Analysis
- max time kernel
106s - max time network
136s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/08/2026, 15:50
Behavioral task
behavioral1
Sample
2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 868KB
- Sample260817-tab9escc78
- SHA256 70ffbe0b5121c3e363df11889e2b51f82f0a6b39dd734abf566f147c6046dd3f
- MD5 625e549b2d4b3ee8673de7eedbfd205c
- SHA1 828da3a97eb16421816ac3b03dd1632a33b63855
- SHA512 7c6c5f6d7682b8b51312b5c1d99d861c7fba9d1d43eee011911db975547b225c6b874d11ec70fbd0d041795cbec7f43826e563d76d59eff611573bde07b5dc7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQN:A3k03kB56ra
- TLSH T1B6156A07E6840FA4D10F81749A968A62EA737C025F2097DF1358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 40 IoCs
resource yara_rule behavioral2/memory/1372-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5de-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2f2-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1372-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5e2-33.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5944-70-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-269.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-439.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-538.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-599.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-721.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-740.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-789.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-872.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-892.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-911.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-998.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1041.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1122.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1136.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1167.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1180.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1314.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1352.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066f5-1855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000006502-2001.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5de-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2f2-11.dat aspack_v212_v242 behavioral2/files/0x000c00000001c5e2-33.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-269.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-439.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-489.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-538.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-599.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-624.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-721.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-740.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-789.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-820.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-872.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-885.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-892.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-911.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-930.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-949.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-998.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1041.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1060.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1122.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1136.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1167.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1180.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1193.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1314.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1327.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1352.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1371.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1378.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1392.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1393.dat aspack_v212_v242 behavioral2/files/0x00020000000066f5-1855.dat aspack_v212_v242 behavioral2/files/0x0003000000006502-2001.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5944 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1372 2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5944 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-17_625e549b2d4b3ee8673de7eedbfd205c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1372
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5944
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 868KB
- SHA256 70ffbe0b5121c3e363df11889e2b51f82f0a6b39dd734abf566f147c6046dd3f
- MD5 625e549b2d4b3ee8673de7eedbfd205c
- SHA1 828da3a97eb16421816ac3b03dd1632a33b63855
- SHA512 7c6c5f6d7682b8b51312b5c1d99d861c7fba9d1d43eee011911db975547b225c6b874d11ec70fbd0d041795cbec7f43826e563d76d59eff611573bde07b5dc7f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQN:A3k03kB56ra
- TLSH T1B6156A07E6840FA4D10F81749A968A62EA737C025F2097DF1358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe
- Size 967KB
- SHA256 bf923c7efa7e2e7b764836697d595e9c528e7a2a9e58666f87d8c88fd5e851d3
- MD5 01b8c9f1e9d82fd14ab2fdf9301e23e3
- SHA1 7d3a32cd81fbc1498bc00a606b6c87bf4f5dbbce
- SHA512 c99bad0e0823f43205469ce78a04c8a1cd431e5ffb8177698a2a6fd97a8b7d68e262ec01141fd0a8485e1f06b14de14c95629e2b81d97ad4916b416c996adec2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQq2MqDBxc:A3k03kB56rAMqlxc
- TLSH T161257C13E6840FA4D11F81349A958A72EA777C121F2097DF2354AE253F32BD0AB3A757
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe
- Size 969KB
- SHA256 1d8ba0770c57ff634d076af8b39e79707a75d79a4b5d5815df7d67809b723eb0
- MD5 eaf18fa6d6ce14521cd55407796aed50
- SHA1 14f255a6d7239b1e98f3ceb581de004f3afcec82
- SHA512 004243fea6713ec84af9a164587340d1c1afb1bf58ac3d12821121a3d76ad18aadfa1ad1b4fae333208da292a49815f4ec4311fb188e5c38f65cab1d0dc2ccf2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQgT6Nr:A3k03kB56r1TAr
- TLSH T151256B03E6940FA4D11F81749AA68672EA737C125F2097CF1354BE153F72BD0AA3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 6d699893a1531bfe32db6533a50bbd72db3adaea8a788409e762a5066ab58494
- MD5 08c123aef22427b8f980539092b51717
- SHA1 4184376a827a6621998f779eb70a13c15456e3bd
- SHA512 9232d1a3f1ce2fc093a7b14093ba26ce2fb708c1f4cd42004ddefff8bb7b67e17d4e9cdfeb995fdcf7a4439f6f94888966bfb6d1a44c18fff5b448d9c52c5352
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQZ0Le5ji0hmxNrM:A3k03kB56rqPji0Aj
- TLSH T11B654A16F6A44B65D02BC074C5D2966AEA733C421F3087CB1354EE283F67BD19A3A763
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 883KB
- SHA256 ac555d721112979369e8d31449ee9f6eaf49464d1345bf7db6a7790661ab175f
- MD5 250a76cac426cee3ebd1e28637566cc7
- SHA1 085b5ede91e97d8439b7d973c31b5837874b76c0
- SHA512 4d500fa299b2fe156dbf6ba27cf29cd177bc7e2a9caad86f148e143b97452874fc39730609ed5d4d781050e9214561dc9d4dd64644db1dea36c5a99b0e3d836f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQLa:A3k03kB56r
- TLSH T17F156B07E6840FA4D10F81749A968A62EA777C025F2097DF1354AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 892KB
- SHA256 0612dac695eb0576d0c421ed777f5fe2c27089f2dd374a655dced9031c4f1d56
- MD5 aff8e74786d4bf6853daac2e0a0cfd52
- SHA1 75637dea32eaf8300c876eba5fa10c004c850ad6
- SHA512 57d34c428d3295b30e68fa381df938f901eba7c538bd302f801a2bb1b0d1c0ae05fb70e37415b720b09636a1dad4ea89b66100fbb4d7d23534cfabc908bad950
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQa9:A3k03kB56r/
- TLSH T1FD157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 892KB
- SHA256 f76f4d7771f78a99417d045593e598c0a2b837b70a8d880da99f6e9b0207f28a
- MD5 7228e4533f38d3ee9d0677a12c7a379c
- SHA1 96cda9832d80399fd4a13de45097ce32e3c8cca2
- SHA512 0b5b30a8ac39d07206bdda710841b619717d002f51f7cee837e9f15009947ce4fbb3dc61aaeb242acad0a0021e0cf485ebc7a0af8bfc8e6a6851ca832327c3cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQac:A3k03kB56r+
- TLSH T1AD156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 892KB
- SHA256 8f5beef6fe5e519052fc9708200e9e51a1f3ae589d7349cf21c92555f9b43f63
- MD5 aeb7733b37bcefef92e3ebd01716fcf0
- SHA1 74e2db729428fc1334e4287214afaab4f61291a9
- SHA512 e394af21fcb3d5ba28a827da81fd4ee956d35b82fa7324474711dbd2e2bafdac6cecccf36c9e4879c09f0bcf3efb5edeb6b7a46cb6ce783673d25a7006028112
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQTp:A3k03kB56rM
- TLSH T1BA156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 892KB
- SHA256 555afba01448ab556f63994da721f5fa9098a1e85a54feb33b2dc44c38139b79
- MD5 08a221112b348ba07527ce3e7e033118
- SHA1 c4efaa24fc3267eb320b3300fae0d80cf7bc6b68
- SHA512 31e5dc487cabe26ab0f663ad004cb401450533186334d86579a99023525463d2924e4b783867c8471f4f3e5a1e6befef258f4f13c70b304fa0984151ba7daa57
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQ0N:A3k03kB56rL
- TLSH T16A157B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 892KB
- SHA256 5ac9a508dbd6e0feb34b685d0d2ce589aee020ace9671ca122504c8fc4bed12d
- MD5 134596a9b4ef27ffdca6692b9c51c6cb
- SHA1 850029be0ac402dd06acda7f430a0f422a7003be
- SHA512 2f9b500e38e86dde645432bb356ded93a8aaf86709fe72804d3768911e79e5c729fcac83d495d33b4222d755b4f55773699e0c69d7a8415b2fbc2107d8fd3893
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQcF:A3k03kB56r9
- TLSH T179156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 892KB
- SHA256 c9ae532886069759b5067e4e04e5fd3b0eaf51a52496a2bc021f57f2cdda32b6
- MD5 f7e2c5eec1eed55729fe03ebfd2217b5
- SHA1 e1b71e2eb202c0e41cd83b39dc7c7180a553501e
- SHA512 1ac88b66321415a590d390b2ce0221096a47fc58af9e9b656e65b7d31a5001c10c24a2c799d127951e1dba5bc708ca99f9f779796581cc31c246c31191912cf1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQJC:A3k03kB56rh
- TLSH T194156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 892KB
- SHA256 d74355d689d9f4f2746f79c153c56493883319a154f845456fd737956b185a24
- MD5 daaa7b59b2e020f4bef4d0cbbfb065db
- SHA1 fbab56f86487c34fff70f56b143a2879b4beaf81
- SHA512 a33e3e0729558a10aff8083c6c774f40d79ba9c894e72f454c9189831dfd72c501c3f4bc48018173d8ca26741bf04af4b0e54fe383f813dddd2c4275fe0eec0d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQqw:A3k03kB56rs
- TLSH T16C156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 892KB
- SHA256 90cc3423ac25e473638ef55ba466e08d815e23e3b490cb747052001e369cf3dd
- MD5 9f705b7eae34f664de1cd83f20f65aa1
- SHA1 9dd4e3fc98f2f5c0b7fcad210eb9537a5370e727
- SHA512 6a96336578fccd149349d97ab4573a55feb2b360e476a22f1512088f9cb50bb2c474e9fd950ae155caa823aaf3913263f1877b174d481793f2140f2bbe90c245
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQxT:A3k03kB56rU
- TLSH T14C156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 892KB
- SHA256 1398e28929d963a2cbca322e86e9dcfc2cd494befb20d3977ec49987191586c9
- MD5 c136a4564394337c01a4b009259c2481
- SHA1 16c8369aac1c373c45f439aca3933f3119d74385
- SHA512 f0af4bcaeb230c3c8bfa6a2b793706eda655e5089cd3de7da22d10e60b24e3ce61ad256c46f02f0ea7b07a3be8da503ca3773d8407c15f83f2f4ed582f9beb3b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQfu:A3k03kB56rD
- TLSH T142157B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 892KB
- SHA256 618bebcff123e5477f256dfba039b473f7f1483eb51ecf0c50ee480f4d1733ec
- MD5 fd96ed7b4074eaca6070eb9325dc728b
- SHA1 fce8df75ed95ef4d36be71dcfd5fd06d5934ed1e
- SHA512 031cbe2a906e87731897a8ad0cf9c9a20128bfcea38c9ab378dd0f464c771cfa0f202019ab5d3b0ad85a5950654334166602c51b3ab1a7ee6aa95c5acb0c82f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQDb:A3k03kB56rK
- TLSH T1FE156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 892KB
- SHA256 83e1ffcfb238bbf6a2be994775d42da8a382c6327992bf70f4ec0259c56fa46b
- MD5 50529788183c95d69f85605928e12baf
- SHA1 e2fee5ad77bcf049cf625e1182d32393bedbabce
- SHA512 df3117d3123c76eb0af0e810480e4ef3205b316cc8e1a28b6c14d7b67967fe4d4df953598d89e68acece947bdca88a8d91376ccc321811d527200a9b458dfd8a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQXf:A3k03kB56ra
- TLSH T12A156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 892KB
- SHA256 c5af0d4661d6358d48df81ad1fb9b26ed056db93cb47640e96a9fdedddce658f
- MD5 5569e7b845dedcf7b79fe8bfeccf4649
- SHA1 da91db4e3e89dd0f152b2c3b708b3974349902d0
- SHA512 a172124069ed7f6951807a4811ea1fee6c2eba1e4b93c1ef61a052d091b2e3b5562c504a9433fe3363d06f2e1b6c77ac3d5ac9bca982d349251eb55cb47f6b0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQgK:A3k03kB56ra
- TLSH T1A2156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 892KB
- SHA256 79bd0b80ed55adbc8e9e106a7cc52dfadd5b9fa90af33e3646a468d065441ee3
- MD5 3eaa89766d723044d86771c8ba1b3b44
- SHA1 d43ba27e10fc9fad4f83b40a1ad4e8488db68c7b
- SHA512 734a7825fe32e0afc1cfbb61e4363d4b1da057671d68c2b656dbfb42b79f86a6dac9be4cde31fe9f49c86cf79bfa43d3762ac623d4a6089dc8e62d07d1d4c522
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQdk:A3k03kB56r/
- TLSH T177156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 892KB
- SHA256 28f7912e6cd574c48f491446fb4b77bd34791289aac0e3cfac481639bc5bec1f
- MD5 58b625434b58d7e6eba50ecca374006f
- SHA1 784394933f97417f93f06640c2c1920081a24bb4
- SHA512 b33a7cb22482abb3662f766e1c5a284bbf1edcdc64866566ed19fa2d39c88157d9c2692e4e26b53d7541ba4570a873b9ef3c7a614893a43e49c372dd089bbf3d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQC0:A3k03kB56rO
- TLSH T12D156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 892KB
- SHA256 a3d61d2c7334bdcb3da1bfee2cc9e6bfc4977369ffee5127745af3f17dd5048c
- MD5 2b59e114a3a3098a8a1fae2c6e02eaac
- SHA1 5db2c2f24cee57943a00206b7fced457f6b48a52
- SHA512 2422e2b7414675ac9e784c9066f496026932edd577ebd91e31eecd700f306c8d74c679ee29d45520525b682f40c626129148aa9f2a637e7dbeed7ee21f4168ee
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQRg:A3k03kB56rX
- TLSH T183156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 892KB
- SHA256 23365eeffa0f77b8771ed46276d418a8388d9c7c4210f439fae1fc9f31573f51
- MD5 7c7f0766d111be9f58b13803632e7439
- SHA1 253344245457f1f2c68a32a7c3b41e8064a00d0d
- SHA512 77090347b01e0a43f64fdcc0de791c57b0fb942ea6b04513fd36a0a4037268d78bfe8cd0d7aecec6e113580813eb068aaa4a67b0e907899b37e8a62746ae8cfd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQ4r:A3k03kB56rx
- TLSH T1AB157B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 892KB
- SHA256 fecdb5426ac6826a2266c15e19313b27bd4c2e7feb85b2bf1ca7c1100f741e66
- MD5 e6bb38a8ae2aa3da4643cbaaa7e14696
- SHA1 cec318a7d44ef30cf5276d01b078c8270b370a1b
- SHA512 9a8d6a24970ebaa2d4ee8915ede12223cb881b34ed703f43e85b3e9562944aa1bb143b6af8a22b58bb942c8fe5e594b2069f7fa0c0f7467620b41d1ac021ba58
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQWn:A3k03kB56r7
- TLSH T167156B13E6840FA4D10F81749A968662EA777C065F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 892KB
- SHA256 f5f0b8731af6f69bfcb5d760d623669a0a1258b0370277720547a6ef7e23eb5e
- MD5 09cfa57c20d5a35abaeac3ba685a463d
- SHA1 e92a54fea225a0fcca0894cfee1397ff10ae36b2
- SHA512 f693fcb1760439a4945216f0d707b1b408ada692c61ab45a81177f8f94be74abe3322fc8008d0806c499066bfca68147e1e160ca8d20401df2fcae81a65d99cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQ8x:A3k03kB56rp
- TLSH T143157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 892KB
- SHA256 b4b625273bc907e2c28ae45f5ff8114960b139b4d1388479192ea91ee238d72a
- MD5 548308f8429e44c59681c92f1021d60b
- SHA1 16bcaa24144512ab93c67c01b93601ae6f59d116
- SHA512 2b4116ea595f56f899ec7857c0a099abd4152298d96de195ce93e7984c186d7ea0b5a0333adabe7a93d4c86f97643f12fe75ec8a8c5a4b0608f182db2088b999
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQ2A:A3k03kB56r2
- TLSH T146156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 892KB
- SHA256 4196cf76fc976a32bb45e67342c17fedee8354b0a7aa5fa44d4d2d701829b86d
- MD5 56c4953354d7199927fe762e3fa610e7
- SHA1 f00376d2cbbc5d7359a4d9066235586e004804fe
- SHA512 6113fc9741b6e8b67adbdcc1f3ae5392cfd7dc1d28bdc211bc6838c37e15fbbd34ae79148ec5b797e5a085775cf53ea2da24e4edd96436b5f9519ddec2d9c7c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQv9Q:A3k03kB56rr
- TLSH T156156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 892KB
- SHA256 7942cb77225ad9243eaa4feaf372ad0cef2f208beb5b86dff2e87185f45e69db
- MD5 c20f01fbccddb0e7b99e94bcfe41ac00
- SHA1 cb12c7526a8780e57d567a1bcb31106f09c61a02
- SHA512 70b1fde8a7b034262d5d9837132f92ee3ebc33a614c13e544b8da2c8e8cbcd985b2c5b50d450f324326aa54329f424ebe115600074cf80402299af33540ab0fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQG4:A3k03kB56r8
- TLSH T1FE156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 892KB
- SHA256 2c41867f85dc3f286be545b5ba2e0b95275e8ff2170d8bc744c29f7f56aba4cc
- MD5 b5023a8395d9248687911f845dd710ea
- SHA1 7c08c38e288290f485c7e3fbd6eceb3c0a6e16a8
- SHA512 663811cab6bbaf7aa5821b1d2711c43540320e140bdbcb1b8cb1aede8d85d379b9df4774acb816d0fe5686b896a9f87ded419443b339e64d1a00e7487f310d69
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQVu:A3k03kB56r9
- TLSH T111156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 892KB
- SHA256 b4b9f32af996ef3a4d17b1e5e42d607898f75dd0fb7353704557a66a69593f87
- MD5 e9a7b8f2911ee8bbe5f624d931e6824c
- SHA1 ac23af1427e78b096cbbd28b2b97912318b89df2
- SHA512 29e2ff633f90b1c9d847c58342a4f1e758c826c51d431007864712836ddf6aa16b1c3c5262e8729fac44bc875967bf8e034908b47cf24bbb8a79b62a18b49134
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQIj:A3k03kB56r/
- TLSH T1C7157B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 892KB
- SHA256 fb63fb000a59bd7df285fd75620db4f967d3f98ffa7bb3d53931468f0c9f6089
- MD5 04de58262ffdcf8d68031164ea38c17d
- SHA1 0c4fd9c4a989e2a81966375d0a9cf6273d25cb77
- SHA512 2daa6b2e6f5cd054022a373171c59b9e2c86b5f670a0a5557ad89a6de2c78e71ee0187fd13d245360c1e6ad6476947cc31f41cf5959416757f5d4d591fcdd74e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQ5g:A3k03kB56r3
- TLSH T1FC157B13E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 892KB
- SHA256 b8d77215d10a453458d575159b267b759afe90401a551e61f38a2a8f25a558da
- MD5 cee2b32390713c307da8bfb8b07aa0b0
- SHA1 3e0bbf0f86509832a5cbb4fcb98d5a3eb18e4f33
- SHA512 c9cdf4a0fc844e72b7327a8da589aae0d9964d36b29b0c202e1a412b4a1d2a7000d1a47de516c4ab5a669fe225786ca48b5e3c47315a72451fa3851a22b8ab5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQgI:A3k03kB56r2
- TLSH T189156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 892KB
- SHA256 f9c384991dc0db73a732f0b9c475d89c9241a39eb6ca49ed041ab8d07e2ed900
- MD5 7afb89c33abb6d9724bf0ab3dd1eb0fc
- SHA1 c31435413b038fa9d883b80354a246affb15df8d
- SHA512 e377ca57f3e3bd561b86abd1a9c5e557be4be39b75d9a728d2778bee9b4bfa1d45f4085c28b16a90ade8ff3aafb7965d7e6476249a177c8a97d6c7c1e9f637f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQio:A3k03kB56rE
- TLSH T1C3156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 892KB
- SHA256 bd179e64ff6337689bbf5f80be8129eca804624d875a7713e9e4c3e9e04e3989
- MD5 4677c6315187084f45f7e9acb14c66c2
- SHA1 f4f73a51d8866b4eb4c5570fdffca74d53c9846b
- SHA512 63dc889a00e9c3ed52e782d56293a4aa0ca2c4c9019bd4059cbc337e2a90807243af9fedbaccc7ac154d8384e4d111ebf673c758096c4bf18914940a1484a31a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQZ+:A3k03kB56rZ
- TLSH T184156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 892KB
- SHA256 ad26ffc568d9185fffa14f4a6cb8f4c31e1b3701cf992564b2af7c7d371dea3d
- MD5 df69deabda85ae638ebdc60fdfac1d00
- SHA1 6099f3f5da977f96a607cfd8b73ca406211e230a
- SHA512 ba7c0d7db7a7942ca2938d8fd7cadd7ad21c89b9d13d030cb22a8592835189d2129e0178399a62ebdf2dda4ade585f2765c67091b9b4522e1bfccbdfd8b53016
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQHQ:A3k03kB56rp
- TLSH T18E156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 892KB
- SHA256 ef368ad010f00dd272d40037a00200d7196bec269b557a2b364427992ad6c406
- MD5 5ce9af057ef6cd259a2113c1ecf0bccb
- SHA1 45faa876aebc0eadf67c8a56333e9f8e1e73275f
- SHA512 963aa150107d18554a91fb7ed5948306b2f63b3ebf5d992895604294559a07c1d7287df055098b959f4e75409835a6c4976994bcc42d4291e647d5498b5520ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQcX:A3k03kB56r1
- TLSH T172156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 892KB
- SHA256 ae47e152c105768d47ed1c8b7ab3fa90d3bcf4a7e54293228ad8300afd76ab5c
- MD5 3104efce9e83fbb982d135e2337537cd
- SHA1 035f70329dcfbee05b47c4c128b3eb7765211391
- SHA512 3fcb8061e84f2661cc1cc54332ddb0e2506ccbb4dc6bc6863dac8984c27b381d58a15b9548300b81fa640f6f5f6666fa8e5293927061dfd9d55e2db051476c96
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQaL:A3k03kB56rn
- TLSH T1D4157B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 892KB
- SHA256 7ac33fdcc42210db8302f3d8fd265ad4c749250f38e12a2e5077dc8f32fa0f69
- MD5 34571a244d35fb6751009fe5754864e1
- SHA1 32259120cae1aa9d2213c59a3f7bd80d8a3913b6
- SHA512 dd0a168bfa2e0915b84922c669a90e59368d55bd45fb564e505286a28b9976bd12dbfc3afa57b4cd1a2d2ee764aeeed4257f1a518878df373f4c7a58b5c65264
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQ+M:A3k03kB56ri
- TLSH T111156B17E6840FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 892KB
- SHA256 5089f57c2f2a24c644bdfddefc26d9e1941c72483f12af34e28aeb5568bfd095
- MD5 1608495f54b9f11408087ca63ad38262
- SHA1 cb09e7aae53d35870747659ad48ff16a38cb7fc0
- SHA512 f2bf00eb618f7886ec0abd8d2fc7c289da9e97f4558e9355e3c18055835cd09cd68d509addf1b9bb6d37f1ecd66ba50688d63c4ade59134b3863076c61a06a1a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrmdoi+RasTQnh:A3k03kB56rc
- TLSH T13D156B13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH