Analysis
- max time kernel
100s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 12:10
Behavioral task
behavioral1
Sample
2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 838KB
- Sample260727-pb17qa1fna
- SHA256 eb3327012f76ace08aeb742cbd36d2ca7f7025c5a574a9f437918454bfcd0f05
- MD5 82839db78b1ceb433ce85bdb38cecc9d
- SHA1 07238441d82030275d0feafd8179a4116091b9a7
- SHA512 d0bf6542224d24949973a16142caa6d3e5ef131e1e617f4eb68d85afa6c7dce7d1398e7cc8e87fc964cafa84ab017db4844f77cd04a98f4e0e0a10519aa86a47
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yC:A3k03kHRJQ
- TLSH T12905AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/4588-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x001000000001c4ff-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4588-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2060-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2e6-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c6b-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a3b-256.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c0-293.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c1-462.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c2-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c3-578.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c4-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c5-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c6-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c8-746.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198c9-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ca-826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cb-857.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-876.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-889.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ce-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cf-915.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-934.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-953.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-991.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-1047.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-1066.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-1097.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-1140.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-1153.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-1222.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-1325.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b654-1871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b655-1998.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x001000000001c4ff-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e1-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2e6-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c6b-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018a3b-256.dat aspack_v212_v242 behavioral2/files/0x00030000000198c0-293.dat aspack_v212_v242 behavioral2/files/0x00030000000198c1-462.dat aspack_v212_v242 behavioral2/files/0x00030000000198c2-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198c3-578.dat aspack_v212_v242 behavioral2/files/0x00030000000198c4-621.dat aspack_v212_v242 behavioral2/files/0x00030000000198c5-641.dat aspack_v212_v242 behavioral2/files/0x00030000000198c6-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198c8-746.dat aspack_v212_v242 behavioral2/files/0x00030000000198c9-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198ca-826.dat aspack_v212_v242 behavioral2/files/0x00030000000198cb-857.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-876.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-889.dat aspack_v212_v242 behavioral2/files/0x00030000000198ce-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198cf-915.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-934.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-953.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-991.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-1047.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-1066.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-1097.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-1140.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-1153.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-1222.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-1325.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-1344.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-1369.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-1377.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-1385.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1398.dat aspack_v212_v242 behavioral2/files/0x000200000001b654-1871.dat aspack_v212_v242 behavioral2/files/0x000200000001b655-1998.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2060 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\MsMpEng.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe$ patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4588 2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2060 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_82839db78b1ceb433ce85bdb38cecc9d_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4588
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2060
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 838KB
- SHA256 eb3327012f76ace08aeb742cbd36d2ca7f7025c5a574a9f437918454bfcd0f05
- MD5 82839db78b1ceb433ce85bdb38cecc9d
- SHA1 07238441d82030275d0feafd8179a4116091b9a7
- SHA512 d0bf6542224d24949973a16142caa6d3e5ef131e1e617f4eb68d85afa6c7dce7d1398e7cc8e87fc964cafa84ab017db4844f77cd04a98f4e0e0a10519aa86a47
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yC:A3k03kHRJQ
- TLSH T12905AD13EB9500E9D10AC1749ADA8A23FB757C561770A3DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe
- Size 937KB
- SHA256 02c17636e10f48f1d2634400347ed19c3d81470c958a12037950ab854cb788bf
- MD5 9a17a0f93da026ba14c13c04680dde1b
- SHA1 bc4033367f02f14719b0e0efaba2e288f9f3cfab
- SHA512 c8b11052095ebd03cd26334f05187b78fe738b9d278bd2b9d06551dfd7ee2ff976f4210e299d3f063a952383deaa1ac90d700836df3b4e220fdc218ad27f5ea1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2y5IxITB1i:A3k03kHRJ4xI11i
- TLSH T15E15AE13E79500E8D10AC1349AE59A32FB79BC52176097DF2358C6152F72BD0AF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe
- Size 937KB
- SHA256 323d842ad6be3aea2fbb039efa514d0e1b1e30d20532ca7184cc7be0ab637732
- MD5 bd2bcd68a48df30036d5c0069c394641
- SHA1 c47bd4d84dde9ba17b25c2246991b8740ec74060
- SHA512 0d2979dad96cfefd8a627b59aa0e338e44beed84c25b2347539a393f85680549b5080071172166cfd8516c565af725a0e6b96431aec5f3bd64546a056b2d680a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2ycbBPzBAU:A3k03kHRJEBPVAU
- TLSH T12F15AE13E79500E9D10AC1349AE58A32FB79BC52176097DF2358C6152F72BD0AF3E7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 45942214d33fd6c20a972bdb81875b0160f2630de3c5c9864b52c161a11b47c9
- MD5 0840fe0c130ee254c50110b2b50ee053
- SHA1 93442c85aa0269a9813772e4f9d49860f428981b
- SHA512 222959abe3f796848e5e7e6db39c6b1bb081fba30e98e336ea2828d70d13cdb15c984c2b5512b4ebb97d0a80f39a69bb2607ddf1eac898e58352ac39912680d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yC0Le5ji0hmxNrM:A3k03kHRJoPji0Aj
- TLSH T1A1657C17F6A402B5D027C0B9C5D6966AFA713882173086CF1399C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 853KB
- SHA256 96559177d0c3ad3046e605a961a65f61e008ce319ddd54a8bc017fd33f680a0c
- MD5 23d1d650900556947476eb8871d88423
- SHA1 00566b9e3f71bfdee0471947a871dcb49cb00a61
- SHA512 f21e2743704b6afb1ce8a26bf0d3874572bb0defab7b80958ccf4c4994050dfdfe4482bc7639be36a0a6cc1c311f9bf2dcb09f0e19a6d027dce9ba081a6d309e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yMa:A3k03kHRJ
- TLSH T11405AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 886KB
- SHA256 4d9db0916b0d39140fc80a27bc9798f88b72b4d2fbaddeb8f6500e83e55323ff
- MD5 535ea54ca1dceb9deaafb8a0c20523d8
- SHA1 98fa6d8e262469540e94d28e1bc9ef1752e94ad7
- SHA512 5ee5ad4a54dd03eefada343ffa17493a585d8794d7f143602d671353d093ed3d62ee73023f14a8446e93fa0e5a1af29b3eb618beefb0592ef3d0ec6b1bca7f8b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2ynb:A3k03kHRJxb
- TLSH T151159D13E79500E9D10AC1749AE68A22FB75BC56177093DF2358C6152F63BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 862KB
- SHA256 1a6ed3256496f5254c647ae4990f77609d6aa57f23b66420f3f16dc59ed0d27c
- MD5 616eaa0b84451095d0f0b32b24f09407
- SHA1 14256b1864b674ea3c1f70b8177987f5d09e9ecd
- SHA512 766dc683efc168908c1b843840d0d3fd2fa86268f5b8940c642c348557e9389582aa9bfc0a691107498e1cdab39f565a9b3268ede76d9cd8d1d91a92ae0d2147
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yl6:A3k03kHRJW
- TLSH T16915AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 862KB
- SHA256 d05ac4712b9bb394bb82eff0e37a626e22619808a3531e3f93fc2d2adeecc8a6
- MD5 5d9525b56f2e24bcf1be7db7afb6f0c2
- SHA1 4eef5f0e6b8ad9bf3e0800946c0d11359eb36abe
- SHA512 f3e5b3c41f6f1e122466edad416fe2de266c5914f017f2a2141ef43fc09c95c2e35698e1ae9914ffad9f3a378bb2d027baccb418a66f0093bbb9447e50360b59
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yd9:A3k03kHRJB
- TLSH T12E159D13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 862KB
- SHA256 32d6e5292134175ba197c9a69a37b9ece4cf80e8d33466399135bbab3aa4c917
- MD5 8fc642ad9d7fa0709d0e0879a5ac5d89
- SHA1 602ca486d57b7114d9e9e84451afcf224f5fee62
- SHA512 452432ea936995115451828650b22f6e090807f9a7df907f0c283c5f453dfbc842f8ccc9ec15e712e8e1396074d0c97c5233902cff0a5ef6549a37fe79168bdf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2y5c:A3k03kHRJU
- TLSH T10E159D13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 862KB
- SHA256 2ffc38563e8271a359b831b112973cdfbcf3d8278526243b2203ee865a50cf34
- MD5 3dcf39175d895ab3906c7ea65d5a9d07
- SHA1 ea6c71f1f63d4e5fca5b8fdc89c5c1272bde83fc
- SHA512 188b2407a82ad128d729a1e368dbfff9ff79ba2ce3bdbb848e4aa19555362dea1bb4a51d122e0f0a4eeb544987e21e565c6f0402e16502f0a5a62ca608593401
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yyp:A3k03kHRJC
- TLSH T19515AD13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 862KB
- SHA256 c744c175131915fccfb7a76d0fdc47ef04c5e79e76a0dd8d785646aead0895ec
- MD5 b3a2c8480a956d44d4d0ce91741cd44e
- SHA1 93d9a25626a4ee6997a55fc8a2e8e1584a752a65
- SHA512 c22429281723098655fcac16bbfc988eed5a2c24b164327c574f66039ea4319013a997605faa89cba70afe604664fb61693a5a1583a76c3c5084de515e962d23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yFN:A3k03kHRJl
- TLSH T1A7159D13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 862KB
- SHA256 975b3677513e2bfd89e485cb0054fba4a95d5ec43803604c2c23e867e655be84
- MD5 a1d24a3747400be193e02b28d20e2287
- SHA1 ed03091e2f60d7c796ddb91000c3314f2b4bbac4
- SHA512 f768d0d89092b967e842a52aaeaeb524a893882c080973c85fb9a701f4b0f197582c8df80ffdaf8b848a9127995eaaab439eb37c7f0fa96ce572801400e2b76f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yXF:A3k03kHRJv
- TLSH T11C159D13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 862KB
- SHA256 027701da3fee4ba595cdc47017f718769d1c6b374800bc5cc8ca5dd96041d495
- MD5 f6a65de9e44827f068818e06a7d7e26d
- SHA1 391e083f84488876d128cfdadb60a53eef866a7e
- SHA512 a55930ad446f076f6e82baaf639df214443a6f8b9f4f28ddd3d1af2481a7ee0c54a113a5663c3b8fbc812613781c6e3541d8291932004b8d53d5dc324f15f2e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yoC:A3k03kHRJj
- TLSH T1C215AD13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 862KB
- SHA256 6cfa4468741ff8e6ce0f03f62f95aa5e4357566a50a764036d782f1e667735db
- MD5 4d91f1d7027ec0c894ed8f3382c35301
- SHA1 193ac12d657cfedb7e2efe40d760efa1bc00b25e
- SHA512 ebd4f403bfa50db0a33ae7f02597c14f059b32a9d4e539737bcc58d16f953994090f7c5f5b5b90f4beeb96fcc39cec059c3a6eb2bedb8fb60c1cdfe8c4c25634
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2y7w:A3k03kHRJm
- TLSH T18E159D13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 862KB
- SHA256 cf9e8a3e94b42c119d458f1077b4f566c1f20cc4e78f69f19c76fb32977de78b
- MD5 409c352096907046d80c092202193274
- SHA1 1ed34de6fd5ea810711bf7ec05a05009ca907852
- SHA512 4a0875334954a566843eb562e263e39cb5cf517c781e89397f6f4eea6746887f8e61004bdb6af2618e95fc18f18b651455d2564274de57376a4b57b1fc4b3aa7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yCT:A3k03kHRJm
- TLSH T19E15AD13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 862KB
- SHA256 6dd3ce7fab77d9253388033317ed2f9908912c524ccc97d8eddcad978163dfd9
- MD5 3aa6fea8f131e0119883e837c10ca73a
- SHA1 44c8399a9511c447bb6ddd62265f84c9d2888649
- SHA512 385329b62232945a65182c6383b6d440c8949d09e48c89d6fcf1ad77485fc91ff16117981be38bc436a1c8263bfa4e90ed0c07ca842b3d2870ab66ba71932be0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2ySu:A3k03kHRJB
- TLSH T12F159D13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 862KB
- SHA256 96137983c6de87dee8559f611bdb6f81a23dfbc3ceb19c448b0a2d2cc79cddb6
- MD5 d9a5165a764e66335c0a7312a6d88ffe
- SHA1 4e915c80b89bb581812cd24849cf3dccb464a8bd
- SHA512 df93e628787de8e5f8d4801e9c0d483b96279cbeccec2f2630d5fec350deba7ffcb821264f5362039f2c2a23e7280caae50e4e08dc46966f191ccda4cdc97232
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yMb:A3k03kHRJg
- TLSH T14915AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 862KB
- SHA256 aea9d62eb4d4634d91de7ea63ba401eaa5716cdc7b0420cf1442575ffe114ab9
- MD5 6522d3552a7d7684b62112235e2e0e26
- SHA1 8f157223d461514051edb9dfad989e0ce8afda86
- SHA512 2d9f30da9951e94e104291a8cbe99bd5a050f54f78fa2cf91243ec56d0b8efefc2f2983309c3f5deae8572dd6a7ca41777da271cdb7f671499b2bea55434a11f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yyf:A3k03kHRJQ
- TLSH T1EF159D13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 862KB
- SHA256 1046cf42073adc5085a12adee797abe71c7725f3a1c5b5abc15707c0c3531661
- MD5 e98324768fcd706145644809f92e2325
- SHA1 46102d6f2cbdf19d45c0158e2eb0ddfcf29b8edf
- SHA512 5b231d7c80582ff7c4440264ff1385e76e836caac88bc4e7f2b74da638230f5e02213222836c6280d4d3f85cb5cc950b30c7b97da60454f48270ce5f1eb1a080
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yfK:A3k03kHRJw
- TLSH T1E4159D13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 862KB
- SHA256 14936c2a3188d3f1432114da186ce34d3ce0e083c254a402b6c9ad1b2968f679
- MD5 728ba000cf43fd605c2d9bdbba649bb7
- SHA1 64d6513b2d25ef0e1aebde6edfca7b5cc15f1ff7
- SHA512 0b88c5e30a317bcb31a1e538d698466e1482ce2d1a94510c13577784acff35dba237fd64e77f30a910dcf3c58f0ce28ec353bce3ae3fa51d7a4fa087f46cb052
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2y4k:A3k03kHRJZ
- TLSH T12E159D13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 862KB
- SHA256 c850174691bf1bd6049aa83823d01135de3441576f34b5fb43fbfd53de1005e9
- MD5 d915894d2ec44a1505e82569dc012baf
- SHA1 575d90cbc12c7794532298eabc21cd9fa1da429e
- SHA512 4c6cf6878ecb0cd45726fafde2d764b48a1417d7f17057394792dee2d1d08d91b0214c4181e78f70355c8fd5fa8516b117b6bb36be9eea4a8263a288bcd0604d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2y50:A3k03kHRJs
- TLSH T11915AD13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 862KB
- SHA256 2e29830fcbc127455a10c90b07a158ae1c5c0ccb78231d63d6ccd3bcd6abca8b
- MD5 94311e50308bb015142eaee48c044411
- SHA1 6196b996bc17007f91140959d3519466840e837a
- SHA512 a55cadc2f33e9f112041f30be8d5f63041db7f5d0c769b4b80863e51456c3972b9d53a46f6b01057fb3eaa0f55fe3921462ec94df6cf568f3fe79667965d8c24
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2ysg:A3k03kHRJR
- TLSH T1FA15AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 862KB
- SHA256 340121b05fda396a5d3a35d3f25f76c053d2bd6acefd269565a5fa95a6746796
- MD5 7e073073b67147a75236df5808c72bf1
- SHA1 3bb7344f37b19e933f71b8ea8b3c6b4353fdef37
- SHA512 037f9ee8a479dd1651921965314339a990e5569d85dd42f13bff4a06efcc83317c7a6977144899fb5712c5c5cd8a3ad4f1d017b1dc5da6d03fc9904a4deee50c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yJr:A3k03kHRJ7
- TLSH T14B15AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 862KB
- SHA256 db8281515b592c260a80587ddd4bf2ef6aec7100829cd3b8cf748f3348bb0aaa
- MD5 a43b981f68c40589a16e831fcda47a72
- SHA1 7f22a1e3b9ad5d3181f6d86cff1cb4beff46db3a
- SHA512 698e3f72728555e27ac6e1b9bbe713d952bab4c08e49236a858ce7d034d15dcaee70a14e8e26ffebb0389a270f399516ab9b43d954d7043ed35e82416f52fbcb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yrn:A3k03kHRJN
- TLSH T16C15AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 862KB
- SHA256 b6180cf83a78c15e4966d4ea709674ea46222cac68d25fdd92b91b6c29437f78
- MD5 e57c9ee2b0b0c5cf23560b62aabc5abc
- SHA1 b2eff4bf715916da898f1c030e2f077876aa0a5e
- SHA512 0b81f5812c1662f4827ee8511efdc99c275dae43b688272b0f0fff6dc75a5d027c745614a7b49bf6e38e0cc9b0d051bc5bcb829889ae05f115795cb60d2b4c4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2y3x:A3k03kHRJz
- TLSH T1B815AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 862KB
- SHA256 179b0c014de91079d2ed848683710320e169caf1749f7676d44820295f3bb1af
- MD5 28644501c5cee80208a2acd0a54ffced
- SHA1 a8ce0a1f11cf95919b8ab586509309d2d9d84ea2
- SHA512 c1d093a287cd3c8c3affd1142777e223b6a9b5f3d674fa3cb8665f39ea04deb9180f88cc4f67cc3afd81f5b8bd39f21e6fbd9a28ad731571dca16a080d8094b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2ytA:A3k03kHRJM
- TLSH T1E815AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 862KB
- SHA256 2bc1463167c85af0bb3094b6e26ca4e1d6b539943f1e2c89daf34fa4b25b7316
- MD5 106fb021b5a4cdac426cabf523e437ce
- SHA1 15f62812394076f439f0d66a1ad986444c83eb39
- SHA512 ec338a403b52a79676e242bf724ba28d3362a287a6bba6553dd3b546d58894cb6600160f6b91cc0400f3430fc430a0881de0cb8e3b1638e8fb902e322778e62e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2ym9Q:A3k03kHRJt
- TLSH T13E159D13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 862KB
- SHA256 a58607d90f20649b7787df7b0bcdce7ce1656dace6c3f46fc94e748c96a2aa35
- MD5 9885531310220bb90a7fff3086f08db3
- SHA1 f03ca839897c90b99020c201f87ae9b8f333a175
- SHA512 ada83a3efb1fac4c6fe614eb6656d57255a7119bf75616c0c4f0890e7afd1600632edd595fc6c34453f39c25a50c4e19d4009f1d7624cdc8f5eb79fcd2714495
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yD4:A3k03kHRJy
- TLSH T178159D13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 862KB
- SHA256 26240b4b3ef4b7eb4bc089b4175b812b0962f0b419b4cdb59eed31988468eab1
- MD5 b78dbbd732f00435db1da74f3a36f396
- SHA1 f544844d23e3be06392655c0218ac5afb28719b0
- SHA512 d67091b2f3d194a0a51d6359a3b54d2fdee37de2244457060b2acf37082bb7ca6a04143f6f2e0ed3235eed25ec9ed080fc256b396cd7fc887431d46dfe94570e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yqu:A3k03kHRJj
- TLSH T14015AD13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 862KB
- SHA256 1db3a63f5d666bfd2817d902ef8ad4dbba5843fad1b2df2d454600956e1482fa
- MD5 48946e4f37baf1cf6abe9dfd6b7195c5
- SHA1 5137f645c8d8611c414b1e6d02ee8a167f724a49
- SHA512 d707c27b272be565d174410bf045add93f5e140c580a736d16886ac263e0cb933f56e43b9b3a79b545c9ae9155f95bddd93b5143c9892b6bd6e246c10980678d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2y7j:A3k03kHRJN
- TLSH T10715AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 862KB
- SHA256 34dcb1065ee73b6501817063596fd7cdd01b4c30d2b66112b2bf079e5dc19f6d
- MD5 52a92c6de4bafa8e8a4b696df92bad13
- SHA1 69d73c46e511c5d6f0bbc57c8f48aa39401f573f
- SHA512 7c1970d7cb4cfb2ef9d20550f36e3e64ed959267771457811a27c092ac03e0cf8b40b21ba4428f6e176e8fe8674e09b64cc2b483c895e8e95b33270207c2f506
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yGg:A3k03kHRJR
- TLSH T18E159D13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 862KB
- SHA256 d74b2b09dec3a06ef197dba1acad6ec2f380d57161d38cec78fb7f11ec17ed3f
- MD5 7d259b2ccc3fd2973fe1d36bd7446c62
- SHA1 229ad109389a9b826c6acf3d39c7de6443db5344
- SHA512 91ed300f439739def7ac5c72753f7c9f11be2c1ad7b0dedc25405ef6bf0e6d1050bdc2b947c02286b24e684e51a0c956a8e6540c3210a6f15600e150b059fba6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2ypI:A3k03kHRJA
- TLSH T13215AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 862KB
- SHA256 60c29aafdd824d7ad55a5cb2e16908fce9d626efdef9b6e20179b8bf59ff0e35
- MD5 c1e63ba1aa7911a1a2f4a3b4500eb395
- SHA1 1a6a63e6d3fe236568f5970aacc4524fed276675
- SHA512 1f0714f33d7214931c78cb29494fbde15a2ce17303e31cc8be2844ef8ead2551efeaabcb7217efe0fd3cf17089390db28c3f55d5a6eb199f727f86ce6b9ffb45
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yLo:A3k03kHRJi
- TLSH T19A15AD13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 862KB
- SHA256 85c97d607bc0a7af680467d27ef69614ed899b54e775ebaae023a4d60618df33
- MD5 12cdeec2c699cab04dc212e9c2a2d08a
- SHA1 ddaaf9ef5abf8fcb821947df03bdd43bfc1b7f3b
- SHA512 dee36166aa9231a0e0db72bd4493754726c0848660e7b3252d7785e8424e64ba838d8e9262ec5b96258d31aef63ca967f9298ff1c29ba7bad3ff7d72af2928b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yw+:A3k03kHRJH
- TLSH T181159D13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 862KB
- SHA256 17b2c34f4e8e543b664c52b42514de9800d9b3038c9218cca7b2f5a1ced61ea7
- MD5 156a7d203a96863ac1fb4c2117464474
- SHA1 6c6d75f5727fbfa514f412b025249e0dfad7afa8
- SHA512 681df76f700c981c9b2b3a33d0da5757eff52d3a7e2397b4969564e2272f5830367173fcbb33f10248ba6ecf428af5894ff52ad07504c7832ba75aaa529108ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yIQ:A3k03kHRJz
- TLSH T13115AD13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 862KB
- SHA256 a352e3944f14aa5eadfcf1b0ca5ac08e2bf2a227f66f06bfa4b2b904286a9091
- MD5 613c9d8b4420a6e773da966eaf25b223
- SHA1 a21ef245f23062f9b6f095041242322c297191b4
- SHA512 9e643b11b83181b17721b370942191b0e7c03ade86f8f95c6885f42880c1796bfcfc4ea9cc84b5cb44c8cb8a508578b318914f7e6b2016721a70acdb0bf08fa4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yBX:A3k03kHRJn
- TLSH T178159D13EB9500E9D10AC1749ADA8A23FB75BC56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 862KB
- SHA256 3e741eae8f56b751cb1a7e3b582272cc6713e1c4f613282c2b4578010e48062d
- MD5 10a40e4582e39fe588d3599d9cf2d164
- SHA1 f88b6a2aa40deccc3eb8d8ab0460dc53534bba53
- SHA512 9bc1885493be108ade5427ebdf37889b3001f7d06463604f0d50efb371498dee9add15a746b13092353414b270b9d8185a3001e1fd2cc1d01da44647c85625dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2y7L:A3k03kHRJJ
- TLSH T14915AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 862KB
- SHA256 56cce11c778c5df2e336b0786ef00e591cde2282470d41a7bee1e39038e305a4
- MD5 da23e160d116a2022ebb85c56af85f87
- SHA1 52f9e56b2f63e1e0aa24f269a92238d118070f2b
- SHA512 5f57b749aea330395467ec27ce0c39bbd12713fd4987d07e06a1f272f0a281a2c2f315715e652ae0fcabe27142ec25b59335612927b9dc3a2cb1588992320ddd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yBM:A3k03kHRJw
- TLSH T17C15AD13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 862KB
- SHA256 ffd8224426aca1be129e497bc34c739028162bfd0d111b52586e6aa1d292d117
- MD5 33a15263ee3102f44e8e242043b145f9
- SHA1 78b38e89e3136ab624a10c6e1c83e90af0174b31
- SHA512 9a2f68f840da3bb4bbbb2c202b61508cb0c5f29759b60190ab906ba7fb6169df0a6c1a8291a561624ae16ff0d7b5f131b08d69f44be510ad6bbcd536d22dd310
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83Z/x2yqh:A3k03kHRJi
- TLSH T1A4159D13EB9500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH