Analysis
- max time kernel
124s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
23/07/2026, 17:29
Behavioral task
behavioral1
Sample
2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 929KB
- Sample260723-v2nbfacb69
- SHA256 558827e70fe13bd23e956fbf527fe8558e627989b502b116b3205557e72ab3a6
- MD5 782bd8a7b2ce4df91201dd8e73f9f9b7
- SHA1 a03b91daf8028c7c7b823ffaac06cd60008c9533
- SHA512 3014b7a5d921e0467351ee746f0f2d5367e605e037cb831c17ccf34ae1df965bfe7acb8133ee01b3555073ff8a170957427c9b9e1f3525d793dcf994aed10af7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaP:A3k03kHRJG
- TLSH T1DF15AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 48 IoCs
resource yara_rule behavioral2/memory/5248-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c438-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b301-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5248-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/1412-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30f-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018985-202.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018987-209.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a65-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a66-235.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018989-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-289.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-327.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-365.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-409.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-422.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-447.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-461.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-463.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-476.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-513.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-550.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-623.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-648.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-727.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-752.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-783.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-809.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-842.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-897.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-930.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-949.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-974.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-999.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1030.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1074.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1106.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019ded-1308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001891e-1482.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018924-1531.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c438-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b301-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30f-41.dat aspack_v212_v242 behavioral2/files/0x0004000000018985-202.dat aspack_v212_v242 behavioral2/files/0x0004000000018987-209.dat aspack_v212_v242 behavioral2/files/0x0013000000018a65-228.dat aspack_v212_v242 behavioral2/files/0x0005000000018a66-235.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-249.dat aspack_v212_v242 behavioral2/files/0x0004000000018989-262.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-289.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-308.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-327.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-340.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-365.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-384.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-409.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-422.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-447.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-461.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-463.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-476.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-513.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-550.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-623.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-648.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-727.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-752.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-783.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-809.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-842.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-878.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-897.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-910.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-917.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-930.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-949.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-974.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-999.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1030.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1074.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1106.dat aspack_v212_v242 behavioral2/files/0x0004000000019ded-1308.dat aspack_v212_v242 behavioral2/files/0x000800000001891e-1482.dat aspack_v212_v242 behavioral2/files/0x0008000000018924-1531.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1412 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevated_tracing_service.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE$ 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5248 2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1412 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-23_782bd8a7b2ce4df91201dd8e73f9f9b7_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5248
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1412
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 929KB
- SHA256 558827e70fe13bd23e956fbf527fe8558e627989b502b116b3205557e72ab3a6
- MD5 782bd8a7b2ce4df91201dd8e73f9f9b7
- SHA1 a03b91daf8028c7c7b823ffaac06cd60008c9533
- SHA512 3014b7a5d921e0467351ee746f0f2d5367e605e037cb831c17ccf34ae1df965bfe7acb8133ee01b3555073ff8a170957427c9b9e1f3525d793dcf994aed10af7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaP:A3k03kHRJG
- TLSH T1DF15AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 958KB
- SHA256 13d6125e22403be8959663021f8c034abcf73a9425054c4538fdd87cb1068c28
- MD5 0755a4b7dcb6fb7d7abcecdf19fbb622
- SHA1 64e7b8598e22e0744f08a6b53fca2492ab73a1d5
- SHA512 eb501d8b05b485e6e1499b3ec1a2895a11681245b42c229034a146d1c6212fe83297a4d5c7c4ca6ac6fbf7f99139d844787a2382fea2f929fd178899405fa903
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa5P:A3k03kHRJi
- TLSH T1C925AE13EB9504E5D10AC1749AE68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 975KB
- SHA256 c95278ddbe6dab450bd380607c3398f521946e036e8a36f22a98fd4ae3dec461
- MD5 391bb4937b21744e8857ea383553ea36
- SHA1 6bc4adc57fc7f81aa7bc9a2d14897a9e608eeba1
- SHA512 9ca18ba3617f4074eed04bfaade8de34a98c0c76e59474f2f08db23fe0b4cb8f2fe0a7dbbb4e61d0bf2d046590e0bb2a4c6db00a0a7da95cd744cc908142813f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaS0:A3k03kHRJj0
- TLSH T1F725AE13EB9504E5D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 049a4e9487a3e448987b795edf467d5fed0e7aa21773009160e87947dfe0d4a1
- MD5 e1f6e1e4b277f4c6c802c359ebb5ea94
- SHA1 3cc80ad31c9be0bbc187588c1e1fcc132ad9caaf
- SHA512 ab2130a2ee09e7ff9a94a56f850d1a751bbef9e30811cdc2363d8ccda1f1446c8d1da00b1c36fba89643dd0e232ab78344e3b75152d2d1055ae102e307b2f8e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaH0Le5ji0hmxNrM:A3k03kHRJSPji0Aj
- TLSH T13A658D17F6A402B5D027C1B9C6D6965AEE7138821B3086CF1359C7283F63BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 943KB
- SHA256 22bb53d9f5db0d04e04f1dbc5803f2ce636cda5efd665a9702551655ce3d25ca
- MD5 14bfe9d0d35d71da9eb77cfeecc26d90
- SHA1 708449f6993ce93521442eee1200c4a40e475486
- SHA512 edd21a5237bc7594b3900ccf9183591375adba7176364d3a8351482db06b1c4a3c6d075dfad4b2a2200ce49da8d5869c21e3950a5b03f67520ea023d0c655614
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaZa:A3k03kHRJ
- TLSH T18525AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 952KB
- SHA256 9077c6ef96163befef6da75cadd3ba8d9b4afc7bb01a8a050dc3b0921e93fc98
- MD5 b8789d999bc86fd029fd6b22c10aea9f
- SHA1 977ead3e68b62f23f1281b0c324b149c02fbb17e
- SHA512 46bb3c6b7fed56cc3199e4eea67cc1b9da27f662c9b30cff7d420764476cf1f66fd6c2ad33735244f1c2532d002081744d8cbc49834c374814114595c039dcb2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaxZ:A3k03kHRJg
- TLSH T1EE25AF13EB9504E9D10AC1749AD68A23EB75BC56176193DF2318C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 952KB
- SHA256 19037fc268e073694e902e6851ff7a52898d2662b7fcda72033768842292b101
- MD5 1d79a6f87e3f4237a30aee800be2879f
- SHA1 e003ec289fe8d0ea2e7a417ca6ffa9d8ad2f3dc1
- SHA512 82195c69d832c88de843a71eb86b2fc05aa48d7e38d7fd836096d4aa7ed41ef2adbe3b59b40a8bd64d3a3465d3dace187e02d362c97fc7e1f37c7979e3a1bdf2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa61:A3k03kHRJ3
- TLSH T1C725AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 952KB
- SHA256 dcf09a8291b8d61787f38e0cb03d2fae9ebfca1ed2d9e1de6ee46dcb993e97b3
- MD5 c83122298c3de701bc672c00a9de5fa1
- SHA1 972cccd6f0cd96f4b848cfa923f47754a8d60011
- SHA512 3bd2ab39e8c54f30116c6ebd1f269ad981f2ee02e0c4f7cd6b1ef16c7a61fe7f289c47fe77c16b12764aabf3fe957e18517c2be15b0ed24708a77dcd3e4d5dc1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaQ6:A3k03kHRJ8
- TLSH T1BF25AF13EB9504E9D10AC1749AD68A23EB75BC56176193DF2318C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 952KB
- SHA256 dbf425d31c7acd68d536ed99c99ba2e7c6e73d3757d10b2b2f6a888ea9a0cfe8
- MD5 53f0bd37e8bc00c31badf54da323cd54
- SHA1 a11c32ce2cd1f9196c488814fa6c2131808824ae
- SHA512 1311079be0c4edb53d9f740e74ec50b57d6449c5ad6e4e0e596d27cf060bf2b3da7685039fd6fca427448c3a17106ccdcdff3b5268ee857891306a7f47e0e237
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaUN:A3k03kHRJh
- TLSH T14E25AF13EB9504E9D10AC1749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 952KB
- SHA256 067b3144c30ba880bae19d1ca18cc33dbda1c75504af43ab2664d8450729cba6
- MD5 0e5c65c2a018396404d06778a95624e1
- SHA1 64b2d7fab5c5b0ad8607faa0102d9e02d91c2f8f
- SHA512 b4352b7330b40bec036da500855e05b08fa485db03f757ec6f6e744d277a4e545a6606ad7601152d10c00eae096e627aa6ae46874c468499ecedea714b79bca2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa6f:A3k03kHRJB
- TLSH T18225AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 952KB
- SHA256 b37b558cb10e5d471cef121e5c589ccdcd2ace003df926b368b737416dadb976
- MD5 6357870627b7d7a759f9710c58a93dfb
- SHA1 0a6b723c4804922c9c741f32f6a697b584fac728
- SHA512 7b5e562449f73c3bddcb968120a2ca6d125445f135004868eef7bff8d63d83a937829c363fe7ccc3980672a93fd375aea4888ab0aa4ec9c4918a7be3f527edfa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa0o:A3k03kHRJU
- TLSH T1DB25AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 952KB
- SHA256 85a3083b7eb682604eef0e565b55101a5d0891ba20c469f2d7af44c3d5c61232
- MD5 29ab497c8c087fd77002ab12129eb447
- SHA1 66ccc6b986a174bdc16e45f4a404606c4ecd050b
- SHA512 fde962c156d7f181f99ff3cf1f9c7c244c458a3328e9609960149f1e3256bbed352d6e5cd92b0967322ec5418e7e44354dfae22c48cc5688b1135631c0bef448
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaUu:A3k03kHRJm
- TLSH T19725AF13EB9504E9D10AC174AAD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 952KB
- SHA256 517c49fc198bcc505d7c7c639d605192027b76faca77ac5d19fc83ff16b64c23
- MD5 6ce2f58f66db764001132570d7213fbc
- SHA1 3c5f4e93458e8f608e445eefa184b2d00a6c10e6
- SHA512 8622326edd796c8b10f9d305d83300829f66479312cf28352bc980713b847fd4e8ad5f39c0db2e4a1148bebdef70f4fb953b9b54a258a64f05fe607cbec35a7e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa49:A3k03kHRJn
- TLSH T17F25AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 952KB
- SHA256 fcadf753a79545195b1d0118bdb87cb4ce5c03fb019427567f754fd1e4e09b6a
- MD5 70f7a7e84f5f147870a09149ec7a838c
- SHA1 cc3c7fcfa08be86f46bf52ab38b091242e8542b6
- SHA512 9fa0d96498ed97564a2a9ed764172187d307c10177c6854d0a6180191dd335518310de9f6e1dbcb4a419eb8cee98a54c04d32f70b544368ef2728fe57f5dd309
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQagc:A3k03kHRJ2
- TLSH T12A25AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 952KB
- SHA256 c08223955b95036d132eb484a2bd3b6d105b36892a60fe9abb9b5df1084f8658
- MD5 b856cbaf94257837e4fd3ba41cd01a8e
- SHA1 891cdfaf2f6ba607bad584b9e3f661386a4024f9
- SHA512 9fd70fa2ca8f7d393c0309037e5a10b701a38b967f50f9a604e7940cf3300740c25a802272a6f8bb0be0861cb8de0e41e9e53b662c29c862658d54b86fd49c55
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaJp:A3k03kHRJk
- TLSH T13625AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 952KB
- SHA256 6e2297249f65f8f370e239259069efbe95e496c5dcccdf7b51e013c15940bf20
- MD5 c0f66e006e064eda050d83569ff2c79a
- SHA1 0ae389ed75dccc4f7df652cddebfd89e73834629
- SHA512 7d30fab34913a26aa67d16f3cf86eb879ad112277bb029dc79b8af6769eb195d1220a54b784aac3bc6dbbbe6b6b19743c7e050ea007bc20f9006ebcfa5dc243f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaON:A3k03kHRJT
- TLSH T1E025AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 952KB
- SHA256 1fda06e7ec6171c3df02c70b7f670fef1b5541ae8aad1eb3c31c6552a1919acd
- MD5 97c460f43b8b6d662ae45a64f25bcbc0
- SHA1 99651a3c1f4446aebd6f12e5b8a57bd3081e0068
- SHA512 b2f18412471249cb5a7af24784fe6864872eb10b30241df7b8850b7e6195c90d99d0b64bd0f68cc5420149d9059d1db70b5bd51c821018f0f8e71cb169602cdd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQayF:A3k03kHRJl
- TLSH T1DC25AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 952KB
- SHA256 637b0291e8f37a8c0e1e1490b77c9a54ba45b8207295b4c43fe24ab7b7a0fb41
- MD5 f025f465aa07408fa39c40d0c5efac3b
- SHA1 f1e9de1c8dea027d7163bb406d51e681c2f41e29
- SHA512 4e6bd95a1b6b1439bf2645ba7bdb355fe47b747ac3141125f9f126294d44e36eac7fcf84eafd745d78827b52011571bd89ee976616f7dd6f6519def879753a61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa3C:A3k03kHRJJ
- TLSH T1B325AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 952KB
- SHA256 9f22226116bb3838aa78e5e9568395e287f60ab52e9dd0b221a1563b2c2d6072
- MD5 c5d22a0b53ed0920a2e6039b1c51b853
- SHA1 ce31b7a2224a151a9f28e9a08939449060858533
- SHA512 07095157dab6b88725b45b85f7915d90c3c70d1343e6d4521b994d6ba4d1d194350a5e40257d8e1787e42c229fa733dcda061b4cbc011075809f135e5963360f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa4w:A3k03kHRJ0
- TLSH T13425AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 952KB
- SHA256 cf0a7df36f115d2c693d1b639f0014085998d9e7007cdfe7b927dd12957abff5
- MD5 983deddc8c603b36975937085dbd6442
- SHA1 a8a068e9a67d471c9e76c210b9f72600b317d1e9
- SHA512 b20c1e257090f65199cc40724945ca9ed18feeaf5e30ebe2ade7404e3a9d7aae06636432a0e83a9c531f921e8620797f436cabfe5b21f8727ea9333f8f1afe9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaXT:A3k03kHRJc
- TLSH T15425AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 952KB
- SHA256 c3fbb16eb96f28c84eeb45e75ad0e011c11fec8c911344ae97e4431b011604d7
- MD5 2c24b1532329d44f20163d04353f2992
- SHA1 da283c1ecd0687a254894d9e1c4fed06491274df
- SHA512 6b1a50a97aa98999a8e1becf8f64eb8f66d8d3a9bdebd8e458b303a9c46d3ff7aa9eb57a62b7fbaca89043c92aec87626aaba5e129debfa5a67e31e352141cbe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQahu:A3k03kHRJ7
- TLSH T13225AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 952KB
- SHA256 1e540cd6dbb3c8cdd0142b73080577f2388f22661108910dfefc9a799b1be951
- MD5 9590185ece5c7c621b82047dd0bb99ac
- SHA1 87666b3d501b0d92b23cf8c8b56e3ecdda931de1
- SHA512 83cd61f81e4432f5a88d76aa94b7d716cd13edf78ad4427a07737ecf18a61d566a860c26ac9507094a9b6dd41af55f5e137f48e6abb13d53ba8fe7242ee9094e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaJb:A3k03kHRJS
- TLSH T12025AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 952KB
- SHA256 8775a01311e302a7323ceabef1c915f26a961e7bc651f28956e133bfe59cf4b5
- MD5 7351cdb9d7ca4ced0293e9ef27141f35
- SHA1 eb122bd0088cf88049672e0b3d3a37391e10b8ac
- SHA512 5ca72b08db17bd097887feb41c38a0484141325c5f084a11fe7855413fd031eb2a4e12ea67ab02ff863ebcbeef4d38cb8ea693bc5a7a99d13fb389c31749587e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaxf:A3k03kHRJy
- TLSH T14925AF13EB9504E9D10AC1749AD68A23EB75BC56176193DF2318C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 952KB
- SHA256 18a69951615f0a460ae649bdcf079591f06e8110c37c7ced9e675ddd7422c699
- MD5 14455e66d848dcf08b99912396440b5c
- SHA1 9b6529e536026abb134b42c250dde2077b94c9e2
- SHA512 63aee4323931f605422de557587a0488dee6c51885d0e5391eb767fd47c579053389efe6da6a93a86df6d252ec34d60219b1a3fa52a8a68cfcc18d379c32b75e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaaK:A3k03kHRJS
- TLSH T11F25AF13EB9504E9D10AC1749AD68A23EB75BC56176193DF2318C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 952KB
- SHA256 4ed3930c9f4fd8d4fbda121b93454d59bda31517f9e7814ed9c6f10623ed53ed
- MD5 149e36678600ab10b7be0b34597570b9
- SHA1 d62568a478ff1c410dab522b0cdde73b20a42c6f
- SHA512 543b9ed04aecb5fc150092aeadbfb4e2769fabc5753822f888d05b9ca144da37030814cef979cde7c65c47f7e19d6a8ccc9938ca657c5cfa78a0beca9661044c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaPk:A3k03kHRJn
- TLSH T10325AF13EB9504E9D10AC2749AD64A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 952KB
- SHA256 55d5a982c36c29e48d9477e9189f5c318040a0fbfe4d8d803bc89ec08bb3357a
- MD5 380758c7139c82eb761ee292b8572d4b
- SHA1 4cc764f99e5526649eeb39f3dc698790aeb35ab9
- SHA512 6db7f9c62b081ecdb674410046bbdce88f4d8aef985bd9ceb9ad9374846f747565700071c82084ee3486e92b9a6f15dc1829e3b7c1fcfe97028e19e1a3de6514
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaI0:A3k03kHRJm
- TLSH T14325AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 952KB
- SHA256 476de1908ec65a790339184bf1f5eb45adfb9d01fff112f674f8a8bcde950aac
- MD5 4cd46147ba4c6743e767fbbb1751e0c4
- SHA1 70f7e2d289c4333a01cbc7b7b64e20ec19df55de
- SHA512 e4f1377e43b188fdc6430346a2d15d6365b498892085b0630943f7378a1d1a50662e6bbc21f7eb40153d0c4d856c0073afbe72c1592493b899f545689bcf03d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQajg:A3k03kHRJf
- TLSH T1AD25AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 952KB
- SHA256 8ddd6ef185d84d9d0f2aba3c422588cf71f44e2abdfea8ac57e08dd4b6981761
- MD5 516a2a692a5bdfd4497639543641b781
- SHA1 35575c8092dafc0f131d629515a0af3e96ae2ba0
- SHA512 4e39ec3645d34e743faf52aa81a3c7f4aae7d0b8283c7ceef1f50a9a6d3fcf009d6ee221550a43f20811092f5539bbc9403e9bf991ae1c2fc2f1450e54dacf2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaer:A3k03kHRJ5
- TLSH T15125AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 952KB
- SHA256 2cd4b99136436a0dc7898bbe5d85ac7c1c803e3b618fed6c5ac980a481105171
- MD5 216935d92014741ea047a60e1236c0a0
- SHA1 44f8df6196e3f72b35b77eeeb6ad9305baeab661
- SHA512 fe78fee8839e4411767893022f7c44c9df37b83c6f3c0148b151c841a799c9eabe3b5fd494e5de347e23bce86405bee519b936cf933403d62a59338c8cfd036b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaEn:A3k03kHRJz
- TLSH T1F225AF13EB9504E9D10AC1749AD68A23EB75BC56176193DF2318C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 952KB
- SHA256 a7ef9da8bc21536842b3e9d94951dc6d855a30db372fbd0eeaf8ce07b958f3ff
- MD5 507c311118d192fdbf0e5a83048d24ae
- SHA1 f71758fb086b4b8673b8ce68ad92c074ac16ad70
- SHA512 0cd2a74a8ef07b1cbc78e9ffbbee326a90613e7d1253578aa7ef0b0549f3b1f280493a7ad7e194cb4637d01f0132ad86d173cd2b3963592923fc6f32c3daa765
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaSx:A3k03kHRJx
- TLSH T11025AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 952KB
- SHA256 cb24144ed04566baf23f9525fec9c2267d8de8377c99d66c970bb6f63f1d5380
- MD5 deee1469aa3cec11643bff666a849767
- SHA1 aa54341d7eb7ebf604ecd8cb7f0c971056a86240
- SHA512 893a92eda8bc951b53f81a643075ac86cdbc6b1bde1d6a11cd76fce21b1cd3923594eff14e1934b0f28ba33ba57ac226c2e276f54c04a256295472cba43a1841
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQakA:A3k03kHRJe
- TLSH T19525AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 952KB
- SHA256 6ce76999e34b147453b838bdbc3cad254496309c14622528a84f7d5338aa65a6
- MD5 a0d51690e80cd2a70d5e2f850d4e987f
- SHA1 aa305a2f4b6bf3ab96612d016b3ee2b599f05deb
- SHA512 69232bd499ed38d62f0b4d1aef27816d3a86e930ae2a483bb179285515a2970af6c499893e58cd3384b872639d8c01435d06c6289dd26a9e8d7261df340f25bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaN9Q:A3k03kHRJD
- TLSH T1C125AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 952KB
- SHA256 755a64eeff6c181849d6a5481756e917f8f11c2ce38c06fb0fc7a1f52881872c
- MD5 8b95326b1d5defebd4bcd67d766fd91e
- SHA1 3c6ceeaf08bcbf5957aaf4f47e9c5870b1e00492
- SHA512 d3631a198c07a573c5e105bef2604b48fff71686c9c4e7857ab819f84e67fed8da455c22eb648b49fd0f826035713171584b57902e98255ec70c2f58fd85f1b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQao4:A3k03kHRJk
- TLSH T1B125AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 952KB
- SHA256 990aa8cd2a5c09d4ffb232bffc4251119ff9b6eb7e4b154c202c9a3aa4480529
- MD5 6deb941a5fba3647b9e89af82045e8e5
- SHA1 796f5ec99a07d2afe33d01a704ff4b86ee25037d
- SHA512 477289d9a0ef777f8b6e9f09e88ae313a2b0fc9fcbdf1a47bdd126df2c48fe4fb233ebb7b0eeb49a35675c06953a5b330699a85ece7b1ee8dd7b34ea44e549bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa7u:A3k03kHRJV
- TLSH T16C25AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 952KB
- SHA256 43e019fc4c82da3e4a88e0ef1f8245aeff40497ce06bb865083e17c329f90e0d
- MD5 18a8b992d53936ff65e5a8de3a3ffd4a
- SHA1 050af0c66d91c5dbdcf23f136d1bcb6caf586717
- SHA512 7da013f09221f6211f1cb417e70207d8577114d0c67894d5ec43bc38bd2a9a7928dcee4bddc459f748317d3008bf1e873c7ce86dbd1b6aed5469369a6529ee56
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQa2j:A3k03kHRJ3
- TLSH T14E25AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 952KB
- SHA256 9004d7daa328222cda7ab85245274bf212c4fa684da822d932728772833f5ff9
- MD5 45c497546a43da5ce7e7df407502b622
- SHA1 b7da9912d506272135726a8e8460ad6bbdda52d2
- SHA512 2e5c9f6ea3ac5eb4550be884f0f584fb6c5322af3693c2abc5bbf7ffac0fda7bc23ef446d365d925db20033064b14138937ba590e89ec7e75fa2f7b86831a7ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQajg:A3k03kHRJf
- TLSH T11225AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 952KB
- SHA256 8d3e5372c37dfbce326a3233f94b521e96624bae9d6359922f8654dcf1604976
- MD5 48792b2fd60f87d9c2defd1c2c02572b
- SHA1 76bc732565340ccc31f01b5b90eb5e989901f8f7
- SHA512 44b2f380d587a8f8a4547ce2434a758e18ca3cc54a651809b53ad2f52295b28cd3d25c4122b8c34ecb2a61d4b8a6e344181993707530f134dea68140a7d629a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaeI:A3k03kHRJO
- TLSH T12D25AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 952KB
- SHA256 ee063606d4cd14a5da89668681b52f29188558742f32a08527cd104590842b80
- MD5 0b8e35af9fd24ccaec7410fb66d6e896
- SHA1 2eb519caa2bc28222624bff20a88b579d7c44eb5
- SHA512 8fa93c46f81a54f6e4434acf94ac626cf945198692572d8b183eaadcd1a473ac8d586be15d733b845d7f26794296206adbe66225cbb5aeddd8057fb744e91ac1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaso:A3k03kHRJM
- TLSH T10825AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 952KB
- SHA256 a3a54a51b2b007dbfe5256da3d2947f04b4d3163e2213066a74ce2d658be7284
- MD5 80b421d3d0d7e820fe65fe34773e2a6f
- SHA1 462fa014f7725f6d46b20f711380841a0ad525bd
- SHA512 ccc6e2a17bf5edc727abe14e86e0cd917c7988f6348e2dd298615063dbfd0433f24b406d9c86b7f146cd4d9e53b2ad164fabd1dc98bce6dbcb80946a103452de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQav+:A3k03kHRJh
- TLSH T11B25AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 952KB
- SHA256 e12a24353fbc85b8d812f367c8693ae086aed44c26896de3e17336059ce88c35
- MD5 beba759b14efc9ff976d9eb37a6ab049
- SHA1 011f12b81ac62acb3b957840bf79e98fbcb53547
- SHA512 90ff3ce3e70378941c1e23d83ffd01a9fb2fdf99e18cf206bc3092b8e54702754ccb267d4da694c7363d0b25c2f07782e4e3f8e64bfc4372af90c4d06f9cf693
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaFQ:A3k03kHRJh
- TLSH T16125AF13EB9504E9D10AC2749AD68A23EB75BC56176193DF2318C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 952KB
- SHA256 654e3cb773e6532a12db553bf6828bee12c351cc684eab06f8930ebcde333d3e
- MD5 fe6b349d1119926fdd24f0413dd25135
- SHA1 73828c85cd74d096510120ff38de8155d5af9898
- SHA512 09263b7602b3c49dfb593f082fb9beac59a9b038cdcec3471cf7c696a3e00005669a9a37bb84b271aea473f30d997f438257f351d1ef746f248af11b92b1d37d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaKX:A3k03kHRJN
- TLSH T15625AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 952KB
- SHA256 4efad5941adb7224bec957b1554cfba2790fc080a90970440b33ea1add6a746f
- MD5 bbcdc3406ea274baa2e077d0338dfd22
- SHA1 c2249d765efe03f1eee18000159dd1005ae009b0
- SHA512 58897284393d1f5b0896c4bace035117bffef0daf5e7508bf2f878c7a116fc82c6a25aceb564a92c216d28edb37ab5d2c49646c5cf70bfef9f4c4654538c36cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQasL:A3k03kHRJP
- TLSH T12825AF13EB9504E9D10AC1749AD68A23EB75BC56176093DF2358C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 952KB
- SHA256 48c74bd461a79b0d0ea479feb85ecc8be8bbc5b60acaeedab00b22d41cc99dd5
- MD5 62a8cf4357ccff6f19b5085a399b2754
- SHA1 4acaa869fd5f667d83ddbef40558061e7b642e34
- SHA512 bff689a59505ad2ce1ed76707e9137b85129903f89c45ec987a24eb9162e9fb3ac667bd6b48e96662a7eb81d487dcc394b06c580c7c5a7a5d2494b7d1fa5b7d2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaoM:A3k03kHRJ6
- TLSH T17825AF13EB9504E9D10AC1749AD68A23EB75BC56176193DF2318C2152F72BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 952KB
- SHA256 73690720fb17df8df2e9c3d307659b9939c6af4a56a58f0b2cca64b111d3a787
- MD5 efa47dced56a993b74c6771b53298c3b
- SHA1 33347512cab7ce66588ea2b96f3c1cc44417e741
- SHA512 223666511076b054c147be139bfdc237be07761b1769824ee4b58f213d59b084d4f72eb8ef6621a2f60f12996943141337c4f5f7574b63f79b2d22df48b64521
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaJh:A3k03kHRJ0
- TLSH T11B25AF13EB9504E9D10AC2749AD68A23EB75BC56176093DF2358C2152F72BD07F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe
- Size 1008KB
- SHA256 97bae97e4261ffd847379a6723faea90dcde4346b4a9a3a55ce9f6fce6d5d504
- MD5 49beaf5cd0f94c0cf64945060ef72651
- SHA1 7d144a4e255474166955d226cd3a2a78b6726821
- SHA512 08cb1360ad297bddeafe17aea51caeaa3126a66e80475a20a89d332b351a39f98bbbee1e4d89424e2f6b7c8446f8201311e6c5bff5fdf3dc2a104f419751cad3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlCUQ0l98bsiaQ9xBQaTF:A3k03kHRJC
- TLSH T1A1259E03E6D500E5D64A8170DEDA8A22FA35BD921B6096EF2318F7152F727D07F393A4
- MD5 SHA1 SHA512 SSDEEP TLSH