Analysis
- max time kernel
94s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 17:46
Behavioral task
behavioral1
Sample
2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 933KB
- Sample260820-wce47seh46
- SHA256 140fb6ff5fc0a9abfe9271d1c59ec3d0d128125ba7e7a9f3e6fbacfc74d12383
- MD5 67e71221e18be8104f9ca33d3ff98c6b
- SHA1 b3a7c2a66426d00d86e879d389119cece64394ce
- SHA512 ff6d6a9565e41bccd709ae910d4a4deb6a8211ab3a82ee0c117d59b6e6aa4c60489ec14f9dd04f350abbeefbd85c7075d48460f3bfb8473821cfc296b34ffb2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVf:A3k03kHRJa
- TLSH T15C15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 43 IoCs
resource yara_rule behavioral2/memory/5936-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c4e4-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b32b-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b330-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5936-94-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3248-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019871-234.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-440.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a85-580.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-704.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-735.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-784.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-821.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019911-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019912-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019913-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019914-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-980.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1041.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019918-1127.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019919-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991a-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991b-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991d-1216.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991e-1326.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001991f-1345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019920-1370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019921-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019922-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019923-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019924-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019925-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019926-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019927-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992c-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992d-1399.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001992e-1400.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c4e4-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b32b-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b330-39.dat aspack_v212_v242 behavioral2/files/0x0004000000019871-234.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-259.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-440.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-495.dat aspack_v212_v242 behavioral2/files/0x0013000000018a85-580.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-617.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-704.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-735.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-784.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-821.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-852.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-877.dat aspack_v212_v242 behavioral2/files/0x0003000000019911-890.dat aspack_v212_v242 behavioral2/files/0x0003000000019912-903.dat aspack_v212_v242 behavioral2/files/0x0003000000019913-922.dat aspack_v212_v242 behavioral2/files/0x0003000000019914-948.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-980.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1041.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1060.dat aspack_v212_v242 behavioral2/files/0x0003000000019918-1127.dat aspack_v212_v242 behavioral2/files/0x0003000000019919-1146.dat aspack_v212_v242 behavioral2/files/0x000300000001991a-1171.dat aspack_v212_v242 behavioral2/files/0x000300000001991b-1178.dat aspack_v212_v242 behavioral2/files/0x000300000001991d-1216.dat aspack_v212_v242 behavioral2/files/0x000300000001991e-1326.dat aspack_v212_v242 behavioral2/files/0x000300000001991f-1345.dat aspack_v212_v242 behavioral2/files/0x0003000000019920-1370.dat aspack_v212_v242 behavioral2/files/0x0003000000019921-1377.dat aspack_v212_v242 behavioral2/files/0x0003000000019922-1390.dat aspack_v212_v242 behavioral2/files/0x0003000000019923-1391.dat aspack_v212_v242 behavioral2/files/0x0003000000019924-1392.dat aspack_v212_v242 behavioral2/files/0x0003000000019925-1393.dat aspack_v212_v242 behavioral2/files/0x0003000000019926-1394.dat aspack_v212_v242 behavioral2/files/0x0003000000019927-1396.dat aspack_v212_v242 behavioral2/files/0x000300000001992c-1398.dat aspack_v212_v242 behavioral2/files/0x000300000001992d-1399.dat aspack_v212_v242 behavioral2/files/0x000300000001992e-1400.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3248 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe$ 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javap.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe - Drops file in Windows directory 42 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5936 2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3248 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_67e71221e18be8104f9ca33d3ff98c6b_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5936
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3248
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 140fb6ff5fc0a9abfe9271d1c59ec3d0d128125ba7e7a9f3e6fbacfc74d12383
- MD5 67e71221e18be8104f9ca33d3ff98c6b
- SHA1 b3a7c2a66426d00d86e879d389119cece64394ce
- SHA512 ff6d6a9565e41bccd709ae910d4a4deb6a8211ab3a82ee0c117d59b6e6aa4c60489ec14f9dd04f350abbeefbd85c7075d48460f3bfb8473821cfc296b34ffb2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVf:A3k03kHRJa
- TLSH T15C15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 a52bfd3d26b1099e3731f53d983820a9bd063353924b02d819c64e02f7998a7f
- MD5 f8cfa495b9ce85cc62bf37ad4e642023
- SHA1 4263620fd1077982dd15b9fa01c5d80b11fcc649
- SHA512 f6bb3445b65dec4d64b8d5babdcfed66791cc02040a6d4c28cc4e0838e14b8d1bf2dad2156d299f50b4fbf5bb015b31ad6ff11ebf2080bc70b88a3a2b9f33d08
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVL0Le5ji0hmxNrM:A3k03kHRJqPji0Aj
- TLSH T136658C17F6A402B5D027C0B9C6D6966AEE7138861B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 948KB
- SHA256 4ff0bc474f84bdee41fe8ddd21b58996fa1cc748bd55e69340fe3358933c4430
- MD5 0ce1a9cabaf7ebf423f7be69f8c35e1d
- SHA1 dfd9e24af095b0b5dc57a0f13a24bf94244284af
- SHA512 b5d0df291aea8b29c0e147cf54c5ed17aaeb2a118a4f127497c2b15a4572387a0450e64277b3c999076c7f071e9e544722c968cee9ae19d434c2c2147e5750db
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVNa:A3k03kHRJ
- TLSH T1A725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 cde215d4b2e896737617b589723b9a65cd797bdd46b698c8c0fd1e48ca76664d
- MD5 e3430b534a07efd50df2023a601b7547
- SHA1 204bc409a2556505fa592c39a6f969d25f03c94d
- SHA512 204164bcb2ea5050153b80051953dc10df51847892c9fa49a97d403b03a3c75aa6c61ef720c2c199f94e9fa68310f4058800ceafad05379a595cf7e37e7293e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVE6:A3k03kHRJ0
- TLSH T1B925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 957KB
- SHA256 f025a0b9af0b25487bd0844f8928e88b70c134c9bf0841a3c064455f7b17a73f
- MD5 184073d0761e9fe7954e90c8f918b694
- SHA1 0f38fbc57b2fd6f7db507f56d39fd6f27c799132
- SHA512 331b4f57c51baafd2bd15206e6f1eadbab181326a3f9332efa1d36d5d1e9a69c27a02f88fa9cd01c9a47e0ff2129bd602d8ed09cbbd29240041163f4e3abbdbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVgN:A3k03kHRJJ
- TLSH T1F225AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 957KB
- SHA256 d04d10ea2f4e768963168a3de878258ae052a8d79cb9071b9ce4d0e7cbe284a3
- MD5 7d932b889c94c9f76c0e05e684514657
- SHA1 1a08bf5a24dbebea614e944de11faec1a2df3fe4
- SHA512 bf4c4901164cee809b333273087ce92b5cf56c80391743c3c0dab7097a6b17c97b439693200947b369b98e7be22847fcc07b99b2344d35bbc4ece649de1f6f23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVOf:A3k03kHRJJ
- TLSH T1B425AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 957KB
- SHA256 19a6a51933fa961d2f649bcc30eb2e239def894039028f5afc10ae5bca9bd952
- MD5 b301eac79fb26d181485551857a548e9
- SHA1 e40bb5e4f32d7fa7bc7b2ca1e8054f7f561ade3a
- SHA512 875b63cbb7b5d6fbcaceeb12c7a7b5dbbb0d7ceec614afda26964f779dca51954a5ed70248a3737f06f77cd5b15b578e83c7957cb561878c20d3bf46efaa2a6e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpV4o:A3k03kHRJ8
- TLSH T15C25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 957KB
- SHA256 ca2dac7b0c4cf3b677d05a40bd9a9ea433d3efff3506fa8dd53ea26e163f9544
- MD5 42b02356b4f18b732d63b5c0543dfbe0
- SHA1 16efea7b6eb76301266aaf23b9e933653d21aa23
- SHA512 22ac39ab7ad6948ba914d599ee9aa1bdbe734cd5949e6fdd9f6adefa6f856c8720ae739421d924f64832247769b1288fdab780ccc0b6552354016a3f6b095349
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVIu:A3k03kHRJ+
- TLSH T1B925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 c039a71abcede0bb59c943205908be790e97316daffdad7f6c8ba320c93adcc6
- MD5 2a216a36e0c291627cfc45a7888c4f54
- SHA1 7b5d3bb5f74d0a0cda4e1ff3eaab814801c82ecb
- SHA512 fed3999a542925b27b60e773a6b6fd124c1bc149b68e4e1356d45b3f7c1fbfe1a6276f5e492ea85531038b9e7ec74c2d5006af483ab0267db7b732380a8c5e1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVc9:A3k03kHRJ/
- TLSH T1C925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 0af8d1807e61957c98e383b256a15bdc45fc6515c5761cb3f61c1f9dfe4eb6a0
- MD5 e909477d3bd204943e896062d7119fcd
- SHA1 7069dfb015efabfc3885d848a6df25ba31c1573a
- SHA512 a994c75dddcd0a4d3ed8e3486c8474cb45634a31206400d9a5e56451107aefe5d98674e10a4ea8a7da4ab6887957908f43cb3101c3ca9ab692d0ca0f833e8834
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVEc:A3k03kHRJ+
- TLSH T15A25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 1002e14fdb1d46aa7dbf93134dce5e342cbbaec81520c00530ef91123cb01381
- MD5 421a15b151b2fdf96a00644d1a4ad487
- SHA1 2b7ed40f7706005542af779f898449bfaee772f2
- SHA512 e6b20b725b721950a3ebf47f92b96e4aad4edb2651d113c725284f35472f5381cc8d21bfed71254142b4ce5ab379703a2d4097239e19c1c851fe8e8fc3883de9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVdp:A3k03kHRJM
- TLSH T19425AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 2901e944f05ae38bb01a597b380a11e4b61d932d04afebd56d2f8b63408ee2e3
- MD5 6d0da691fde5692bfbda7fce8a33b761
- SHA1 f4f1dc2884822d802c07d0bf97b62cc723374a5b
- SHA512 8c1ec1c5617677ff5a7cd3d7163564322a012a2203ebc243d500e8118026adf40c070cc274b8aadd237176c48de8095b7d08c2c81a6149546a280b615c15653c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpViN:A3k03kHRJL
- TLSH T1DC25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 52af420fcab24fd8fc35096ae395d1dbeefb6661cddc68ae05bccb81db9068d9
- MD5 dd281f07e04dd4bc92bc06f8215676d2
- SHA1 840c7ea596d0bf3682f88b3a99f7066121505fe3
- SHA512 2d58f20226fcf516ac9888b2ade15a97c52fec09698dfbadecf33643a10da25a6a00e76261ae3e50bb9a9e25c0109f379565624df5394fd47d14b5a3f1679896
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVGF:A3k03kHRJ9
- TLSH T17325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 2b4ee07c89f6d7884e9c91a6ef02da37c338abfeab578d665a300dc6e42a1989
- MD5 343ce50c5a56646e7230d80ebb3085c8
- SHA1 b346b54d1ad991c3fd67ee2bd557accd021dc9f6
- SHA512 22fa7040e842b20ef192b3042133367c2b8b4e3f6f263ceb6c9571aedae20ed4e5307c5871ff0e23e1652d449148dd4ad8cb935a502ea504479ddf95c7ba3f4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVTC:A3k03kHRJh
- TLSH T1A825AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 2443ef477bb75bf0640c260a964c0c363b4f472c7901606dbb7922ce955149e7
- MD5 986ae1f17f67a67db6f5290409d65c19
- SHA1 43d10e8c1dbdeda409e7f7773b4c30742e1cd5c0
- SHA512 68f5c39c6bca617eb2de7a35c977999d239b3c5c16b8f5fd20b2de1670e6ddc768da5defba415a4794ba594227527ab68c24fefd5bacaa5600e47d37db87215e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVcw:A3k03kHRJs
- TLSH T10925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 30debed5f6a989251f6a600e5c6e01ba5a8000b68770610457b67ea93082713c
- MD5 10264eeb0a3cf6479f4620848180adaa
- SHA1 7e9e3a0a74a0bec22ddc0a8758b0d72343954464
- SHA512 645da32babd2d7d57c5179c2b8841b44cd738f17a665924c68e5cb69c9eef9f2223cceff71a415e8fba79ab993828808366b5f430f4a6c6c0753e2007b70a05d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVTT:A3k03kHRJU
- TLSH T1CF25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 638c1b39a3dad78a4b062f5b89fe647ac8a15210090e2c8e8a57bf3fa2d5e831
- MD5 c0ab98df6e403688bc3cd753fcb376c8
- SHA1 4d3a978a32591cbbd2d78b76afb58bcdf6d343cd
- SHA512 5d2fda9a07c4ded1f4b7c4500b4e8875fdb7bf6f025616506f554c24af556b0400cb5fff493d3f187626b30602b87cb356b6a3cfe4d35901c0e16f8892a49553
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVlu:A3k03kHRJD
- TLSH T1BB25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 62bd449b7b34b81f62a1f9e7b9ba71e1747436b06757a482bcccaaa0b2c5c511
- MD5 00e90d051c92246466e8abc1299ca864
- SHA1 051cb5ca761cd6bf174adec386d66684864bbefa
- SHA512 d0dcdde49477ee4cbb19475460f3bec5b68551b7df623db87f01870e0b8e17175b38fe0d1f9e275f4f0011702f9c16fc81ab44b4d8cc85c1bd9594e92831a489
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVtb:A3k03kHRJK
- TLSH T10B25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 03e66295824ddc836d9432ece9de825c765655a67faceacda5475a6b7a34b150
- MD5 fba9684a477649db5ba853d4824a966f
- SHA1 3593542120c6b5cd0b375ba71121da74ff2910f9
- SHA512 32d86eceb9e172bb012c8dcfb44709ef6790f9c1a7ede1c145119479ad898654ef53e1e924994b2af5b5a3c4bbab722c555c119551704e0b58fffe00f65b34eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVdf:A3k03kHRJa
- TLSH T12B25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 8b69806cbfb5bad7e59455ba516db951cb183dd24c7a8ba124c043082b96de4b
- MD5 ef1b39f02279b3861105a7d0ef55af81
- SHA1 d11709eebbb0324860ee8427bf21ce114b9e88b4
- SHA512 9bdc31c2ec0c1ef7cf0162fa1f22dd44d58a78ef3c4a6277838f34cfa320f4e27bf4f853c66ab0efa4213a63493426a10cdd3b7322750cbd075809760d7029ff
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVGK:A3k03kHRJa
- TLSH T17925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 369df7994c032d1d791a5a07376acb385d4ac73d2cf90b112cd268793a26fd39
- MD5 6c1817c3d4fa2b1feafccb34a48edee2
- SHA1 798482dd14ba8c9276b0c68e97fb6c0a9f4bfa91
- SHA512 c98270775232181ba20ca192eadd9f8b6c7bdf5271d6774a08b7211ebdf5540b170adaa69bbe9368e0d997a41d7875a25a92f3c255e14d73715275dda97f31f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVzk:A3k03kHRJ/
- TLSH T1BF25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 a316616d33e2a9c07daf1cb88262489825330ee4b3760f6c61c4b3bf2f13b80c
- MD5 9b8b2ceb8fa401b10e994d83b0eefde2
- SHA1 b8a8592920b671912a4bf3bbc92f415a1bc165e6
- SHA512 52042348396462839a161b3ce62b733af23974cf9027d6ed3712571d1358649e253f135ffa7df75a397d12a12d4fd3baafdead78732c17e73ce5e05cfcf0ec4a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVE0:A3k03kHRJO
- TLSH T1DE25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 751910cf025f7953c7fe113c66d7958ef83e409afef4b68e02a920a92204a11f
- MD5 6f7c9277d19ad32240fa4705a2691b11
- SHA1 85367951aebe0a76a06517a91996cf09e89ff7aa
- SHA512 7e83123bce6ac6dca5458acd049ca28ca0188770f29aa61a5bb00aa33fd6ef2def6758f23f2ede462a77ce93f98ad150c29f67e5d2669e6bee49b1ca7887c9f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpV/g:A3k03kHRJX
- TLSH T14625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 e63eee15ef5bc7d7b03fc35bc5258872d9c1a428e9881110d646335a8d7d0072
- MD5 306af6dc567f0951439884b68bf4ce1d
- SHA1 e4335fd093171b8019dea89b21c407f43bc3636d
- SHA512 5c00de04b187a0511f58d6120d09013ac3f34d03d5fbdab7d0ed5e9f22b92730993de7ad263affd59aedebfc81034099d65b487344d54b129f378580ed2e1230
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVSr:A3k03kHRJx
- TLSH T1AD25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 c3c1bac383463d8ec6ac5481a4383722026f6e09561b1a816f2e3af75d0917d8
- MD5 3e54136b3b360487ad39d1001da06aed
- SHA1 896cdef364b31b4b43532030b5047490bba12d8d
- SHA512 93e3fd44f14af8dcc20bf55e2e21080a15fccecaae07dfdd19a590dde51d71932e0e47f1fdf18b04eb76ce2de970ada8fd90ee7307b4d79a5f967bb0066b77dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVwn:A3k03kHRJ7
- TLSH T19525AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 76a77379c727371f6f51797826da3a2ba959a7f2bf59b14c5caa5080144e5338
- MD5 3c1552705f2adadb9094c2306baa6d4a
- SHA1 da2b53ce27e16259ff37fbd647efee7c56a26111
- SHA512 0dca8565c8123305f0c75a59fe60770faa981fde375dc9af21b22def907d8a791ce1885dc3849be3c47db932a8c30d39654a0f08c34ac8f230d877a95d48b436
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVOx:A3k03kHRJp
- TLSH T17B25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 cb67a12f05aa43c25655a635c518826386490481bcc5dc3d82fac0e2a13848a4
- MD5 220bc35b0a775a146c840052f0278164
- SHA1 6fa1b520f8d5c237f8a1b12713e114b1f21dadec
- SHA512 bdca9defb315d54ceba6fea70f4d4db9ce7bb7366689273cbc7904c26143661a5fcfbe418775e2ea8db3bbaabddf9296ec2ccb195c18766af6bf7384792afc07
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVoA:A3k03kHRJ2
- TLSH T12525AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 9eb2a296293a38168e7847f73bbff99410ccfbb42a922efb60e3eb0ea7969cb1
- MD5 77a480dd7eb234016e4376879c89bf34
- SHA1 e2d8e15bc48ac4d247f765c905e52e6acf1937d2
- SHA512 34c98c5073617c2279fa89dd0040a82adca7e048318984f464ee8b80840ab642cf450e876f87f714fd86ae7f09bd06f30299174495ef374f013075518f069920
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVB9Q:A3k03kHRJr
- TLSH T1F225AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 1dacc9c7e595224466b2b8006abdc40c38f7738c97674a0fce10ab4d3238e3f3
- MD5 e7048e3f24e2a689f43a4b19ddd8572e
- SHA1 b77d971729da5fa3c3c64f173ca979227c5afe73
- SHA512 7be26779b30c99d647f3059595cf27126cbf65a6d7c5c1afdbfa6122c006de4aacdfba09f446a12157ce939c596a80491d230b1c71aeab0b92bdfd69a91ba307
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpV04:A3k03kHRJ8
- TLSH T1EE25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 fcccc7c64e65a390d8bd13614a52df76fe88e2b9991a5fc0cee038913369d4ea
- MD5 06a69bfa957f3b043fa8cd1678d97a9a
- SHA1 c20047b0b1266122cac57f71ac2cac7a5298044e
- SHA512 ec0d8353c7ca9c7d28875a9336e217565f8d65b447f4a8bbbf92859b1962c3ea7793f5a49e660314a49c2cef6cf4736aaaace4e9e7f8f28d1a6598a41024f286
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVfu:A3k03kHRJ9
- TLSH T14125AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 b6816b5b5380a477bf4cab9109630e63f45b73e06edfc0b5db114be3e83f0b5a
- MD5 16b4edd9aad670b7089fdc9df0200988
- SHA1 98f6fb05c4ceb0768b67137e4afedf7738331b3c
- SHA512 e011a790aefdc4bc329efb589376f64f2e3d249fda69a754eeab8958decfb49b60cbe4b135908ace63ff46ec790b3471b46686ddedabf728e18b6e7d2c84abd9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpV6j:A3k03kHRJ/
- TLSH T18B25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 1f147448201c8887fddc2cd6466dcafe5bf537a70799f03c63e854269b4718f9
- MD5 24eeaf9c6c738bc658b35ff19110050e
- SHA1 689f9d72a4f5d136b837d785b760243f85c43ad9
- SHA512 04ae5ccecc3b1f2732603c4a0e0a958cb63ca7bc384014c14baa34f9bc6919bfc9c0c8b0f66a7ac2a1a9b7ab8879e2782b56b40e6c868f3a045540ba11526683
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVng:A3k03kHRJ3
- TLSH T17925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 46f5a4a6032a09289f2062c0187d33cd5cdf7d1afbc830bf0653180ed7c007e6
- MD5 07a48acf55d67df7eb333f64afcaafb6
- SHA1 07dfb6d45a3c3ae6b56e3b89ba2eab77d9b69c11
- SHA512 c70b0fd2b1d0a1f2d41d847eb4ddf74f6bb55c32862c4507ed8ec33bfe27b922d67ecb1bcfce9ea1ff600b5f8fd93abc0d3950089a7458d20ae0f32bc9b5e3dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpV6I:A3k03kHRJ2
- TLSH T1DD25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 8018870743bbedb4a900927201e69463b864ea93086bd14a4d04ec3499110588
- MD5 49ee7d32fb5f9813e76fe80db626e8d1
- SHA1 afcfa075dbe568518cda4bc2c93d2d633eefa835
- SHA512 06e9d65dd71aabb3aee349da9bf5d2029d2aa943fdc912ce865b0b3e756218abf20027655ff6c6d77900ac30691917b8ad1775b91d19fd2903fab58b56f7487f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpV4o:A3k03kHRJE
- TLSH T18425AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 32f4bba1e9b71b8ac1307aea294cf6b2108edab112600d39fe6b8ef54907f76a
- MD5 0342058284c8595eea68ef68a37ab99d
- SHA1 7f5d9ac94decd5bba5f609f8ad867b6b7d8fc2dc
- SHA512 c767fbcbcc87d1659342ce010ca5a45fa7f370e0a1849f30d683a7d9ec6614161271397a95071eafa4d571eb61cbca0293b669e02b4dd9f746db180a395c16df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVL+:A3k03kHRJZ
- TLSH T10625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 36f2180d149a316ec9bc91d380014dd0841509aba5e1805d4e569e77fc29ff32
- MD5 6ee7ec98977adf07694c27c3c8d388bb
- SHA1 7b083ab389de8db385283e518f598b8f6e9dceeb
- SHA512 65bac34d25ee06ba9b2e470bd6827ff68649a9bbe14e71001affa0aa56b854ec67fded6a96d86c11e6617d1915db5021263be7c30c3a20d744b142299568e1e7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVBQ:A3k03kHRJp
- TLSH T1B625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 d6741c4435c668ec34e952a26796d1171bce51577b5e7f775a933dccf871d6dd
- MD5 45885065d0bf42645b4899c2d70f3a4b
- SHA1 3fee4acea2e6d6852feda0ea4694cc1e483d2687
- SHA512 5f9f7acbc00fcf7d624101d96eda6818830562d959e45fa161cef07940d4fd56a1b69e5a1c9d52ee10200abb77ee6ce26aba59175657b07e5ed3580ea55b2610
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVGX:A3k03kHRJ1
- TLSH T1AB25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 3bdace7ad68d73e79388ad095b2c649968b98a38f937fe169b7553d4344d8f62
- MD5 dc0b0373ff247c8d1abc3e70d4fe557c
- SHA1 2cbdfb20a3a5fa412b5de48f834d5038421b9c60
- SHA512 f7298e15a4b7d498bc0c0a39102e5b833d4dd7dd398fa6c8f9245f333fc5d7191795e92561d745176f9f4f5cf708fde9be211adbb44bcb9fb4e0731a96bf9cec
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVAL:A3k03kHRJn
- TLSH T1FC25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 ec3c5330cf8405161fd522c0e2f38580d3abf296b34fee7b6c402daec604cc0b
- MD5 268f761aceaa6be5f2a34a9c44d27313
- SHA1 6ff32fffa00906931c239fd9e9f2b1e6ede5384c
- SHA512 de7566739a0614a3f1289f374795f760f3a9da61e8453ec53ae12845a82ac37118b13d1003f972c8efd5e65575a4e2e9dce74450bffad03ed4b6452795c1a138
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpVsM:A3k03kHRJi
- TLSH T12625AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 6cd3d06de34a95a2e1d0cdda2b862b59c37770a4b1c4ca2cfa37b2b20248fd41
- MD5 0efa56ed457c1eccc78cc053c45d6e26
- SHA1 9f7f62707a670d02be402d8cc4061a051558cf12
- SHA512 404f4281bba39a915e8391242004005b0ca0962b81f43fa667f1d4f952c9e17279cbac87a28395025a696937351c0d7972e6b6e7666dae886a461d6511c5aec3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JL5jcpV1h:A3k03kHRJc
- TLSH T16F25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2318C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH