Analysis
- max time kernel
105s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 12:38
Behavioral task
behavioral1
Sample
2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 933KB
- Sample260822-pt9a2sfa72
- SHA256 b6ba13a42444116f4b1533aa0dd118bebfa55cfd752e46fb18cc190ecbc59dd2
- MD5 7415ad1ba94899a656caa8e634be533c
- SHA1 54253e0c724c3259605ad7720ef4d9bdcc092f5e
- SHA512 8c544b826728f67d2c44c661fa14b477deb5c9c4f77d9c5905cc3d8080291284bd54e40af6d2619192b7da264780e4e03bfc27e49dd5f86fff487b9729d0ffd9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRa9:A3k03kHRJe
- TLSH T1ED15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 42 IoCs
resource yara_rule behavioral2/memory/5104-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c591-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2a3-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2c3-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5104-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3452-47-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001baff-224.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-261.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-442.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a55-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-576.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-619.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-656.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-729.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-767.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-854.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-873.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-893.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-912.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1080.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1130.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1181.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1218.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1346.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1397.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1398.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1399.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c591-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2a3-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2c3-39.dat aspack_v212_v242 behavioral2/files/0x000400000001baff-224.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-261.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-442.dat aspack_v212_v242 behavioral2/files/0x0013000000018a55-491.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-576.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-619.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-656.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-729.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-767.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-799.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-854.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-873.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-893.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-912.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1080.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1130.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1149.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1174.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1181.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1218.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1327.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1346.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1371.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1379.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1393.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1394.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1395.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1396.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1397.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1398.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1399.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3452 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jre-1.8\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\mpextms.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 63 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5104 2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3452 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-21_7415ad1ba94899a656caa8e634be533c_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5104
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3452
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 933KB
- SHA256 b6ba13a42444116f4b1533aa0dd118bebfa55cfd752e46fb18cc190ecbc59dd2
- MD5 7415ad1ba94899a656caa8e634be533c
- SHA1 54253e0c724c3259605ad7720ef4d9bdcc092f5e
- SHA512 8c544b826728f67d2c44c661fa14b477deb5c9c4f77d9c5905cc3d8080291284bd54e40af6d2619192b7da264780e4e03bfc27e49dd5f86fff487b9729d0ffd9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRa9:A3k03kHRJe
- TLSH T1ED15AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 bdc65fd547554ded042fd90499d69328da915f709f9134507ab2a568c5cba087
- MD5 aec8e8d37055affd021e982769d1932c
- SHA1 e53937568101c2e61ee54ee5437b6858069086e2
- SHA512 69917c344ee0981c069a7754c916614f7c12c5a4ea4867c34e25b2a4c483bf5da40801ea22945bd00caee61fbb8ea2c4c8a414b2e85951a91f604b28aa287c50
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaJ0Le5ji0hmxNrM:A3k03kHRJOPji0Aj
- TLSH T10C658C17F6A402B5D027C1B9C6D6966AEE7138821B3086CF1359C7283F63BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 948KB
- SHA256 8446be93195d404326fe32b3940876d861b5e61c392f717565a895ef36d87d5e
- MD5 90f7fdb4d98b8b3deeaaea02a848a4d8
- SHA1 081eb6499153fe99222076e48e611fa17d489ccf
- SHA512 b794562cedea9035af246647529c4fdcddf2406a9b8ec252fd10eed510f84dade6170bd4cc5e3c295418b64c5a770847be306d1ee094889747e0f8e7cb3d6899
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaba:A3k03kHRJ
- TLSH T16025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 957KB
- SHA256 d447facaaeadbf09f2f381438a8bfc8f8225a3db532dcd642e628fd399911fb2
- MD5 1acfd07c32d02b45223d2ee1e1206e3e
- SHA1 62452cb156a18258627ed178b405371939251c03
- SHA512 223be3298a1244da7670d2051ab9c44bbac78e2245c7f93cdebc7a03b5a97ae019c0586841142a9768b7b5d5eeef1fdebb322077f3e2eced402e24640ce5e0ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRa66:A3k03kHRJ4
- TLSH T16025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 957KB
- SHA256 a17c5e036135b80ee83bd93673892bc7c4433ba50d53c5816894cc2f3fc54e0c
- MD5 0f86770c12c02f579d352be23d34b8d0
- SHA1 b5df3c75ca9053e2820809df1a2bd3473325468b
- SHA512 cb85ddaf987be119d07132eff11308f5c3e412f5755a7ed9bb7a23ef674f81385048bd4e1b22ddb68a5241f785b434fc222f0367d2cc0095751f58255eb3f4c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaof:A3k03kHRJ9
- TLSH T11325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 957KB
- SHA256 913f4a272b21e88d0d39328641273796ca4384a8adcb8d194222bdbfaa09e602
- MD5 2ef1fec31c646898630ace7368b5cb9c
- SHA1 491d83e1e9c97dea14f18bc76f47101dbf525ebe
- SHA512 b9095bd2129faaa4055106062c6fd47702966a3cf46db25eab8dcb83eb01eb56394487434dde81407b39afd656875c598327e54075a9a8b4eff0791ba12ba828
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaCo:A3k03kHRJo
- TLSH T16A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 957KB
- SHA256 e977b80c1b3861572a9585883c719cb562a597a8bd88de59551e60ea9979a94c
- MD5 6847fd6293d6612dbf4bec804e939d0a
- SHA1 6bd1c5be1b8bac7d75808e59e03941d2ea78ed2f
- SHA512 237b03169b598f0a3d1a771de1383546628cf7999926e3f79a7a76435ca245485dc5ffc0931b41ed6e078a9eb2a8c8374159348ef149c6b339c55d69180a722b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRa2u:A3k03kHRJa
- TLSH T15925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 957KB
- SHA256 6f9dd394d3b3839cd043faa69781d6b8df29b3dfc485919fbf5c595000ba5a07
- MD5 3307aa3f9e92df7290ed0ad711d1b230
- SHA1 540e12b45ac89492280ba2488d7dc6990f9e46ed
- SHA512 7684c0415e6a00b41a2f7d568f3a00bee45c65693e1bab8929cad6b41d0ee083045297ca9599637e1d6d4ed6cd4734802e31ac14cbdf6ae159c393c623bedd7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaq9:A3k03kHRJb
- TLSH T14C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 957KB
- SHA256 df9d8bb0a792980ca64415603b55af2ab56ff8c7abc3aaa3b420cd449d252c85
- MD5 dee7f98e06610e6fcbba6a20e5ae1de5
- SHA1 1cb628743872741f4ffeb7939fa95b57fa7a568c
- SHA512 ac9e035e62841ec27074e13a0f3bb2a6cf40bc8d46af07bfc5af1c9b286f25a7736642429843185380d6e75ecabd9b1fc22f6a5ab6d1a3871179de55f4c1ce1c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaqc:A3k03kHRJS
- TLSH T1C125AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 957KB
- SHA256 e912a3759f19bb461d7c5a6fed5e51042dfaf909734439597fec87a37a4cd6e6
- MD5 5ebdd4cacc081285b5bcf518cf3e03f7
- SHA1 f583d1a16226d2f78f012e0ca79d2c20362d4ff4
- SHA512 35f0a4d1f11ace6792097b73d951daa6add02aa74d28708374751ab91a25045d6b8fa0b5640bd4b43cb1b77335e690c563af6e9826ca03b78d53f94d1e91fddc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRajp:A3k03kHRJY
- TLSH T1C625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 957KB
- SHA256 541001eee106529fac3ebdfae8697056c22dc6c783b1dc61883fd8deb9e173b2
- MD5 7e87cb3fa35b8cc1885db5caf3f73103
- SHA1 7a30e5c1007ee8a3502434ee834bd849a991083e
- SHA512 6bfe169427f7a06c482139b35eee2a6a49f569915219147a4084af4441caa6e62ddc4c9b800d00b96e299fe55fa2301c26ac8cff1c7cc745d197b9601d3fbfbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaEN:A3k03kHRJH
- TLSH T11A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 957KB
- SHA256 2fd91944f4d2974690a9dc3b221a8350c7b0a91b6734aecc2016dd24bb8cc0b6
- MD5 e9953dae8d103867630d9497cab2bb00
- SHA1 38ec25cf67543cc82656f182b7cbbbf2edea188a
- SHA512 7a909fba0b0e54f6a707eea4f96b1ce0895653c04058f1e42a383670d1d00d4d9d20894eaab75622607d519734b5b50b48e6f32ff554ef341f29ee742752daea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRasF:A3k03kHRJB
- TLSH T1E425AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 957KB
- SHA256 eabe16889f181296c70bb0b5429ca9016d3a5a2a89ad3951c0ac676e9cb5bbe2
- MD5 b25d1478382c631817dbfbdad86dae7c
- SHA1 3717d95b9d2284ffd1007468cfc72c1a5286603c
- SHA512 b47ce0bfa65dbc04ba212368981c95d98c48e1167c4ab974796e97085abd3ae3ac7447aa3b2e00e0f5ea661102aa093f35bb76b367ecb13a58ea781ed76277b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaZC:A3k03kHRJt
- TLSH T16225AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 957KB
- SHA256 33faf184814af0cab95791b20f3e4442dd44f4430404f170fabb4cbffeda85fb
- MD5 e4a9d63ffaf5d31005e7402f80155c6b
- SHA1 16b352efb1f2283ce3530a74830fd8ff61dfd72b
- SHA512 39d3472ab6ad5ba08d3441fb64da0c859da27f7e0b4786d598fc0dc091440f85ac47e78483326a4aae5748276c1cec6463f84eabd71c51ab3d9b5cf6acc21b22
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaaw:A3k03kHRJw
- TLSH T14025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 957KB
- SHA256 f5f9b8843c806273c905dbce3cd5594d2c5dd30453172cb280a60762aa64b071
- MD5 101cc512d9eae508dfbfa0fe59ad560c
- SHA1 62ba844078f65fbbb00ce209a22e559158857492
- SHA512 62e4dd7260b05c304453980b7cc94d0f92fa10e2e9f6c0b0817a3aa45173424b2c968e467e92ab72d830c04726ab264ae3d0238d2265e46817fa9c6a955374df
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRahT:A3k03kHRJI
- TLSH T12F25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 957KB
- SHA256 38ffba74fc1600f4680323f6b40c961209791dfd08c79478ea4160338cba12a4
- MD5 09f2f4bfe33fe5d9f15a196e8acb8905
- SHA1 b459845ec877bf467d6f7a0f822211a81f4bd059
- SHA512 3dc1f38a492e8f4b77838b61acac4b734598543bb31448621e2cc376dd3336808ba42400872e8aea3ee2e78d23d71e7d8f8e37b365572cc8a8cf2f7f3ad6a0c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaPu:A3k03kHRJX
- TLSH T1FA25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 957KB
- SHA256 ed97de29f55f9d64c6f79d45f43d6cf0ce4ceb5e8df83a67ed317d330aa017fb
- MD5 a9b24237c9d003665f58251893787a38
- SHA1 9d99ce0c3d91dd31688cb2bbbb26f1249f7e646d
- SHA512 f272b547f05206da9630c12b620e7aa4658718897ca5c8535e25d85700e13f72c5ead80d04c1d51f88056f52995f6b32ae9bcc3a0e6d2119069f6786b754f333
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRazb:A3k03kHRJO
- TLSH T19F25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 957KB
- SHA256 97e9a9d6e5628f4ceff0f413dc63e266c42e8235f098f25fed17e53b8ca6c898
- MD5 e01d22631f379893cbeeacd6dbd0e5a0
- SHA1 2b38b2cd205e2546bf0cf9a266abf1fb1832e91d
- SHA512 7ab2bf0da2fac361e0803fb5cb3677270396c67ad30a54f55ba65d9aa85484ac127b87eb7372bb6e5666a0db658dbf3cd67989248a0ac33e288ff2d9ed6f6e25
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaHf:A3k03kHRJu
- TLSH T17F25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 957KB
- SHA256 7f9c66dcdeac12ee5f40c3e96da0a7dd5f7c49d00346ad482251c79bff10b0b7
- MD5 202a1a04b35df5ff9555c67a3e105576
- SHA1 e2b49bd8d8dc33bcf07ced3faef3c7820015cb0c
- SHA512 92cf00a729cffd7b83fa578d0943f5cca4f4f4b6eee122160c687e912518d92b8ffe3c278535247e3b5d192b847f4e52684947b25da2f95c46fa6a402f3abaca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRawK:A3k03kHRJO
- TLSH T13925AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 957KB
- SHA256 03ac3d2f31402448c92ae4d2ab1a4de33910a8a18d3e65eb81031afb2fe46dfe
- MD5 0c64ac13b3af343e8462b01457fe54b4
- SHA1 c05a5d26093ac1e70763c7b97884a6dc8d402cbb
- SHA512 410d01800e976e0083830b9e2114cdfdd9cb39f5814a095624bfaf7da7855796cb21e389bef3f45fbfd144db40f4d52436f030c76fe1ac06b201555a06e71d9b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRatk:A3k03kHRJz
- TLSH T13225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 957KB
- SHA256 a6f8b1f61aa863243e7d62a79f4375a3eb1be04c50715eb09b4e85ac35d0bc31
- MD5 6b40068ca61d26b48e0fa6b56af1bb49
- SHA1 2ecc07e9e83d651fa89413433cfa12ae2531020b
- SHA512 12a344a678ad7dd5956dd258d0e0d8a76d4430bdd6163396cce47a4baed199692f3ca5d481aeab1b0e0a45e19cb4d63198332ffa6f4978b9326a5f73454f06ea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRay0:A3k03kHRJS
- TLSH T17725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 957KB
- SHA256 dbb64435362c2b965ba2fe3c978ba5516c116f582a36b9343d44d7c380a14d6a
- MD5 fd78af4e1ca9f41c37484a07e244c735
- SHA1 4ae4723778a64cc41a10cfc4c53cfbe1d1e86b16
- SHA512 5725139795c6be4c165a5c63061723d7514e2d0a329dcd4df253adf9bec6df2e702aea0296949a23ad7cdf659c52b8e28942b4660a7afdfe4e3b655b960b2215
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaBg:A3k03kHRJr
- TLSH T14725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 957KB
- SHA256 02d6c1d30b839bca942e966b955f69f8418cee5f11a31d1df6f12f7de48d2216
- MD5 51be7bf2bb56f2aef848a4342021bef7
- SHA1 3b3f67dbabebe02b691f7ccd57a6b9b21153eb1d
- SHA512 a1f9d005309e0b68ec152a184da72f5b4f5531639990b2f89f5673008fe360c617aa16b9175e335d1ad59ab6258c44187251c029b9bc4db8482330a682e7ef0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaor:A3k03kHRJd
- TLSH T12525AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 957KB
- SHA256 353a5706e0747eceff15bf3c524e9be9b8a23cc6bcd4acfea34478843afc5040
- MD5 e980eb55f0507a99b86b202c5f9335ce
- SHA1 ae18a0d2d06d328ff19db2e0da0bab59cc30ce9c
- SHA512 079e776c2390196ecd5620755cc7486dc26d184501a9974e4348655d3515116adbcea7c5f2ee7d32cf26ed01c9caa8e2963cb593e6d350e72d693ae743e67ef0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaGn:A3k03kHRJ/
- TLSH T13025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 957KB
- SHA256 8bc40a12f8cc1793a05056fde095b536cdaa15cc6ef5f26f62a1b8d84e1a3029
- MD5 0019847c166475a9c3e4646954e658bd
- SHA1 665a559bcc1e753d375c2833b753a59a8b0fd5dc
- SHA512 6f9354b629f4ff4081e954a400aded551d09d5163d9d3876610495123e4b966a0b4c5f230c69871c44b722935bdedf659b2f1ab111b4db58d838ab75cc1a6c31
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaMx:A3k03kHRJF
- TLSH T19725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 957KB
- SHA256 4bcaaa4b17a8e710a3e60ac5a15bacf6aefc2e212334c8a485bcd98350bc559e
- MD5 acbf788c3a9af4fe9cf656396a73bb4b
- SHA1 f1a516a23bb938625273bca4e3cb27b81a225a14
- SHA512 c001cf00de08ccea06f70809695b65f2e69aa74b69eed73e542c6e46763e622497b0d18071b9dcb6b72406148712c98c2e7b0c6eb584aaafaa8d7a225b900290
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaGA:A3k03kHRJK
- TLSH T11825AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 957KB
- SHA256 8cc34649f50bd37a22a44d8480821d5499c7d4b1a3c2d32e06cde9fc20376b81
- MD5 e1ccafec031da0b396651603d8e0c243
- SHA1 510122cf319ecddc1f6e5e43d73c8cedb58f1ba0
- SHA512 bb6284fd4aa67efbc044a2276dcf1ac3885c7dedd1de086c283ea426e129e357497ab2ffa5aa8081ddf7fe7bd80d67c2837ca8f1761fe3965c453ef5aaabbad4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaf9Q:A3k03kHRJ3
- TLSH T14D25AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 957KB
- SHA256 bebbac6a70cd887d826440ae264bf080ed9e2ada4c72d5b13a79f4716e426a95
- MD5 65397ca59f4f805092bbccbeae12176f
- SHA1 3b92ccf78d7eebbce26c1cfceedd4e4dfba1b4f7
- SHA512 96d22bfac6a9a9527f1a0929fc8d02a17733cb8b05c6095dab4277786c44c12a1989371537f2a0a0ab4c0430db32bda0414c5b6332577549028feaaec8dd2c5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaW4:A3k03kHRJo
- TLSH T1ED25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 957KB
- SHA256 2c978a8753c7a0982db31076e655f8eee79d69ee6e7c75832c75d58f8509cc6f
- MD5 ab2e0e17273a36782366b4243927ae20
- SHA1 65fc912333628de89d326f4d1e4a5ae971951b74
- SHA512 bb28a9718c86b03dd5c39aa37b39f6e168f4522d1427814bc8efafd55035ee846fbd9c2a168fd08a55e48903972336483373779e0997eb21d360ad3cc4c9c1c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaFu:A3k03kHRJ5
- TLSH T1CB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 957KB
- SHA256 05fc828779815f54f102a5bc00030cc641c67a0f56488f063e89c5c9f8e362e8
- MD5 6d2aa8d82699f02502d8f6bdf4fb2ad8
- SHA1 1a8a89f2b51966b2a683be7026ddc82b2ced1090
- SHA512 5203b6dd14cce78742293bb2ef3f39c5ebaf39f7ff066a716da8bb2f17589fbb674ec4f3d94c51f8c2ea3ea13ee976b2ad757ef072ffb7348e6a806b71d6a596
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaYj:A3k03kHRJj
- TLSH T15925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 957KB
- SHA256 07150ca9c27c8b4bd791c304e480e2884d9874cc1d117a2546004234d27d700a
- MD5 95932aa63d162e7620b399ec75e71ec3
- SHA1 562c4d62034648180b9efc0e36f02d65bc706a25
- SHA512 9089282eac9c803958470c21d5b8eecdecb8e772660367bac670cc7f896424fdcf384b6c85aab945b0e82c882cac168d7172d5ea91b16278b042d909d2cc34cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRapg:A3k03kHRJL
- TLSH T1B625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 957KB
- SHA256 8fcf52c12652e26ac01dde05c10511b2704bbb1c6b1f03d4957fe32d796c7c03
- MD5 df159a1f16ecafa88159b1264cef9f9b
- SHA1 2952a2f6a5ea23b1fddb498dec3b4c9ed4891273
- SHA512 77b329d17a250f0c5f28f5a6ee4f308056bbc38a00e43dfe644eb2d9e9cafc9740f3dc5f79b31960575a6d763bed745d038d0d463dcb51bafb17a9234506a177
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRawI:A3k03kHRJi
- TLSH T19C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 957KB
- SHA256 fa36ccca03c5ddbca073d8c0ac889c04a67a7b73a31977dc3939689cc9e09c04
- MD5 2a39db832d0412efeb8cb38195574427
- SHA1 99e7d7ab65f2c677a3631ba82fb3c8fb9c308391
- SHA512 1f7c3bbc19ae6bb5849eba6297686712a7af1b5f9ad2e86edc60ebb5d4d61a89e22aa50e2050af5c0e8a3a980715020a66b586017621fc79a150568a2603400a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRayo:A3k03kHRJA
- TLSH T1E325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 957KB
- SHA256 d7b9256482f851bbc6285fad06b6274ad5ba9705a88dfb2567fcbf90fe51f183
- MD5 f0ef0fe52968ed6498370670a15058b5
- SHA1 df3ae35466331e4b86cbb1fb978f662699832061
- SHA512 bc2565dd98d045d67cf0e6d7169cdf2b690a43b2b08705b0bab7ec1a606654c7a772ffa9fca053c2f2876dff4bed5ebfcccc7081f808605d77a32699145887ed
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRap+:A3k03kHRJt
- TLSH T1A025AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 957KB
- SHA256 8d728ef981aceac9c8896df80255fb98994cff468b95867b818fb638b4ebc6c3
- MD5 d448c881e9dc03d8a029904843a42b4a
- SHA1 e0a5f23d74c68053ffb3dd0802c23eda6fda1632
- SHA512 5d2f302d3a8fd1c6fe2050f883e4c97352ea9c3cb27a5a8fbc6be09c490246b69d09cb761b9d5086b0a51b5c257fc5c9bbb6c4592cbfde622527964a9a95dcbc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaXQ:A3k03kHRJl
- TLSH T15725AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 957KB
- SHA256 5a2c3e6fdd97ff1d8ffb910cd9a24efa4d0242f7593ea1b069db462f0060fd65
- MD5 e6a9a9bb3a70aaf2a5023391a11c60ea
- SHA1 8276050a4615191be44da09b2d0e9506386b3fc9
- SHA512 93caa90a82ed658ade62391d994c86434bc7766e96993e1cb46704d2c763dfdc8ca37b5db0716d9a3f41779d600ae28e8492fd03cccbb944146d4eb4b040dec4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRasX:A3k03kHRJx
- TLSH T1F125AE13EB9504E9D10AC174AAD68A23FB75BD56176093DF2358C2152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 957KB
- SHA256 b567a3c3d158ba16194d1ea29c1317d976d8ebfc9c2c6ade01b40a7910f61d1e
- MD5 4761ad44676462bb2b3a0fe6265d6f3a
- SHA1 2180d6fff1987289e95e520ff7d630dcc02b6754
- SHA512 70d3746ced6750bd7f03239e1aa3ee3c9034135d7c69faf814de1a2e20fbd19b6cff28abba5a84e5d8ece30e39a050074221a97e7be2ecbaa1fd8409d45ffd0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRaKL:A3k03kHRJ7
- TLSH T1DA25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 957KB
- SHA256 0a49b502f85c8bac54f0591b689ce3a280a80c950ed6b6cb2a59eb89905bc5df
- MD5 685f08fbde2f0f8462339eeafdf61a58
- SHA1 6e68fba6e033168067f1694c14bf35797dd3d4af
- SHA512 99876c6231333a5796e62ad2f3ba6e22139905dd25357398495f0871216f729fb8e7b8f093e386f56f17612a59fcd7c5d5cfbfd4f3a9a91d5a759b13a6398c93
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRauM:A3k03kHRJW
- TLSH T1F225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 957KB
- SHA256 a5f57daf0d47b4f5c8d2179d6fcfc974ce559fa9de7a1f3121c911b191c2da2a
- MD5 1df8b96b90679ed5918ff9a2b937bb68
- SHA1 0205ab69007c1aa1fbc39f0f8d86d76126850a3d
- SHA512 ffbdcd9f3ad509e5583b67ca8a87aec42bf83967705884bcbdb2c7d61d53b4b96684b66b680e329402e79c66298f69a35d82b3479d1d37e8a7503c91cc4dd0b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bscEvgmRa3h:A3k03kHRJo
- TLSH T1C925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH