Analysis
- max time kernel
97s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
24/07/2026, 22:28
Behavioral task
behavioral1
Sample
2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 845KB
- Sample260724-2d43lsgl6v
- SHA256 0740dae24423159d79099b315675a451e5414a46c302704e2b21263254ad0824
- MD5 1794718910464b31ec6e6362390bf901
- SHA1 ab27a7e0b4c8fa839b53d9296c7ee475b6bdcc69
- SHA512 6f884e28106e8a9af5e152578f8d6c2951c1c5736e9be4a91a6e3d7e564a10a9b7a5d8cd655dffa9b4eaa1aa658fefb5f4419940b5acacbd1281c3f953fd1c5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojg9:A3k03kHRJk
- TLSH T11C059D13EB9500E8D10AC1749AEA8A23FB757C56176097DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/5832-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000500000001b815-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5832-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2444-59-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-427.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-470.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-496.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-576.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-602.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-626.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-711.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-743.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-786.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-842.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-874.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-887.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-928.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1009.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1046.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1090.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1103.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1153.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1188.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b955-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b95a-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1484.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001892d-1521.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000018934-1564.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0007000000018a18-1566.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893c-1578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-1809.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000500000001b815-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-40.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-270.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-427.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-470.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-496.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-576.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-602.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-626.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-711.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-730.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-743.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-786.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-793.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-842.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-855.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-874.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-887.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-895.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-909.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-928.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-935.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-954.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1009.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1046.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1053.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1090.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1103.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1134.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1153.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1172.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1186.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1188.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1249.dat aspack_v212_v242 behavioral2/files/0x000200000001b955-1364.dat aspack_v212_v242 behavioral2/files/0x000200000001b95a-1377.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1484.dat aspack_v212_v242 behavioral2/files/0x000800000001892d-1521.dat aspack_v212_v242 behavioral2/files/0x0003000000018934-1564.dat aspack_v212_v242 behavioral2/files/0x0007000000018a18-1566.dat aspack_v212_v242 behavioral2/files/0x000800000001893c-1578.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-1809.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2444 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe$ patcher.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe - Drops file in Windows directory 28 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5832 2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2444 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-24_1794718910464b31ec6e6362390bf901_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5832
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 845KB
- SHA256 0740dae24423159d79099b315675a451e5414a46c302704e2b21263254ad0824
- MD5 1794718910464b31ec6e6362390bf901
- SHA1 ab27a7e0b4c8fa839b53d9296c7ee475b6bdcc69
- SHA512 6f884e28106e8a9af5e152578f8d6c2951c1c5736e9be4a91a6e3d7e564a10a9b7a5d8cd655dffa9b4eaa1aa658fefb5f4419940b5acacbd1281c3f953fd1c5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojg9:A3k03kHRJk
- TLSH T11C059D13EB9500E8D10AC1749AEA8A23FB757C56176097DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 874KB
- SHA256 103404803942d250c024371111f310041a838d061e304522d6d1a7a991b7ea76
- MD5 6a8d63267fd1c7c6836fcc8bdf9aebeb
- SHA1 4c022898fc11f1b5d3c66d72c8a34d95b02b9a7d
- SHA512 a8ceb436948fe13380bdea99c6e542485c19fb1b38c3f95976d23793d84bb5081fc55493ccd256be0966b13bd7489cde08de07fadd0875661e86693174d0f93d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgrP:A3k03kHRJY
- TLSH T1B715AD03EB9500E9D10AC1749AE69A23EB75BC52177097DF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 891KB
- SHA256 02164c77259bf0ccf735a4cd704c42eef04db5538827385dd7d2b75da7c7dc95
- MD5 6a9e704c7239929a8d502c7eae52923a
- SHA1 4a4632b5a8029ddd198e96b61b7ae972e0c0c5d7
- SHA512 624244965d25094d5c535fbc8646c96b2cba29c7f14024466403c5b58fc6b5bb5feecc499fe2af83b3b80813f9d985886fd870c0ea092ec61ecb6ed8b3148426
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgQ0:A3k03kHRJh0
- TLSH T13A15AD13EB9500E9D10AC1749AEA9A23EB75BC52177093DF2358C6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 936KB
- SHA256 6830e1f16db35909dcffcafc063174df04e65f8f84a5a5a67b2a419630aa65c6
- MD5 070da60f994e859982f393f2654b13e0
- SHA1 8fc92760e83912dbe95dfd00f57e0dc3f7fdb046
- SHA512 7ea979718427300865e4bc03b5f45fdaf34abb856b2734f6c4ab0021a4e39aa13670e54094c27faf0bd3557e8c369f7a929bfdc42b829c6a0912675267e0fded
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgp:A3k03kHRJ6
- TLSH T1B715AE03FB9400F5D10AC1749AA69A23EB75BC621B7097DF235886152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 929KB
- SHA256 c0accd8450f55a34abf1f10a807c197f5f070f67c2615b7217c3951df0bc1654
- MD5 fc094bfb2784eb21e76bb9795e6067f1
- SHA1 6955a2e2f2c0c11f413441ac7c771882982e07cf
- SHA512 d9789791e9408d5f540c08fb2108a95a164a6319cd79bd4a6b34b2f5aa9e4ad3fc53836583c84a710589131cc93c3ab418cd9e9ac25991030a892d7a208418c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgs72:A3k03kHRJR72
- TLSH T1F915AE13E79500F5D14AC1749AAA8A23EB75BC62177097CF2358C6152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 897KB
- SHA256 160577d28e0e82889a384f7a76a54ddda69ff2b98447cb77c40e406a726c33af
- MD5 c4551b034692f0bc51f30a980cde158e
- SHA1 24f1229ec2318fc373f1af75bec36df2a7b772a9
- SHA512 58fa2f9b03c1cbdfb98a871943c2c45271978bb75efadbe1a1c256c9a9a770e6ccbb69237b746db16b5719d9fc70dbe3366e5ebbac231109ca517040bd70f5cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojg8fj:A3k03kHRJnj
- TLSH T1D015AE03EB9500E5D10AC1745AE69A33EB75BC521B6097DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 952KB
- SHA256 70befe198f8894df799e796d7cee572d53840781222e5aef4c7ee22734394b2e
- MD5 a88acdd7bb387167ad9154699cac3544
- SHA1 15541d7ad4f43f5a2f10bfd66f9487f177acc9ee
- SHA512 7609b44146cc4a5ebf263638d0ae920ae1c995c6939e07a01b0314256f34a2431d114ac142108f59db931f65be621f43925bfe9b1af98c98ee6864014334847e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojghhk:A3k03kHRJQW
- TLSH T1DF25AE03E79500F8D10AC1749AA68A22EB75BC66177097DF1368C6152F73BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 735c3ddbe2d54a952721babbf6e8a6d906fb472429481331f741cb45e6856a07
- MD5 4d31f2b7db564277cca92c376a162dce
- SHA1 d607e4332815a3bc139b63312d3fe66e92f5c81c
- SHA512 292fe8fa0291db2b68b8e10a9a2197398192f0f0aa1c68ce3f238dba115c06cd20b52aa6c4f427207431cd464f9bbbba216bb5c6b227a9ce565a1715ab139146
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgJ0Le5ji0hmxNrM:A3k03kHRJcPji0Aj
- TLSH T1DD658D17F6A402B5D067C0B9C6D6965AFA71384217308ACF1398C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 859KB
- SHA256 c585bc0d27c557cbef72e88157a94f0d3d12394edc7ca9d96ae4eb99d45688bd
- MD5 b801d673513e19c24ab64b9185665881
- SHA1 ba2fd2e1e3e555d067b78590024c519fd06f1887
- SHA512 b28a18e2c46e5e45c3070b6fccca9adf316326afcc1c782092a2f654c3345d848d9b3fbb2c28574cafb64791252f642b9622bdb2b0e8a613d18cdef5c0dd6231
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgba:A3k03kHRJ
- TLSH T1C215AE03EB9500E8D10AC1749AEA9A23FB757C52176097DF2368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 868KB
- SHA256 06b4d1043c2012f2f37887965797d2e50741341dc4f0abde2b793e743fadf5e2
- MD5 5388e08ef7b5405d5556fa457bb3c724
- SHA1 29915bce2876d9b53312568d0d723cb890073cfb
- SHA512 aab1a200efeab8633b71f446ea8493a37da567fa88587087692f79fb35d323b19fc174c1c4789ed5bf623e1cf7e2fdcc993453bb1759f692f23434ce167d3e69
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgq9:A3k03kHRJt
- TLSH T18D15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 868KB
- SHA256 618feebc0afad3272ba37bd7e7085b032f079635b83872a7ebf840913b19287b
- MD5 5ec3fc541df3b785ae7e03b21cb4379b
- SHA1 c5979e0f20bbc66004231ebd81bd83862decb1f0
- SHA512 b37b4b035735a6045eab38074c74c53df6b529a5ad5465fbb59316f887bf03f9784a09cfa1c5456e79b46689906b85c0b81c97529e30d95a56cf2382b70a1749
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgqc:A3k03kHRJY
- TLSH T13F15AD13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 868KB
- SHA256 e295bcdb0c0b31ff2f57a5acad3462a85e8c16204435a6c2cfae11a00d25a82c
- MD5 2ed1a42f521780955b686341e571f5c6
- SHA1 9c3556825984b63bf87f14623a08b6fbcf0edd7c
- SHA512 a5aabcaf9879561893d17529aaa41a7070d41539a005ce3e2faedac07c3e9673d96244d469f7012afd7db409f20a4dfd01a3bb9d4fa64e5587acc9f3c754aac0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgjp:A3k03kHRJO
- TLSH T11B15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 868KB
- SHA256 e713ca16c04ef93ccd5062f235ce6cc8dc5a4cd941e6af782e7f61a141eca873
- MD5 0b6b6e800c9f484bc8e514c723dffc0f
- SHA1 d3755530de0817d81c7fd298f4a4db7e4e420e57
- SHA512 062be08462992a0ef54e85808cc7c953942fa6f7176a5adb948ba995459e6e54fc3771a976c4788fe54cdc0bbf5996b59cacbfbaae934e3060727e29ec9a0243
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgEN:A3k03kHRJh
- TLSH T17615AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 868KB
- SHA256 ab4b026805037c6265b63af4759ef032d7d61196eddc3569a0a62d9155cc4129
- MD5 34dc7c40dfa9c65a4f09206b2f22e7f5
- SHA1 659d9d8c04c4da9b8512680b022afc81a36175a6
- SHA512 f30a5bb756e2e7b0233cac66fe6da7888f2f25565e1826dbdb63d5b0b02f032ab939516f8df18a490a45b49b164c0f7c8b1f565b98f8fb6e90b56ddd998f8655
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgsF:A3k03kHRJz
- TLSH T19D15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 868KB
- SHA256 f3c6d6c793919e58efa18281f5c1a9d1bf756af635998d3f6e6116b62d37d56a
- MD5 a9ac5d65d7963e85be240881dec4383d
- SHA1 87093704be3bcfcde6daf29a7961d13a599f4abc
- SHA512 f2b59263eab01f59a3c4f5140fbfb1192feacf4c42e967951449938a872643d44c0fc82f5f0ab221ed5548f8cdb4855a34081fb39f56f30ad1c8ede5c975016f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgZC:A3k03kHRJv
- TLSH T1A515AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 868KB
- SHA256 2cc2072205bf559b662805455f230879f89b89f4cd21f2b6114b14f053987c40
- MD5 91b6fc129787c9b32c23cf970f3112e9
- SHA1 bb20ac00f83a5a64dc918d1ae83f70e5297ab648
- SHA512 0955cdf3a794201c60084f18b1e016718dcb3ce1e0d3232b6f2644487220293319ed076b1e1559292437ae4c51649cff32e05a5e019f955b6f8ded897e7050ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgaw:A3k03kHRJK
- TLSH T10515AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 868KB
- SHA256 8b7367dac11d59853ef4c0668eb6b808e87b352ecd042a04ecd9d2f44f459c36
- MD5 c81f1c716f97cdaab2e5d8d8f2465d68
- SHA1 e45587bfcf37b2eac9bd430e60ff8fcc8973a432
- SHA512 e641dd17ac37dc97c005dc3e0f9b3a0d27d17a8b013512ee05f0ac25ca80ee0bb3e0d1612b59c79de587a2d94330d0e05843cc83ed67893c8870e3eada881cbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojghT:A3k03kHRJ6
- TLSH T1C015AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 868KB
- SHA256 75adc1a66e0c52177a7005d8aaeab917f4ea688e9e2f4584bcbd2206fa31ffc3
- MD5 c81d4fb63b7aaf1108c2bcf30c51abef
- SHA1 7fdfea0b34e8380cd3c6dd7f8583280df3442db9
- SHA512 d26688d9a0ebf0dd6fde31a856be16280e8e824726dea5cf08c47495502d4b99c58cd7672469ee5d617e1639a3ca9310a88ab52355788d02e6a5698b854a1e85
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgPu:A3k03kHRJ1
- TLSH T1BE15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 868KB
- SHA256 44ec5490f197d46479baded6e650e2f941d4c4161a0edfb7fc1cfdb2d2656636
- MD5 f705da7344b2fb75b73b14407b97178e
- SHA1 4fd8d379aec03c1c19a0e53861aef07e60ed1a6d
- SHA512 b40a8c44e3bfa98c8d7fda21366f0d83baad0d8021697faabf6b28d1d806332f9b4c6de4e1908da34c9ec3211b3cfa5e86a6f3108d977b1c9c0b469fdd0e2f07
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgzb:A3k03kHRJU
- TLSH T12615AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 868KB
- SHA256 fdcf314fefb2d1fdfa133b83d8255e79f32066c9261f2e5b0f8fe261b02d6b56
- MD5 c8f9164e2fff28f00fed4f8af324e31a
- SHA1 399eda25ed5a3299013120c92d69fa616b387dbf
- SHA512 1df2b62da111f6d40e03d6fb72638fc5dd2b1b49ad537444b97321e2a95c793f8fb07a69b1dd352823b48e1a888a068c7e30665d7ee21f57a412d5703af45f69
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgHf:A3k03kHRJk
- TLSH T1C415AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 868KB
- SHA256 0a4bd01f6ba51eed7b3f9223d1e4c41ef58188d8b70f464a7d83538d755bab24
- MD5 346beca356f9fed78ee95dfcd798f783
- SHA1 2c8fdcfe291fb2c47fcd440a2b710ff1531a466c
- SHA512 170507861e65387aee21039df197c385640de2ca2fae71936f6075c5dcbb9cb3f99778fd4bbd156301f89131744c451cef599dd8f09aae20331ddc965ab6cdb2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgwK:A3k03kHRJU
- TLSH T1D015AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 868KB
- SHA256 189d9872f3683a9e7c715aa35c583ec3c1b7b87a1541739097e7b1258bcb4d89
- MD5 f6001947a38e2800f978e04c3d32c1db
- SHA1 f4e33953858a0d51138e360db9daf8e8779fad3a
- SHA512 8010c3799f868b5513d06bb5eac1a9e8564c12d91987bfca141f28ffcdc1d5c80e106ec2fa6d288725f02d081fca8c80c26be273f72bc4a57a47285cbc6d7cdf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgtk:A3k03kHRJt
- TLSH T10E15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 868KB
- SHA256 a1121c6d9893cc4cd6097f59dda822b270e7c525affdb9d1da724a7b90d05ee3
- MD5 780dc23d6bb4172e3003d1f46bb699db
- SHA1 2bc753bbb7088f1f53b6fff7b29332728c37ebcb
- SHA512 f4b2fa626076212593244206ca89a75ee8dccbdc408ac85a09519f9914810e5239c76c5dd297c0f45c89eeb78ca26f08c5c26827cbddde169086550b3217826c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgy0:A3k03kHRJQ
- TLSH T15A15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 868KB
- SHA256 6ecd2b0b4eeb24e36ac4729611e2fe6d3d2944af462936e4a3ac68968e9d3c1f
- MD5 987b8d00ddcf9a7c61c212a8a3ce3b86
- SHA1 f3cb18164b87a298781f8d1cd7e5dd3a9580fd4d
- SHA512 bffeedca164f303e39e38e090656e5edbe96b55c58c5584875cf6240582be874591d869a75ae9b5a91aa3e5da168916eb53b3ee1ac43833beeb92cabde936056
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgBg:A3k03kHRJl
- TLSH T1FC15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 868KB
- SHA256 711a6bbbdd686021116f104a2cf9635cf831eb60b9b1500ce9943f175462e842
- MD5 904fadae48540450bc1a691faa76791d
- SHA1 2a934a8c47c27daaa4376dbc3fa9108a921e1c07
- SHA512 343037ada0186bafffb757db331e8edf77da0d485c992b50bd2787f5074249467a972661049da4fe488cb4d03480fd853d956fc95ccfa486c70f9febeda9ebc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgor:A3k03kHRJn
- TLSH T17B15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 868KB
- SHA256 09f27dec587c82dd42cfec555ee890c732abd61fdf5090bf50c38e2499034616
- MD5 c8c214ccca0efec07814e988a1d39027
- SHA1 63ad4e8c35df4a23ccc0f8ecac40db2748c6c166
- SHA512 d8513c7e6b5416c4bc0c9321921ee3012e8b1e2a76ca7f9c1b3d3ae4a2bb595e717d1ed7f4d30231796723cf8a53f02ab80670b91fed4a6a1301237aea07a34a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgGn:A3k03kHRJR
- TLSH T13A15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 868KB
- SHA256 eba28fc1d4b7cabb71ab3dd73a2d111190dcbd44f0d13175f42222e66643c7c7
- MD5 88c6feb72acb0171eceb01dc2f49d95c
- SHA1 0009db30a819e7f423e5e26c977715444c52a936
- SHA512 e24097988aa86b00bc8ecead6ac0f2108f57cb230263f9d2e5b63ed4f3b7dfc6711af4247c6f1f31854e6f9d992b148d9dba44923d6b13fc4d146750f0916ee9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgMx:A3k03kHRJf
- TLSH T1E015AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 868KB
- SHA256 31104e945be962cad1e1f1a15029966d1288d7a2d94a01d826ab1b6a33fa6c67
- MD5 80dccabb0206c4c73d2636595b79349a
- SHA1 d43b1f946ff53f82ae100490b61377dce1a2c753
- SHA512 e839658c5902c282902ee04b6accfe45b730a01dbb96fd44568a8075431bfabf84d09344b626590301b8f998c4e525e7af820d63e13f5c78af8d9bd5f5b40a60
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgGA:A3k03kHRJg
- TLSH T14915AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 868KB
- SHA256 d80ae2d38ca00e2dbc434a55d3f952a39b40e9365974c54a30e3fc0a0f01f7d8
- MD5 bc75544a1cd1d572535814bc9dc63721
- SHA1 53b9fc3c38ddd8496561c32072233b41fe0bafa3
- SHA512 3313987ebc902d179fc7fc780c1f13c82971493109aad340b0a2c7378be211ba7f8a3d8530e5486748e5ada0cf65060d6912472e8865ac8a165db96822e0a256
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgf9Q:A3k03kHRJZ
- TLSH T14615AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 868KB
- SHA256 a2b31ee2d91ef98e875d68bcf089a5709e0f030c65191f71449bea60fb879bc8
- MD5 197b102f6e69d26c475a25606e9979d2
- SHA1 88609d540b1fa90f232eea52da4a7cdcee383af4
- SHA512 c45d64ee56e6fb3ddba7dcb8d371681b10c3a4dc4f677683d745de2826d41b0cf24c3b44108df9dbb85925fc004562912944f8af83ed17a56a3a78d3e8010c63
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgW4:A3k03kHRJO
- TLSH T16C15AE13EB9500E9D10AC1749AEA8A23FB757C56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 868KB
- SHA256 40cc90e056a8c17b1175085c20b4bf0f38d7dc38381d9f2d903ad707379d1436
- MD5 0583c60d9f03530182f2e5fefe310819
- SHA1 836198572a053bd79044d97ef5fdc875f79dee23
- SHA512 adaa1a16c7a9eb6e54e189225b516814f93ce3205c43b4472925301dae0938fc01bf535f9f5da3d3cf066e2235775d5e99a8e5fa92dba64419da55d54bff4958
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgFu:A3k03kHRJv
- TLSH T11C15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 868KB
- SHA256 35d16a526245511c81494918c1d152b36cd704f37e0a3a41bdc9f67dfd384e54
- MD5 63e3fa186a6545ea0ed5a8da91f746d3
- SHA1 4154561c66ddc200aa9a4f56f0a89fddd4126a31
- SHA512 367f699ef7d91cb5daf19b88e1529f24d7f5db5389285fc5784d71419a28a5781cb25b364e9c730aed0d58407169a04d6f290bd1046668d609cdbccaa59a678b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgYj:A3k03kHRJx
- TLSH T13A15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 868KB
- SHA256 1dd16efa1827f820b4f6cd634cf399d87af69bf5662812a7ce8c199b15f09dd6
- MD5 0b602237089c59a0c31a1bbe07460461
- SHA1 cdcf4053f3aa1c92d98fe22ea8d8cc897235967a
- SHA512 ca405d331c43f320dc8f4189fdc77650325c898a483a9132f2f74fe601ed573c930e97d9cdc5785de21eb8e0eba91fcca6f26568e5918911f3dd1338ea6ef76a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgpg:A3k03kHRJ1
- TLSH T18415AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 868KB
- SHA256 4bb8d18df1c7c86e593c52519982aa83abdb001efcc991aae58fd8eb29932352
- MD5 421a27124b0d63ab4b4de3146294ead4
- SHA1 c8034c78bf22cde47a4c0640d178ead9d1cdee7b
- SHA512 21a9b2be47e12fe0c49bfb071492fa3c72a7581dc3dec22fa8b20b859b2c4282b6641f1bdf7f76a44a132f4ed0a607d71b503065d56ecec38e2adf224586cc34
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgwI:A3k03kHRJ8
- TLSH T1A315AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 868KB
- SHA256 339d2057177e8e611a1c10b712f4fab3d8e659bc49d471abdfd44f3454ba7695
- MD5 91e7cd8fae4f2ddd74cbb5c9730b3a4d
- SHA1 3ef6340daa4ff987f885fda904ee736437490da3
- SHA512 48181de5358ccb59a2fcea8dde5a1be60cc70b9f8655d91624dcbc9f4f7da156710882d2c050161f57b66f77ae5ca072599f322ae04ecbdf9fa14e954c9a8ea8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgyo:A3k03kHRJ+
- TLSH T16915AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 868KB
- SHA256 38a3f0a4b9ae16429cb8866f542bbe04a4ac2f8655632631be922ec8580d569d
- MD5 3154e01d70003033265c4ec741fc5bea
- SHA1 4093c6493ea9d2316bc0dd0eb21e9a5919b599ab
- SHA512 55009baea0ad1a41b01c48c50722de11ebef8fb06804cff5e742cba898facdc9ea834799ea983587fac3764d4559bf0e10af674d8374dc0cfc8b58113904f554
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojgp+:A3k03kHRJr
- TLSH T14615AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 868KB
- SHA256 5cb2ec8fd3cfbb23d30529e0824e01e9bf0484ad1f5de47c1f0434872ef8f7d1
- MD5 21270182ac633487b7462faece05efb3
- SHA1 9b3971099207581c197ebb818b5d8433bbebbadd
- SHA512 30343547ef673be120bf7f454e26fd1b50672e587e6aef6458a70a18e1ba8123f22b1526a16353be8c00a251bfa8a5d85e027bcbcc3f723fb06147deea1e34ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgXQ:A3k03kHRJv
- TLSH T11115AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 868KB
- SHA256 b70c55e8427103e3e14752de04f3eaf5162a54b5fcf5c0eef5e917d2d835a0ca
- MD5 a410541d3e14807991eada992e9548cf
- SHA1 fc38d78e6d482489acbbddc9020ebd8c94d5fa69
- SHA512 5df22cf3a7264f2c581c739bf3a69320b31015f749866a8a200082b3909c6b4baa968f312297e5dbcba2cce5e051b9362e57533df4c664e463d0a5e22c4908c8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgsX:A3k03kHRJj
- TLSH T10415AE13EB9500E9D10AC1749AE68A23FB75BC56176093DF2358C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 868KB
- SHA256 c04595006bc3619b092ccb9fe3931e9d9db0f76ee86903278e0be2bb48150ca7
- MD5 0c1264492fda304436b6a5030d29d785
- SHA1 75361c76b6ed75327a2d1abde87b5d9776c00949
- SHA512 57f7796c7af7fdc116713220bf30c392d96a171c3900c08ec77801ca71acb17b8268a4daaeba3c5fdb9ead775bd913ccb6b6875c8983fa48e3407898d9ce0765
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgKL:A3k03kHRJt
- TLSH T12215AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 868KB
- SHA256 4137edddb5da60a01870880067f0e3cfc95d82f4be951c9903668ec62cdd3328
- MD5 c5678f71b3ee789647946c89d496f80a
- SHA1 1c64eaaf17851c51a7e3cc7478c3115cc2cdb132
- SHA512 3e86c07ffa85a690a5a7320a971f477f0137c923485701cd6f21e41a1d1d0b5f4465722f5b632c2720b5a0497b36ac5154a210b0b24d3845ea359a93710ae890
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojguM:A3k03kHRJU
- TLSH T17E15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 868KB
- SHA256 05e5888bdeff9c7b936b4456de96eac421aac5bda0069098e21e1de49551308a
- MD5 f7aa2ae6dfbf9f664b2b8a389ac68d52
- SHA1 bb68424002a143b9ae6cc1f32aba24269869bece
- SHA512 285d6c12977da9b59d2dade132207e8bfaa69b49e24b067769694dce0ef5375a292f42a4ef8061c9bb020ec9b8cf4435bcd58c4f88acad1134db15575e6abdb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99Qojg3h:A3k03kHRJO
- TLSH T11C15AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\pingsender.exe
- Size 928KB
- SHA256 6f1ae767111474cda98c2593d417461dfd23b256519e4d6bffab362795a86095
- MD5 fef91bcaec7d88e53471ee3e844d4b7c
- SHA1 e5e1bfc4bcc4f693ad9d24af326b0315c7685c71
- SHA512 f0c7b6ef7015fc1e3b199d19f1f528e1f94f7590005e032feac7a3dec0a5145e75d0e65c0e12d08726051430d825d6c05dfaac0384f76bbab52a0aacf130d1e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgI1:A3k03kHRJF
- TLSH T1B915AE03EB9400F9D10AC1749AE69A23EB757C56177097DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Mozilla Firefox\private_browsing.exe
- Size 909KB
- SHA256 0dced6be478fc13df5a5cd79a46be575f6383d5d4e37c968e9f66951a632d4c5
- MD5 f72d7f629e96191d7b9adab3c64e19d1
- SHA1 21ef4fce40d9145e4b1789a2923eb7b977155aef
- SHA512 8bacf73838a02fd3742f794e528dec7c6eb8afd83104d30185beab583054ae26244cea85ee4db9997421ef1125c92b609ac5bcf70b0873c0b1f042660d473898
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z99QojgIp:A3k03kHRJbp
- TLSH T1FC159E03E79500E8D10AD17496D56A22EB757C521B6093DF13A8E7292F72BD0AF3E3B4
- MD5 SHA1 SHA512 SSDEEP TLSH