Analysis
- max time kernel
120s - max time network
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/08/2026, 00:01
Behavioral task
behavioral1
Sample
2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260801-aa52ystckd
- SHA256 e6df5db59247ea20b4f34b05de75475cf59ce84767baa9edae9ad0c1a0269fa1
- MD5 3cadef3de57bdfa109a57dc50d00a46e
- SHA1 8cf4d7f453b322d7bc9a53eee04780448f4a44dc
- SHA512 cc736039cc9bdf192aeeb3a694d25fae551d263ab29c991077d3beac0778d0963f230c032927f1e4ad625e2795ccb6bc46ef62e723c36c3275275231b1145357
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa:A3k03kHRJ
- TLSH T12315AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/3956-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c49d-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b313-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3956-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b318-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2312-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c9f-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018992-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a6c-210.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001985c-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-260.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-323.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-450.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a6e-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-530.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-713.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-770.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-833.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-864.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-941.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-961.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-987.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1018.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1061.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1092.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1105.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1142.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1161.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990a-1186.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990d-1328.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1342.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1355.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1380.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019915-1387.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019916-1394.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019917-1395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1484.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001892d-1533.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893c-1576.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c49d-5.dat aspack_v212_v242 behavioral2/files/0x000200000001b313-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b318-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c9f-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018992-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a6c-210.dat aspack_v212_v242 behavioral2/files/0x000400000001985c-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-260.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-323.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-450.dat aspack_v212_v242 behavioral2/files/0x0013000000018a6e-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-530.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-609.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-634.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-713.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-770.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-833.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-864.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-883.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-916.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-941.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-961.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-987.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1018.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1061.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1092.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1105.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1142.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1161.dat aspack_v212_v242 behavioral2/files/0x000300000001990a-1186.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1193.dat aspack_v212_v242 behavioral2/files/0x000300000001990c-1230.dat aspack_v212_v242 behavioral2/files/0x000300000001990d-1328.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1342.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1355.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1380.dat aspack_v212_v242 behavioral2/files/0x0003000000019915-1387.dat aspack_v212_v242 behavioral2/files/0x0003000000019916-1394.dat aspack_v212_v242 behavioral2/files/0x0003000000019917-1395.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1484.dat aspack_v212_v242 behavioral2/files/0x000800000001892d-1533.dat aspack_v212_v242 behavioral2/files/0x000800000001893c-1576.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2312 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe$ 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe$ 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe$ 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe$ 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3956 2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2312 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_3cadef3de57bdfa109a57dc50d00a46e_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3956
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2312
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 e6df5db59247ea20b4f34b05de75475cf59ce84767baa9edae9ad0c1a0269fa1
- MD5 3cadef3de57bdfa109a57dc50d00a46e
- SHA1 8cf4d7f453b322d7bc9a53eee04780448f4a44dc
- SHA512 cc736039cc9bdf192aeeb3a694d25fae551d263ab29c991077d3beac0778d0963f230c032927f1e4ad625e2795ccb6bc46ef62e723c36c3275275231b1145357
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa:A3k03kHRJ
- TLSH T12315AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 953KB
- SHA256 4d26f11cb76ecd2279b1bac9cb188fe1c4e199e204677be881017115c414df48
- MD5 a10a8d043d88d70ab0c8bb549b4ca92b
- SHA1 f157d178ad6be32e1124d674296689a66e4c51fa
- SHA512 cb343caa39ac0bdc96cbe10ed029a89d6b6d6e8d37a105b9ac0b098ca57fbfce2a42d636908f079bbaab7bebff146b49bd17854ddc73ab8f9142d25a78c60f71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaxP:A3k03kHRJX
- TLSH T10E25AE03EB9500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E395
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 970KB
- SHA256 bf80a0ee25071507cf3cba41bcc7d3e7ea013cc6f25defa597a00104ebc9a964
- MD5 3f8751b5a8e26fc443fa2f849ae2265b
- SHA1 26505490ff76e48f5f3836f5c7f0765a5a572d74
- SHA512 ce3e257a8bc295567507b9d57e44d5e34ae4fd1c1b66f4ac3fd7d5d44e71dcc1a562ea0f869a69f926fa129bb841dc2111c964044b35e5bcd55685fde4964695
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaa0:A3k03kHRJM0
- TLSH T198259E03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 976KB
- SHA256 b870554bd6b122097568889c1f0dcb7a4642e14acb61ad50eb2f38ed7d1ab494
- MD5 2b183239681652d233870769c2e549df
- SHA1 35750d12da36292466fe264fa597c7093dac781c
- SHA512 2c4d9485375aac1ce5796570c78047808ea255ecb5a0645b0cea2f78204326e923960b5edb4ae22ad2f7a38d658c54c3773289fd4dd1c13b99ebe96aa2da49fd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa6fj:A3k03kHRJ+j
- TLSH T1ED25AF03EB9500E5D10AC1749AE69A23FB75BC52176093DF2358C6152F72BD0AF3E3A9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 c84077d980427754de5525c388e5f3d5c94cc02c4d9d4420a1b25e259b8c190e
- MD5 6266382fbdb4195f25afc684dbda6efe
- SHA1 f001aa0f21dd2096d1a16bb1018d6d6dc2de3ef3
- SHA512 2c5be1bbe05137a4c946245cb5493f051ff8471badc565c2f90e425ad06ff927ba1c8e7df475eb7c53769c15f6f796624d18be2477e3d824acbb3f18f0ba4fd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaP0Le5ji0hmxNrM:A3k03kHRJlPji0Aj
- TLSH T11D657C17F6A402B5D067C0B9C5D6AA5AFA713842173086CF1399C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 cbcf3667df960f6fc8e533e49fa475a04a4eb9c3ad4238c266dfeb32877ca2b6
- MD5 6f9226851dd3a54529ac939d94f66b48
- SHA1 145ecb9a02e784d2b99dce90df8f48c4440362d6
- SHA512 c60f56ad042699fa941821e8c638d2d60f460db3f782f906e42b257e6796966f61147a58dd0bd12755ad03862114f2707b4eed642e431022dd6c8770688935fe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaRa:A3k03kHRJ
- TLSH T1A415AE03E79500E9D10AC1749AE69A23FB75BC52176093DF2368C6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 971KB
- SHA256 6f62e543fb4b519bf0f905009c0523948825cde2ae8aa4bd083da591867742e7
- MD5 a94350e11142560fb432e8e5f418f7ec
- SHA1 1ccecd520241da9012a0bfb004121e85dd51a954
- SHA512 bbc2534f97266b560371a72bcb36b8188745e91615390d6d3433c131ec6039ff6831f56d693a117a42f9a4d02ced8c5f5f567f8456bc5bb76977fe9b0eb98c1e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLayb:A3k03kHRJEb
- TLSH T1E0259E03E79400E9E10AC1749AE69A23FB75BC52176093DF2358D6152F72BD0AF3E3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 947KB
- SHA256 2ba9155c399e3969cf1489082ecd9f493afc70766ff016154567e119b377ca02
- MD5 2304d1f64df288ab7a424ee0edcf9f0f
- SHA1 acee33a875c1565e8509c37ee464e7c39eb93a5d
- SHA512 7d75a9b99c5af410ed2d87bd247b99ee5c972b27d6388bd5aef53bcc73c74ca8008ab9c36c2d0916f8afc8e37e6001c3320c50e0ab2e021adf2ea9e599534bbd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLapZ:A3k03kHRJp
- TLSH T18025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 947KB
- SHA256 087e27eb31f029f2431135718c990c5760ff6086cebffd4644dd8ab9a4ad28e5
- MD5 3f9a8f26812c24a516e441acf283d534
- SHA1 1d477095b1b04885b189ac84ca568d028f0a4623
- SHA512 9013531b8297b1c933092b4bc0a71e2cc7d1ee8ff4800ef64c028770dd21dcda8494ee87daeddca5170fedd28fb659e9fdf357ff2fd878e93e6e66210e803b09
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaC1:A3k03kHRJ2
- TLSH T1D825AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 947KB
- SHA256 6152b084dec15646a6bc963decb8906585d9057f02afe7c4333875300584d061
- MD5 fb05616660bd29d05e435bacf964a7e9
- SHA1 9259df3ddc161bdd07ff7e3f31073e8be211c9b6
- SHA512 cdcf4a3df8027c1a9f65a826445a3413328f021b34fd65cb9cb4364c48c00403b7eca51b3cade0d54dba3cc082462340db272f05611e6a9c447c6c462194da73
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLao6:A3k03kHRJh
- TLSH T18E25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 947KB
- SHA256 984da156dc38e9cfb8c667e8e3261bc7325f12278127633ca946b4f043cd77b5
- MD5 b591610054d56f90fe51a4357fb3cec9
- SHA1 ffd89f8bbeb4d26161e388d8000a72f1e131d535
- SHA512 860b557cded87274ef7c27026485a5ae6f7dffa933c6d2156c3c179a9bc1aa5e41b7a3f4ef77cca7d8ff47bd7d2ec7a3f4a70132a89f54200551d792908e291e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLasN:A3k03kHRJ4
- TLSH T11025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 947KB
- SHA256 f7e894166454014fbbaa93df50a51e7735a762acc1f41dfec81c2c2110cb79a2
- MD5 63bb8165fde3b80d41f904682c305621
- SHA1 594d5d8e070eb74a4c76fa427cd8363b8e75ea6f
- SHA512 90d08c130b231fdd6dff9fa06f3fcf9195e42a6a15196d746ae32d632e2f6d655fcf76e094dccfd4b7e3f3aca938625e4fbe10e5b7c33659367babcb094f2383
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaif:A3k03kHRJw
- TLSH T10925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 947KB
- SHA256 0b2add1d0f209df7dc632f9a4b758f04c55c83a0ac34852173e8933ef543eca6
- MD5 af98e9e7940f1c354b7f9d53e94358d7
- SHA1 02ca82081a8fc578fa588895a886eeea508ea951
- SHA512 2419e240ae84c5dde29990067f279c19c2d3d1e2a245b7a07aa43c16533b0b4de5f7dcb7c69cfb4ee7ab2e02eef7a8bb3fba1ea98e04ba1e8066b9dca5183930
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa8o:A3k03kHRJ9
- TLSH T14625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 947KB
- SHA256 a4519ebcdcde6401acffa1545b32bb1eda41f479b72145eb6ffdccf3ac1c16a0
- MD5 cbca8bf453564f429b756641b044197a
- SHA1 e288059bb549add05ff86df94528ec19b89d4902
- SHA512 405e62d925b7e1e4a91cdbea06c6b8623ae2768ad9196461f85369b40aa16a5fca00d76cb7227900fa2d2b22adbf3a23f2bdc75a6f789773bbb4e705867a407d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLacu:A3k03kHRJP
- TLSH T14225AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 404f9b5674b72e78c219892aa39d2e486f26c4cb71d3f94baa6425a6e55a0d8e
- MD5 b594d1a08867f9415d669f95202d59cd
- SHA1 f72eab684707f3a24ddd33dd86fd74bb32672aa4
- SHA512 94d9478f2ea16da830df20940db3d054780509e2dd95d3507232dded25911ee18852bea706e39ce2a434131ad460a057829f8e9801b535315e4856530ee57c0e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLag9:A3k03kHRJu
- TLSH T18525AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 5238b0eb70efee95764fa336e6896a5731451187f0eb3570b72145911af69805
- MD5 cf2c831ee04cabc23342348d830696df
- SHA1 bc06b47eff7be20a18fb11c9e329b6636a99b18d
- SHA512 2f0560f6a7b3e73da072058cd6de5424da09b3c680e10e8a221661209d22a92a038bc86656576413ad10866b6f77055f05d7bad06a01328f62d25878ea975be5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaoc:A3k03kHRJD
- TLSH T1DC25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 b814f81f265b2021dc8d2ab5ee471b97a7b4a05548b23870c94a77ae1b2ca4fa
- MD5 8d812f1da70cc3c2c4369361d577a583
- SHA1 a4d91c4ed78fecc0b12796092a922b58305b14b0
- SHA512 5504a53de29f432d7dc29a2ed380255147257574b04d2a97cf20bcd8dcaa64755137f7e9ad8ae64e1ffbacfaa9671e747134f8b3cd2ecd11676595b4f293d058
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaBp:A3k03kHRJB
- TLSH T1FE25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 d2a7eae4fa9990ecb3197ce09c6f514388345d2376487f095febef7b206d8e98
- MD5 e09e3c5884f68817b014e75c34450106
- SHA1 ac3e997245d4e76208c7dcd1d5d99af8c84bd7bf
- SHA512 1dd3beaf4b7c713c61a204fbb05c34133fbac25fc4746b1584be96f041695f37441c449015a79e5a249f0f3f82e1e6d2cd64261f7651bdad5c458f57ec4bfb35
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaWN:A3k03kHRJa
- TLSH T11225AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 930106dd37abd211657be2038841e3c94e48bd97296191e8123b4a675dbe24e7
- MD5 ed02e68d2f3c32158189ca026fc7be75
- SHA1 e0f5859b047a826d08b14a4f371499bd310d6feb
- SHA512 03955cf82194e0ba20c1d42c184f16c3a101a07d4520b8e8d364778eaaeb66f2b3d006810e8b9ffe6f49d94dd5aee375018cbcbd771826b04655c6e1663510e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaaF:A3k03kHRJg
- TLSH T1BB25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 d9fb9f9a7ac245b3e4db39935d22f3055e62e583e77631366f1cdd79b89f2f41
- MD5 77b616be0381f9dc968d8737554e65eb
- SHA1 3d58fb768c2cb6a5f8f9ecf92c51e08803f0bfdd
- SHA512 36b12ccb1cf873a4656653bac3e47bf9bd89d760091d44d5de9221b2000966797857f1daf803fddc601cb9c170c84e583b534167708fa20484764bedc022dd7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLavC:A3k03kHRJ0
- TLSH T11525AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 96dc9c289ce6be17b8e98b168033b93a27486e25ed1047f65d320c8f4bd7725b
- MD5 0668e3be6f42fd6beb1243493192d86d
- SHA1 f78bc52bc7c1fa14d102c2eed1b7cc8ce4739335
- SHA512 342ebe0265860900399777135e81b0da51b9236393f73e2d099d5de3256118b157276ec300b77438111c6c79039bff0813858c948e8a6740368c8e289ebac3e9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaQw:A3k03kHRJJ
- TLSH T15725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 8d8f2eecd6f2c240611f28c870732e6c426ba185f3fec309930915688215dde9
- MD5 17aef0d34721a7c5efbcb500ee769955
- SHA1 8abdedcdd28923e73f7c3613d19562f69f56baf0
- SHA512 a9ff2c24e0f17d4ccb5550f1a6d90f6ecfb5bcbb60d09f6cf07309d8615b66581cea7ba0fc762ca2c8cbfff9ff779473164a5916ec6967d16bae151450ee4f2e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLavT:A3k03kHRJ9
- TLSH T10025AF03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 5a4cf09319f4c167f0e2cbb26a9175d78f8b82bf48cdf5c6d35659c29b3d0568
- MD5 9e4585e919e586c4c5c449c21060b4c7
- SHA1 9acf7debb3f1ec531240504a7df690674a69a8f7
- SHA512 1b2d751d220f1a133a99e5451ab89b0492614e8d50ebecb77d0b25e94dcbb36b5d688d3c1185ebb6f4c5b40e637e632bc4b453af1a4483534449cecba3caea23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLapu:A3k03kHRJC
- TLSH T11025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 bc23a3c6b0ccb2608901f1758a502f79c94dbc50333f89b80480157b778d559b
- MD5 571c25ebd687476d5f50fbc002db4a59
- SHA1 6ec1ff96d128eb59d42a3d461a2a288dc2ddc0ca
- SHA512 c6a9e39f4f51d5f797753e1613d7257277e27f21e6747aeea73d7069003af2999a0133ed26e9a4636599d11adbb4d22edab22780e391a4d5481d0891e015aea5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLahb:A3k03kHRJz
- TLSH T10725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 aa67827eb9af7fe2a8d5c0a5cfb3573746956fac170b27691bcb1a066c4bfda1
- MD5 26618922ce6d849e83fe14845210e35a
- SHA1 7199e475d4770dd590a680df5d7b6754c8120588
- SHA512 8c1ed732eb0e39a136de2e1902d14f27acda7fe5e4016094b2e5cfd2346825a26282102ffc37bd9b36aaab88a1fcb2348d39f5bed344f17545d48b77670120aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLapf:A3k03kHRJr
- TLSH T16625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 507f2d845cfcdb9fd976b07239eae9207b1e2c9ae9352a8a16257ece79d50a45
- MD5 5a9c505bf3e7c1c625538e10148390ac
- SHA1 b98d272145661890949bc1d599ab58a7d9acadd1
- SHA512 4ebafc1f4204ba6a50e1fbc31877846cac4e1e064b5ab509b44bd9d7d82f7521649baa25ab9941b8af7a59e4bd0ff9dd86c66ac970b028f36e4c05708ce84479
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaSK:A3k03kHRJb
- TLSH T10F25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 616841946c1d02be91cb4b98b03bc4de10bcdbb7ceea8866d762dbb82856cdba
- MD5 37fc97a23db635797be62ef7f18cf8a4
- SHA1 db56050ce7d6761359a43178cfd649331ba562fc
- SHA512 45926466050835c5639be11ac58796d83058fbbf5e2bd58b3523984e623a07fec2b5a9a2a8bfe8c6abd65a29adca206268e7fa8cdb7f103189ca5bae057634bf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa3k:A3k03kHRJW
- TLSH T1CC25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 0d9081aab2d091b3012ee8e0706eb81ab05fc4771a5625cc668649a7cbeba63c
- MD5 6b17476439761ef57bacdfd67c75eb94
- SHA1 2d8e8b5b8594094bffc6e398f53f6793d8126178
- SHA512 5c420850590fa4dbb2b1d858956a473452d5d26f56b033adc37ec3f233976d30c28be52f9c29098b4e9d96cff038dd53dfbdb67c04b066ca05dc8f75bc4c65e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaA0:A3k03kHRJr
- TLSH T19125AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 b224360181229915d9c276da365ec4b4dfb9165a7bfc4f2f67bb6f4785613f9d
- MD5 3c3e36f4c8054fe24d9abed9bf5286d5
- SHA1 a5b06dc0f474eeb2a863f28e60790c82e81dada1
- SHA512 8304d3410640b33a6c22c7d0bf591f5c31c9d94ad2ba33143c970619c0fc764b431ad78fccb6f556605cb20594f97f8d2059064fd55a50849594c2805b05c7be
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLabg:A3k03kHRJe
- TLSH T18A25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 79b09edff790815100599590365732cd2e21843ee30994c3ffd64b4b29fc9079
- MD5 2a9525014726ea8544f04c3c7b8b631e
- SHA1 4e6f3e9a57c27c3535e50b65ab63bf56727e37f6
- SHA512 120fe43d60940b900e7430785bfd7351eb523ab3c6c353e9460e0dc4c957611dfefb63b70d76278fc343cade205e86da7b1be1a93be67d9cff86a2732dfe551c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaWr:A3k03kHRJg
- TLSH T1E125AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 b7a8b4b6eeae97c3b5a3f460c78121a67d205327c212ee528195a833276d917f
- MD5 f5edfcdb066d501e74dc4ec5c80fcbe2
- SHA1 615715dbdeb443b6457a4fa3d3385348c6762305
- SHA512 df2828dc70d2cff9a0f89e64149b9052641b5890de24cd15385985841f882097f1d91bf9bcede4a9e0a6be9a95e148484fbee3e6c4b6b96a65b0f8b5422a2839
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa8n:A3k03kHRJy
- TLSH T1FF25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 3a05678f5648c23df862219adc1a9e1c177dcccc8d70f0b9bf41eec39d7c490c
- MD5 864fa24b32c0b63ac0cd8a5f08db4067
- SHA1 1a19474c9b427d8bcb960fbea4925e2c4c338560
- SHA512 e01fdc6fa190dd7609d1075e29787f0c1b0c64d4df4d8a8effdd0100fa5a4f3c9d6d921981e6a961db60abda3c5cfd9a7b1a61217d773ffc7cb6319da5fee86b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa6x:A3k03kHRJA
- TLSH T1BF25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 408c50fc1d753791b3301a0f0bd453ce57476ffdd0e3cc2995081e21afc669eb
- MD5 cf458916a9c99e7a5f82590f38ca057e
- SHA1 21d78dce2a61fe89b4342043c979a8cab1f92493
- SHA512 df69d0ae3c42a8de86b2774e14dedbc0f42f8a922128d69e4210b1bb0c2e9f0a1d6b4f383f19a811e1f7fb1562d492bad2b4828e2d9e2095e3afd0a5906fceae
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa8A:A3k03kHRJj
- TLSH T16A25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 0af5901a3d00c633d5ca17b555619990ff3850c8eca74ebb9bb5003b2500ed06
- MD5 9a47da9b28f93ac7dc5112ae9e373f7d
- SHA1 273acf178f47abf0f0b56a38dea05b2200370696
- SHA512 cf53f9af565e81d6e942cba6a15d2240ef18716aea2bb0cb51205ae3d5008df66e67e4c2412a36e57900e9bbfcd5108816a805cc7f4959140994e00d5c7e52db
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLal9Q:A3k03kHRJu
- TLSH T11425AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 0f6ff0b3752a14e6e4425d6d08b3b833efdd643de9afd525845659b64938a2e0
- MD5 75efc47c73ddaa0973090e52a4af8e37
- SHA1 1eccdafc169379330e7cdfdf1e94db7a1d72ca92
- SHA512 5ba3c152ada5bd3135e26823d6eab55f9cee46e161aaa7630fe9e3046ef57c1499a23143efaef98a3a8049e1cd2380ad4434a3f9097302727d5a41512bebebd9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaQ4:A3k03kHRJN
- TLSH T1A225AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 b06c5148b7e3684483a47bd7def7b680baa93ec17bf99ae16d40a428feb22d9a
- MD5 6bf56fc9e73073624354d2b5798eb015
- SHA1 34f0ccd96bac5beb216bec2685f76071a66e6092
- SHA512 5c1ac78552fe8e55095845b0b87c2acd96e31786681a091247a9fccc0847e4c2ff844e974aaaba95961936ad05aa0e52957225389b3a30ee2e0fa56a015f4edb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaTu:A3k03kHRJo
- TLSH T14A25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 c3192d1632653bc0142cd82719af2cadae89865fd1ecc19f0d88663f2b3d152b
- MD5 27e6cf2d5c8d6afad0bd798de5138a1b
- SHA1 2dd4aaad7cc7c2c9d44b8304ac379a1597f194eb
- SHA512 c592ba64fcb65dab558f01bbc553e34b654cc9ad3b2e7f6f4e09ecfed7ab404eee6894fd507faf1ee8a89d5a38491c7bb4409ec06bf984f245ac617666b8011a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaOj:A3k03kHRJi
- TLSH T17D25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 131799b40690f3363456f13bfb98dfb8a5166d6adb428834a3ab46fc3d16b4f0
- MD5 e3ac8b9dc398334d2c5e6d120d34ff35
- SHA1 59eedee9d547ace4eddecdafb2e9365de54f4a2d
- SHA512 2ce058423ec2cc93f0e1b4686bbd1721e641dcdc888c80864e33ee112a4e45889bcc49431b52ee5703f8b54ba9eef64d3e6327646b5fad84f087390e141dfe0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa7g:A3k03kHRJm
- TLSH T19625AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 6d13b4792e9a03d58d8c06ffec34435393f2bee1749bce93aa6a6ce58f511403
- MD5 34d2e3c4552ee7d3d8310fbf173e000d
- SHA1 ad907b99105340004fa0a714ed0a84c2cd7cf719
- SHA512 f7320897537d329c7300e6ca4b0ff1755aff679624b7cc3d6d3d4e438c7fc6353b23606d386ac91e9e663d599d7ac009c44d4ecf9ab22b5e09e0126c8b598994
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLamI:A3k03kHRJv
- TLSH T15C25AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 81210761451a26b0f500b50fad1011de51666d6e51327ea9fafb1c546a35ff7a
- MD5 ed4f1142551d063df8e84b3175b6f193
- SHA1 b066becf5869eac65750b69131925c11ee5e916f
- SHA512 c32a6ca8059d9a2ac6fbed0813b1018fefb9cd484b57414e28d4e684d0bb50f875da304d58b4cf7c6554ddf700093e23ed8aa7f3f7b5f636fa66e58ebd02371d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaUo:A3k03kHRJZ
- TLSH T1C925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 2ae8ffdc3136f7211564dba8a7e21011ab5baf41418c17383ce967224cb5b761
- MD5 eb58f22212534c1b06732ca702f4059d
- SHA1 5a37a34029058cb90595f82bd0a42db331124da8
- SHA512 5ce8e8baa5191a3e14dbc4e99bee5d5069a968fca9ca227426e516303f2dc270d7b969e8cc4670704f53a00bec4dc3b14d4496506ffd8208aed66609f49eef1b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLa3+:A3k03kHRJc
- TLSH T19025AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 d98c6258efcc1c54a81913b810425fa5966502bfffe167a373c13f2ab740c36c
- MD5 247c969ae70b13e8fad86653153b8861
- SHA1 be68fa155d7619143cb39c512072e6dde6e37f76
- SHA512 c7733cba13e8705fd291c02a6e3f1bdfd6a7b9d7a607ed8f4069ab2677f08e6de7619bf554cd6e9feb69aae0d8245a3c46c97e1ac3a0ca36b1d84715f957cd02
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaNQ:A3k03kHRJ0
- TLSH T1E825AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 0ffef4ab99184d35b8ea792529397618293f8d063c07c8d8dc719b119e15c5e1
- MD5 719b92c017da2e15600e00839f92c4f4
- SHA1 701d56ce1b76b69cc78ccf9423905543c523a687
- SHA512 2dee20668988698b868d27a06d6d70538be0e8cef8c4600d0260edf70bdab3d91a327846e2de69d89bb97739384d0fc34699f6cc997162fb4b9d4094a77141d8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaCX:A3k03kHRJ0
- TLSH T14925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 110acaf3d02d5b0b05f7b9b17e83e3d508e109561cfdc75a5238827a45c0382f
- MD5 fe803792a0bd83bb2b649f544e4f1a04
- SHA1 c90be27feb531b58e1b0c5bc5a98a112a87a9eef
- SHA512 7ff8770f5ad789b701c71b50185f439810b47dc5af5caa665d6ea5d43b4a1f6b0857dcf52b6d261e306ac85f86f94b53435e6752de656d9e3b59e65d692b33cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLakL:A3k03kHRJO
- TLSH T13125AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 77ecd5668a0c57ab3076b28597cb50926cc57a80261588a43a73798ef7a9952c
- MD5 9924b3658cbe3abe05875a57321fb74f
- SHA1 ba870f590eec927cba769a00b7db497ad2061e7b
- SHA512 07a0683bb6f183c2a5832906c67797e25fb6baa5b40c376c4cda6f1070da291f03cd654f90ae3ceeb330ed9b0ed7c2fcf54cf3f7226364e364e4ed58b062c8cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLaAM:A3k03kHRJ7
- TLSH T13725AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 d5c79c6737d93265bfdb3b1e724eb9258ebe19ae38a876330ce39a7173e76816
- MD5 83f71aafd95eb48d7f0a2f738474560f
- SHA1 5bbb4123fc58da069bd14900fe1c9728c3b42dfe
- SHA512 0172bd5ee9f58993c948d0a24bc6ea19d42842d738578128d6482b166d750b69a3ad3c6b07990eb807f799972bf4cf019a2303ca83173cc7a14b78e032dd6839
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLKhSaagqOasT2xLahh:A3k03kHRJ1
- TLSH T15925AE03E79500E9D10AC1749AE69A23FB75BC56176093DF2368C6152F72BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH