Analysis
- max time kernel
96s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
09/08/2026, 17:14
Behavioral task
behavioral1
Sample
2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 844KB
- Sample260809-vr856aaq4w
- SHA256 19a17bbe1f5f13c5bd41c28d505238a5474dde406b0d0fb44047f6266ad3fdf6
- MD5 0c44da2b3c54fff370633e923debd1c6
- SHA1 2f5b3f7bfb8811633d143f3b413206cb3d9280e6
- SHA512 ca6e8236a60a9dc7ce8d88f0518e22d987a037bfd3ef61843975bf80dd1a76ccffe377e50b05e3963c5e4e591e883e040cfd187cf7838fd4144d5f50f8afff50
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvp:A3k03kB56rS
- TLSH T146056A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/4832-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c566-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4832-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4712-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-294.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-463.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-573.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-654.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-726.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-790.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-839.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1004.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1079.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1128.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1216.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1319.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1338.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1364.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0009000000018925-1452.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000018934-1515.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a44-1546.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893c-1571.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018944-1806.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c428-2120.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c566-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-57.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-294.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-463.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-573.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-616.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-654.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-726.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-790.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-839.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-852.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-877.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-890.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-903.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-916.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-929.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-948.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1004.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1048.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1079.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1128.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1147.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1172.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1179.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1216.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1319.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1338.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1364.dat aspack_v212_v242 behavioral2/files/0x0009000000018925-1452.dat aspack_v212_v242 behavioral2/files/0x0003000000018934-1515.dat aspack_v212_v242 behavioral2/files/0x0006000000018a44-1546.dat aspack_v212_v242 behavioral2/files/0x000800000001893c-1571.dat aspack_v212_v242 behavioral2/files/0x0008000000018944-1806.dat aspack_v212_v242 behavioral2/files/0x000e00000001c428-2120.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4712 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE patcher.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe patcher.exe - Drops file in Windows directory 60 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4832 2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4712 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_0c44da2b3c54fff370633e923debd1c6_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4832
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4712
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 844KB
- SHA256 19a17bbe1f5f13c5bd41c28d505238a5474dde406b0d0fb44047f6266ad3fdf6
- MD5 0c44da2b3c54fff370633e923debd1c6
- SHA1 2f5b3f7bfb8811633d143f3b413206cb3d9280e6
- SHA512 ca6e8236a60a9dc7ce8d88f0518e22d987a037bfd3ef61843975bf80dd1a76ccffe377e50b05e3963c5e4e591e883e040cfd187cf7838fd4144d5f50f8afff50
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvp:A3k03kB56rS
- TLSH T146056A13E6840FA4D10FC1749A968662EA737C125F2097DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 891KB
- SHA256 110307dbe8db3b9a03c7759844b7d36b92dd1ddffe63e477840af44f31cc820c
- MD5 8d950e16b6337eae03f8e4b2ce09a4e3
- SHA1 a8f4661bd979ce8f1283444ed4c3b78932f4c637
- SHA512 63d2f13c837c0da06e79a3ad31bcecb3dade497e177a03ac77488e2e5b78c8e77036ae4c69619eab79bdfe6ae512b316b7f45bbf90081f03ceb0a86449973fe9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvc0:A3k03kB56rj0
- TLSH T135157B03E6840FA4D10FC1749A968662EA777C125F2097DF1354AE253F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 936KB
- SHA256 f813b268661861ec6c04b584524c8df33bd02d796a6cacd91e328782bf39d8c4
- MD5 b14ab991f64ca291c8fb328dd49f9da2
- SHA1 3f3942e2a1db875f93af7a63142f4e78b618a4eb
- SHA512 ff9cdec1632bb3d109959393c94c9c8996599a868b143bd3f95a21fc26e17f78a6f308d7eca26d005686af94b715c3076746b8da9e7ad0a2b5a6e9b495e4c4d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv9:A3k03kB56rY
- TLSH T177157B03E6840FA4D10F81749AA59672EA77BC115F2097DF2358AE193F72AC06B3E357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 929KB
- SHA256 4feed68a397f4068df1c6dd996db26fd94d36fca35ac3376519db03b75763cca
- MD5 a7b0f7e0229f959a6be26f3085f08ff5
- SHA1 faa9bab33f801365fe75793581bf08a6db934fe3
- SHA512 b4cb7c9233f29bfba5dd4b158d384d3fd8c8a22f4cdde08f7395a5066593306267ad86311f621df0c0db90f775cd48073fceb7493765a835bdcbd8963943a48a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv472:A3k03kB56rr72
- TLSH T190157B13E6840FA4D10F81749A958672EA777C125F2097CF2358AE253F72BD0AB3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 897KB
- SHA256 78e76ecc18912a656e4324c0efb2812836b137c6167a9287f1fa3c756cd4eb72
- MD5 7ab48f3ecd7f623874f42972f2e61d06
- SHA1 9895fbae028baa59113ce3881e1f4a47e6e1b40c
- SHA512 193502e4d97c843154529c0ac61005f3ec4eb872abf8a8f6e2cd197c2763a24fffbed16843c388d6b15be963cf5e33b1f8d83796abd38af72368b984f2ddb309
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv4fj:A3k03kB56rVj
- TLSH T1F8157B03E6850FA4D10F81749A968A72EA73BC115F2097DF1354AE153F72BD06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 952KB
- SHA256 da85994b30c1a4fbc202f2b43e28c57d27130ce1ff54efdf6641465801c09dfb
- MD5 9de5f5693fbf45ef4021daed362ae66c
- SHA1 93699636d5f294f54495619fe4f3fcb34e2e8f46
- SHA512 d7f3711f3f4f1aebd24bb700e04364626afd63984b9432f6befac3e12d4dbed6005c287c6eb4be09de8071d2bf458a2d7947d61e6c7bbcfee27a9b828d049060
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvNhk:A3k03kB56rWW
- TLSH T1A0256A07A6940FE8D11F81748AA64622EB737C161F2097DF1354AE253F32BD0AE3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 01c7a090513e1ea82034f25b9ca1145ba6acb1075a5cd80ce0577f3e3cef9d1c
- MD5 feeb2954df272a7ae9e3d8807482c6cc
- SHA1 2fa400f901a76c183df5089fbc060c7ca3376b8a
- SHA512 89a2d0ebd70e58989a79236aba1e6eea21f22701993eb8d741ebeee1c35a24b58bf4011d12d53215bd5812428b26f6836803818615427c7042fe18c8805d3050
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvV0Le5ji0hmxNrM:A3k03kB56rSPji0Aj
- TLSH T154654A16F6A44B65D02BC078C5D29666EA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 859KB
- SHA256 d11a4591b68c616cd9e8c10165b426a27b43a108198c949988ce5477315841e9
- MD5 cd0a57d273a2797f342e163985472b77
- SHA1 5bb5dd53f98fa711d8e1295fbdd68beabee5bce2
- SHA512 7536491c353a6d89a37f6f23437d37ab48132427ee0fc41332958192ed13c00d3e1dcbc01ac1a23613c34b7b8e762e8da08fefd4442df448022e3c97241fc0b0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv3a:A3k03kB56r
- TLSH T192156A13E6840FA4D10FC1749A968A62EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 868KB
- SHA256 d8d5a9ada24ea2cd81ba8c6857508a538b6275638328efa723804bcdbb57692d
- MD5 eafaa24d0846878d5627ddc1d664f1a4
- SHA1 fc75a75bb8da70f0fe9662d84aa32aaaf993f5eb
- SHA512 266758eae8cff0d057b429fad84eaedaedccf80fdf6ed8d0a4bcd9f1b58b9ffdd22a3da80eb64421dc38a0a59bbc7f549dff44c66d54272b3e8649580d4f249e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvYF:A3k03kB56rl
- TLSH T12C156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 868KB
- SHA256 af26a59b487ccc44078b3918f1ed95ba929c6459dd948ed0999eb9bdeaac2b40
- MD5 4b96df7f7e76be0c5d1ed0c124efa8d1
- SHA1 51faca807172c8922db9da8678b9fcaa3e529582
- SHA512 08a43bc1111a67e10a60014f61784e25df8e070a928f164657fb91913273afaa9a817633aca9a990b33a5511b013fbc40ea66f1321dde1c64e1c1a3314c9e16f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvNC:A3k03kB56rJ
- TLSH T1B2156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 868KB
- SHA256 662df8d94ca93ea4b21c632c2c0caa53bde7f5ebba453cb62566c8457ce03be3
- MD5 b7dd8864757b40d041515ea0a2003d4a
- SHA1 dc7b7419f9f680569b386ea0ac99d3ebda784b89
- SHA512 4fc54a14cf4d31895c787b275884e23d9988b5a3f74c71e75a84f6a468253f20692879923d383d9665a61415ac3ae25a9f84acc1268fd120c479e967139162cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv2w:A3k03kB56r0
- TLSH T13B156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 868KB
- SHA256 d56911865585f1f3aed10c30e1d460fe107404ceb6e806985ef930edf0206fed
- MD5 296e883584ede80e1dee050398699b2b
- SHA1 7305d747cb05791797e898adbd944f57660e8625
- SHA512 467e593fd205829366d3b3082ae0ecd5578334a5276c0c5528b810d4f8c7dc6c7795f59804db732556be6da4bbced0111896a65da958bb4333cc928646b852d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvlT:A3k03kB56rc
- TLSH T158156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 868KB
- SHA256 fb30cfe3bb98e8c696402594a307d340aba16c0a7e0470c1bce4dbd3d3262328
- MD5 bf6aee4d7a85cb534ba6e81d8a7f66ec
- SHA1 04339c45f54ca48d30cff93ddd377f25ea49ae68
- SHA512 3723f278a063489c6948780c0128f68a04c433ece1fc35c435f98e4d5aea0368cb6124ddca3fa7594cdbdcda4691dbef93d9de6d82331e85e440bb8359384c93
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv7u:A3k03kB56r7
- TLSH T125156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 868KB
- SHA256 ad2fede5ec1af04fd43e3f92b8aa5c3e9a5a099d24a60c9517ebfc50006d6ce9
- MD5 e6e6c91a63b69ee9143bc0f97c2b07ff
- SHA1 a37d21af6103fab78770f035ee6d429587f6f349
- SHA512 09939d831f917afd5ba02361bc4bca2c342f21059e26c3b4324fa0164575639708d221ecdec6d8e755446b879d1e8c71df30b93afd57cdc0aa905a38ba0bb5ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvfb:A3k03kB56rS
- TLSH T11D156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 868KB
- SHA256 bd23e7f60503f7203b4527b8d33ec6c7d0eada2a8a86cf7ce063381f6957de6e
- MD5 3baf87e2c3663ca7028045847c31e508
- SHA1 22af7c12c4124ec3be571ec80d017dd6ab4407f0
- SHA512 5559a47d3b7f96c2bc1c3ec2812b21d2fc82809730af8ad8f2a90f3462ee854ec64101bb322ff096482b0510eb9addb7b1b611242caa156b8c57dcffdc4c055e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvbf:A3k03kB56ry
- TLSH T142156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 868KB
- SHA256 ad9d84bdc0a6f3a10a5dc3de1fafacbb4154fd3bf027263f4a6a9ec71b553ed7
- MD5 36b07137a681bec0b746aa8df084a11b
- SHA1 283cc2c9e453ee0484c857573f9cc46119fc2eea
- SHA512 7442f56bab4c5803dbc227e5155e17d7aaf7e8840e592c8602d37cdc38a2baae8583f1b40205074e143677beaeb074f7683fdbf79c52f2c0e92675add9f8d24f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv0K:A3k03kB56rS
- TLSH T1EA156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 868KB
- SHA256 be3dd8ff55519d7aa083bb12427e3277c575e953ca228be0a3fcdb3c34fd8d42
- MD5 ce14cca8ba6a762381ba1f900cb3394f
- SHA1 507ad22baecfeaf607dda74d832a41175edc8d5d
- SHA512 4f062f546ff5dbe6301f6e6fd7abc33b8d4dcfc9d01f27028e768326f25aa6b7a73cfc76ea920948bc608ccc98b8e28422bbe09b9839a2334e35b3bf627a40e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvpk:A3k03kB56rn
- TLSH T127156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 868KB
- SHA256 7007ba54e0b2ebe915c76ff9e8adc245f2b8517bcb77c6866664bc0f781dae4f
- MD5 587707346d063cea100a264f66713be7
- SHA1 b317313f9968eac48effb49bfdeb0e69121c9d18
- SHA512 2205699a496968414a33c72d4315fc01d0cf838ec8e2e4f3fbe5b0c3d43d53061562c8f79b1010b908abda468e6c9857d79ac716a46121ccad3d2a6c9f08aace
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvG0:A3k03kB56rm
- TLSH T18D156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 868KB
- SHA256 b770e8e0ea8a8d8d494df8db43d8ec22e76163f7fc699030d6c2d32d8801b1e2
- MD5 160d08e7bdf8bf92387ff9dc2b35e945
- SHA1 510d1f5f38502a455d333b8f5a33ce981b5a9c6a
- SHA512 2a6a52e55fe3208a1f82ba13f01926ee3feed112b7fd5384c3ce183bcf199d51f92695c9e131da22e21f6e1e04981ea5390c3660e945013d5f0346965ab0bea8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvVg:A3k03kB56rf
- TLSH T148156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 868KB
- SHA256 7918d6e3d2f47df582f1e8281fd09749d379e4307c65e08dd55dad54381b0944
- MD5 787cd804b7c98f17970d4150bfbcb3b9
- SHA1 904b3a8a9767fa6299a9789e788b2c0c20ec5764
- SHA512 3ac23ec55efb0abfea705ed6a34d2a4c4e8cd5653e37131b4bb2d4b2d799aa7153d39fe3240154078cf02ba65b736e3fd142250528b57356516908495abd93eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvkr:A3k03kB56r5
- TLSH T111156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 868KB
- SHA256 0bee53701eb51173022852e867a31a7ac429ac30f2726d5f25c8742ee21a9fdf
- MD5 3246daf2505ef3d64e59519d29675e8e
- SHA1 78b1fada6ad54530b879088da3af12d3db34de8a
- SHA512 5b3f77751f5c9c9c6f83c823d083a800e3254024c315fe6e4ae83781cade8b5b24ad7842d49a3ac7daacc01b7af1b9cad3ba514e0ceaaf7246a9be133ca5fcce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv6n:A3k03kB56rz
- TLSH T140156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 868KB
- SHA256 68de097f105b21051d5e317110df71320f41084d78c5db689ea22cfad1295cde
- MD5 87cb91b1a0fdb0b3c757756e7c4662ae
- SHA1 f8ddd3eb48223cbbc743f9c5fa0a1f0543449be9
- SHA512 57c443aff4d09a7253c968442a723a8fb708dcdee4cc0bd8d715c49afaa7b66f221dae73dbb04de05fc0869fc43c7c54f3e8204154e843b40bea4d3f4488da39
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvQx:A3k03kB56rx
- TLSH T19B156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 868KB
- SHA256 7ffe91835b6d60fb3d5a796ada31d41fb51ecbefe40f522a02590a6d59d617f4
- MD5 ad8a0ffb7c6fb92958951e1f4a7ed7d4
- SHA1 3a4379d11f4b4033f150bb3d19a6f66b651ddf97
- SHA512 84e91dd2adc4587056664c805a8c8e89325513f9c0c6270a3b3e85af7f6c8ff8d222265da1586a2a764962f5874d851ae44b614632d869c96652b4f74477cc08
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvSA:A3k03kB56re
- TLSH T1F2156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 868KB
- SHA256 43751c3d1ae8149c3fac8a0051b2ea4310be3b01e889e62a011af3e7e3a511d7
- MD5 2ec4199040c8fa342920f2f07ab8dab7
- SHA1 0293e8225030c73def149f4213eae31e1f101e3f
- SHA512 a1b78229611153a11b51ea32225e9606d1f09648b957b91edbcd593593825461d692fc95598c371f2706c85c3938e3fd681fa3f7d4df48b6a6e62f973e317cb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvr9Q:A3k03kB56rD
- TLSH T1BB156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 868KB
- SHA256 a3bf71c17de9bcf2fa0c57d1b2841465cd487b0ba407d620d788c38fb3cb3f26
- MD5 586f86224d94f84d9cf079e98fc9c562
- SHA1 95ade50fe4d732968b3220a212cae3c83f4c83e5
- SHA512 86e68b59c6e32d1488367c59d493f4822a8a30470b7e034306099bc675b81be54eb86b08d4218f4d7d20fb473cc41565ad423e0310b4a18e084b8cfb04a3a0f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLva4:A3k03kB56rk
- TLSH T13D156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 868KB
- SHA256 68edb2a7b692bde676314ae39301d57b6d4d2b0fb1a6db56e91756f24e33eb0d
- MD5 8bd35904870b81eb68671737137b4985
- SHA1 916dc4823628155b6304318ca8c6c4e874e91bf9
- SHA512 eda1fc9cc305a6016df3978475777b0b54ac3aef449515423b232d6d8790bfadea91d72d2cf7e7e2eb32b71ac51e770fdb7b60ac4a91e7afc2e8c5849429ae76
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvBu:A3k03kB56rV
- TLSH T16F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 868KB
- SHA256 8b2ec4c6a5bc87a0620c7093db82958b542a02e9c270a02f5830447712027b1e
- MD5 3150c74b7a2343c36ea44b0a1ecac79b
- SHA1 764f94ebe828010a68fe37e9dba1c40caf2460aa
- SHA512 7af568bd3f4ed3afaeee1cd84c616d476bd63ee873ce8c782d9ff4174692c790b48b2b09ca083f16ed2530154d8bf98955ede1bce55a88ca723156a25ada4349
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv0j:A3k03kB56r3
- TLSH T19E156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 868KB
- SHA256 92a9081cc953b485f6684f1b01b2ff07c4ea699f9232d6dada2cbe9e4e349e03
- MD5 3512c9c178c238c6b886be3a9ae331d2
- SHA1 96b9576a10028e5eb24a7192d9d5850d9ca5c2a1
- SHA512 d6dbfa1d4372e929b6fbc68450ff6d64dac75cb6180a835a4e293d6be8a5f942ee80b469653ae20371c12026e4218abac157f8e6bd6491d3d06a18669883b8e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv1g:A3k03kB56rf
- TLSH T1E6156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 868KB
- SHA256 658361a00ab3045a180b51a24c123d606a5b47a1282cc08c546540a2e5895895
- MD5 78832c84125b0170377320e6d1366151
- SHA1 04c2342ffd6d9845d91dbb0f3638cecc0d6b6e4a
- SHA512 68366ddff5ff57f144c48229603d2831a9b400d678022eb7e569b077f8bca60903a281f2266dcaa7709e41d688bc5a9b03dfa1aa7a334698edc5a8d8e0b1313e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv0I:A3k03kB56rO
- TLSH T1A8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 868KB
- SHA256 678561eb00d351b61e49ccc5c15314ea54fbbb3d1171ee4432e1773b4b244980
- MD5 fa23ae0419f12eb6fa5b2305381f520c
- SHA1 8100172d76f64cc9ec2780b15e3243a3f6d2e1ce
- SHA512 58857f12d8a8b988bf908e7ab7d07200344991387354637985d966d361b0bc242c96a7b49dbad7e62882a594b55016108157b2af42589dcc46f941ffab507933
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvmo:A3k03kB56rM
- TLSH T18F156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 868KB
- SHA256 2c3751d362dc99e3a4d8c25de85cd56428db7042246d5b6690f58382294c96bf
- MD5 a8f0c53f13cb5a6dc1908f8b1fa3570c
- SHA1 c69854866fc46dd0bc17f2ec311e6743de0d648c
- SHA512 ac98020ff69ee728e4cf94c0139de782528859567f139fb5d644578f01dbc045b4f920c9bd321fe1d906a2ffbceb8eda5ca14f949b09c380220a60df9b3abbf9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvN+:A3k03kB56rh
- TLSH T13D156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 868KB
- SHA256 34158bb3623ab1079c7c8de28697049fe5a260f6434f1a168dc176a473b7793f
- MD5 26287588c45aa25399bbe7ed10482f54
- SHA1 8583586f910bd990ec5ca782145c44158bef15f9
- SHA512 6298d2606067c282e03d688f5b694a8ec1d4647a02fd63dfbe8521e079bac75c58c9ee5940b210df5c6b211d76ec0e4df1b3bc062ec1f12d90b1a0b2e5c52958
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLv7Q:A3k03kB56rh
- TLSH T1E3156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 868KB
- SHA256 1ae00e92b78a90545065cd02b799f83cbcdf528e6d1c4164b4ae9160fd526457
- MD5 6bded38bcd9b585065771ee1a4436133
- SHA1 404c2692ab97a62bb69844b78d8dcf7ee044fe9a
- SHA512 e91db9577a25b9ba8b9d01fd459cc9e85e8867bddd46d14ece9b60841b6978b5f22aca4e3ad67213a7adbd04f03f855bf65c860a66ab567951b7fb5aaacf5b31
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvwX:A3k03kB56rN
- TLSH T15A156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 868KB
- SHA256 b8083697fa73bcddf7e85ee512ad8510de5ddc8f4d90c38360e45290a7f8f684
- MD5 2efbaac1d03d97bb6ca4759bd44b2146
- SHA1 13c2107227b7356c0b35ca0b19afa6464cf16548
- SHA512 6f1e8fce48f35129bf630998651f6197272d4b25430c104eef23dfd87cedd4dd4bbbc5cc5d2673c5772a09dca39f54ba7a8f34af1109be77b98c51c0e1e90383
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvGL:A3k03kB56rP
- TLSH T1DF156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 868KB
- SHA256 a7d80af528ce2f46124503da0e9a3e1eb4869baa3d280a3325e039659e283747
- MD5 0b0b7ae975d61192bd0256651732074c
- SHA1 4fe2510a796781f8cd9b4e54a15c945ff0a61707
- SHA512 9c03b9d87e3f5301d0161584ae8979f24d5057b2c3db384944dedcad859b3b933361ba104ba09319dff62379e4d3d45c0107328096811a8432bc14a98b5201a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvaM:A3k03kB56r6
- TLSH T1EC156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 868KB
- SHA256 657792034b611924e795ef593fa3507dd2d21b1ba4ea7e27774de3634cd29417
- MD5 98b3de0a652096680a491a2696d60e08
- SHA1 963ec6789e74b7bb50570c7cc1ecf29bb286c200
- SHA512 4e1539c2d8d050680311eb4231b7e0651dad22699fdc87f7cbf097fec4dafda55860be140af6602bd3af99a404d075e688052b25f3b5b6e9e4f2b42ebb08e272
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvLh:A3k03kB56r0
- TLSH T1D8156A13E6840FA4D10FC1749A968662EA737C125F2097DF2354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe
- Size 929KB
- SHA256 9d9115a961f9623f93eb00e487e6f496b3e326ef764fd0c2bcdacbc703fad541
- MD5 511d7471102998a00bd87a32e570a994
- SHA1 ce66c7fb7bb60a995e832d1045dfce8a9bb75367
- SHA512 4602cc78d5159b26fed6133f1af7153249651f93a5c3eb4c3e0146a1f1f20b8fbb117fe05dba0d63c6f9fd1d842c6b8adc87394455dd4a522d00698fcf1e3ebd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLvtx5:A3k03kB56rOx5
- TLSH T1F0155A03E7880FA4D11F81749AA54662E677BC521F2093DF335CAE153F72AD0AA3A357
- MD5 SHA1 SHA512 SSDEEP TLSH