Analysis
- max time kernel
110s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/07/2026, 22:28
Behavioral task
behavioral1
Sample
2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 860KB
- Sample260726-2dn2dssvbt
- SHA256 87ce8ad00eb66fa586f18ab8e19be5f35389d7aa8225c4ee79c0b31557ddec6b
- MD5 057f82cec8876813d796f5397bfa88b0
- SHA1 6373c04f689ba91ee571e2b36a543e8e9dd70a9e
- SHA512 60aa852a8765d761d5a2f166fcfef5268baa9352c37b5dc7a226c9b9986ddf2316ad8a1d2befb44fbe83e3b4b80b7624db84ed6dbaa93696398c05e54d6676a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaF:A3k03kHRJz
- TLSH T167159D03EB9400E8D10AC1749AE69A23EB75BC56177097DF2368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/3060-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c539-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3424-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3060-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6b-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a3e-227.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001982b-264.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bb-361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198bc-464.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3b-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-532.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c1-606.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c2-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c3-681.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-830.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-861.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-941.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-960.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-1015.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1059.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1096.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-1115.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1303.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1334.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1353.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00080000000188f6-1492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00080000000188fc-1535.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000018903-1572.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a21-1579.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001890b-1815.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018913-1883.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c539-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6b-59.dat aspack_v212_v242 behavioral2/files/0x0005000000018a3e-227.dat aspack_v212_v242 behavioral2/files/0x000400000001982b-264.dat aspack_v212_v242 behavioral2/files/0x00030000000198bb-361.dat aspack_v212_v242 behavioral2/files/0x00030000000198bc-464.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3b-495.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-532.dat aspack_v212_v242 behavioral2/files/0x00030000000198c1-606.dat aspack_v212_v242 behavioral2/files/0x00030000000198c2-632.dat aspack_v212_v242 behavioral2/files/0x00030000000198c3-681.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-730.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-749.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-799.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-830.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-861.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-880.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-901.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-941.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-960.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-1015.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1059.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1096.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-1115.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1146.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1160.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1186.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1193.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1218.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1303.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1334.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1353.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1378.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1385.dat aspack_v212_v242 behavioral2/files/0x00080000000188f6-1492.dat aspack_v212_v242 behavioral2/files/0x00080000000188fc-1535.dat aspack_v212_v242 behavioral2/files/0x0003000000018903-1572.dat aspack_v212_v242 behavioral2/files/0x0006000000018a21-1579.dat aspack_v212_v242 behavioral2/files/0x000800000001890b-1815.dat aspack_v212_v242 behavioral2/files/0x0008000000018913-1883.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3424 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe - Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3060 2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3424 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-26_057f82cec8876813d796f5397bfa88b0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3060
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3424
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 860KB
- SHA256 87ce8ad00eb66fa586f18ab8e19be5f35389d7aa8225c4ee79c0b31557ddec6b
- MD5 057f82cec8876813d796f5397bfa88b0
- SHA1 6373c04f689ba91ee571e2b36a543e8e9dd70a9e
- SHA512 60aa852a8765d761d5a2f166fcfef5268baa9352c37b5dc7a226c9b9986ddf2316ad8a1d2befb44fbe83e3b4b80b7624db84ed6dbaa93696398c05e54d6676a8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaF:A3k03kHRJz
- TLSH T167159D03EB9400E8D10AC1749AE69A23EB75BC56177097DF2368D6152F72BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 889KB
- SHA256 cd658211c235e42bb0dfc00e51f197055b2b8fe14825cd855af3c119019f4f5b
- MD5 43050e9a152329186b92761e06f190fb
- SHA1 99ca9f22a0618b65e44bed2262298f66350fafd2
- SHA512 877d2466ad07a268c1afb69c64e6eab5f971b7d93b4d27c1f8bedc98429f4e1b227314b5dde1c32d3bcc0bc4f00accacff713239b6f3fe7c48c1dcd12fecaf36
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaTP:A3k03kHRJd
- TLSH T11E15AD03EB9400E9D10AC1749AE69A23EB75BC52177097DF2368C6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 906KB
- SHA256 635d8264d16639b3b0c1a26a97bdd69b45ffa2a34a26e3f2e968fdaa8f246c38
- MD5 bb7c4d913ff4b082e2ba5f83f9db6bc1
- SHA1 5cff8b33cf8b3b8d2752b68264b4f1e97ab8af83
- SHA512 aeae37f9378dd521638935daad912bc0f366bf8a3f44f94ff704c436ddcaefaed28e84973399eaa700bf68ec905612b1f64f0c9f665cbed156d908fc48cd44be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaI0:A3k03kHRJ60
- TLSH T1E315AE03EB9400E9D10AC1749AEA9A23EB75BC52177097DF2358C6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 951KB
- SHA256 bd159be0cf9ab38d5c0e5f28796bfbd558d83d6bc38daee98c576a4d216c58f4
- MD5 3181cec6b3f420813f704889e35cd26e
- SHA1 b48a40b963c2410a595c646e877e3d67d0d09cae
- SHA512 01e841b39449896697d09f13450fb7bea65c57b89ff1a6dec9496d8d0ee502e8cc780c834dde630560e40a5c60f28f63460f532050afb669447a3c87550a5d34
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEah:A3k03kHRJ/
- TLSH T18D25AE03FB9400F5D14A82349AA59A23EB75BC621B70D7DF235886152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 944KB
- SHA256 258bca065351c3892879ec11970a02cceac1a0d91b95c312d34d192d3473ed1d
- MD5 af23c02f6f8e73b46230674ca935b992
- SHA1 839d053273bc2165a118f2659e82a1e6f61babfd
- SHA512 ae5d094a8ccbf9b4dd312c855f8b47187de9de11d80e795030f9621174f512157f67c47fbdd6f4b19fd4e7b092260e4692995d7d5290b1e620ec4ab884240b66
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEa072:A3k03kHRJ+72
- TLSH T1E225AE13E79400F5D14AC1749AAA8A23EB75BC22177097CF6358C6152F72BD0AF3E399
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 912KB
- SHA256 7721d9a22eb1fc53df574af06c8325de861c9ea69ce0be566e709de5875d1212
- MD5 25883d1f4c08ea65f07ef6e86fd4e9d4
- SHA1 904976130ff3bbd0552949b213378db17b8d2a1b
- SHA512 a87d5e79d3554747dce089243c5a0c06841ee5833936deea05251d7214c9d160745856acb4b8e95b0edb9faeb25686c75c786da2c23b501dcedd5a31944de8c7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaEfj:A3k03kHRJQj
- TLSH T16815AE03EB9500E5D10AC1745AE69A33EB75BC121B6097DF2358C6152F72BD0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 967KB
- SHA256 3d22d4f558c63e9973ca2ccd2921827524f51739c0e39ee3cacb7dac799b75af
- MD5 908260571cfb7d0a19001cf34456cb09
- SHA1 34092bd91c5bce3619b22fb16407af493c3f7898
- SHA512 1d1d72baf305cd755b69f6a289c86c47a5887a74b1d9f508c1c6234b2ee3003bf34c969026dac1f34a544843a606d37efd5c5cee3b4c89ce9a3ddb88e34a0735
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEa5hk:A3k03kHRJfW
- TLSH T12D25AE03E79400F8E11AC1749AA64A22EB75BC66177097DF1368C6152F73BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 f61933ab529d15923dfc0afd7b4a8ca2684053c829f8712c49ca6b86b7f82a0f
- MD5 2f7a14d1b856f26e6659c725a5a2ccf5
- SHA1 0ccc78487c8776508bcde9554b45aaf21f5fc7dd
- SHA512 972cee5fe4377e6bd43c941e52aa1e67637ad11764809cfcd723777e16b62270cae550a91f055e4c24ae5414797fd0546e9c35b8dfe29e9a6eb97835b89791dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaB0Le5ji0hmxNrM:A3k03kHRJvPji0Aj
- TLSH T130658D17F6A402B5D067C1B9C5E69A5AFA71384217308ACF1358C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 908KB
- SHA256 39a480ff9bc60447c53fe86b17dc225207193bc5a9a63e6e26470531dae9c545
- MD5 ec1e61c7c3cef504d979405dda6fa914
- SHA1 b1761579894d90db71e899ff4cdedeb69e2f2f88
- SHA512 e3561720a644e0fa443b2f20fb5ad14f3cb31848a2d11409bf9ce82ce6e7e06bc291adcced0ced07db0a5e1afccda39fc5267d63591bd8d5b3eac6146a165b62
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaQb:A3k03kHRJSb
- TLSH T1BD15AE03E79400E9E14AC2749AE58A23EB75BC52173097DF2358D6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 883KB
- SHA256 a96aeac64ce44cbda7d93bd0f0fe04e39fef8f2d152863073a0ee9d9796f40da
- MD5 5fb2aa578d57d25281ac0e5ab92ae9f3
- SHA1 26d2f9288cd85818c4dded679d61074021e14075
- SHA512 e3be55bd8c09d17aea430c09917e77de3fddc8e25c855f0ed49efaff73557c974697cb37932a5e1110260b5c83404b8b164e19b2a5e1e9f775f59bcb1354e4c4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEai6:A3k03kHRJ3
- TLSH T1EA15AE03EB9400E9D10AC1749AE68A23EB757C56177097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 883KB
- SHA256 4152f5dc8c15c10e5969e8f4f6461bfffdd82ac033b09d76cd2144570c4e9922
- MD5 61ab9aa2d94242c1bae44ffd19fa8197
- SHA1 74400784e2c4f23d2d4b1545d338d2411c88cd54
- SHA512 41493614f249f68adaed09778819eef2c858293dc9a7b7989045a58f1b2f80cd91620a7d90c9f5f37bd86b0c6cf7cec7ba73ede59e845698883f545d19bfa6de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEa6N:A3k03kHRJK
- TLSH T1E815AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 883KB
- SHA256 c47291949d753294cc5ce8788c68026f6509d94be95cdea267b059fd3e2ca65d
- MD5 24442793e5a52135e3fe1c081f6f537c
- SHA1 0ab6400d314a2f151f564800696e7a93faf50a44
- SHA512 c4f081be2b256fdbadf7085573d9496848f374069e98d5b1f55b7080ef311b14c912ff9014a2addf108e743f66ca0cd78c2d3e93534f7652d50444af8eded60a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEagf:A3k03kHRJm
- TLSH T1C215AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 883KB
- SHA256 39b7621179939c87cb45462539e2cc0faa3064e7fda07e62acf97d2e8ca4b64a
- MD5 7592c891183b5099aaee9d81b779eae9
- SHA1 234f0b1a73f67cecf652d9820e35a4ca0264bc32
- SHA512 0f9472b7769d16a551f69d1e0fed944fd20b98db838ea68796bda33373f5d696523505dc700bca688e4f27f3777152842a20f923a5d6559f09b8a62588ad1fe1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEa6o:A3k03kHRJH
- TLSH T19D15AE03EB9400E9D10AC1749AE69A23EB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 883KB
- SHA256 00cbeae79e9b03a863248fbdad6feafc8248564314bf2bfaadaac588e149fc43
- MD5 5acb56e0b1bc8b1ebc4bcf6ac36e49ea
- SHA1 a69fad0802828933f69906ed4583b59e7f2148fa
- SHA512 e2ebbf394bc3fade659985d7bc808feb9e5856b89b229abc93b884381f21825eef9fafc2e855487168b0b7d71bbb20e4e9d5111a67bd49ce3fa25eda80eab862
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaOu:A3k03kHRJp
- TLSH T1B815AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 883KB
- SHA256 f44a95627723b7c2aac5c464459506b21eeb3def8501ae6585e7bc1828505180
- MD5 f9f0fc4bbfaa776fc1c5b4ba875371ca
- SHA1 f45c80f1face2fe1e640d9f985130cd46210ad3e
- SHA512 7ac9e40665bf3ca61826a334a428d8a8b52eec6db53ca3fe4d349031467e3e7c4d8e1d4f0e4da59ad276c52a06ec38c4db03eaddfc9e48d536136fe015f743f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaC9:A3k03kHRJE
- TLSH T17115AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 883KB
- SHA256 397d920abd4e17d5cd0d95ea7b4a9400f7bd9b498ab9f5a53c7422832cb18122
- MD5 4543b59c06cc333273331202789bfb94
- SHA1 6b1df7bf007f712ea8335547be40ba8de9ec752d
- SHA512 5ae16adc142e2816fc595166cb612cb578a7372b53e1f88eff2a5b8e1b52099d8e5a73aee4a22e7f56e89e45a552f566f1cf55f217584a9cdf04eafba99339ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaCc:A3k03kHRJt
- TLSH T10B159E13EB9400E9D10AC1749AE68A23EB757C56177097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 883KB
- SHA256 d620da167394923768c50d95d6dcdc5576c259d0c8940f944362ce13b0e9440b
- MD5 ab321ced4fe31df462ec7b39c7521c3b
- SHA1 8082fb39c139622cca293453682bb63350fa558d
- SHA512 ba423480f60424b3041a0b3c980b51a498491a6f8e97e07a9cdc24b794239702b60409234b97afecbd405a37e464670c2c31ef5ecbcd466d3843144eb5a0854a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaLp:A3k03kHRJz
- TLSH T1A215AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 883KB
- SHA256 fa38c26963efefa774feacc7e8b74cab2015cc1a16774017a9f5fa9cb2fd1ec6
- MD5 bc7beec019fee1b6d75f6e1fadf99562
- SHA1 1eef070c527e551ef11e6e10a17a1d0618c8fd27
- SHA512 34a71b74eb9c06c3a71cc8ee5a1bd99819954e2c8f98715a9fc4261269340eab80b66db629dcf8a26d9fc2864bda0e13d23f5fa9e53415156be3d2cb0493d618
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEacN:A3k03kHRJI
- TLSH T18715AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 883KB
- SHA256 17d67ec968f1dc1f6dac63981fb1d1d37934bd4c6e66840a4b7a563609f0a83e
- MD5 df521000178244676e6494e475544d4c
- SHA1 3905354c44e9ada5360e642ed49c3fe38c7208fc
- SHA512 72d3ee29c5cdcc92c28ef30e58be784c24b22fb8639114d93535801b1e4a07590102d132596221c17cc98997032b6317e3eca01e4a5cb62e2d02f53209783030
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaEF:A3k03kHRJe
- TLSH T1B315AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 883KB
- SHA256 7987c5c2c64561ca994309ea906b43cfd564bf66563dd3cdecfc3bf768985699
- MD5 27d97965edb51554383ac2b40447ee0f
- SHA1 2a70170cbdad03060d4cebec9d584bb619b8b698
- SHA512 4310349e1de0ea18164416d2c11c4fe2cdd128727e948f726862e59d0ec897a9b3eaa733be21140911800873c98b192452ba64c39d69f347badfedbc3b9398f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEahC:A3k03kHRJ6
- TLSH T18915AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 883KB
- SHA256 d73bc74bf3c7c4c18b7703bc3886bc7003396406da4b7e21d6ce2a2f433af274
- MD5 b530550cd871529ffdfd4ddefb4c9241
- SHA1 220363bb9b95dc78138b9e31bb6b0b47df79ffe2
- SHA512 2ce8330b521073e78b2b1b758567e246597e028118cefc008ac4744b9186f7925531f8185ac9770ad5d5e2c121102f167c32b44a51390582aad047a11df2cdfc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaiw:A3k03kHRJP
- TLSH T13E15AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 883KB
- SHA256 70fb1f6df6ff77d6d2c026c58ef1a1d978f0a6e7d91fefbb66e4f39582a637cc
- MD5 8135fe0ac903823f52390b49b05f3aa2
- SHA1 b397dd3b0fd52e6ce953bee9a90117b595f70140
- SHA512 2c3bd527d2c3a4bd3342d6da7e9b7002decbdbcef114afdd92e55a094b88b46e81ba3a4b4fd5c0239b3e8485101dc2ed5bdd95a4b5712eabdf93ca8689df6b0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEapT:A3k03kHRJr
- TLSH T10915AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 883KB
- SHA256 502244a4001ce28032e3bb1b2284b93e61c268add17321af8437179189871816
- MD5 6f5533bf585dea44db4e2d13465ee5ba
- SHA1 5da27df6fde0243b4616103b102f333a51e7a364
- SHA512 f2d272f136eff1ad92d50a22a277f8e6b150a92046ad8187075c3f2b638a120a75312d5ce76fa7d5d0ad4eaec696cbc4a8e41df923b7eafc5d4dd311fdb151e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaHu:A3k03kHRJs
- TLSH T15715AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 883KB
- SHA256 3799f0732d5116c2a75c3ecd3bad59fe2846e6f069f85ae4f73c7fac1100f2b6
- MD5 be5580ff84e27aa7ece0f4da5c444470
- SHA1 748db067c5608812d4a690295662473383b46b30
- SHA512 b0ed8ad314a77e4a9bef0d703595bad88421994bf252fd2a68f707215e1a1a4ee3c11553970e41ff76e7914ba633f96ea567d9ede1b1bfc6fcfa538ae500f6f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEabb:A3k03kHRJF
- TLSH T13215AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 883KB
- SHA256 61073f515502ad4342b435561454f2c3c172b9690e7602aa089cf0a5a1eb186b
- MD5 f9ae0247ff37104e446849da7a43ff54
- SHA1 3d0f159ac9fd21c10c186ef19f5aff0f40a3c1b2
- SHA512 c1a0f93760310c1cb4b8a11bfa5bc0b94d0018627e5d0fda1137f55663bb9a8c5c712147a3520c727947b28f69fcf73fa655bc2736ab8ed3b814fa446d9c7f88
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEavf:A3k03kHRJF
- TLSH T1EB15AE13EB9400E9D10AC1749AE68A23EB757C56177097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 883KB
- SHA256 745d8b979f81d077ffab7833a576fdc91cc4061137ed48b38cbb8e4e3b4518ec
- MD5 792186ce12196a17fbd969b0fa63d84d
- SHA1 4efc42455349a205946ed889e0ed05375988ea91
- SHA512 8771420ffe2246daba706a1ec92e4ce5a68769bc8db4fea515300b485dd0713b04d5d139492819e4557487ed8ecd575c638081f2f8771c29fd1ec49bdb5bb029
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEa4K:A3k03kHRJ9
- TLSH T14015AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 883KB
- SHA256 0e8d77167270a3a1c0c355a4a81d2994b5fc66af1fcbc67f2252020ff4fe8697
- MD5 1a6e5e53773429f464ff0badaf8daccb
- SHA1 6c0345304fd28ee1a0c1d56973836da438c36ac4
- SHA512 ed7866c2d9b6c249c183cd10300501b683c26e08704538f0408b21d944a080a9d1254f88f5a1b33fdb30b97e82d2cb403baabc35ba70f878d8e512413c416af1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEalk:A3k03kHRJU
- TLSH T13B15AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 883KB
- SHA256 372c63ac85822e560b420adfd982408590bcb4a39520d795236e7beba96b2ff0
- MD5 ff31d28b28c8d94300d0955f9ff7ac6d
- SHA1 fc9f64bf3c516bd56cbc1012211f21f14502073e
- SHA512 ea6b2a513f6310baade137a6c74c7e385c241bfb1972e6e5076c8f0044c44de2389942711a819b2af043675124fb0baa8c3b28a931e09e8fab9cec6a555c6a04
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEa60:A3k03kHRJd
- TLSH T17815AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 883KB
- SHA256 b008733548e40fba927eaff3a482660583b58a52d9c7068f3a5162b356b49c07
- MD5 9804aca707689897c2f0ae969533adf7
- SHA1 e57b4d984b40745c68b1ed41309c607b9f6b6869
- SHA512 d1789be8ce4d3ba8f29825ef22f274bc4c392e2a33bd9307c7503930b77ce84639fdca9d1ff7d2b8eca22503711e4588185dc775ca2cf734bdce795e06116cb2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEapg:A3k03kHRJs
- TLSH T17415AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 883KB
- SHA256 6dbbe217aaeee09a78535db8b6ee59b3631bf13206b191da3dcd8075ddb62f05
- MD5 a967b598b71059186d51fc64fd1ba80f
- SHA1 1afb7054bfa1fe1c47dbfe64d6c363d2d9b139a7
- SHA512 05824a8f6c0e1bd597d1a331eeb1966f491b356758d96619651574dea819b56cad3b308516c614ace295f83f924e67b2bfba771562098dbf2cc7c18088dedf7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaQr:A3k03kHRJ+
- TLSH T11715AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 883KB
- SHA256 5b4d1c53d811d9f1d9cc1162c0dcf76207b885f1446d593f8e975b106fc580fe
- MD5 5f7bf98d07a16454afa4a9e5e0991c0c
- SHA1 89737528d93c625484d97336fd8c26021eddb1ba
- SHA512 bcb4a57ac1c838f8c4826fe00cf65bda4f4399d05585ea590f9d0d6c30ebb2bfe5c4d30c188cc53876e49dd72befc64f163f3f4f7166d0f4804868f513609fc4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaOn:A3k03kHRJI
- TLSH T18115AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 883KB
- SHA256 d5a6c72a837ab37f302d2bd15834093d243ad4c4d2e48e26eaae44ae50651a22
- MD5 a5b51b86b3c859fb132ab545d5c0263b
- SHA1 380292b5db79b108a321eb2e2439f2963948e109
- SHA512 c09fc8fd7f887556a137c59dddb04e3381bfec49fb91045b0bb9abd486993049edbd6c493dd05461ca72b66e72ec0e48b061fa60accddd8fb0106b6899d14ce6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaEx:A3k03kHRJe
- TLSH T1F215AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 883KB
- SHA256 375bec4c3902944d2171a87589057cd625ef2fadec41fc46ab8aa9b2e529e9ff
- MD5 fc7fe3841ab48e98d6bf9ea0bc6c405d
- SHA1 3727ed048b3e01a5f0faca4ba71dc31727bd8e2f
- SHA512 16fe3d8c975cf07c667f92e7f4e8fca13bd49454d7e65844e67d3f5c29650dba92a6db8fcbceabe39fa6a3220e1e5698d0ccaa83167dd77567fda0b11c431957
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaOA:A3k03kHRJV
- TLSH T14E15AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 883KB
- SHA256 6b1fc91e4210302598ff40c21ca014519281c0428da0bee65b64e98d2512271e
- MD5 fc113aaf3da9e5411857b4de03a4484f
- SHA1 445678b0c4fede31b09552f5c40cf64e2eb44f13
- SHA512 45d9b3033d6b95e3c480c3ecdb8d5b3eeb96f9eef69fa20b63a229657b9c93d35af7e87124af92c6b15e35d729b2f4fd8f2c5a4b9dfabedc7a09ba47054eebb0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaH9Q:A3k03kHRJU
- TLSH T15815AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 883KB
- SHA256 936bf75ae8a3dbb9b36e1ce6cdccb6a52f8d84aa5d4c1ffe6b9395244f3737e1
- MD5 6dfd38e6e67f7f281673dc3a4430a449
- SHA1 f3e151e9b492e7391486d7a8204447802e379163
- SHA512 cb73c632d2b0503fb009f7831e25b35d4a1ac443cf9d42984b9ec3fc655d7915ce946b49aea232faebae6b6951581cb054d2bd3da0351e72c9e5d299ee70400f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaO4:A3k03kHRJf
- TLSH T1CD15AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 883KB
- SHA256 347fa7f762bebcb63fa5bae98393a8edd8423c239324cb87c2c6a85446352266
- MD5 1bdf48d70f7d0c48cf9f56111caeb790
- SHA1 785b88ece297cfc8e02dd46501b3118383492f7f
- SHA512 9a6a0a6f6b32db44bb7600c387ce8fb1dbd90be680380ce0c743920e228a351a92e4400b6dc14198a635833b75ce2e707bcefe08a0563818cfed9ccb8220dd37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEatu:A3k03kHRJS
- TLSH T1F315AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 883KB
- SHA256 12cf00b9e4e54a826c12fbc8be37c4c29b268c8da107810bf661af806a947aa8
- MD5 16ec3bb417e4e4f320b613faeca27d7f
- SHA1 7b15eb725464c1ba47b5dbdc6104b56c28b5b8fb
- SHA512 127d30ca0bf3935c5956bab3e1bda0b7673f6f65587574161f357b01b276548d7288e43f92353ef0e56d87288a04ef2680d649a8023f9a5ec2babc5d091e9a7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEagj:A3k03kHRJM
- TLSH T19A15AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 883KB
- SHA256 1958dc540362dda5fff11070717489d9852f468e12ed29e8ed0186d0888533bc
- MD5 931531b67433b8ec8d987efd924ae0ef
- SHA1 26dee36c595a459151bb8114fad603aa7b2ec7a6
- SHA512 64c76d261dba183c6dd4cff533af47174a34f0a45a547fc10493efb30f1003d987ee5a3b5ef11e268601d16b9aaa397320468c9c3913bc33e4e3a21564ff7548
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaRg:A3k03kHRJE
- TLSH T13215AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 883KB
- SHA256 dd37bb8d7e75c59bc59de847e1c32d479a4740182c24faf6bc79dee876ebe9c7
- MD5 4a0579460d7bf9cdff5c59f2b8e1161a
- SHA1 291938cb994c09e198559a50bd3f38b22d8258cf
- SHA512 be9d0d61fd1a8ba1d42de9f4ea0d53d137020f8628f9140793e23e11012dbe7742ae11b832f087e75383e332aa19c1028e92f54cb530c5a8eb47c7037540724c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaII:A3k03kHRJt
- TLSH T1CB15AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 883KB
- SHA256 66607f0adbcdbd8a95073ad5e77d131fb7dc3cd366f1299bcf03f6443c035bbe
- MD5 1582541163a8c1147566dd4ee0142ead
- SHA1 1b16549d02c269412f884ee2ed25d57792e33f37
- SHA512 d875766086118eafdcf1a22ef4c1cd685a38f7f84f09b62cd4b8d66d01bd2b1b4f0fd1103ab47ae91791306a707f67250c3dbfd557845bedecc9798649d0f757
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaqo:A3k03kHRJL
- TLSH T16F15AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 883KB
- SHA256 27d7ad6eeae892c6bcf801c54625de5adb40ba34d8fff220c596ef43b72756e7
- MD5 06df84a34200ceb5b6deecf0eca04788
- SHA1 a8334ab1e7ad4274392429813e88a4d16474a442
- SHA512 f9cff3c2de8c755caee0f826615574280741430bb66b34ace067741ac37fa9c49e0e67a872128ed5c0a0a750385a275a16b71c0d02cfae9e0c585849abfa3206
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaB+:A3k03kHRJO
- TLSH T1D815AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 883KB
- SHA256 0446e2b8223f8aee8eb28d564f018db1472e00ff534808b133a3f0ea1297352d
- MD5 290223645c760715e4e0bdfb0d72a172
- SHA1 bff3a39550bb8f2ecf3d5917d08dc7529abe34cc
- SHA512 ac6c76c09763309fc70242cd9253dfa04dab6881ac6edec10c07acab8a5405573b7d2a3c1c7c333f7c3f19a49726fb252db1efdbfe860696c2dc9bbe9698477d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaPQ:A3k03kHRJ6
- TLSH T12A15AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 883KB
- SHA256 13e73b8cf58d7a401a6d199b94c2bef95e0a8b16c56c6fc143732e24726b4472
- MD5 87a8dd1592b7b1382acd9c537bde163f
- SHA1 008d5a7dbe9bae16c00bd81d19a672b0d105144c
- SHA512 f19df4c0a7acb134b68c0f74e888181de714e8b68e1769c0a1eb8e346bd9f2584a5ea60142959fd82b12fea97063086a454163c5f3493e7d035d25e0818fd083
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaUX:A3k03kHRJq
- TLSH T11015AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 883KB
- SHA256 cb009959d507c29fcfc55c2400c7fe241ef5d7d0d6cbc2ef4d55a9b39c8be95d
- MD5 d5f4aba280ed1b3c356f792de2aa2362
- SHA1 48813ddd2170aa8532044a77ef13aa7f68eb74f7
- SHA512 0e15b72530cc2f20c76aaefc59ab009452a457f192266ebac1dcbe08d711a510d32eea886dc8d946d9628d093ed325fb1cd570957a3e3b562d239eeb6a8009bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEayL:A3k03kHRJE
- TLSH T1A615AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 883KB
- SHA256 155daae6aaa38ae8541114b45fc7905b7a756f2c40d0af4c4ca028e678df9923
- MD5 c4e829fcda1d8dfaadb2f4cec9eb5543
- SHA1 1f492e9e2b3266f5a91b3ebac009058f6e3a66e1
- SHA512 3d7e8dadb4935d431a958b8883e6e6fba1ec85ae71127a074c86c13d88d49c41e43464f01a402f94e28bf2e1ea309826daf888fb08713682fab7db4fce662ff1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEaWM:A3k03kHRJF
- TLSH T16915AE03EB9400E9D10AC1749AE69A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 883KB
- SHA256 51c576ab1e87926ae68330e09dbe9435c51fe5276a5929dd8a972167827c6ee6
- MD5 78e06400db90db7bcc46b3142c024417
- SHA1 ffaeb37a616db04b7f453f35160fb1e16ebad6ee
- SHA512 5d7a5c3f4031ca4cab6f5726d71ac671a758c5e0ec9290ac58125e80046a5ca752792e08601cc5698bef8dc57e78796a9d655e2fc001321f5773f222cf061bd0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8WKjEafh:A3k03kHRJf
- TLSH T1D115AE13EB9400E9D10AC1749AE68A23FB757C56176097DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH