Analysis
- max time kernel
112s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 01:57
Behavioral task
behavioral1
Sample
2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 922KB
- Sample260716-cdarbses5t
- SHA256 5f79b7e0b56f00251f160ec48904ccbd817b639e394366fcbc5f9526e0dd1ee3
- MD5 4c50e3c781812efb111c735d30df9f63
- SHA1 4bc9831e6b8828e36b11046cf04dffb989ef4bf5
- SHA512 b820ac6d566cec4c9dd5d27eb87e6439e746ac16d990fd9a0c0b2595c1d748a4a5d5e6e54139532346578402014c73b3c2345e2e226d4f10b660acb9e3873bd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdX:A3k03kHRJX
- TLSH T12515AE13EB9500E9D10AC1749AD69A23FB75BC56176097DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/2924-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c455-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b311-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2924-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/4388-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b316-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d3-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d5-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-242.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019853-267.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-412.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-479.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000188d7-504.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-595.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-621.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-647.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-751.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-794.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-801.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-832.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-882.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-895.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-902.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-922.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-961.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-992.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1029.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1060.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1091.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1104.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1141.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1160.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1225.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1316.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1354.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1379.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1386.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001886c-1495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018872-1532.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a00000001887f-1575.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c455-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b311-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b316-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-60.dat aspack_v212_v242 behavioral2/files/0x00040000000188d3-204.dat aspack_v212_v242 behavioral2/files/0x00040000000188d5-211.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-242.dat aspack_v212_v242 behavioral2/files/0x0004000000019853-267.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-412.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-479.dat aspack_v212_v242 behavioral2/files/0x00040000000188d7-504.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-595.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-621.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-647.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-751.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-794.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-801.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-832.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-863.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-882.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-895.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-902.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-922.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-942.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-961.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-992.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1029.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1060.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1091.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1104.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1141.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1160.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1185.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1193.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1225.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1316.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1341.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1354.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1379.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1386.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1387.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1394.dat aspack_v212_v242 behavioral2/files/0x000800000001886c-1495.dat aspack_v212_v242 behavioral2/files/0x0008000000018872-1532.dat aspack_v212_v242 behavioral2/files/0x000a00000001887f-1575.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4388 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\bin\jinfo.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java-rmi.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2924 2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4388 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-15_4c50e3c781812efb111c735d30df9f63_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2924
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4388
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 922KB
- SHA256 5f79b7e0b56f00251f160ec48904ccbd817b639e394366fcbc5f9526e0dd1ee3
- MD5 4c50e3c781812efb111c735d30df9f63
- SHA1 4bc9831e6b8828e36b11046cf04dffb989ef4bf5
- SHA512 b820ac6d566cec4c9dd5d27eb87e6439e746ac16d990fd9a0c0b2595c1d748a4a5d5e6e54139532346578402014c73b3c2345e2e226d4f10b660acb9e3873bd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdX:A3k03kHRJX
- TLSH T12515AE13EB9500E9D10AC1749AD69A23FB75BC56176097DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 951KB
- SHA256 6a3dc22dded71c64fd3c1942795a2eac237e869eeca431571bae247e8f1d88da
- MD5 3bc5082d151f4a55471be9db3778eb34
- SHA1 2a26bd24ea00ad4c55fb7e2cd6b2480efeb71e49
- SHA512 5c2c4bdf1177cf29b22eb2c5d066ca841fa6bc343e649c57ade768b641aa4dede4072255f2497f20bb6392fe9532d2ed771afb2e24b52c7bae2bd79338903eee
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdIP:A3k03kHRJ+
- TLSH T14025AE13EB9504E5D10AC1749AE69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 969KB
- SHA256 0aacb190a01950695741713e9182e6d2312a3120fc9feb34be5ee069fecf9087
- MD5 44d14e3824e5b006f24e6bbd980632be
- SHA1 093cc1651f0571a9c8365740767beb9051590dde
- SHA512 cfd4d78f6d52089ca556983ead1fc669942f374530590f8618befd30197049128c2df125de34e90326a8957c6106e8d3e6666b05c61aa01af9041d6787e5ec0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdv0:A3k03kHRJv0
- TLSH T15725AE13EB9500E5D10AC1749AE69A23EB75BC56177093DF2358C6152F72BC0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 975KB
- SHA256 d056e634c38ad6fe05160e2f14456f314b2cc33818b2e21ba23c155b82f04923
- MD5 04499b1f6d29d52a3cfb0178a3343dd1
- SHA1 b34edff7b6561e72a32a53a387be82bc10249292
- SHA512 df1bc27777d73499379022e5b8deffe0bfaeb5024457c03fa2bc60692fe6fa4d8d80d091b17d7e2b8bf64b0d0bedb9e2b263dd125c5a17288458fd9110db57d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdxfj:A3k03kHRJhj
- TLSH T17225AE03EB9504E5D10AC1749AE59A33EA75BC521B6097DF2358C2152F72BC0BF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 2d2cd042e020c7575f21deb07d587715d338251ee197e5e27cdf44ce17d910e3
- MD5 6331c8918fa76e028092f47d113332e7
- SHA1 3a7d3b6b883f1c4d9c6e877c7cfab5a1a1912f7b
- SHA512 177460524c58768449c25b4d1f2db292d5d9eefb645b8daf2257efd4452e9fa07d7248d1e8c0e7f8aeb1f8cadf10ca316ef2d5231aed2fa071b5cf522d294035
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd+0Le5ji0hmxNrM:A3k03kHRJ+Pji0Aj
- TLSH T115657D17F6A402B5D067C1B9C6D2A66BEA7138421B3086CF1358C7283F67BD19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 937KB
- SHA256 731cc2f33cef67924ba20097d39909f2b3806cfc532595104ccb154a51aaff7d
- MD5 1d2ce870925c8d89760e2d58538add14
- SHA1 761fc482a649f378634305cd9791c592f2503acf
- SHA512 756c77d1f2e193a52b683c9e9d11ee56de82c90ace76e42302a976c6a7a0279c4f2dfd793ffa20aaddd364158e21ad8a22a73f0e24d1ae7318e52898e13b1244
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd4a:A3k03kHRJ
- TLSH T19E15AF13EB9500E9E10AC1749AD69A23EB757C56176097DF2368C2152F72BC0BF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 970KB
- SHA256 f774bb93eb0c79abe35088db11af5749a79f4b737a13316e6fe0eee6cef4d92e
- MD5 879a35a230ad8187654960347cfbf9fc
- SHA1 b415204c9903819a054cf99fee471f1663855201
- SHA512 5791d909e89118f56dbfcd6831070721e823fbc135a478f89d021496919519419bc3d8f80c352655a1d48599b4d5d9b74bba26567e1b71322d408e96833c2c8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdzb:A3k03kHRJzb
- TLSH T1B325AF03E79500E9E10AC1749AE59A23EB75BC561770D7DF2358C2152F62BC0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 946KB
- SHA256 a1d35ee2c357dd96389f1c788488861ad08726f5731096d9c3bf6546a1f6831e
- MD5 037a0b9ad57650fd858b7d9ecf363162
- SHA1 6ccfee8220c4f0a625f270c37b09d370c4ea1011
- SHA512 b43931e37abbb7d21eda26b820a990b6f84f66d1331e1f8370844e63eec4cc8224b8fd2c5d8cfcdf3a53658bea5903326af15c9881d1708ffea0ba0b8c5cf95e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdaZ:A3k03kHRJM
- TLSH T16C25AF13EB9504E9D10AC1749AD69A23FB757C56176093DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 946KB
- SHA256 9dbe66ffb09456ffeca052b66790b340a3a21db614ab6cc1cec33371a3b66e47
- MD5 28f359cfc55dddccdda352e56a17d273
- SHA1 0e8ebe5efc274dea24e937488c29c3fa79d03177
- SHA512 81e80770f05b1c68d2688a6d7c5868ce14994dd386d385923f58525806390d1d845284c896db01036af17a323330724f74e7502e73b29fc4561861db979dafbb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdl1:A3k03kHRJD
- TLSH T17825AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 946KB
- SHA256 c02d089c22411685968ea75268ef6d878dec2d6bb96102e7758a323ac3ac654a
- MD5 40682362e10daeb430c3b7e49ab2fc84
- SHA1 f5a5ce793329299d5eb411d4ddede55dfeb30034
- SHA512 709082123edfd63a19a56eff8ee634d16e27606c14fba87b3ae2eabd3b7b075e968d8c7e773fb397aaa0501e2add4b5d5bc0f2f753d2375fbbad47da79547e18
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdR6:A3k03kHRJo
- TLSH T14125AF13EB9504E9D10AC1749AD69A23FB757C56176093DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 946KB
- SHA256 2986bfbf67c0ba9e75b843647f3465fb4b5de2addbc3ac15bb81239e9ac1f705
- MD5 5ea58b5a2deff33a574b8dbcb0c631a5
- SHA1 a3aa91d2767527fa4b680099f0292f0f6bfc04aa
- SHA512 587da29d5decf9ac8235a74d26be11c4fcca62facfe45a792cfb050c04be4148fb93eb605d6e80bfe80b50365b7dde88c419f97dc703f4cc9ed3f881c111818e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdPN:A3k03kHRJV
- TLSH T1BC25AF13EB9500E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 946KB
- SHA256 17440668644daade877ff587a41a87a6af573baaa35ccdead05d8bc92f8b5d29
- MD5 b689cba1e1c2d85a642fb0054f9a84a9
- SHA1 88c3f19bf3a7ece68e57f392e9ad6bf37776fa03
- SHA512 dea1f7afd4518537a84c85fa723791638264735daa1f41d4e57a256affb56f42535b2156e1fa9dd9ff5413ddffe945a6d1de585cac7535eeb80fc8f6c3460801
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd1f:A3k03kHRJN
- TLSH T18525AF13EB9500E9D10AC1749AD69A23FB757C56176193DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 946KB
- SHA256 4008c85cb6e15e2f5db5bee40997f04829a97b70b72b6816965d2b63ea1e7567
- MD5 68f4e5be8f712ea6a89c094046d56838
- SHA1 64dd23f5fc9a5d41b66d2a0d0d689434746eb62f
- SHA512 d345c0d42429e7aff85a9210d78c4cfb6fafc010ee89a337255cd8e8566af10ac84e45ceb43fd0d7ee6c7e0f9699707edc5acb89f9752d958dcf1df8b9bc3adf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd3o:A3k03kHRJ4
- TLSH T10625AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 946KB
- SHA256 ac9cc806c69d091041bc39a2a72da88a2f0d46b7a604592b4522138e2e3bbda7
- MD5 db5df4963f46840dbb36c9ce738e6202
- SHA1 30241005c9fe1cd91f8322817b47985cb79a447c
- SHA512 2a71a6141bdba76b2a9afc85f5004624ff24fd73b1cf0d719e9565f4b54a0bf3efa937b59e3505e1e9b75f71d30a408a9014bd22105e9dda44f3cee4b67c1af1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd7u:A3k03kHRJK
- TLSH T1DC25AF13EB9504E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 946KB
- SHA256 524bdc59fb65daa617f445547f6610faf28be86074f536461cf67f985225ef27
- MD5 26fc962aad2d1ff54c830279778c412d
- SHA1 34243c7d2dbe5360a4f9fb6381e290c006b21ffe
- SHA512 1c9300fb9a679e69dc67079cec7ae82e224662fde5afc999c2209660b83cf941767decbbbf54e4c16214ca3328000586d0857ee39011163b3b481da822d6daef
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdp9:A3k03kHRJr
- TLSH T12B25AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 946KB
- SHA256 d9784635cc86b2688dbf9f79b2a89e7573f54031dc2f40dcf7b98be19703fc3e
- MD5 2ad6599d6c82158d539dfa8000fb44b8
- SHA1 2e51913b68982544929a415b62098c468b5a3bea
- SHA512 5e89b55cd4d92f9851c9b5fd8b2b9b7258098ac6f8455f2835d2e01820f71f07f861e1a5b957d3dbca863a930e6e5aab8b74d60260b1b899e6463fed7d030ace
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdFc:A3k03kHRJi
- TLSH T11E25AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 946KB
- SHA256 f8d6e811169b6467b987f45a5fdf201210f6f22cfa724958a98ed4f1bc1c29c2
- MD5 4d6d4b55e17d7c973a3bf4b64f23b879
- SHA1 7d169d67642360a74b2509582e37b10df13b77b8
- SHA512 0a65c1c9fca6fd7125dd79508a196d5e539f3052c139e0859f20d6cb20724df45f1d5307428f711afd128d6c3bce6cdde17294f2460ad219603a2bf8df66a0ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd+p:A3k03kHRJI
- TLSH T16425AF13EB9504E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 946KB
- SHA256 fdebb54aa2177469a54acd98e3e4c26df298ee8c533a39b5593f6d50d8e5bfd2
- MD5 7707fe2231dded684a51d75ccfcde9ef
- SHA1 a1637b8bac99ed01d42cfaa661d7742d850d4442
- SHA512 7a05e4d5834a0602678a226bd21b42dfc303ac91e8160decebc74e8636797eecc5132088b359ba9e486d7430620fa1e510668c50f2cf843e3a1950498d858e10
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdxN:A3k03kHRJX
- TLSH T19025AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 946KB
- SHA256 494d05979b1a431ff9b55b28ddff49fc958cf492877b9892055dffd6ffc8c952
- MD5 3e29f5deeb61ce4d8747d90c0d2e82d5
- SHA1 1630ece0c22a921ee7568df3de559be5a18740c3
- SHA512 d0ec027a005e209c669bbe2a7252da91851a9aee2b90fe3144a888e2145e0df7bf872735ae3a70af2efbca969a27bf437bbaccb2cb60a69a49332e1fd2a05700
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdTF:A3k03kHRJR
- TLSH T1AC25AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 946KB
- SHA256 7e90cb496ad7565cb64e471683ae4117ba0fbf59afcdc6f64925e2bde9e8ea00
- MD5 10e970aa6777acdc4548b2cf550146fb
- SHA1 b460d5d2d40143ce0e242b5bff2d980a6105e88b
- SHA512 c7ef4f0cbca23dedd4912a7e3a38eade48db2afa8697072c93d1ebaaee7545f8fcc266695aecc878f8001a991908dd838f40b4f95857fb234276d600edb5e4d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd8C:A3k03kHRJ9
- TLSH T11425AF13EB9500E9D10AC1749AD69A23FB757C56176193DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 946KB
- SHA256 2b5cefe820d4322a7ca0e03af2b082b505eff03a858670d982e6f294de4634e1
- MD5 fa34b7ec17eebb4597f4b8cb255c3e2b
- SHA1 2da37a2392cd1d9e1702f7f9ec08b9539260805f
- SHA512 5912831b6a58b4e465319d856b2aa2fa4ca5d67d33475b4aa62eb28d8f5c3e4e231cbd408c39dd73fd3f88501f54608ee20c05d19405121d595cfa6edf346421
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdXw:A3k03kHRJA
- TLSH T16825AF13EB9500E9D10AC1749AD69A23FB757C56176193DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 946KB
- SHA256 1d8fbc25569cd10d372e0ce4c0bca5554fb4bf9e7fc235ade5125e8cdaa9a374
- MD5 b09a53c62e127af97845f43c44da5f0c
- SHA1 a11628beab27cdd6e289ef029e7a8b44ebe56065
- SHA512 ce27561349ecbf67ae001218c30eb2ffbc2fc73c3a8dfedce1f0f3294cadd9a7b6e8ca97305753af9c746e637aea054ff86ca96f7346c88d1991bf86ffb015f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdGT:A3k03kHRJY
- TLSH T13625AE13EB9500E9D10AC1749AD69A23EB757C56176193DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 946KB
- SHA256 e20c8de823a4fd1c4e717daf7acd2bb8f76ca7260224e7526566db23c931e6c3
- MD5 ae4ab718ccbce1fde5799439825affcf
- SHA1 e3d9409f87d49d73de96d5ac128ce2eff6954128
- SHA512 9870ea0189b2f8456020b974c22fc1a7c2b085dccafc84e77d9bc13fb952d41e8c033029b8737dc3bfd9f4409eb8f89e9541663e6137ab6efa4a6c6fd183577b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd+u:A3k03kHRJn
- TLSH T1CE25AF13EB9504E9D10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 946KB
- SHA256 8bcc734706addd98936938907dfd1747f05697635f6b890c617078febfa03573
- MD5 3767a249e8c3020ff516374508831dc0
- SHA1 a9091fb619789b170ee8cfd0e31e419c5be02151
- SHA512 6c63a4cf974bbcd7271f1892882b520796651a1dcd376bec7ab09885c40fb64c09c7513a84fef62614e21e2dce384ac6771f12c5140105401a65b21804a5a6d0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd4b:A3k03kHRJe
- TLSH T1BC25AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 946KB
- SHA256 d7ed112da0e1f0dbc3c00be144faaa3b31264f875d6670e42336fe24abd5345d
- MD5 eacf7c60ead5f859ecd765f5abf20025
- SHA1 69f891d6c3e6012cc3fc9f72891bbd47d13359e5
- SHA512 86c886be4464df998189802f6c48d7a39faf1e851cf59cf53800323fe0bea8621bdddd6f40aeb04bbb234d08a0d8c27dc87a0af679ed8da7d59002bec4714ab2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdmf:A3k03kHRJ+
- TLSH T1DC25AF13EB9504E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 946KB
- SHA256 31bab14ad398c50e80bca36f7c82863380a0c59acb05baefb97d820d9e9b67ba
- MD5 c6445e557c713d9705253c2853e3156c
- SHA1 59cf7d8f28d92ee9f332f20cc5389dc85ffa171c
- SHA512 f0f7dfe81606cfc3c359ae8e095f3cfa5be0e8aea21cd455c6090b3b41b001b9e84f1d624556bc6ea202c7fbf5cfa4901b1ccf34c94ea09451462cca34f3934d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdjK:A3k03kHRJe
- TLSH T19525AF13EB9504E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 946KB
- SHA256 4f412970c3b9b936957162fa98c0c11f03c9ac52e2a01094e0e99e6a6e62346b
- MD5 cf39f2a1effc385e587da4024b2d48ca
- SHA1 21c0afaeaebb256ac79d2370bfd740a5cda46b93
- SHA512 b4be2cb052135ad8882ad6ed1ca1843a53d9f07e8ae770122ae1ad5843e5b1633bbe15bd887a2d4b0de56422e297a96e0f010ec071e15490543b819c3565e239
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdEk:A3k03kHRJD
- TLSH T1F025AF13EB9504E9D10AC1749AD69A23FB757C56176093DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 946KB
- SHA256 acc7ae22b35c2121db870ddcf01e08c9e851657550298c919feef3953212cadb
- MD5 828d6fd82cf97693834f9b32c18c3979
- SHA1 b89fd5f3cb417ec8685523389b93ec0157c4ebcd
- SHA512 3b78358a9318582cec06400c29d8ee29c5d6d647463f5b4352cdfa093600563feb6f227a7e68e3edf9ae9357a050c12459467258cd4e9217962c54f9dacc081f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdN0:A3k03kHRJC
- TLSH T1B225AF13EB9504E9D10AC1749AD69A23FB757C56176093DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 946KB
- SHA256 da00032f09bfbfb4a5f59d0b12937d7cda4356fe336e8a4fdf77c7d1a48213ac
- MD5 d83d35a9507ed01e26ed308eb81370c8
- SHA1 64b5ab8c07070c4187f23d07af3d25de83269c3c
- SHA512 5b78a6f9028c61ef0cd2a715a5206037cffa71e08e532ddcc95f060bdb759392e1c5de2db7bee8fc1c6bbdb7193a8905b54ba71a27fe24a0a6f51780655eb5bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdQg:A3k03kHRJ7
- TLSH T10C25AF13EB9500E9D10AC1749AD69A23FB757C56176193DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 946KB
- SHA256 da3e950497ee552e6f2b552a886ccb389fc02b45c0c380d63801b300b3b84713
- MD5 1d981bc0d75806cdee1d5b943fdd159b
- SHA1 ecb7984caa268a80e2bd6ab7e0f2d474e728e25f
- SHA512 80d9c36ebda87365b8b9774ab3ea53454bfeb8cc3265506a4fe20bbd21ad441c658a523e585e5d5037f598f651cb73e6dec3c8264c3063ee52c4120c953cdf9c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdlr:A3k03kHRJt
- TLSH T18525AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 946KB
- SHA256 9a971c3a052351eb4c2dc6e29c3ed281428ffa4d50e08d3bb587871092a08623
- MD5 843c2cc1e13e48952e0ab20063675b1a
- SHA1 85e963ca704d6987b03a51b6d836890782e7c496
- SHA512 bf8f429fd6cdce460b049130d32f16add192ab920836bfeb4c539e796fdfed03caa63a8862b4021a9ed13df0801f6f4cb312e9a44d2415acee42d336a5c11ef4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdvn:A3k03kHRJv
- TLSH T1F925AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 946KB
- SHA256 5bb6882b8ae1943adf46d530d5b192d9f3d5674dffeecac2418c202e0958c546
- MD5 17bed687274d74fe3e02ff4232c4c887
- SHA1 dd26d39bd6efa0d9e599cd3c5d699bb40e8c4ca0
- SHA512 657ed7eccc7e8c577f08900dce2115c44d4ad2abe10ba8a6532fd49e70ad3cdcea42b2bb6d2744121d945d7628858b6d065086a1ab1414a3ab0f11a1c7219d37
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdbx:A3k03kHRJV
- TLSH T12C25AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 946KB
- SHA256 0c80e77dbc4f705aee806996a4402cdda6ad100267aee7ad33b1877f659eb27f
- MD5 af3034b155d261978f34fb2888e1aaed
- SHA1 3d60901425f54475473b89e1d83b38c0475f0086
- SHA512 7c6ee2b18da4bab4335c2aa293b00d38c73e40170439b6d3bc9368bd67636cb681b651149ba055004beae62ed11114eec3d04eba95b807a223640a6c71bcd7cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdJA:A3k03kHRJa
- TLSH T12425AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 946KB
- SHA256 b717acce4121fd8c6c9bc2202f6e4a0f0941d58dc53671856455ec99853f501d
- MD5 d34ac40dd11067e0b3af6f3e42fb4313
- SHA1 dc591178cab7d4ff1e3836689cce43a4bb8cc5e3
- SHA512 191b89ab8f7548e39920550c18b6e87072bf5cd25113a249406c0e558cfa6db40d810e41a0996eb3f06d02dbb18ec82243e44c68f97f3f7a000f51f4d904b7e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdC9Q:A3k03kHRJn
- TLSH T19825AF13EB9500E9D10AC1749AD69A23FB757C56176093DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 946KB
- SHA256 097938cdf03ae3ba136971b6bdc13362b61b4aff08e943ae6ca09eb0e315e2f2
- MD5 763d6b7b794224fcfb0c86c235d47030
- SHA1 9e4becbd2882629847b97369fb86beaec30d715d
- SHA512 638ee7e2ea4af41a60ccf54a3a25cd4dba371e016da8be15fd073aee74121dca8df9a23aa87d6c7472c44ad5d9eaba61c595da3d93c9d76b11af8ab8320fb77e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdn4:A3k03kHRJ4
- TLSH T19625AF13EB9500E9E10AC1749AD69A23FB757C56176193DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 946KB
- SHA256 4244961eea9801a19dd4ddb106f235c06f7ed0617e8dce02712c9282fe7d4061
- MD5 21ea637cef926f4c9f66873ff7db820b
- SHA1 d1947a0135fe0a6ebabb40376d289bf5fa5eef23
- SHA512 7d425bbb3b35c2a8c73d467d36213a13eba4e0c971f990172a567ec6b0048b8f655bbfd6654b302af3486f12746b2032d3675d7e0d34b50304ac6528110fb6d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdGu:A3k03kHRJJ
- TLSH T11F25AF13EB9504E9D10AC1749AD69A23FB757C56176093DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 946KB
- SHA256 b06a8afe789b49281a13a72da7f2e375a8ae3c88e1a613721da7d3fa947f29cb
- MD5 98fd9e04bb117559aacecb74b04e3739
- SHA1 592cb40196c6612c1d7c64ecaa761325fcadcb5e
- SHA512 514e98b557e8289658c955a6913c916fdb68118e87d2898c359794bddd5bf21a14ea5579b9de31c9a9591e235ba82a31f5310b06d1ffc89fc923f00438d20649
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahd3j:A3k03kHRJT
- TLSH T14F25AF13EB9500E9E10AC1749AD69A23FB757C56176193DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 946KB
- SHA256 edbbc63071d7f5069a8d3cf448ce3d6a2eb339b7f2a7acab10d45f245485a4a6
- MD5 0776a688bdbcc3ba8fbe9b067b8c1ecd
- SHA1 93549ba51b69cdc30fe8f06f5b51685883aefd59
- SHA512 dd23951801a102a44bcb8e7e28ae2975b21448a4998d97340a217251a4e615d27dbd03b242f7f3e4c25d10aaf91c87278a2cad5d4a5ebf9dfe07b8b1bf5ca42c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdig:A3k03kHRJ7
- TLSH T1DF25AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 946KB
- SHA256 beac99db9cdd5e7a31c04839e286428c9dd321a316c45f3192f92e3efece7620
- MD5 f83aa6199744d53cbcd73a75cd615714
- SHA1 48fbdba1e34f47bfcef51ab34a53616fa88cf73d
- SHA512 8644ea22ef359c5a34729bbf80a9fed2ab05f84e9ae5ab730574fc5d633d2fe2d64eb6787af6bb6b9e9148f7ebd3b453e91da2c9502dba4af1888f5b1e857098
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahddI:A3k03kHRJy
- TLSH T1E525AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 946KB
- SHA256 2ff01e35cfc78604c616a38d8ea140a766929dc34fbdc1cdcd37672523fa42b3
- MD5 75f024621e4ea309f7903becabcbf2ec
- SHA1 c1d957ac6f8936fda0d552c9c6db91cc0fd29df8
- SHA512 54999b5500daf9818707b4cc44a8aed1634a2a82aa6fb94161a3910b58c499d0333304eb448d18749793729687afa077ef86c75175f73d8e562addf0b0b16e86
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdPo:A3k03kHRJQ
- TLSH T1B525AF13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 946KB
- SHA256 d757ae0b0b9e32c8ececce62cde7eb8683eb99fed0180da4bcf487c2e6385477
- MD5 74070f3ffa31d21857d87ebb0558d55e
- SHA1 c864103a76b7665f2efe6b1d9c7d7cc1b535d774
- SHA512 45d604d3fda6e340887012e4f019a84917b28b00ef1743c6052c320a737e575c32575f2352f8fdfa42b5eaef7045236ecea5540f1a5411dd3312e74ccf81ea0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdU+:A3k03kHRJd
- TLSH T15425AF13EB9500E9D10AC1749AD69A23FB757C56176193DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 946KB
- SHA256 47a04be27c911914801446f8608b09d1e9b5411498d13117dcb8525300b73b83
- MD5 50d33760e682b5d4c94dc9d54d932f62
- SHA1 0cea1cb69d357543592748fd685c8732404e2ded
- SHA512 71af4c3af3ee2302341839c3a6325a463ccf7e7a324dbdd423b7e66e7c2909694965698f6adb7c7c1a0dab0b22b370ff766e03145e61f8a3481d44885fe79bd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdcQ:A3k03kHRJV
- TLSH T1BC25AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 946KB
- SHA256 db76de719a46fc32e6e969b0cac1795a712090f6eab095a96d260955e3661462
- MD5 8a87125068d0fdac47dcfc3199cd6623
- SHA1 98436488c2effd1caa608f9d513dfc5881d8c6c5
- SHA512 7a79312b4b203f658d0804234312c7b3b0117a0d8c420a2e9ae813ed184d3d08d4c84a691606a53eb7464e147baeefa5c167e31128e9a96e1faad8c9ec5a5d80
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdFX:A3k03kHRJB
- TLSH T18225AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 946KB
- SHA256 db4806f396061620c00147529339a1c83098ccf69b3438f4ff53ea38de6d360a
- MD5 6bb14b4a4473c076b082896683694fbe
- SHA1 8f845d35f0ce3d06307ad35595c96290b8a7fec6
- SHA512 07d9c85a0cca3118373478acc21ea10d5999e10c9037922249935b29e2bccedd7ae4d1c1c8b20da6c182a84ff81587cf32d39e112a26e663984f40a7c7709419
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdnL:A3k03kHRJL
- TLSH T1C525AF13EB9500E9D10AC1749AD69A23FB75BC56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 946KB
- SHA256 3ffafe1978caeb43a147472591b2f90b0ad32027197891e54551d9ac0cadbad8
- MD5 1727c11493a43c44072cdeb2efb0dff7
- SHA1 e7c1dd2007620eba516dc98ac792054a1af6d5f2
- SHA512 54839d944d891649d52395bd8d442dbe3fc2dab0070b65a3cd0803f2b2535e3a1a504398134aac404ae9f622922ead8cbaa651586995b0c8cd04e12b85b7dcca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahddM:A3k03kHRJG
- TLSH T17425AF13EB9504E9E10AC1749AD69A23FB757C56176093DF2358C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 946KB
- SHA256 2ae9f217be89837722903f40c14d8fcbb85f7df5324c633b738c839dd23fb3d7
- MD5 7fc809cf3454f647864ff0616dad13fc
- SHA1 87b31a19311a185174a478788b10216ebbc61cea
- SHA512 6f15f11db22815bb37cd6200496636395b91d21e26f4556f42c7ceace653bb29699b757553bd531a5d94ccc242a796b76f2b723d3381ff8b8beadff005b4bba4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98b8JFxEahdOh:A3k03kHRJY
- TLSH T15825AF13EB9504E9D10AC1749AD69A23FB757C56176093DF2368C2152F62BC0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH