a4cb906d8b48
- SHA512 3d4725744ae1bc7b55cb373df38e0ca6405abe4a26377cbd31c5d38658f5e44ac2ead8d98d5dd3531377bbf688bc6e5794c414f3540d477cf99b23a584e6f10b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hOa:A3k03kHRJ
- TLSH T1E225AE03E79500E9E10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 971KB
- SHA256 810b031e60e755a85d553c7d64d9df845c96297fc3cec019d1fdac54f05ff17b
- MD5 2eb41d281349fd89d0681b544dc8cd78
- SHA1 6d3609aac0a8e06296e0af6dc3e5fb5d48e462a4
- SHA512 0bdcaf9bb79a27ea0025e72cd2148414387911dd97f3263381b03262fac5057a0d02f7c6b839f812e7f5807c0037384ba08a5eeaf0473aa0585dbe116aa795c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hv6:A3k03kHRJD
- TLSH T19325AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 971KB
- SHA256 8070fcca5618e0ef3d296853b00d72554015d1065e655577fb3b8c811e74f54b
- MD5 288edcb1fb913641553440b6ccc17831
- SHA1 1d38a1ceb1b2331df2566b34ce60000ec1f5d58c
- SHA512 65e038d5df0aec35dd306c291fe9744185936a720e4776e4f011c39fe502bbe5841facced901c17b19f0f6789bc3b37833c061d765faa4138ecfca6c561ddaa9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2h/9:A3k03kHRJo
- TLSH T16425AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 971KB
- SHA256 abe9f376529586d67771ea1b992763ac5781ef8e94450dd2e5c45b01e9fb45b5
- MD5 78530bc4eaac99792aae4ff45a2662ff
- SHA1 bc3ebb163514c629d4c18ae2a41aff41f003a02f
- SHA512 400bc3f492fa88721a9945dd951b1360addfa71b139d0904560a0846d3ded86e34d74b33e27b27e1daefb60b4289bca0f4e9ac7c674f66c0e9d8d4733dbf6992
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hbc:A3k03kHRJp
- TLSH T1C925AE03E79500E9E10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 971KB
- SHA256 90a6624fd388eba37997b5dfa4f9bc50091e9524c93c79638dac2da3e4608f25
- MD5 f08a7fb145eb6b3e9fdafc5160e354b6
- SHA1 61876513bd5e459896d54dcc383683874cffe672
- SHA512 e4dd413617ddce273318523414920b56f174b09e69b35bd7466edb4ba0b5a1a8933eb7a7d65f041525f4b4fc678ce837fda25122a1a764add414d662033e88f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hEp:A3k03kHRJH
- TLSH T15925AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 971KB
- SHA256 79b17862f1f7e2e54590a1116823c667e6164ec17b50bb919a819109a07ca349
- MD5 958a70f8f28779ce386ed46f8599e99a
- SHA1 38ba43dcc626737247caaeb9ded06da69717db14
- SHA512 03522b78820bb5778406e345af9c475e3337802bbdaef9804527f909587a2893c5a175dbfbf454a03dc3dae855aca27702804302358dc09a1070a82b0ebc240b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hLN:A3k03kHRJM
- TLSH T12825AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 971KB
- SHA256 6a062b9fb477a8aa6392aab7c75a042ac7d653a5dc79277b16b93fd341268196
- MD5 b7a5de22c420da6c88dba89c4b3d0a5c
- SHA1 a573a65d8080cbf20e614dc2299f8a0aec893298
- SHA512 d10f06c243c77e1ad2ddce37a2910ff87439b71274bc4fca46abfd2f4858a8da56b72d6efed86f1d111c01f1cc5445e5824e30d62447868a9b9adee66b77eb6c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hZF:A3k03kHRJa
- TLSH T11225AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 971KB
- SHA256 c7d0aedc55f75aa3552e3890a356f1ab07cee5facb7c25ce6b4ccdbbe322d83d
- MD5 491e087c77922f9dbbfd48a6c84cfe9b
- SHA1 2c9c50d8f8331076123ea0120dd1f3c79af5152b
- SHA512 05f9e3756bd4699328f84f970f826128bbd58726431cecef36c508264b79a6e2af310d00396551d1b3d31114eee3e10ae3b4bdbf0501232b82b45df901ae2072
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hyC:A3k03kHRJu
- TLSH T17B25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 971KB
- SHA256 14c0146514a711eea18255a0bdf60a04bf443b29075985165c80d279c3d7f7bd
- MD5 a66a8cb0245f8dc45ff997686133e9a2
- SHA1 24c106d49ecc78a1af8d59f1064baca0b386763e
- SHA512 6adc251347758e76104dd6e640e892d8665a398dcf5fc44d0c60e520fe146bb0c9bc09b9b7826b6fe29ba89552f94d4cd3bc83a0ad397bc0ff491c663f282a3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2htw:A3k03kHRJ7
- TLSH T16525AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 971KB
- SHA256 3f2d17a358045c4c85713ab8b6e464cb9a2c05bcbcb5c72eb65a88671dac6577
- MD5 ea9be6094ab92a8e0b6b23860d2a7bba
- SHA1 99c12454a4cc6d622f56c75cefdb5ac437e65e6f
- SHA512 a4812e8d283268f62fe6506a7f69a8b1849a72fef9e391f0835d7e415de1396f44e1ab226a31e2a7ac5d68cb78a6d38f7f8294e6f1a7ad2e51407dae5a37fa13
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hcT:A3k03kHRJn
- TLSH T1E925AE13E79500E9D10AC1749AD65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 971KB
- SHA256 88927264d556374fd5f69306c9d821c6bb1a8796d8ed6475f767cc444b572d90
- MD5 6e0f6214325bc2afa7512a2bd6453528
- SHA1 833bd0efe83064c038c6d8dc9033e147a729aa19
- SHA512 ade206a2a684fe2f898c194ccbab3d5654ab4dab958bc8676da3fdd0ef7243ffd71dbc8abf73ee9896d881b68bf64674a8681862d7510a502f8b51e25ce16a0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hwu:A3k03kHRJo
- TLSH T11725AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 971KB
- SHA256 be9f1d431f2088068b3c9ec96b7842c75f623031cd3375b991f08998819d6c9c
- MD5 5e5c720e0dda75c6ef661b9c58ee2da6
- SHA1 7af760fa1a1354e53b9f42a2fc72fbc5b80a7b1f
- SHA512 355506866b7cedca924134739acb0f0051746176d2226619feae33a8ff2a1e2507259c7e2d0a151119fdfc130c082c870ee24470c8f38500c54bbeecd00e3bd7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hOb:A3k03kHRJR
- TLSH T14825AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 971KB
- SHA256 f67f49fdd42697bd7b8f373b957a347dff6e929094b9e00afc2c7de1d7c33bcc
- MD5 765a9e6add0a056d15b92343183267b0
- SHA1 041d75a9cd095c1cafaa8de2ebaabe8980bebcd0
- SHA512 bcfade831a5bba30f7767e689dff282c9af482e00bf7640420a6888e91b865c8b3dc86a1c2689a77307767afaaef28354a8a90bc6f621e6ccfdc31f4bdc43eea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2h4f:A3k03kHRJR
- TLSH T1E925AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 971KB
- SHA256 0959d97b2e81c8f563908f97db14d7b771edc7914562541afd60a87ebe2c7b41
- MD5 69a95795b294110dae4b20e2c976768a
- SHA1 eb383ffd5c436ac53820339e8c5d10f9914ae5a6
- SHA512 348f9e57c98d00088c1f6e534ceaf358f23de2f183000c8b4cba459963a4a1fd35383b5cad63564ba6f062d12408e3ecb48f6c844ef96ab2ae1f7dfde102abac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2h1K:A3k03kHRJp
- TLSH T1C225AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 971KB
- SHA256 a5ea7b7078af9706b2563edb39be16610ca4d96b25cddb5bfa828d2ab64e2a29
- MD5 2a0d66b9d6e3963401356328f5bce14e
- SHA1 24b085ffcc62544a36eef09b6c8d366a461223d5
- SHA512 edb24dd05c7bbe8cdb29998f0eef27ed35f674249ee7c771d2607f643f0410b2f062f4383df4dbe6143930fca69d7b74fb809381eb25e0fc7c50feef6511804b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2h2k:A3k03kHRJg
- TLSH T11725AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 971KB
- SHA256 b2ae2a3a1d1d929faf60cf88b24c5971f5a2537d5665091dbff9b711d98ceb0f
- MD5 48375097ec8c26d2f809438a9e40dc3f
- SHA1 ab23d48c1cf33f3f8c9e1cae970bb77545a18e88
- SHA512 6817c230ecf4c1b99aae53bf226796d25d5a6420eb05eaafeff9cd257a1c4e53b9d4e37c0e5233a01a97c5aa5650b9d01ecafb50b59354b2bd2fe599822d5fbd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hT0:A3k03kHRJp
- TLSH T16F25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 971KB
- SHA256 900cba8e1b29f781d47e8456920d4051da854e428d53fdee166574f66afbe7d5
- MD5 9f60ede72d7651f340c2b32e84418afb
- SHA1 b0781f1a84f7583d1c34a7efc430533580e36024
- SHA512 b52f8e5da85bb3e515a004902f72de59b54c9f657f2e46611dc6229086e347273bd5529a81384639bf38d3087cb717a51bcbe3cab86fcde4f60c0cf3840b0db8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hig:A3k03kHRJ4
- TLSH T17225AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 971KB
- SHA256 1a33f03f744e5ace3980284b70795fcf1a2e056cfe21ec97050c99451746815c
- MD5 54f8240bb101ff9b7462bd955f2a94d7
- SHA1 634bc1e6d8ea870af835c7e87a9878b937ceddaf
- SHA512 a8688f56d13a2f374d861555243c1111c7ad293d51cbd1a49712b4f2619a54f8f2a59783778c67d9350b9ff9b69bd1fa2a762417994d976b8ed394c7445d7470
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hDr:A3k03kHRJi
- TLSH T12325AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 971KB
- SHA256 9e3791b183c5ac12c645db18b8859e28f1d34b3c677f80a16af0b1e269f223ca
- MD5 8dc38cbfbf2850c94e115f95306bb69a
- SHA1 96e99dda1efb89a9401146540c4733d35808ab3d
- SHA512 9fa28a1f2164f1fc6a9d855a3c0acf91de190e9b0fffc8a458be790bc679624bbadfff71ec43c0c347d8e873a61ac2f02e5e05efe389a5944226f15537265ea0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hln:A3k03kHRJ0
- TLSH T1BA25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 971KB
- SHA256 7c29f49e40289c764a04b47016bd613b73f67f13adec62d7c76d431cddb19dec
- MD5 4dd3f0bb30eb52ec5a61cb445fb8910c
- SHA1 caf88ddabacb4fa0566a62552401bec64ec9846f
- SHA512 f8b098463ab47ba4eaa4bcf954b880a430a53cfc9c03b0e226d0d498d019142c887af981bf01f2e07716ce599e78eee62756b33f61f769fb1adf7ef2c190cd27
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hRx:A3k03kHRJy
- TLSH T1CC25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 971KB
- SHA256 a9426efaf3e472e611d9324338a127bda757c439c6127476401af86b9b4613f3
- MD5 6eeea37712dae2dfa1ef1e8aac91013d
- SHA1 a47840007e08a013c7ad999dfabbbc6f1fd73e4e
- SHA512 0ffd6eaadc8afe7a81956301d1118b3cc8ac143990ec8100aa6b1bfa13b7fec485f9f1e022a0069b257eaf40988b25c74e29a6b3533d3fe91360c3a3278e3858
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2h/A:A3k03kHRJR
- TLSH T1BB25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 971KB
- SHA256 854597a56883613463b5b949955cab902d17280308401ff8cb03278c471aab5c
- MD5 3f73698aaee8343d670aa515e12222fd
- SHA1 f20928d54eda8e4d1f0a48a6bb31c2bef3c3d091
- SHA512 3b04909e72eef5f6d429adefe408c617c834d18376c59fca727f4108afebb5ede1b03df77a3cd22c5924d2ec9211609801a29991bf0abe4bd8cd1cd5c1dc6902
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hQ9Q:A3k03kHRJo
- TLSH T17F25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 971KB
- SHA256 f94daaaef436e05f664331e03a39969bf966cbe46b20605dc5ea1d207d2e69bf
- MD5 72896d2235628969b410dbf0400dd6ed
- SHA1 64b4bbc1169f5ea2021275af0388a863880ee394
- SHA512 583cc97cfa1bbf376b6218afc0eb03bd4127934f49aab2b99b4ead36334ed38f38219013ff6d3e49e2c4207479c066bbec4bc38242ab2d9162edb7542fc9aa4b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hx4:A3k03kHRJT
- TLSH T1C425AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 971KB
- SHA256 d333128e46bfd74e1d6edc5abce345def122af7b6a20106cfcb7ddc6da1208fa
- MD5 2a13c8989cc490fadccaee4a6dfc462b
- SHA1 1814c33e66dd64974373cacd32a806a3bb658801
- SHA512 72cfb8d26cd6c550805fb8501428e20b4b25022a6c2226e763744c4f8d145c1ada0c5d2c46c4876cb924d579e2c16960efba057c4557da95eb6ae7cf13b11060
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2h0u:A3k03kHRJ2
- TLSH T10925AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 971KB
- SHA256 548d52f985afd8b212d484a7d2d3e2062ca8af6eca65c4d77c25425532856f09
- MD5 cbbf95ba1ff17d1b1d28382c55f89597
- SHA1 da53cd8a266bfaeb8b2ed52b2634702491846642
- SHA512 91d462a510b7cf20932b61708a81578f9848afb21684eac8e10aac45234edb4d958af549e49687c2563bdabf7cb53c8fdc1010ae25f145b7c7bda8f2367cf614
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hFj:A3k03kHRJI
- TLSH T1AF25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 971KB
- SHA256 293bbf3b8521262812334b481128049b18833c7d4f01c4b1b7097cc03edbc99f
- MD5 95883dd2d9b801f81f54085588da01b8
- SHA1 dae2e408dd9cfc72fa31cd51e7cf6dab08e33094
- SHA512 f53a781f6316f8fc7e20aabceefbef580309f7e3ac0ab21e7005499ae2a9ac435d1dd7449d1705996b576e1d1dd20a011f9ccc94f43576b70a735a3bea398b85
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hMg:A3k03kHRJQ
- TLSH T1E325AE03E79500E9E10AC17496E65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 971KB
- SHA256 e9343cdd6541661546fe2febb7c7c763dd3343b0e33e1d04f9a4108e03c5800a
- MD5 2f5ed941f450e6e481a922fdcbee0a41
- SHA1 33597b589fa976432902a0d1a6812e67d47336c6
- SHA512 58cda0fcf66b47e51bc21ad4df84175b708748fc8d413fe2eca40ad7bebc373e3ece18913830b8f5106534d3b0eadad04026c228f77306e8799d75dc9ab8a759
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hTI:A3k03kHRJx
- TLSH T10525AE03E79500E9E10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 971KB
- SHA256 441fe7cee07d758f2dcec47801db14d29cc461267a4774eb1ec1042bffa391a0
- MD5 edd5d4a41a0fc923c0b0ff0ab45c5378
- SHA1 5baa0367856fd3ead63e8e65ba859a99c729989f
- SHA512 425789f89d84a57dbbcd1e9c76aec05936f8c8ef64a3d7f05fe6c6a75b3e94611fe0da23dc38aaa5db0ada2fd512ef603569c4cdb14f7c510d86c2e86dc90c42
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hpo:A3k03kHRJP
- TLSH T1C225AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 971KB
- SHA256 84d940634f874d1a65541a25cbd6fc61426033a536b8925b2860c9c1f1607149
- MD5 e9b2d2a9eacaf0ad72d1b74caf36d9bc
- SHA1 c7975bff71a259dccaa03dc4a217ac7f99cbc0cf
- SHA512 964256c869e39107c7cbaae7aab3ff3ca337b93283a658f784e5159f42bb12346b1f7c525125e7f25711371307cf99f3ef37c199e6bb18bac5d40c495abb0129
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2ha+:A3k03kHRJ6
- TLSH T1C325AE13E79500E9D10AC1749AE65A23FB75BC52176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 971KB
- SHA256 a2b7678105a5c64c8939a6b56508279e7821c139d255a2fd5e92b34fb0355d9a
- MD5 595d9b7070828044d248c0c2a24e5b7a
- SHA1 6ee9c3c7f93d305b22800bbf00f8eb6ebbc85f8d
- SHA512 122c536d870e6e6de92a96c9089577123f870058184008aeb240c23686de0647927b33fd161fa64c0fd03f93cf7a5ea16aab7423424d8def23612d21b0a2fc3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2haQ:A3k03kHRJ+
- TLSH T11C25AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 971KB
- SHA256 620195194faa2d778c9b50e0b37ae92315876506784a2c4cbc347490cd1a1059
- MD5 1da5ebca1827a8486cd3f124979cb6df
- SHA1 72fcf67004acc08012b87e8636c8942a77b6cd8c
- SHA512 b549fd9c6e571378a27db7175bb61facfcc5cdfb9d8d6a970720a93d4c0648e428862e7258d587c5791943571d93d3ff47c3ab573507b9e8909e6f00c8684c44
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hrX:A3k03kHRJe
- TLSH T1EB25AE03EB9500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 971KB
- SHA256 f0f9d29752583d5a6746128e02b2ea51702262b221ebf6b9d2c429c7c141306e
- MD5 e1556558b15d27838783aa039ff9c5ce
- SHA1 06ecc573fc66074416181987a7d1954d34034ef1
- SHA512 961298ec156321d21fa40509028d52d3f899a36bdd871e08d02c6157cba8041f3f3e199739e4683f88c288f18048c9d4cc726248778b85a8e41ef5797b7bbc31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2h5L:A3k03kHRJw
- TLSH T1B625AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 971KB
- SHA256 c1ca727fdb156e4a55aad3d35f8f15f8195b1e7b3df2ce4bed46e53dcaa2e590
- MD5 eb95f2ce04ced1518e494294688aed0d
- SHA1 1bfa500ed11d5d5e0643afd8752d430648771d74
- SHA512 163a1dd358c1489b944b6380dcaf90a9697f0bc500fb1c10794311c97b7b9fb1161f3a5320e59a8e0bd2c440a368fbd850c6aff65916299c7ce3bd098613b91e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hnM:A3k03kHRJh
- TLSH T1C125AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 971KB
- SHA256 078e830e22ea3c3ce71ff70399f2f970a2b9485862228e313c15a7f506ab2889
- MD5 fec043b83f47ecb066e14f1baefd64ca
- SHA1 5a3994e551269cff86fc51faaedf67390ffde6f8
- SHA512 5e19ddd48eaa5f093bdefd6c1360c8b469d1043b252605859de5d6b8f6527be90db9b7fb5bebbcc9844584ab4b0fdfe7b07ad1b2f11e2cceef4f32b047be6a75
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasLagj2hQh:A3k03kHRJz
- TLSH T12825AE03E79500E9D10AC1749AE65A23FB75BC56176093DF2368C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH