Analysis
- max time kernel
97s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 21:36
Behavioral task
behavioral1
Sample
2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 933KB
- Sample260822-1f6tjsck71
- SHA256 c0695091f2b00e5d3e4c2a3a80599bd49ca4695146cd22f76983d8c4525e4575
- MD5 f06b823e11039c17f3e28dccf38af6a8
- SHA1 bb97ce5c31dcdefced0edd434978044f7fb08490
- SHA512 3eb49e3a88847579eb50eeb31c6d3136dac9eb03b6d19eb1b8c0f9619a232c56c5f6943a4c3800be14a0f1a71090ca4450cf25cd818d1ccd03a1abf36cad71c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdw1:A3k03kHRJJ
- TLSH T1EA15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 41 IoCs
resource yara_rule behavioral2/memory/5256-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c624-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-57.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5256-166-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1480-167-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-240.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-259.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-446.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-586.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-617.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-684.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-733.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-783.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-821.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-947.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-978.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1040.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1121.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1215.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1324.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1337.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1369.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1377.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1390.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1396.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c624-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-57.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-240.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-259.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-446.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-495.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-586.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-617.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-684.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-733.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-783.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-821.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-947.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-978.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1040.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1060.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1121.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1146.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1171.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1178.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1215.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1324.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1337.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1369.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1377.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1390.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1391.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1392.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1393.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1394.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1395.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1396.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1480 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\java-rmi.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe patcher.exe File opened for modification C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe patcher.exe - Drops file in Windows directory 59 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5256 2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1480 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-22_f06b823e11039c17f3e28dccf38af6a8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5256
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1480
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 c0695091f2b00e5d3e4c2a3a80599bd49ca4695146cd22f76983d8c4525e4575
- MD5 f06b823e11039c17f3e28dccf38af6a8
- SHA1 bb97ce5c31dcdefced0edd434978044f7fb08490
- SHA512 3eb49e3a88847579eb50eeb31c6d3136dac9eb03b6d19eb1b8c0f9619a232c56c5f6943a4c3800be14a0f1a71090ca4450cf25cd818d1ccd03a1abf36cad71c6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdw1:A3k03kHRJJ
- TLSH T1EA15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 f2ee4a6448af57219c9fbd0b33632c79f8ae04581fddfa5d9da08e17c99785a2
- MD5 5e7b1e3297f203d26db80adfaac86d6a
- SHA1 d3f0823b241dded8627e5b4ac272a78d1bed26a3
- SHA512 b0d5821872f418538ec4d75363c74b459c8a69769ba51fdebc6ae92a0d0cb0a4bc06359c8e6b28372852bbed0b04c94e4d8d980dfe9dcd0d39319058bc075c97
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwx0Le5ji0hmxNrM:A3k03kHRJ1Pji0Aj
- TLSH T180657C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 948KB
- SHA256 0cbbbc598540cf1f81c11971a3996aa6f59cb2d3789df8c5deb3d88fadf1fd1e
- MD5 daf3e0eeaf228845a898dc7e5a7d3ab2
- SHA1 3710ebd9df3061c6526dcc640e3aa1bf3522fa6b
- SHA512 2f98557a4a47698c70f37c60b2a0dfbbfef4c33e28c646a8412389cbdf3011a11646ed48ab5eaa3fe69500064312c950e49de390370037244afd2ffc3a672cc2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwTa:A3k03kHRJ
- TLSH T14E25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 f264740c0d156d75ecb3281dfcfb4b12690a90e5dfddf031cbf9f9eb1f34b6a9
- MD5 e8492359a613b382468f77f2113a6834
- SHA1 17a781a36e7da01372bfe6044e72491f6cbd9fc0
- SHA512 c87cb64a8354ca25a5e8b5d62b797c7eabb7d1052adc7de5e27ba0c51bdee96d65ac726665999f83f44d4929d61b9554ee006d95b9f4b657797f3f459a8836a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwS6:A3k03kHRJx
- TLSH T17525AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 957KB
- SHA256 c98db257c471ae448c7f337dd8ec7471bbe0dcdce30d9888ca09821aaea82606
- MD5 fcb25c0cecaa1a54cd1fb5071b93150c
- SHA1 ef2deaf818b1399290d1f5a74849dc6f515b58c3
- SHA512 5bb766668816a8a3c8f849d4ace632c06fefe6ce369f57dcf0072820fcd482817f65d5a48bc1cda5209163088d3ea542c9ad3bcd7cea9ddae3f8093c082468a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwKo:A3k03kHRJt
- TLSH T14425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 957KB
- SHA256 a9395a25afe2df02b9c4037eeb360c27ce4c963c7c94b4e824b29682e59cc51e
- MD5 d453a99e19b7d6e8374bf03a220b5672
- SHA1 b66b2da675d10e9fba8da9fea259104c6b15b5c0
- SHA512 0818c94b486f05d29cce01110aa530e2d709960c14eef3ff84aa812d50b8bb1db7aa69982c19a5c6be39aa8c6bb6ed591278b4009d4c3a26a83da2ddb23329e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdweu:A3k03kHRJf
- TLSH T1A425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 2517bd59785d4c344e99e09e4111c99653012ae47dcf4a5ae8383f3545d11ce7
- MD5 1a0fc81fd648781467396a51aeeea73c
- SHA1 ea8a4f6ddb617ff842e71c2bcc8caf22f311e454
- SHA512 e64957e7145c0c8e2775e084da96fba3bbc4d055f93036e079b13fe41c5f2f1aabbc6aaaadcf780ba12e9b79218d2c893df83e21fd902c5798784cac76a92bc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwS9:A3k03kHRJe
- TLSH T1CD25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 d92624c2ef4f92903db9a9400b0dc1864c8e5e0739878cf4d2fb6cb128c6a03a
- MD5 cf9d363fefe877f1dcf27fff5e500563
- SHA1 f3243db0943064b5a1b83810b633a37ab51005b2
- SHA512 08a09663a8cf214d4e728419fbeb20da20d9a52fa1f4e3bda86c4e90b08dd1242ff89dde0114d364f07cb8e59ccd8d64f895bf8f93b00ecef7f4496e603a29a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwSc:A3k03kHRJz
- TLSH T13525AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 927124708b32181d31a92770972eebc67f4f00360338ca494ec1cd009c9a6069
- MD5 ccb1df0ccb5ebd615ec5790ce543a621
- SHA1 7beb42e6e948314bc584ceaa36591cbf673e0034
- SHA512 a1d21e55d64b278e51384105f0dcb737023e9e4dc8ae6468d60c2ab4f76f3f1f1fd23840d75a41ac7f95544fdf7c5f90b7bc3ec5416d8bb5ac8080d246ab536f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwbp:A3k03kHRJR
- TLSH T17A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 f4d0d9ae48bd45a0116ef454df05bd37fd0b5c29ad363f6a238312a15ef72591
- MD5 e94444fcbb3ce64a8f203a6334d875c0
- SHA1 1767c6db5b2cd299f29b941c2cd8af3b2784922e
- SHA512 01d7bd82942e6ffe27498568480d4290e0b51137b54840344eeb9db799440dae280d9b5becfe169da109beb4479561b6de93023ded3529febeafc687a9203674
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwsN:A3k03kHRJK
- TLSH T1AF25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 0a44c843c6d865cbc85ba2633ea42d244e48915612c4ea90edb83e9bf300ecf7
- MD5 b9bb86b7ef23d0c40af90cf14f4a5e2b
- SHA1 13af24489d93924be833b09866e3d047ee039158
- SHA512 b0cd89fba6b55b502a3880b7fe25274863905745e8b23d950a69893ab0cff7270cead90d9357f2219699c206d1b16b7770c10219492d1859100701001df414a1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwUF:A3k03kHRJQ
- TLSH T16125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 508932202d85f39ce94e15a60f111c3e8501baba3711a71c9e59511f6809965b
- MD5 07a87a078cc485699a6ca512794954c6
- SHA1 e7280c19679474af50c13b5d2e311973b53753cf
- SHA512 13f42a2ed6263b4a4608985b7fd2fef60129c497245910978dc4b1bb3d28c223ac3131d30281b97ea12589ac7403357edb13e9c117f90456d6f52d369cf3f27e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwxC:A3k03kHRJk
- TLSH T1EB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 d66cc8e1454a22a5649bcab6195a607007122672eefe6c62f6f932c5ffac0e21
- MD5 8ec5bf3c36208bdd5e2c14a61144aa81
- SHA1 71735f8325e7de7a7eefb70bdc6ea9cf07aa8ebf
- SHA512 22a5213bcf373291376e34f4196527b8c4469240dab924ca5189bc5b6b10764d761cb2d36f870de43114df23c568b3b75a80f385adff8e94675f876f512e4869
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwSw:A3k03kHRJ5
- TLSH T15825AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 7ae36354882f8d542b0a1e6cb5800be1034fc540b87c7d9a6c4cfb166332d7fb
- MD5 b53b11c23ee564985a9896ed5349343c
- SHA1 fb9c27d742a69ae36efb9b4603e013a8dfb10a3d
- SHA512 231a70b40360859895f402cb1edb54ecc0771df4e9acc810ae1ee947064bca36dd9c0eccddd34714a252fe71d4600188e7ffaad14c552177d3967b1582fb3b0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwZT:A3k03kHRJt
- TLSH T17D25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 2cda91ce8d6ed9083aa92ae86a9a4230d222c2d6a09846a1182b70f727c5cb09
- MD5 ce04bbcd8114423eb1af3667324508cd
- SHA1 d8599eb7a48e98ee2f73cddc09f8da03cb3ffbc0
- SHA512 1e7e5f4e0887b7d6f940d0f4268b35506d9353db875990a357185805c04410df4d165da18f8b002ba1571087809c592dfce5668118d069ea96b9c40e58fb2d83
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdw3u:A3k03kHRJy
- TLSH T16C25AE13EB9504E9D10AC174AAD68A23FB757C56276093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 48d4acf7e2886bf988162f2a7e0477a650be607ce8327f438485b9c2a88bad20
- MD5 cc17a6c4fb5afb9f6686d6b253a95178
- SHA1 53eb23528c17305e1deccd2266a8b40f2e16ffc8
- SHA512 02e7d031a8f31541e10ec1d6febf42fa527f9f4ea5e7a770bf8f05a6d3ffbbdd1125f19ed7fcc57f19699f9683415d2da58e06268fae11ba08de9bf82182c0a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwLb:A3k03kHRJj
- TLSH T1D925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 b889351d31009f851367d2b23a71609c727cf54b53022a2942c7976b4b7fac72
- MD5 e7b5eeb7132f10c0635c5afbac408a09
- SHA1 03140752e40c9301674e5170fb715597dc24503f
- SHA512 ec67c959d5243e8589e85e79ba9794a2efce7fa36f109dff19dcaa3d51a5abb9a49d072d21ab325f0693a77d4131c8e22d6a9f5c2a240efd22c47ad3c72f7489
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwff:A3k03kHRJb
- TLSH T1C625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 5a72a63e6a928936faaf10c98f0e39efe86822aef10fd5815440f1405223cfda
- MD5 c26de4865caabed25bc36cfa6d832743
- SHA1 3d7c1a1aef6500fc202aed005e9de8b6c5736110
- SHA512 ce52cba2eb1fa143f3352797d1c4cdaddc7f00b1eab2276e556abab27794a7bfd59ce680e336ee505eacb81d2b9a61003006488c725d4826a4b4bfb2c1d566bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwIK:A3k03kHRJL
- TLSH T18025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 7c2b56723271cfd21417043cb6f1f4cfe3e96c2690290aa37feba564710d6fd3
- MD5 44fafdde17922a125d7b8d2f195969a8
- SHA1 2a768e1f721c779cbde1e4447b10467085304508
- SHA512 1de0fdca8eac58374a9849803435fade0217ae918bd7a5c01ce4deb306720b9df16afb45279cbd575681a383253e54aa563cbda173b907e173e7e53e0a81b2c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdw1k:A3k03kHRJG
- TLSH T14625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 75a57d34af6669964183595101b38fc9242338d18a95c3d4869b95ca3c5f6074
- MD5 7a5a4643207e6dd003aa9c2c180f6f87
- SHA1 d62b7f6c04efe6feb2b67db2547c1e8a72e50883
- SHA512 2dddf0726134531e54c76c611508d675762dcd99997f4292ff4b487fe31f7a151e4438b4140354a9bb467779829627ff1253dd257dd32095ac9047d5f90e0bf4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwq0:A3k03kHRJ7
- TLSH T1CA25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 d26692d4ab5c31976e6be48fa8342ef62f2c6fd023f7f7e36eeee75b089c4764
- MD5 73b13a3795d438145552bb7a0b7a7461
- SHA1 0f3b220515350c44e132db9831bb0efad9ce180c
- SHA512 6de8b1d62b2dc9afda74c31288bff9d1c2831f0813c7083af5bfcb9cac0361b19e2b180a19196f9d48e9bde7d2da4ec3b8e1e800e387749f2a8ab7fb93dfec66
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwZg:A3k03kHRJO
- TLSH T16E25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 a44e789b4fdbb2556d18fa53a1f7cf7338443a281d9977b326cc2cb75a97141b
- MD5 13e786ba4783b578f7c1fd1a90341664
- SHA1 f89b04790caece20c74071c0352f40b5f062eb54
- SHA512 25ab4ec3bdcab965a350a1ff67f26fb4e4f3a4ed256bb8782cc319898ef206c82c19df08ca2ae443890aa969c9d0ab4398d41d727fa4bd1aa45f561ff4acfee9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwAr:A3k03kHRJQ
- TLSH T17A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 3070d440a9f9ca45ce0099cea7942cadc3b0a7bda76cde69767d556a95d9d83a
- MD5 aac388cbc68e7826d91bf1a48f85de2e
- SHA1 f14b603fbccba5a444a3bb1ee623c12b992464fc
- SHA512 225c7e284ceb42aee10cbc14ca43d20116469c40194464fbcb4e9c56ff3c90169f9be8c14e4cacb5d3937c18b5037dc4b681864a31878b9a44d4793e41d7c007
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdw+n:A3k03kHRJC
- TLSH T1D225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 4e7a9d4a35cfdc448dbf330285e3ba3f82ff54b1e7920a25383a1ea2c5622cbe
- MD5 2e2cdc96a58d573f6f7b7043a2bbb1d2
- SHA1 b4302e4899742e542e21f991130a853966eeb178
- SHA512 546e13dbe2ddbea5b1591ac125b7f6f8ee16ddcced7710efa9f9b78c585cbd716adcffcc638673fc6764ad951a1ca8caac08b2add9a566d902d93f2a048f159c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwUx:A3k03kHRJw
- TLSH T13725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 6eca5bb7a2c68b1a1f8c830bb3500f3b34064f8871dc74df8e8b4beb7866cd14
- MD5 759f32e2f8e74546c2e35ef283ef28b3
- SHA1 a6f0df7cd199548916d2052e2ea5a6a56b34a769
- SHA512 7d5b41deb4c118d912097fef04cc63f7f46999657e23205a9bccc5790a60ec717a39c3a2aa26cacb9c5ffe926dbc46789cb11c886ee2af28b5242f637e431af4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdweA:A3k03kHRJT
- TLSH T1A425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 818d14c4dc7f2cfa86014d56ef398572bf4ceea97024739625e523c30d134058
- MD5 268c88dbf79392fb0880e71219497f34
- SHA1 25b1b6547a321aa553759e4cba7ac2119a41bb35
- SHA512 14e58366fa4a4594a0e4dc14026a5d9960acb1ae4a223f4d500031b6fdcf6b432756a8fa4c5674d78b1fe5eb063d9de635a86f3b5f5c49a994dda4a0959f3c66
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdw39Q:A3k03kHRJ+
- TLSH T10425AE13EB9504E9D10AC174AAD68A23FB757C56276193DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 13c5df9bf0f8ffa4e0db93a7dc3621a0a4460a0257e4dbf75b0047acda84ea3c
- MD5 7b163dbe1f4c5950dadf5ae20d6d1ea1
- SHA1 dbf881bce25c0c8686845635f9717725523da652
- SHA512 0987e3ce6bbc9b3866b90de92b5879f8caab643b40b27a41b7f0757a4e7be6ec9eb83a91423df56ce58913ca15f085c3e7afa55d527d50b6aeb849190d327f79
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwe4:A3k03kHRJ9
- TLSH T1AA25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 c8e6106b792ed730213d0a05e42029c8d9d356d39388235b45a038cace2bc64a
- MD5 6bbce405e56f9abbec0fa2607d171d3f
- SHA1 f0ac0a0efa1ddca97551f9a20f5244570afa5224
- SHA512 7b8be33f54c66a25d89fa7bcd19c3908644eccb61c17029ad59d2e1e90ad3de772636aa7c2afefeba0d964f8b3c26b49a6e7059774c7a4c10dc5ed5bb4ffaf5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwdu:A3k03kHRJY
- TLSH T1B425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 716f06fbe18cedb9471f43acfa4490ecf40b35fd3755f38c96257691dd4d4493
- MD5 d3d2c72e463b6ab301681b4a33936fd3
- SHA1 ebed703112318491605a1d50dcb950b0221500de
- SHA512 f9f45a527db64ed0852b8d81cf386e2030b424391ddc8def2611a6970ec683e33f4dd4d026c0d7437e41c6d47357001450680010aa1a830bdc6074bfc2d4b43d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwwj:A3k03kHRJy
- TLSH T1C625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 e9deea5d59ffef4f5e7825f34972f88edab5e926c81eeec7f3f32516f1c8ba6f
- MD5 df43eb8f561d35f39909a1f2a1d24af2
- SHA1 df5783a3de66d92ad75b79519059523c1dcfba79
- SHA512 daf0b4e3785f3854cd653461b14b4ecbb07269b8fd0903a8dbb83c4ffe9d6b32def26b16afa0bb8cdbc73f5eb7f8df2a646181b1d239a6d7cbba35843461d61c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwBg:A3k03kHRJ2
- TLSH T14025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 5b83c0a60e4859b77c494293beb9b7223dd753b6a43c9a00a287fb9cb0db19de
- MD5 c7a43a7e0d76d5afe8553b8fdaf2cf61
- SHA1 e3a04b005cc63a2f7e6f57afae3dd8a38c10e87a
- SHA512 fa7fe5d391d0eef795645d0d5423a70a71e5f65c078fb21e1bfb983b7969b42d68389be560cde031f0c66d9ffb5ac139cd482f6540584641241e4146c4507057
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwYI:A3k03kHRJf
- TLSH T1F725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 1e409ec544465a89f029b7c6986e176b999cdab4f31eefb00d9d4dcd31a86f1c
- MD5 6fd009b8a9bebc81a63c31a8502b3334
- SHA1 977aed3622e4d123f816e221cdee9fd075b83885
- SHA512 d40a8ecffe2e1dd1e00e9f99e3a017d1d7ceb8c71fcb68d5f34213181466d7866224a70ecb3b924194607438dc15760355fc7225b2bba5f7b22b192f7ae2cdb4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdw6o:A3k03kHRJJ
- TLSH T11B25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 97a3bd3d0a423bd9c95ebbb276c54bd845262c68a0a00fbda2ead50329b10827
- MD5 55afabd773d1c5f7143d13cf0350c744
- SHA1 8bb67254243ed8c607778301b634ae4e52d4a4fb
- SHA512 fe5713ecbaacef050fb91bc81cbabe30ec7bdc0fb8e39cd6b759f8d0ee83c1c0abd8362d62bce55640888dd3b55f8384c69674096b732185183d14225d7c62f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwR+:A3k03kHRJs
- TLSH T11C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 6710e79224c14124f1c403ade14ea100b2b51d4f35cadd9061edeb03d6ba8934
- MD5 dc6ed6d553da290dd410c13928aff12f
- SHA1 452ec4041610ce1c50c183cdd7864bde9819e7e0
- SHA512 03b7d5bdb9712f7a2f486721a150814a4077756289c3fb6d60081a9ff8a9c866c442b3d4b92062b96daa35d279d100d76d1996f201e42529ff3b9142bc1af3ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwfQ:A3k03kHRJE
- TLSH T12225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 855f44e0a2716fea7e2eb70a2807ec9d44e92e40b367c8cc3aa00d7a4ffc2b79
- MD5 9974c9eeda9e4f692d669dc68fe805d3
- SHA1 598841b6e6b9eea92401780c0ca60ffd9bcdcd52
- SHA512 d61a3498c8cf68d89d5f1816b359bda06cafcaf3dcaa712ed782c98d164aa4d39bd07663db16688357fa47d9cb797e7294e1a28f03f4b8e640b16bac68092b37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwkX:A3k03kHRJk
- TLSH T1A825AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 7d57432ce176c02cde1e4daa358ac51fef0d138c61d4029c03c4c1762563a704
- MD5 d7f8d83c347e4d372fbe69d563e3ca6a
- SHA1 7da235671c18b9eba18eb57320ccdbccaeb84799
- SHA512 c70daa473169cfdf6605940c1a0bf07e2a198c822a15d5db2f2f0e9ce25f0345ebc31b00370919b0b5da2325533b435f060da6530aa4d50c96ecfdae797d421d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwiL:A3k03kHRJ+
- TLSH T15025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 3dcd8675fcf389a16e161fabb17f9008fd1c214595e7a7f9d760e44b9da7c45e
- MD5 ab9f070eb9cddace488db6bf281412ca
- SHA1 615f72de56245c76058f1b56581d57949713d3dc
- SHA512 3d7d1a4ffa1cfc46a43803339e65b81dabf388afa167163fe4f4276eb2f8bf84d7ce4d8c60384efc4d45e4bfd61bbc11c47861c6df08f02b701d36e4dee50f1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwGM:A3k03kHRJL
- TLSH T18F25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 62313e7413ff6c4066f00f0e608ddba330de316c43dff406d278dda7772ce608
- MD5 67d3c6cfdc5096b98ebce5ffd0680cc7
- SHA1 843274942205aceb3cb5241520649201fe660246
- SHA512 80c80549c29228a9cfe30110d408e2a76a96c5d18ca845eb30d2e5956172b05b4522020151212cdc972d401d69333e116c822603e47bbc96b6774c37718cf06e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscCj2xdwvh:A3k03kHRJF
- TLSH T1CD25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH