Analysis
- max time kernel
95s - max time network
130s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 04:19
Behavioral task
behavioral1
Sample
2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260826-exnteabf45
- SHA256 6c8c5e7c5b8429354ac7df068e6562d3af8ce91b78bfe105724a399d7837cf1e
- MD5 e898243d2e713c007087df89b7c9710a
- SHA1 c226f44963be99182d679556fc2c114cd23f7fa1
- SHA512 9440179e48e0b3b71314977bdcda76d1c9e7a16063483e3fdb0ca96ab93ac53b03ae403e575a49e7354a6ffb54787f31cb0fbb0815f3f70f205350dc8b7e71a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xo:A3k03kHRJd
- TLSH T14215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/3076-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c476-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000600000000bb41-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3076-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4136-40-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c80-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-313.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-471.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-588.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-625.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-704.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-735.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-784.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-821.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-852.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-918.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-931.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-950.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1005.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1048.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1134.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1165.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1172.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1179.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1302.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-1333.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-1352.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-1371.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-1378.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1391.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1392.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1394.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c476-5.dat aspack_v212_v242 behavioral2/files/0x000600000000bb41-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c80-59.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-313.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-471.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-497.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-588.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-625.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-704.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-735.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-784.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-821.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-852.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-871.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-898.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-918.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-931.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-950.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1005.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1048.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1091.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1134.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1165.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1172.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1179.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1302.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-1333.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-1352.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-1371.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-1378.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1391.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1392.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1393.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1394.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4136 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe$ patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmiregistry.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Workflow.Compiler\v4.0_4.0.0.0__31bf3856ad364e35\Microsoft.Workflow.Compiler.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMSvcHost\v4.0_4.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3076 2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4136 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_e898243d2e713c007087df89b7c9710a_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3076
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4136
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 6c8c5e7c5b8429354ac7df068e6562d3af8ce91b78bfe105724a399d7837cf1e
- MD5 e898243d2e713c007087df89b7c9710a
- SHA1 c226f44963be99182d679556fc2c114cd23f7fa1
- SHA512 9440179e48e0b3b71314977bdcda76d1c9e7a16063483e3fdb0ca96ab93ac53b03ae403e575a49e7354a6ffb54787f31cb0fbb0815f3f70f205350dc8b7e71a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xo:A3k03kHRJd
- TLSH T14215AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 395bfb917d168e9cf7b678b086cc0ad7441da35357453aff38af67fbf0d0f186
- MD5 a277a37043dbe1ac94c124bd25e5dc02
- SHA1 9b9465414e0b35154c9eb9a0a27555400224914b
- SHA512 fcc622d27428443dabeaaa65ead873c6b6241569fb04149a938628f3af3bc6967c1cb207f214ffeaf5ccc9c76e3094060e31b4206774c965aa12b4796925980e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xw0Le5ji0hmxNrM:A3k03kHRJpPji0Aj
- TLSH T1ED658C17F6A402B5D027C0B9C6D6966AEE7138821B3086CF1359C7283F67BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 d315943018c2f024d27f2a021f09b646247addb0ecf03e7b23e0a9c2322c4587
- MD5 10f4742a8187b9e07b57c5ea98df60ba
- SHA1 20006542c8db594d991ec89f1948ed9d274a20fc
- SHA512 62ce06dd55d1f2a9564eec128c7f876e4ec97a2fc8df67fb31044902f4c60744ee0ef320dd9e2672994fcd481ed11c4961766cbab95a16df1ec909ad99dbd95f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XZb:A3k03kHRJYb
- TLSH T1CE25AE13EB9500E9D10AC174AAE58623EB75BD562760D3DF2358C6152F62BC07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 948KB
- SHA256 f2acc7095116e10e74025f474d9ca9901fc0d8b0b2038b266cb0776ad11fa549
- MD5 a3b9fa565f1ba7024b28dcbad4e2f480
- SHA1 9d1fcd4dbd142d9e939193fdaea422447fbdfa18
- SHA512 b2f3ec294899bedaa2b2142f4acae03ba4be9cb21ec4d77c0e0fd37939687c8dc32059316f90d5e5891033c949f894a4aae97695d85b84634888936e05c382f4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xr9:A3k03kHRJa
- TLSH T18625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 948KB
- SHA256 8e8b3c7494204694ee756c193fcfd0dffbbe1e6b7e300569426d09233799f450
- MD5 13a29fd2a65732bcc943205b3454fc20
- SHA1 13a36eb31de5193dc544e6b0d80abae06866477d
- SHA512 7a228f98ba107b334ae5d2239da06d35ff79296db9fdb72d58e1e5d41626a70ccefd2a0a7a7b1efdec505ef6c5ad19e33c680f7b0a7665a1293cfdaaeebcf6af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30X3c:A3k03kHRJ3
- TLSH T11225AF13EB9504E9E10AC174AAD68A23FB757C56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 948KB
- SHA256 b0d6945f647c5dfcd731ff221fd11d1f3bb0b1901ea17c8a97e32a5da9245a0d
- MD5 3cb959d04561aa50f57adff326f7a645
- SHA1 530b1bed7210c6c8be71cd8ec69c74267d533dd9
- SHA512 adc18ed4e213c27485834b0aa4dff2cc4237086b7e9d3c523cdc2021907b455b71aa7bb68fb7128fc85ea766af1fb11e9f2150695dc93e04e046e6642160445f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XAp:A3k03kHRJt
- TLSH T1E625AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 948KB
- SHA256 e13e7d88c0b2769430c86892c49b7ef88b5b822d86ae159335fa152b5a938614
- MD5 3698f6e2b8629e4d4d3965d9a0c19bed
- SHA1 f4876c6a5f1bb62dd610e2ae5e1e6c879d30d24e
- SHA512 bbb3dce43eac32ce507c6e8c7ec19bc776e5be91e18de7afa7a32b52c2d264ab42c5a5f7e7912c8c6715a15869b0cb5074c95a3db18d80d7d31c18a9f32b0502
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XHN:A3k03kHRJW
- TLSH T11725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 948KB
- SHA256 c5beb65507ab8e0f75b4e2215d9c0b19b163cc635e45c40de0a8a47b5862b664
- MD5 9713c97670d5f4ca181d297a285dd7e4
- SHA1 f620b9327866f6476fe064b2419e9ec5d3f78bd8
- SHA512 31c7817b515c835ce1d6812e9695c53ad2c613d78ed9c7313b28ad9c08016a3df8869458f9a6cee15b1a4dba131c7709280939ab2b5da744d2592f1a18650434
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XlF:A3k03kHRJ0
- TLSH T1C925AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 948KB
- SHA256 cdbcb41b3942247ad8cc437421bb797ee48af257b0fc5a93803286552bc37616
- MD5 ec1cb776d3439516f78e52d09584a5d9
- SHA1 decc0c55641ffce0d1769f8a5c47ce61a88410f5
- SHA512 e3183f4e435091a63151cb4c7cf29f052925419778b67ff85bc18a4f2a3e4054f998e3683a13c7e22aab0f18eff5007c98c61ecdea2a0276b9006d3b8a3d8b64
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XGC:A3k03kHRJg
- TLSH T19D25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 948KB
- SHA256 5d989209c29b1ee739d9feb1b8490f66a883b5c3a461967185b58f630cd533cf
- MD5 ef97cf91cc28bd281b59ab695ad1d5b9
- SHA1 04f10e2ae5ad4c0e897c4dda1432539672e71c13
- SHA512 04f172d0905bb5e441f4b09c11e1a369970955b19f62c9dc440bebca6ec9bd654e6655f9b32bd8fa59183c19de3929ede32d2eca82f899af9dc42132626c6ec9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XJw:A3k03kHRJ9
- TLSH T19725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 948KB
- SHA256 96d96a6f4ee89b3c9e611d76ad5fb0d4ee4b5a080b310ae9e2f05ca1bfdf7a1c
- MD5 91a3040ea5d11cc6cdf7337a6577ccd5
- SHA1 5a9ba424ec2609b2fa09bed88b5abc6fd946a746
- SHA512 6515a18dc8d9641c839f62dd8742da17cb541f90a3bb1241da06de2d40f91a5ecc90e840aa5f1f091fa6d87833dc3fb637a4eab8afee0e8b0f9a60284b119796
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XQT:A3k03kHRJx
- TLSH T19A25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 948KB
- SHA256 876aca54a42577372983d90d46f6450cb3d093145c09fcaff2be9e5cb2c37879
- MD5 e259f096402eda0370843b74b86ed1b9
- SHA1 60034f5a62acb450fd02b2688c12a706468acc9f
- SHA512 e4e703dabef710a529398d2a459b1f3b67c853688c77fcd8dfd9d5dd170498dc28a2b68b91046979c9865ce57e6b746295eafe4bd9c87b1dac564137ca8a3868
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30X8u:A3k03kHRJm
- TLSH T1EA25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 948KB
- SHA256 411237ba3d7051f6128112870433a9ffee161f2d4943566b1d2cdcf9d8050491
- MD5 dd60a1e641dc3d4abec8743dbfbafe9c
- SHA1 8acb4c00b562a4a165f541c13e25fbd6b04f5f0c
- SHA512 ca9650474c94a67d4952b72d329ccec3baaa5c30601267ea2a22f36c9027b1d5edb75fcb9c0ebb062753ce3feee0b0e7113d9404a156cf42fc8b4711d6b214ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xab:A3k03kHRJ3
- TLSH T1CA25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 948KB
- SHA256 b1ce2f6f9879f96ee5bb4aacf53f77cd602ef1d7bf2ea024fd17f1479db0ca3d
- MD5 ee10f0659f8aaf50deb32bb9a305b9db
- SHA1 abc0a3c9989b6a7fc4c87629387b9b0467edc960
- SHA512 c4bc3122cf2e7822bc12651df4418abb52960a56dd4e6591ba20be2f44dbf3a289e0fc93b7dac976ac90ac0f7fdcaa8bb7e61ea8b091ff3f6d5bf5e8a5fe044b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xcf:A3k03kHRJf
- TLSH T1AA25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 948KB
- SHA256 1e827182837fd71d62df51292b7a9568d55854aba21a4dc2f6016c061e5d7f81
- MD5 3e61e33e3a7ac7a32235abb89481d58c
- SHA1 095ca7e9f87ddd87f2e401fee2b0daa478a9a9ce
- SHA512 bb5678de6a717628137412c4b4dbc0aef24fb33d624e5694c1fbeecea13d50c07fdf85124e1856fed73c7dd9a4b524dc47ad88b3a0bc391699133413f606509a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30X5K:A3k03kHRJ/
- TLSH T16825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 948KB
- SHA256 4cb377864218518fdcabf8efa29b8be015c6de153842c13c8690faea49906079
- MD5 fd9fbb00f5346260c915eabb4868fe74
- SHA1 84202a017a7aaf187cb7d49194f80344189d706b
- SHA512 5234a4e498460afd6c7b406e17b4befa3861036984da93350b4bf11eca0df85dcefd0540586e5ad7b21f19f357d7d9af30cabd1696ff08b63f3f9eba32274fa0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xik:A3k03kHRJK
- TLSH T10B25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 948KB
- SHA256 f4be7d5131b8c3e1b46955b07b6bd14f4582d3106f1c1ed10ffd444adda44655
- MD5 f0e429d222601626f3f7afd08fab8913
- SHA1 5869b75839ad42e4ace7c928e2a8d392ca8d112b
- SHA512 9e4e3c8e166ea7456d740377b814fe9426e529d2dac06f6a42607ebdc6ca292a050f327d11edf5f28209bbe6c061b18db2c1334bbe13131c769b8adcad3592e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30X30:A3k03kHRJ/
- TLSH T10225AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 948KB
- SHA256 44c9fd41e088b865d41bf916ce8ab20e1012c031eac90f9e44193f161b3cac56
- MD5 7630b1efe85692d8658850c3672757d5
- SHA1 12459f6f64111b29b6a450af6921ef02bc3ed527
- SHA512 fa27f17e37431c544832b9ce2a7373d5a4e088ea7ba0904b6aeded5ccbbe42f07bdcc5c1126ec8c6818059811d3565a73f921abd55826a015e6bec9e196f79eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xmg:A3k03kHRJi
- TLSH T17525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 948KB
- SHA256 64874d380fe51fc674e7538eb8296806e61e154c72dfd457c50499b1822ad8d2
- MD5 f9d28bc59f377e94aae5fa494cebc265
- SHA1 4eadd3c503510460a2ea92fd8d30ff2971a7e7ed
- SHA512 d310785e5001aea90584cbe70b885f7648f1494a3c29a965a94ab3a13b96513751a1b330df5069ac23daec543ec4b7cf4df8d8ff8e0c1c55b6f4c28c6f6b87e8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xvr:A3k03kHRJs
- TLSH T13725AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 948KB
- SHA256 f13738987c3e64c0db50531a527ac9a6269b4a9ce1c363272119833c3fc28f55
- MD5 f04926c7c51914be45a85c9c4bbdc036
- SHA1 29eacec32cda41d486bccae612b9d7e2961948e5
- SHA512 4be06f60acfed3b16afe9a952b7cfa135cb9f2d6b817e186890c58c46940b21f0a8c5d7941ebe281313c2172b18e6da942c66ba712ee4267cc1c44c3ca7a87af
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30X5n:A3k03kHRJW
- TLSH T15625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 948KB
- SHA256 25937d1faaecee628210b305bcc63a4dec4a91abdfddc1a6a8e999b4f54013b8
- MD5 301e7065e096444578aa6cb155b48d1f
- SHA1 548f5e1857d6c0665f9688449d5cabe8b0e83baa
- SHA512 aba194a03fb4b1a9469d0e80f2130571fdeff9d343cc41201275071e71921e26b738eae7c04d83c09d4edf1791fd202af3a89ca0b3b93d0de7440cfb25f4fa22
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XVx:A3k03kHRJM
- TLSH T1B225AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 948KB
- SHA256 136c5bfc8f612a540a627fde5908ea313c856cb1d3c5b1b377abd1c6311cb90e
- MD5 c0f4b0d4786166195a9da140137391bd
- SHA1 b161ac92fbd1e71c220ec95a7bd22ab8e5741d5f
- SHA512 f9d339648d76bfb0feeedc7bfe7d48f3391a67f3ebfb9b3f2ed8f37a91b0e952024ace8f1b6473361e8b49db925fa2c6ebc802ee4b3647a681e1d2ed5f9a101c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XLA:A3k03kHRJX
- TLSH T1F825AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 948KB
- SHA256 1b5879b569d0a9e2cfe57c64dad34714af08bad8088512bd1803eb172feebb58
- MD5 04bc72559182e231c6ba34a7c986dc66
- SHA1 0a2e09352e2efa21a520a031009db92a5ef939d8
- SHA512 ae51f9edaac2b45267fd18b91c832a6035c66e7528bf1c3133275412505bfbcfc5fc22ca66868240c2ffefcb0806ef97299753532e1a1e1d783f59b880116ca5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xc9Q:A3k03kHRJa
- TLSH T1F325AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 948KB
- SHA256 26ce23539bf597eb4acd8f8074a20706861511c77da7b450fcff9af111094ef0
- MD5 86d8993c49187ebc8a2a35ca93c10b33
- SHA1 9a9720ac7099641ef4e6395facf149c4f0e4c861
- SHA512 9b7629041335e5844bd880bb401b1f9508206163a8aa7c74252d835b4d1b197b4ba0fea1d5fd21869e4dc839fd5e72f75d1f8b82b23b0a8023f618e67408950a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XF4:A3k03kHRJ5
- TLSH T1FB25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 948KB
- SHA256 ff1c6b0b1e38a737cada84728f9b4466ec73b25fe27224ca61de11b54167b5c8
- MD5 ffb7f690dd22418b45f0d8743fa03423
- SHA1 992f8fb8c5c3c8d03da58ddff57bebebfab4a991
- SHA512 0e066f1447a7fe02524fe1bbf4771419cd671ccc930cd93b9e8d956267a5c2f9532e059187ab3938ab8b7c55f222be0ed539a00dab1280a7f8d012313b9aa48c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XQu:A3k03kHRJE
- TLSH T13525AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 948KB
- SHA256 73335b8416cfa755aeeba3ab4408a473771728b7273e4281f1f885c0df67af4c
- MD5 d3478dcccec230da585a9b0396bfc416
- SHA1 0942e0d56814b4eab6aa9fa9319f8e31234c3edc
- SHA512 4ed578338ac5a08cb444ff2f73a4df3aeda99155b2248cf28ea44c9588a62aabcfed332efa822eca141cda7adf8fd2e6f00239147cf687b4079652206c5ad5e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XRj:A3k03kHRJG
- TLSH T15A25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 948KB
- SHA256 5fdda965bf577e4b1eba304c410a676aff0283c84b82314814cfdfa0ff69528c
- MD5 d42360716c4776fd29ffdf830db30dc7
- SHA1 6702cfa48d4a33581ce2821c303d0148a07e4c4b
- SHA512 fca99601b29b840700c85f9671c0d0efed8de2336eb19965d3c4d16aad364483d61c39bf85529dc13fdc5d05fcb3a803756a77ec1334cd5f993c0e15156a3dd6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30X4g:A3k03kHRJq
- TLSH T1FF25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 948KB
- SHA256 ac8f7ae7562295862d19393ff8e3b1acf8e804313aa7accaf2c4f3d7d4413ef1
- MD5 db29fcca4e22c5478514ba3814d5f168
- SHA1 1dd980f137426b2a7477fbfec105bbeada7d33b0
- SHA512 42057181ebbd812450357eb9b8b3dd89c33bd3d70a58a47e838157fa3d6ad17f34770fda82347cad00d69392af27194a62db7437225d4332a302bc143e1a8622
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XXI:A3k03kHRJL
- TLSH T11325AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 948KB
- SHA256 2aa1433398f3699979b2ea6c8e42069a0364bf1925691f44317d796829994bed
- MD5 4c64ea9e55be41584de8305725952258
- SHA1 92ad1dc63c845b065844eede0e55ac55aef25442
- SHA512 becfd78f193d8c3c200b613ecf929e9630460f654b0c1036cee3040fc7dec0c23629e78fbbce51f3032743dcd9d71154004732aa26a5a343e7bf8a430285ab33
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30Xdo:A3k03kHRJV
- TLSH T19625AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 948KB
- SHA256 d2bf75a72f1fccb9b4c11d3a07b10887e6f9a267ed604b187309318b50c0adb8
- MD5 42a1daeaf2da9915be6555417e90bdf4
- SHA1 06fc09729ca74fb7b4be723e7a15dbf12a98f205
- SHA512 4bd938c82f7255f519ac5d0419aa783f57b9da217f628e008549717105a5fdd18df4d5bda599006aa5ce3f6062b625b740028de720d99608e3e121fb98af28b6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XO+:A3k03kHRJw
- TLSH T14C25AE13EB9504E9D10AC174AAD68A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 948KB
- SHA256 089f158155bae439dae25efd5fe05a35712b0c75606d55c3e5353b39a2b2cb05
- MD5 a0ffadfd70679c6f21c79de549cb360c
- SHA1 32da4502ba1cb075cdf56421bed0151adb0a6f76
- SHA512 e2c6299ba502be03cd1e2a198dfb11ee42b2887654df21d82172c82b35988233629130a899b880c0ffd15c3b2ab31989e3c37b7a086cc5d8b822297df5f077c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XOQ:A3k03kHRJA
- TLSH T10F25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 948KB
- SHA256 ab0b8d227045e93de3d7a1913a9d2e4feedb6e7f7af882aeab5458db8a6144e4
- MD5 fce990f70f743783fb0334e4a073bdbc
- SHA1 c207c9f2d334c159210f10e9d2ef6577bffcfa6b
- SHA512 1dfaa15dc2fa111f51d12bbad22e7d472b197462f3b55af819b70b56bb249b952d9e78189e3db3d3b1ff0791bf0094ed936327044b4969c02813c5d8c843c6fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XvX:A3k03kHRJw
- TLSH T11425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 948KB
- SHA256 ada1bbb8f35bee82ba1c5de88dfc10d83ddaa430dc80c4f4ec996889d5cb7840
- MD5 e3dd1aa9bc3916784efdd765eb3c41ae
- SHA1 c54d614ffbe965ae6bc6d6e0b70832a828a9491b
- SHA512 e5d3360b4f6611b5e7965cc2ccffccd4a3390b11e3132524a837888793f5775614d6b020280c5247dfa8ceab3c993de26d8f49ee2d7a3bcf4d42b11c48e320c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XlL:A3k03kHRJS
- TLSH T17325AE13EB9504E9D10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 948KB
- SHA256 4f04ae02fa3ded5e14de570877c77841d767c858ca966139713f75120ba736db
- MD5 995457696175bea15c09ebc58faed22a
- SHA1 d2adb6b9783cf14fc70501344429acfa6b62afc8
- SHA512 ee170a9b7a2b6218cbc282118d5d40b4b096b5b711696f2beb3eb92a5f90b4fea3d8d4e2ce2b9dd5b57b9b36c75dc27b75359be0ac9fbc751576d9fad3744c59
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XDM:A3k03kHRJ/
- TLSH T13C25AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 948KB
- SHA256 719367b49f548468fdfab4ac7522909629e43761fd26de6b421c4d28a1eea7e0
- MD5 b4217f6c550f415d8f97d66e4b115350
- SHA1 2b814c46aaf28a503131e260d7252fe64fdacf4d
- SHA512 65e3559ee8ca99ae946c209d06e8d38e81c1e81f013f8a6eb10bafb3c7f5c226d2137f6afd7ca4917f7029bb32e09e4b17e18ae61984c747370130c14e73625c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8Jyasm30XEh:A3k03kHRJx
- TLSH T1D425AE13EB9504E9E10AC174AAD64A23FB75BC56176093DF2358C2152F62BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH