Analysis
- max time kernel
94s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 04:42
Behavioral task
behavioral1
Sample
2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 915KB
- Sample260727-fbpdgsgr7s
- SHA256 5db46642e5ebaeec6f18ff75fcf654e973f577440582c0588373d144e97328ec
- MD5 c68ff00c26e0b262495c9e924f95e428
- SHA1 597bc77143e6ddbf3a75bdb4c91959dcf58f33ed
- SHA512 82c2df4c6be0bc7af8bd1adc9fc1409f6b484b03ff4b0c19899c455322c4e62e9cdcad65fb206a553818ef804eb1ed9c362671a33a5236447c125f98d8f3ddba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmN:A3k03kHRJg
- TLSH T1D915AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/4084-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c5ce-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4084-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3340-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-271.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001bb5d-451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198e8-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-579.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-661.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-759.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-839.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1004.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1047.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1078.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1127.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001bb69-1215.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1318.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1393.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c5ce-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-39.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-271.dat aspack_v212_v242 behavioral2/files/0x000400000001bb5d-451.dat aspack_v212_v242 behavioral2/files/0x00040000000198e8-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-579.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-617.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-661.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-759.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-790.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-839.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-864.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-883.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-929.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-948.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1004.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1047.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1078.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1127.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1146.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1171.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1178.dat aspack_v212_v242 behavioral2/files/0x000200000001bb69-1215.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1318.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1338.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1364.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1371.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1378.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1391.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1392.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1393.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3340 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{32D54D7A-68C8-4A48-B601-5B27D66D3DA0}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4084 2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3340 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_c68ff00c26e0b262495c9e924f95e428_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4084
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 915KB
- SHA256 5db46642e5ebaeec6f18ff75fcf654e973f577440582c0588373d144e97328ec
- MD5 c68ff00c26e0b262495c9e924f95e428
- SHA1 597bc77143e6ddbf3a75bdb4c91959dcf58f33ed
- SHA512 82c2df4c6be0bc7af8bd1adc9fc1409f6b484b03ff4b0c19899c455322c4e62e9cdcad65fb206a553818ef804eb1ed9c362671a33a5236447c125f98d8f3ddba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmN:A3k03kHRJg
- TLSH T1D915AE13EB9500E9D10AC1749AE68A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 40a78efda1c2c5d2449da1b6893442412489ead6de8cf91f86b2b7d1b01db109
- MD5 d678de5b2ed1eab49130baa3c1b45269
- SHA1 778c5898f0e77ef5bc3c015395bd9ea321f33616
- SHA512 5c85b7c928a96d97353248b3898ce015a74e20f352d70f03ba6eaa432fd9d77e3eb0a563385337fd4e2ef8e681aebd38e4a965a586c2f6332a178c85e1ed1a11
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmZ0Le5ji0hmxNrM:A3k03kHRJ4Pji0Aj
- TLSH T162658C17F6A402B5D067C1B9C5D69A5AFA7138821B3086CF1358C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 930KB
- SHA256 52430466775252eae7de8c8d91c84aca02df73da534a0a694a68b1f76dfc93f4
- MD5 f1889fa56b91cd6b81b8012501d491b5
- SHA1 98246e4e60c418d4785a232c7a343be272e35896
- SHA512 2390443d139a8c1e46da0d919fa5c1f73ced397edd41c34652fdad23a2331dda6c0e890effaf2b4f71b19dbaab51a9593051c17c7d28dd88e92ded7b7b54ed9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmLa:A3k03kHRJ
- TLSH T16A15AE13EB9400E9E10AC1749AE65A23EB757C56176093DF2358C6152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 939KB
- SHA256 d2c8932db427cf62fa96e7f93c4808eb48a4c6fecc091b491ce7ca89cc2a74bb
- MD5 4ee6067bc6d6cb09e54a5ce62efe82b8
- SHA1 71fe9a7716965b51196ecebedff6a267335cb83a
- SHA512 562394cf3459b0f4c9f2b8de5c9d03b17c022e950ae6368020d8c3b9d9df62cab31d239b004f1f635a530bde8966b1d5f97ac76379cd9c31fbe6e00b560c840a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRma9:A3k03kHRJx
- TLSH T1B415AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 939KB
- SHA256 30175b29956b8857870a2ddfff1fc5adb1e8712620087cd64f2b818e517d50f7
- MD5 4569e00daddddc6ff38b47d54eaa1519
- SHA1 dd4b94fd8958ebcacf9f2a04caaeb5c3260066a0
- SHA512 8ed4051a6981de380106234df1955118f37e52d43546e63c4547d114085d31a5a0d76e553dc47fe4a4edef0f71a53e3a5015d6d0e23e1bb8aed55d20c03fe7c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmac:A3k03kHRJE
- TLSH T1A615AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 939KB
- SHA256 eb332387c0e29113dbe03b117fbee2566dc81349c31d4d0fe35ec90cb61a9ce5
- MD5 641e5f78c71b11996d670d983937a814
- SHA1 abd4db8f7f3627d362c571f2bbe90d132112a574
- SHA512 548054f9ab502a00a82f79c43aabcf2cbe842fd33d061e63bb1374f78688f00ceaa42287cdff22a139e7ff04f2e469ddd5541a81a177ecc4fff995905d29e08a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmTp:A3k03kHRJS
- TLSH T1E815AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 939KB
- SHA256 463adda7666183761b5622a664214993c2611a24787aa1d5174eb7fb71bc53a5
- MD5 02885e3288b61c12a3b469bca3eeefe8
- SHA1 b267e9a481b2cdb016b56ada160a6a7ccc919858
- SHA512 6c6d3e773d4090d0ef488b0867021506bce16d56be20ffafa8038e09ac31bde61d916a240d207eb215bc64cc16e553c830e1d53872adf60a8fd92b13d31a9907
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRm0N:A3k03kHRJV
- TLSH T1B815AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 939KB
- SHA256 60e85090064b1f1eae728332135c4ac9a6ec1f5b49123f92a371262e32c7ad3e
- MD5 6e2a9402079ec2b3d3e3f4340bf9b3c8
- SHA1 f0e57edd4f040f969af4e0a71c7c7d3a281c2162
- SHA512 7381b5828ec77edf0aff6736450e666cf8df9825639d79d413b86359aed69b4049513e85dc5667a0ec6a0e49c03e70345ae3364f38e7dbb7a2e4748e1a0e9969
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmcF:A3k03kHRJf
- TLSH T1A115AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 939KB
- SHA256 a33aef441c4fdaf185303898ad28c82c30c08b709f125eb93e270c0ca291cb2f
- MD5 f1a22b3a249985ba3090207a3e27f518
- SHA1 5a221ab9ddbc6279b6ffa4a18a2917d5bc7f54b2
- SHA512 b3e55167586662461dc695ba2d441eab447d81fbf97b0b376b746c7ec8a21c568363df921a61fb04b178c34bb98370cb7c1c02c543fda0e2a467c78dcbf4ec4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmJC:A3k03kHRJT
- TLSH T16D15AE13EB9504E9E10AC1749AE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 939KB
- SHA256 cbf32f1f67427e7c52cd331127462832b89d2cf2c26711028220e068f001ddbc
- MD5 afe8a3e44c39f0b1df5cc9a309504d4f
- SHA1 96960d7b016658952da086fc83b96598783f85ef
- SHA512 901eb201ff8947a160381c57e0c57ff9a7d3251129d6d22df92265b2ba97e5f8a2b407edfb1de349975b58f800f96d6c80ca8317d2ea866717b59b2f8492c392
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmqw:A3k03kHRJW
- TLSH T16F15AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 939KB
- SHA256 c7356460b5b151785938d2ce5c0d1fc16ff81a5f029eeeb58db0c7a12f7cdd0a
- MD5 f1542bc12a3bc4e3cd5ca5048bd750ff
- SHA1 6dd966e3f6f34968f9c120ced9bad2b328ef62c6
- SHA512 9d63cc1801e18645915eb79a2f33358c9421b74c9edc1a5d13ec094df2fdf5fcbb1e524e89d971c1888c088de268d3e1a33da31f1405e21c7d00372f5dc5dfdc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmxT:A3k03kHRJW
- TLSH T1E815AE13EB9504E9E10AC1749AE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 939KB
- SHA256 95985f282e86de1c2dfc2e5df50949c3559d17db35b29287c75d7f4fc00c4bab
- MD5 fd6a1ecb87ca4b1e4a9520c674177dc9
- SHA1 297a1a0d27567fad4336df65406f4839ade1d344
- SHA512 1c6e37f7f0a8d9160d6ade4264794a52d155efe601299d1ec7dc5f7c6060043840a6a58b2a8480d0daa207ba7a3db385ded5ac5e20ada32824e03887212ab74b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmfu:A3k03kHRJx
- TLSH T1ED15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 939KB
- SHA256 4870f72a70529e15b6ab19efc906898cc5f2b00d06ef33d433133f46d064830c
- MD5 628d052cb71ce081ac3309c67213f7f2
- SHA1 92b7619c4dce9ec3ae515af391b188d2ffcd1902
- SHA512 c5a7a82dcd43dd982fbe94221c326ad3dbf69e98e7795f5316bdb2025cbcf57b4772db78374f8ddcc448e15a8002afcb19f2fcedb2cd6c09e496c896dcac5680
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmDb:A3k03kHRJQ
- TLSH T16315AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 939KB
- SHA256 d21ef637d117b45bcdaab9ff607fa3e6c167149f2a12e96a694c4e70eb9fa2f1
- MD5 0d67e43d92ffd7f57a94c1d06cc314a8
- SHA1 1a5b75a5912dbfc995cc2def36b202e41e145cd6
- SHA512 7a7d9ca6b333eca86f280f1970e9c41948971fda3187cfdf462e6430b36d2aface2f9226e829fc6e2fe153ba6829b3d031be0050a37cc3651de6328d2667ee96
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmXf:A3k03kHRJA
- TLSH T11F15AE13EB9504E9E10AC1749AE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 939KB
- SHA256 36b12de239af1b8f036d6aea130d80c3e346059bd5dde925c98e64f477cbf7d9
- MD5 a498266f3bc0519013455e78c9665cb0
- SHA1 f2f2407582b1e038b7b4e04adcc8cc228268b40a
- SHA512 6f310f86ced9084711ee370191a9dba75ee634abc383295a10a842dfa62e9c77278a3cc631455bdeaaf2c618cbf5f39f14196471cde0489898cadf5dd48cfd29
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmgK:A3k03kHRJg
- TLSH T13315AE13EB9504E9E10AC1749AE64A23EB757C56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 939KB
- SHA256 57a2f6b7ea87ee6701e176e18fc997eecc3fdd4880a92b0533b099dfab55d459
- MD5 8166b23699bd36b032303224137e7fce
- SHA1 1f28ac3262a262dc3718efcb0d27cc9af563a8e0
- SHA512 71778a536f194931b6d37f42d9991048d401bd30f773910e0fe30ee60af3134f1a7e79d8aa0cc566e7c1388cf62f327aa304a46f58be147392711a79b6ed335a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmdk:A3k03kHRJJ
- TLSH T1CE15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 939KB
- SHA256 1936f56aa9f397a11ad29f20069302891aac7fc0e08c5e974fc073fad20a8f0b
- MD5 33e8de0dd4a061cd146cfd5ae25f9b95
- SHA1 f3f822f7aa57f1ee8a34928ecba88ddcd1646bd1
- SHA512 584c5711ac7f049ac2f787a970e731904e193c39de521995a55887205bc13fb7e127971aee9b24b6a7dc97a684b9716f91b849daaa7ea29077395c4ddf0818d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmC0:A3k03kHRJ8
- TLSH T16C15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 939KB
- SHA256 ec2698f87570d175ebb15be5673ddd55689356076b4759b9e218246e8af83420
- MD5 08e203772434ba8994a82185d3704a55
- SHA1 f7a6e21cdebb3d2fb75a119ef8c3016f2bd96734
- SHA512 900c59847e9ba9b55aa60dc734669d4584ecf3e6a17febd4171f19516729f93d2ac88a20a70996275a83fb1b596efe8da4e72dc60beea148475c6fb5ed50623f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmRg:A3k03kHRJB
- TLSH T16415AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 939KB
- SHA256 dd2477223ba791f4bbf02be475117f03502cf25e13b03395b3583b5e03a4db10
- MD5 875c045dc7c55ffc8702f25ad29bab7c
- SHA1 5893bf638dad0b8c16eac8831d4f07b5ce982439
- SHA512 ad48c39539d654e89add34c200e02d379e72d538f0641839fc122ee8445e18201d40aaccc81f86bd0925b9b335ebd5dc014dcfffab06c0ddc943b06dd059355a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRm4r:A3k03kHRJr
- TLSH T13915AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 939KB
- SHA256 798f29755f6966138c97cf0576beeab64f0c5635ab20959bd7d768ba81464fd8
- MD5 ad79df17cc94ce83989d2b20fff9b2ab
- SHA1 ee201c81eb39a1c92b86eef2ec92cbe2a6ce8857
- SHA512 49829836feb0420ca3825a3a3367db0eb9785a94c81682280e06ee835864809054c0a7d687bb89bf8a1482cb5be0a2e1832a84c2809e6f7ea7bb8c6dce2aef89
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmWn:A3k03kHRJd
- TLSH T15715AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 939KB
- SHA256 114e1f8604669ce8549c9a938a3fec60e1fbd25ed780a556dba9c512102a85ae
- MD5 e2af43c2edc3b837af43b53824fd3a57
- SHA1 e05bb0ae423d7cfed8b49ce57bf885dc4c9db2da
- SHA512 7c983aebe3191960f5af066ddb259cac50274339191cf71a70aa3548944650e7b88d5ac422ef5dc04ee70bb1eb4f3f52fbf153005d3f8069921b6146d797f35f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRm8x:A3k03kHRJj
- TLSH T1CA15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 939KB
- SHA256 f063bd24cb9c57edeb805597d2c8a82b7671a9d87735452a40d1a52d6f6b0b14
- MD5 858ff06d530c7aaa3393b9d9d5107062
- SHA1 056000559a7654bbf6e72f6255a29388be90493b
- SHA512 00c06a89e4d40b771550d292f3bc98faaaf0d0d7f8182abba0f085ec1d711e714ff6836f702d8f8df576515625a10c11b030c98e066f7756d91cca3254510d1b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRm2A:A3k03kHRJ8
- TLSH T1E515AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 939KB
- SHA256 8cf9300992297c62a46e5d2bc3f9adbf8ccb4f7ffa0720d1e5d136f7145775d6
- MD5 acdd85395a4559fff101983ed235599b
- SHA1 091beb467a2cd61c92829be8d6f64ef0b8b0ae5e
- SHA512 3fde0cbd4e209f2f0812f13739b0aae568c9f4a09d271784f5eff164e6bbe8b41cc845d302e8dee2ab447f0a03776a3ff27f000c451dd31e5f3ebe12ad3d4857
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmv9Q:A3k03kHRJ9
- TLSH T1CF15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 939KB
- SHA256 ef44278ca2a83c498e5ae3877bb6747ed3ab6ac2dc937d0149d9ea09579fb6be
- MD5 c625fe437cdf16420f34d3b5b27646bf
- SHA1 6108b3158a3e9e475ff9812a0d933e2fe6f504e3
- SHA512 b3272f15ae24d561c20f8ff2c2b58492f46588af67370585f4ed407c4d2e8b019b1d11f8d654bf9e563e0c4c12e3299670ed2a0279fd7e365a5e9c0f29f4478e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmG4:A3k03kHRJi
- TLSH T11215AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 939KB
- SHA256 e49332ad9318197f505f5a9856c6fa85d45fc3003fe9d65995204917a7d3992f
- MD5 88b52326ef7fe73032a03e8897ae4586
- SHA1 00c08c56a7f1616e2a3932091d70320f7748d2d7
- SHA512 91e8f00f37ae5b32230db5986e014062d7f67703a0f20ffbca7593e20ae873924636c209694a08f9555ffa5b1f5fb2740e489f062eff43d8a18dceabb05c969e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmVu:A3k03kHRJT
- TLSH T11615AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 939KB
- SHA256 542b923241d83ebca3a704817f5928539f61bb8fcd726d3d24816cd660a7dd1b
- MD5 07ca3439e274c6bf4a34dd8525420382
- SHA1 500a4063e75dfbfcb71f7ad7555225a5e7448721
- SHA512 884be4085e967f50a100cee9809b99c5ef6b39a0832d6e06364787fa2a2c6a90f751b349e4ca01a96712de7047e6be8020db7d0f464fec8f9e1672fe0fcd8562
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmIj:A3k03kHRJd
- TLSH T1C515AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 939KB
- SHA256 577e6ddf27e7b076796f48644744e13fa58d723817a362bfc465484575697adf
- MD5 c349645fff49e1f181e474c2926f174d
- SHA1 a9be90e65ab0d85331420fe7a1ca7bff42bc0e1d
- SHA512 5d7fa5de984a3ef18f6fe0aae960ea507deaa944292d3aac416b4987f51f8dd2b8cdb9775c3100c02db27f2b2875cfdf2bfdac8d7783a514339eb9051b81d4ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRm5g:A3k03kHRJh
- TLSH T1B115AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 939KB
- SHA256 5e4313aaa6f74948510392989f853e8d9101e96e4243bc2dfca03b894ebfe2bd
- MD5 3f9b5e7e2a3e62b43a23ac029e4d14ad
- SHA1 de9ed71c6ec8d214887869d06e145eed0fd3c797
- SHA512 0f59caa21c75c88f3f348f567f1be06f8c7947838d4319c2edbcf656d6f40679fd796345c06f16c24c44c404de63f4c92944d0145d8b6b42e26d18919430b32d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmgI:A3k03kHRJw
- TLSH T18815AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 939KB
- SHA256 f2aaf7852e867576f2466d2e8c1b08294dcc4e59680f084f90ed5307965ccea8
- MD5 772928b9dcdfa21e523e6512cf20caf8
- SHA1 18ba9799214a3362b5ecfb3e7f43f3f33f274f56
- SHA512 194a8f173ce581fd2c13c49ccd5eafb2357373cb48898bde598115522d967f1e92268be6ae225b88316041126d1dbfa0038d653b2754e4e0f97e2bc33295b84a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmio:A3k03kHRJS
- TLSH T12415AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 939KB
- SHA256 ea9d7fbc9e53d1c008e9dfd45767fb788d2f88cfe36e183d174e18b903332b57
- MD5 e7322898cf61e22f027cb7b8ab210253
- SHA1 5a781d0db773c66b3a4e5e7a2e8e8431d04aeb08
- SHA512 a4c42eb3ebcfb386d7de47275d95697210989f8bc4821947f8158aee65e092971bdca214d9164757da7d3a6b1e9d21dba9b74a803140dcd0392fdb9981184c68
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmZ+:A3k03kHRJX
- TLSH T14315AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 939KB
- SHA256 2fc2ef8ade906bdc19607ff631691408feefdb8c38cd9333d91b960c8a185f73
- MD5 6e8f3847fdd71e38da0224ffb45eee55
- SHA1 429cdd56c6d98ac20ae99fb8a35e3a9c53f422d4
- SHA512 c914c43504d93a4b33d3b687507210a8397d6be515da50908efea7198d9877a144e530a7dc74dad889bb84ceb5d1623cd79fb59187f209e2fc2e7bc7ecf0de55
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmHQ:A3k03kHRJD
- TLSH T1FD15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 939KB
- SHA256 1fb687abbcd5ad32a99359a1f5563bc707ca22271f7a3a32fa42f5764ec47374
- MD5 c9a1fc2b33860486389a1a9a5121e274
- SHA1 8adc489bcc3ea6b86d9aa7f9f67c66367ff41184
- SHA512 b3a1fa28f495b804c3e4203a092ab5526b9a3e8ed68f0d6eba4f0ac067128f2cd4b0105ab387695279e3526d47968007be7f2e757f01f84efbb93941cbcdf532
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmcX:A3k03kHRJX
- TLSH T19115AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 939KB
- SHA256 3b491a6d4277f6b0d618b27182e75e8eec4e1ce9df4eb79c29085bf49b893ad9
- MD5 ae15a29dc2786e35ef9622e9cfc32d5d
- SHA1 aea34a24a08abce824cc2db352392d505381da32
- SHA512 5d9073cb1c4c60db9a593c5ebcbb81762bfa68dbdb1eba79bf74dff85dc9d2fab419dd81c1a2c9c963d7eefc0dc181ff094ba34174e66f3230a46119bd81ca4f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmaL:A3k03kHRJ5
- TLSH T15115AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 939KB
- SHA256 dc6fe2c164f81ecb3b31b184301792fd5aafac3c717e86cb476e6e6642af3f19
- MD5 76a1d8565225cd61b3860f5bcf2f9cdf
- SHA1 e7c708f2f796525eef5d4dde29a614676ef8b27d
- SHA512 c8b545b715ac31392a4da8d96a9e3259478185b4fd6b0c2a5341157fdf096b70e3c8e78160bdd18775890e98baab6b6953f0fd947a74cea479e3a21c3ac3bce4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRm+M:A3k03kHRJA
- TLSH T12C15AE13EB9504E9E10AC1749AE64A23FB757C56176093DF2358C2152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 939KB
- SHA256 64d173b8e4d509d85d03ad6db8924b9656d7ea335b10a1b09ec6ba9ba7bb5e9f
- MD5 ca2330f1a419782a8dc5cf1ea5299bd3
- SHA1 26e79c26307ec40ddc7952930c61b71e11b793c4
- SHA512 dde1d6e3b63315a2cefa5ba1d68a68ca007a55c9742efa5dadefac625240d7734344f5d3ad865023bb26a22158ef3a89b30d76c004e153a8af507dc1c7ee69de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaoEf8BQKEaBRmnh:A3k03kHRJy
- TLSH T10C15AE13EB9500E9E10AC1749AE64A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH