Analysis
- max time kernel
121s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 15:08
Behavioral task
behavioral1
Sample
2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 853KB
- Sample260710-sjd9psbx2n
- SHA256 edba22b8186ad1cd3be93ed5e74a1fc14839afb310f6e2ad2b0c47922fa273d1
- MD5 b584a5bf904cfc6e07f0ae9828badf96
- SHA1 57f391d7b0d323fe774e3b96505786e50796e20c
- SHA512 56f5afd74c5cda576266fdf9987ee081e2aaa0b6ece51210f1dbefa7bc2c26818b6041c20cbda878116f6280c84bba14b4d2ed5ebf8f92913c977766682f79f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hd:A3k03kHRJW
- TLSH T1BF05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral2/memory/3244-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c532-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3244-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/5092-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c95-59.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001898b-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018989-246.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a68-271.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019857-416.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-477.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-503.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a67-583.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-608.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-633.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-712.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-737.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-750.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-793.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-800.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-849.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-863.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-883.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-903.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-935.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-960.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-985.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1016.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1073.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1118.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1149.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1168.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1187.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1194.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1231.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1304.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1341.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1355.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990b-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1388.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1389.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018920-1484.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018926-1533.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018a11-1576.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0006000000018a3e-1591.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018935-1826.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001893d-1893.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c532-6.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x0003000000019c95-59.dat aspack_v212_v242 behavioral2/files/0x000400000001898b-203.dat aspack_v212_v242 behavioral2/files/0x0005000000018989-246.dat aspack_v212_v242 behavioral2/files/0x0005000000018a68-271.dat aspack_v212_v242 behavioral2/files/0x0004000000019857-416.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-477.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-503.dat aspack_v212_v242 behavioral2/files/0x0013000000018a67-583.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-608.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-633.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-712.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-737.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-750.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-793.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-800.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-849.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-863.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-883.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-903.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-935.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-960.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-985.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1016.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1053.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1073.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1099.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1118.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1149.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1168.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1187.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1194.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1231.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1304.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1341.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1355.dat aspack_v212_v242 behavioral2/files/0x000300000001990b-1381.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1388.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1389.dat aspack_v212_v242 behavioral2/files/0x0008000000018920-1484.dat aspack_v212_v242 behavioral2/files/0x0008000000018926-1533.dat aspack_v212_v242 behavioral2/files/0x0008000000018a11-1576.dat aspack_v212_v242 behavioral2/files/0x0006000000018a3e-1591.dat aspack_v212_v242 behavioral2/files/0x0008000000018935-1826.dat aspack_v212_v242 behavioral2/files/0x000800000001893d-1893.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5092 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_proxy.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe$ 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\crashreporter.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe$ 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe$ 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\SenseGPParser.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE$ 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe$ 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe$ 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3244 2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5092 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_b584a5bf904cfc6e07f0ae9828badf96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3244
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5092
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 853KB
- SHA256 edba22b8186ad1cd3be93ed5e74a1fc14839afb310f6e2ad2b0c47922fa273d1
- MD5 b584a5bf904cfc6e07f0ae9828badf96
- SHA1 57f391d7b0d323fe774e3b96505786e50796e20c
- SHA512 56f5afd74c5cda576266fdf9987ee081e2aaa0b6ece51210f1dbefa7bc2c26818b6041c20cbda878116f6280c84bba14b4d2ed5ebf8f92913c977766682f79f8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hd:A3k03kHRJW
- TLSH T1BF05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 882KB
- SHA256 6288d351f52cc15837eeb90953320a614453d19a4e78b95e1dde791080276ffb
- MD5 07aea4fd7421b77caab7149ac3e9acfa
- SHA1 9445797ad50100411154e99ea4c1bf2303afcb7f
- SHA512 7fc9b18bc1e6f1a1ec2a795bf94e7b47f8caab17f91e2253ce3776024aacfebd34756ce3a2ae5783f201d326ca6accf571a33058cd4d1ac479e3ab9e759f68ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hLP:A3k03kHRJ2
- TLSH T1E615AE03EB9500E9D10AC1749AEA9A23FB757C56177093DF2358C6152F62BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 899KB
- SHA256 75f62b30997150638f9846e96624b2f5def18a3989656bc616c0f0335e2feed6
- MD5 a8b362598039b56bb77a96b26264f745
- SHA1 c50ff473f4e2f59d92f6a1210a0e128406a27a6f
- SHA512 34a10b701b393a58f6049e18ff6c48ba50dec17b6f6c647e73801f3c5a485f524d2ce3075bde2ea0843e0c2a69f21cbc60d4764cca0bebd8ac9f440bee811426
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hw0:A3k03kHRJH0
- TLSH T140159E13E79500F9D10AC1749AEA9A23EB757C52177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 944KB
- SHA256 06402cb1e6401e5d916f5be770a01321882598c877f377dd21b7b4e0d36b9753
- MD5 3f65efec57e7272f4471647d4c46239d
- SHA1 5f8f45b0b1dde505f8e7f9b43cd1c99c2cfaaa6a
- SHA512 0d0a010ceb9f978517ca5b225fd3dffe9f43c9bf9e58d9ca63f0a4c4787b21fc711c21513ff04e8bd3e136c1bc3c7e9a600c3aa81a3461c9b2d17d5a56ddb1b8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hJ:A3k03kHRJk
- TLSH T12025AE13FB9500F5D10AC1749AAA9A23EB75BC52177093DF235886152F72BD0AF3E398
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe
- Size 938KB
- SHA256 8a9c328eaccee1626f5804f06d53b37b74aedcb67ef27fe2938f7fe552c86f8f
- MD5 bf8731def3cca97b14605b1ec6e7432a
- SHA1 cc528e91ce2f322b36cd380b4175561fd9acd4a3
- SHA512 6cd06bab63c8eca1b1cdde5cd6efd9be74f53730a61746d37df6d4e3c243f02bb11a9b53f09fee090ff5ee32d1395db2d4ca01d10bee576fd692979f2ac34c8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hM72:A3k03kHRJv72
- TLSH T1B215AE13E79500F5D14AC1749AEA8A23EB75BC52177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 905KB
- SHA256 1daf140a14e1bf6f41d91a8acbaccc5fffe40e5b65e635f33f55cc750f3d563b
- MD5 de782300570e0754d20d16365eae966c
- SHA1 734dbad6477337a1a4a0a7d639e0af8d585a161e
- SHA512 d0ca87e26fc7cef45c2495e0f48cd13b63b42746735bddaa5df2057206aa57d30cb1ee8918f2cb3557da1a82641464d4df151672893128c46a41cd979640098e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hcfj:A3k03kHRJpj
- TLSH T13915AE13EB9500E5D10AC1745AEA9A32FB75BC521B6093DF2358C6152F72BD06F3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
- Size 960KB
- SHA256 255ea02d2e86cb8030f94458bdf5cbb2af5b07cdcea8360b3f8175b2e3ec22f5
- MD5 465bcb35abc6e77f0dddc4523f35c7a7
- SHA1 ee861dadd1286c01fc9c973b0c2599012491f56a
- SHA512 0d5e9024d1d0b257153b58f11cae2b26cecfaf3ad1013a142c5978c896ee6f303aabe190eb7d60b97b4166612a35662bf8ce5bf95eec37c9af7f805ee9774ef4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hBhk:A3k03kHRJ6W
- TLSH T1E325AD13E79500F8D10AC1749AE68A22EB75BC66177097DF2358C2152F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 90bb2749f2e3c92e082b35fecb82157a2f263b2b75d8e4776a486163e314668f
- MD5 511b200677aab97cbe15c2587dd08ab9
- SHA1 0721d1e70d738f81555af0132d4b342a99d5c130
- SHA512 5aeb1f368e315cdf50aadb9258f08c43c4a2a6f39e56eed14ab17c7cca2e4a1f86c2240fd704940ab72cf274a78746b489f92c3444d312006ac35dfea67110eb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hp0Le5ji0hmxNrM:A3k03kHRJWPji0Aj
- TLSH T19B658C17F6A402B5D067C0B9C5D6965AFA7138821B3086CF1399C7283F67BE19B3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 901KB
- SHA256 65f67dd6fde8b65710efd0b973f216130d4864f8d8f8d9fdc94de36301f7c9be
- MD5 369af87be8e79a0252f44870a3d2f32b
- SHA1 43c3684463babc942d67634fd82171ae5f18eda6
- SHA512 031afc01e66f7be1a990aac2dd77f07a714044406dd02c33754e4ec60505ee2a2047e0f9a22a8b8b2a77e93b525a0d52f977cbe6f4ee97e90134d10fde5750a2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hYb:A3k03kHRJLb
- TLSH T188159E03E79500E9D10AC1749AE68A23FB75BC56177093DF2358D6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 876KB
- SHA256 d4dbabac59e191bd9ea037beae2bf9a82ed7da30aa009aa9701281d60088386f
- MD5 da44172960b236966eb9f7de5cc3d1aa
- SHA1 46cd32ebc7b76aea9f91706a3cf7b82483a0b2ba
- SHA512 8ea44c2635baffb265ad1c24c6932be7c43551e91e7f676bda559ace18a89490d5da014c3d7811a0903d274c51f9709ebd36fa93e5dfc821504fb32563f5ccdb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hDZ:A3k03kHRJU
- TLSH T10215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 876KB
- SHA256 0ce9c1e482411cdf3717fbc4660d7459e6da2d8331c2944a7562798b7446b9c4
- MD5 0ca8aeca9766aae004cd3970dc141835
- SHA1 82dd8c0c7aa7225e4693a136fc8743ce1179bac8
- SHA512 1fb7b76d66aecdd1ed5a152f75bbcdf5e65695d4d0844554259daf301db8d0bbc02f11ebd6d7494e7a65739862b51e6a983a06276b1134f4db92782d6201e771
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/h41:A3k03kHRJr
- TLSH T1B615AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 876KB
- SHA256 f8bf9d7dce80ddb1669891356f08cbf2b33a2828115c7f2b336a368b6e4d45fa
- MD5 65858783885ff355d5c781c5d06708d5
- SHA1 e6913c669858b3dd700ca4a1816b8c1a953fc7d7
- SHA512 f485810c0576ae0997bcd018e05b14ff8c9f9847742abc88d2c9ef12507e5db21ca8843540e7827bc7ff20d24ff79753e45508630a9d95a139ea05a328c07a8c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/ha6:A3k03kHRJA
- TLSH T16315AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 876KB
- SHA256 eff3ec6e961694e1db45ea4afb01e24b5e5151df71a8b876d604561e07805d49
- MD5 5676113a237f72a4cff251f6673517f4
- SHA1 1ecd6de5c4610046bfd4c25b903ffc0618f055f4
- SHA512 acc3242be0329c8f052c6ed0ceddbaa8a6160485b0d59c892dabdacb8ce73e71cc59331f626e332e77ca3393a7e679c269e8da63ec8cbc7e25081a6cdf430876
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hSN:A3k03kHRJ9
- TLSH T11A15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 876KB
- SHA256 617926c797e61ea9cf694bd49eae61d8ad33409d3396dbc15a503f42ff2839f6
- MD5 d6220c2bdc4c380fcadacd1296950d90
- SHA1 6dd26a0ffde9d63aacb68494388263cfb6c184ba
- SHA512 1bec4e6ea15c299dc1655ad5af2aaa0f2e388c23fe566f0558316e9cee3a278d100d79072f4b9e7bb72d5713e2e0ba3be5e25ffd3dc20eb8452a385786888af9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hIf:A3k03kHRJ1
- TLSH T13515AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 876KB
- SHA256 fcb52bf81a6c6acb3ef2e4bf4635ab41c243aa75a8463c3e60cafc3942b67077
- MD5 6a73f3a21ec679a7b9a3d52ce8fa9b82
- SHA1 5a9179287b11208073ced097f48fc0e52a45eb52
- SHA512 b95977c2dfa6f3e90a015c2e255e2eed488e6e00cc8ac89be18bc49da101b9329e916f970a847514bb1de16e24e6c6176d5c12d26d37abd7802e2dbf6e406539
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hio:A3k03kHRJA
- TLSH T18115AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 876KB
- SHA256 f8be64471614b415439504ffdcf7c2075e5d2e64ea8e0adaa743d9ec9e59de0e
- MD5 f579db8d90ecaa91c60558630f398214
- SHA1 df0dfc652b0601de1f8b6b70794d3b08e62c64f8
- SHA512 7e987849a0d9ef54cb5508f573b172d1605c0e88e91199b54c4eec3f1515ad65cf7576e1fc8fa463078c899d388e6732bfe2bdfb4b84442f246f98c07e19d3a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hWu:A3k03kHRJi
- TLSH T18715AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 876KB
- SHA256 813a91a87677dd604355d3d4f6e77f5426681b7af0497a7c083a0795a5210bd4
- MD5 6f0c41f792ee13eb48db05b1dd7f4fea
- SHA1 7ea5445eacdbacdf14d3916b82f6b5687d872d8a
- SHA512 682be620c3f3ae75a75802c3918afd7235c280632f959d7246ae813388e3d3a49c682107c78d83424daf12f72d252989cd253c80c403318895cba4d928b0c0ef
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hK9:A3k03kHRJD
- TLSH T13115AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 876KB
- SHA256 7a168037c2815b08cc3302d7c162be0b105e6d6d04b23236b6e808db545bd350
- MD5 a07d35a2823ce4b7686f47c486680610
- SHA1 74ac32000d91639b5d825cd494e4caabaea26534
- SHA512 7b143f4a2202146daa5055a78e4e1ae19130455a022842084c76563883727eb7c7080ef2a6ef998c619f26a0392658d86b3788990751ebd1e5d27016a1e6c877
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hKc:A3k03kHRJq
- TLSH T12C159E13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 876KB
- SHA256 ca5433a528159b46d2c5ba691cad5b8aca19bacc443153e07424cf72b85bdd50
- MD5 979f84ac7a9d581002a546096318c9f2
- SHA1 9da6cc4f6ad5546e2a54455fce5a3d6056ea884d
- SHA512 1a7552f9a700ea6c8d425c8f27f4df8d4dfcd80f8c77a677553c97ff48431de3bf921fb4183f843d3cbbdb36bcc1b4790e2b55a9f310b59c751d8f403fdc73ca
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hDp:A3k03kHRJw
- TLSH T12915AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 876KB
- SHA256 405f921071de1c1dc7f4972a1151caecfc861406a6f9c9b8e9c7c886d1f92dbc
- MD5 370e74af7ed6656900ad36ec1cb88a6e
- SHA1 e1411535f1be73cf9af1acbc391e4689643ee1cb
- SHA512 deb21ac3e29e3ede2192a802109e1c203aa68b55e4e73a125ec4259c0de97e30bcc393f3778363234e85b12ea2d9abe6ed4a17af00912bb8bbe498dac4b1bdab
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hkN:A3k03kHRJP
- TLSH T10C15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 876KB
- SHA256 305be5d4e7d2c5e7064ea749d4d8301455024931ad3279a893fa5269fc9439b7
- MD5 a3c1486f154a2f3395e9e572d3a8180d
- SHA1 009cee46d84ab6549ec4761ff2bac7cea2e408b5
- SHA512 8e698e3989e087e914d58c03c3ce1b9c12647b73d1a59f638d03f3fe7a7dadff8751d869a47d9eab096792f806a65059433db3feeb533d6f8a70b8a35145952f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hMF:A3k03kHRJp
- TLSH T15C15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 876KB
- SHA256 d18a5a3386a443479f85c627e456b1ec23619581e285bfa7e50f807a603a73db
- MD5 60ec8110a07ad125df6c20f22826b165
- SHA1 b9286df8804e5486977dd507f58fbf4bd0203773
- SHA512 fbd576825d15a3f4616cb46a61e7a58df34b2cc1d010a0060468f0fedd7f238c489decfe4c663b5e28f900726e9e17b4d28c32b8816d42c4d1bafecbaf2da778
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/h5C:A3k03kHRJ1
- TLSH T17115AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 876KB
- SHA256 975d424a70ab9be4538d70243535f45f27e3510675a42cd226556aa5465ddd22
- MD5 5cf04df416ef4d6d490d0261904d7126
- SHA1 54246347ee2a63e6825602371e918517ada98049
- SHA512 ecea93f8f77963ef852a71e788e5044d7a2dd00e20204cdca0d42676cf31906f96790ce87e18df434956f91f217d6b9c877ca9363b4f4b4723ca2abd83a317d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/h6w:A3k03kHRJY
- TLSH T10F15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 876KB
- SHA256 e98c74a15c77c5742b36e570f9bc5565583fd3b6bd6af57d0f867f1292030830
- MD5 a7e7697a2395be2904c8cae4317a1cbb
- SHA1 aa259c284191cefd3a724523edd5c57039ece37c
- SHA512 e83548ede9e92b53d84456b8cc9a6d19e76acaa81ab61c6d44af77b2a63cf68660ad6b92ad6155822903a2abf598b53ddeea7fe1722de6b11bc3adacc0924fe1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hBT:A3k03kHRJQ
- TLSH T10315AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 876KB
- SHA256 77c0306af9680d6083a5ad0cef5561e778701116f0ee49e2f66f7f096a6dba0c
- MD5 d93ba94dfb3b0e451fb8e34ee24ecfcb
- SHA1 72018c6c60059cdc84cb1cb21f6a42cecbe8d9f9
- SHA512 73e7fa7154b65ac974b8f90b45be05acd7dd07f7ebf388d1a53e542bf27b579830c1ebfd4e371b1cb62196b98fc57ce87890685dba41c1cb3e0934c2f3c6d3cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hvu:A3k03kHRJP
- TLSH T16E15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 876KB
- SHA256 97b3f7479820db7a324f6fda0b1f0a667deae9536372711fc937d20be31d94ef
- MD5 fcea9abc266cebb29176fe6278b451b8
- SHA1 b01f54a8f54ad8d87642b4ff8d98de0ce8294148
- SHA512 8def601071a31c3d92cf943973c9ce7bd50fa7ee459bea580e9c7a43fed0d977056105f22e5877d1c1f01a2d40b6104b6ecfbbc10071f94a5bc24e3fe4610235
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hTb:A3k03kHRJ2
- TLSH T16915AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 876KB
- SHA256 ad808aab256d20640006d85defba8aa19c96777a414e674977b743408971da0d
- MD5 ac4e39dfc715d73eb0af5119768dde13
- SHA1 7fadcdc484e225758361007f9a054f4a0d830f1f
- SHA512 31f1f00408bbe2e48165034375546c2c1d53fe81343d18fc9be8c33af4f83669ff8af2ef398efbe07e38160532132e943b194f82ed9de45ece20328f11943244
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hnf:A3k03kHRJG
- TLSH T1B415AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 876KB
- SHA256 8b460119401b6e364b9d55602e78de509dc6d193c5bdb51d1e88bfb2e723b3da
- MD5 854a10b24c5ace9c2f1b85d54982b1d7
- SHA1 4ccbc29c0336b42d20b4460a92408ca53927ad80
- SHA512 a69e508b7820e2661fde658bda4a4708108743de1d7570701328b5cee51c0381157e267a308e6a0399a234c1e3568083436884ff9d02b00cd7b8835303f665ba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hQK:A3k03kHRJm
- TLSH T13C15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 876KB
- SHA256 ff77f67d98863c6d247436f3e35d3b454fdf9d29880e0b2f8857171b9a3a299d
- MD5 c20a3ed2d4d020ca6506075ebbed0794
- SHA1 aacd65be69ebc0688eff97ace7d0ddd4b7011038
- SHA512 eab24c9cf334c070bd0e355653f48a91cd9264c19cf40bc811c77329f6e371db8b01b74af6d76d241f15a246e4cdc59ba283bb3336e8fedbb910e618f3929959
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hNk:A3k03kHRJb
- TLSH T1F115AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 876KB
- SHA256 799f4a68c9873e5799b5b14c090ef5fe6df8b3c5134d72794dcbf500a39bbb58
- MD5 049bb2106a5f9df417a291e34576b8fc
- SHA1 abb3980964ab7ded169f4df8a0019419ccb93d46
- SHA512 2641e891ce560aa030ca9d7d19edf8ea407bd8c8a488bc6dc7536eeb358ca9ddee06b5a25fcc0c34f40577a5dfe92ce6a943bcaea783c8108c082b9520c23cd1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hS0:A3k03kHRJK
- TLSH T11B15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 876KB
- SHA256 f532a3c46a7d827f1eb4e935ee42f4959a405724842141b87bce73be334f8010
- MD5 502d6bd4862c62620ccd604c284e62e4
- SHA1 bd82b9a28a8020ae7bfae99e7967aca7d930e231
- SHA512 22de7ed5e908d8341f053ddbf47efc7172f8d26dfa5dea076643f73f5f463c1a9e84d7e1c63a2187dab50b53985062d6ca0b880171a15b6906ef2c68d0b0b525
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hhg:A3k03kHRJz
- TLSH T1D715AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 876KB
- SHA256 9ac18dc861fd3347d6456ef8b2161a4705619b7ff3a35eee28b584d2312c5aac
- MD5 e60efe170249859fe7ecb2e6af99ee68
- SHA1 a09ec0917c7ed7a24c984ca2fe2c9d31200f37c3
- SHA512 9b9c8ce3fd196025613ffb229c80cc4a1ad34c5e220eecd1040632de014fb36b4caa8d787a001d057b0bf6ae377785218300fc51b8ff71fe4a6132f05f5a54cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hIr:A3k03kHRJF
- TLSH T1F315AE13E79500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 876KB
- SHA256 3519dfde4432c4856a800795556a638d2e93b7489c767c599738e3fc9c82812e
- MD5 8aa3c84db23d56e8131dbbf33114afc4
- SHA1 8e39e3ddec3750736af1a8b1bcb5a0f76584038c
- SHA512 ae375a95ed53c554bb5b162eae44b9c89e2286055ac9492f7ede508fa1b039dcb5ba44394984fa666f9b56d1fdf839842c71fe9ce7b96ec1f4b0b85e32f797cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hmn:A3k03kHRJX
- TLSH T10D15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 876KB
- SHA256 52ea3f461d48f560db6a08ba21424a362066f4d91b38e915f1c4e0fc3b0bb7a0
- MD5 ec857925659a76be2d8e39414af67afe
- SHA1 e67c8a42ba3276174106a400ddeae1ff1336d313
- SHA512 eee0410c6e012d98a3a730eca20806f00747ba3e20c5899c0fa6d6ae67e5bd5af4a0e68660b7b263200acb216d418cd83648d8493982aa15c6a91cb1951485b3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hsx:A3k03kHRJN
- TLSH T1DD15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 876KB
- SHA256 47726bb313959185cba0c50d2674c1f9088a6a9a740581b8280da5b7e980393d
- MD5 4b4da4d303b63d1564d7dc8dd7071d52
- SHA1 92901c0b96dd3b09eadda163eadb0cc8d905d019
- SHA512 d92e7470138b0d2e5466ef8bf6a0b1359aec8285ffb2823700b93138ded406ccce6837d7683776a44487db4eea317c28f15dc54f8db3b3fe0caf1358c145a7bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hmA:A3k03kHRJy
- TLSH T13215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 876KB
- SHA256 793a6aff5df8247e215c06775ceacbd5d6f7e0a365e0a6fa7d5b16f2ccd20893
- MD5 4ae5583237af79fd33cbb4e79f1970aa
- SHA1 f6c024ea4d3c3943c9ad31a6c6bcd34e5af6db1b
- SHA512 d7325a67a7dd5f6f211aa2cd3420f7e2b7d22977a543bccd0bbe64acef9bc1a7edc6a4132a5c1109025ed5602990e4afe9db17bff9ba4ec19c024742dbc97e71
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/h/9Q:A3k03kHRJv
- TLSH T16B15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 876KB
- SHA256 624b5905940c5419fc8a3714aa5f511cb0a8286fe332099aa79b8f24a357cf52
- MD5 d02d4494a83a93191ff7eb9420ed914a
- SHA1 9d3a0ee7ec9fbbd9f6e5014e0bfc8e0c879f87ac
- SHA512 9b7d4f405de51b27677bce4171cc0547b978896a037939d961835ec4a1c1466845fd5818f17b27b9c9360d5280b9a9ba75928754856cb268ea9e5b485f55e090
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/h24:A3k03kHRJQ
- TLSH T13915AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 876KB
- SHA256 db808278582fbb26a9b0f4ace48b703dccf5c9066576e962611c0c95f93a2550
- MD5 077321aef1d640fea35d7bc3c30a424f
- SHA1 6496b5c6e032285ae938cee93fb3862eed5dcc1c
- SHA512 89e9bf8bff7bd57bc672551b0b2f02ab99d28a7a4352157be9a31a915d2770d12f684cbead939f8e3fd9703af1fb44492b7c0d1e02cb9015144d54b5cd126c14
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hlu:A3k03kHRJx
- TLSH T18015AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 876KB
- SHA256 1373ee7812a11fd7aa01f3835511afeef15b9cda81510df1b488460a66e70d6d
- MD5 0403e137202e1ee0b94da2a8e7f3b12c
- SHA1 732b8ca12eefae5796a91610a4ec5901e10789cc
- SHA512 cdb2538e5f12d79ae4fa478fc4b8d5b5f18d2ad7c289a2387341d0108f3369b9805a038c0a317e9b99bef729df82d3434dd95bf5ca138a06f85dae69442f7d51
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/h4j:A3k03kHRJ7
- TLSH T1BE15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 876KB
- SHA256 ef2ea2aa8fde7f2e730390d4244cd9c4ee52ee823b040a34c3ed0801884c129e
- MD5 c603c57e09f547981de9fcce0c1be0ae
- SHA1 4ed21c2b6c75c6ee45fefaa66125a4958878ded6
- SHA512 60cdd87b623ceb365bb5ac78d0db57ff31c0037ae03ccacc7476941755897b5b33d8f12a8c8954be5c3dc5c16ff57b3e586bf1c3006f5ca5d3bba1683e011a9c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hJg:A3k03kHRJz
- TLSH T1F715AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 876KB
- SHA256 62e4c4b0618c2afcf61662e7c348f534321520555a39e15aeed42c4573561045
- MD5 e9c7aaaa2d4e96c428fd226d16418b83
- SHA1 a18898b1c9676c9a1dc2d123a3b71407b5927594
- SHA512 6d30f0a37cfb08280627667c39fd1f63d17c7438ba0ace679fc2830a58dc10b81626c1f3d7e3a0213ce49a0d68e8880b23ba13c9c6b39a639746b7c544686dd9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hQI:A3k03kHRJa
- TLSH T17215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 876KB
- SHA256 05d6f5cdb1453b966eb03174aadb37f5480c6bd50df1da04a808e9f1dd550705
- MD5 8dfe36c44f5ef62bc1111f97a101009e
- SHA1 eaf4476f5c4b3cf2b3432ca6fab99578c84b74d7
- SHA512 db4fee7e4ec8d545124d00b4066288627a98fb935eb85367817a06055a745c0c49f636ee9f4c45f428309b2f1f2773edfb0fbe679dc04c8079bf59e6031479a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hSo:A3k03kHRJo
- TLSH T1A315AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 876KB
- SHA256 583f9aeffe5648bd2cd6b5fc831dd080baf7649758f39bbaaaa5d9abdbace48d
- MD5 602482ce779fa19eea9c9e1b3e9b7967
- SHA1 a118ec9f4029b680eb5db3d6281ba757e5813d5c
- SHA512 55f78bd029248675bd11307173637f8f5efbe188ebcc96b8c50850f359a5e96641f3f43ed035476fee7bf6226969e73a5b72043ff03503cc075a7b4a95b38bb5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hJ+:A3k03kHRJV
- TLSH T17615AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 876KB
- SHA256 fffadcaed331e9ba4e726df8280ebafc0e804cd2146bca5f14b1c0439995b347
- MD5 68e0c7a75083ee591adbd05e02c240de
- SHA1 9850f8a96bbee9dc3ad151aad9ceb3a0f40507a8
- SHA512 5e1a150f3f0651b997ca26bd291947f4118c18e173a6660ce115b8eb7211e7fb1081491e2576092c0bfb8cc57103bd686d868f518bf279dc0cdf85a73ff3cc1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/h3Q:A3k03kHRJd
- TLSH T16B15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 876KB
- SHA256 5a79a9da6c7af31ccc134be88c1f206774d4ca6ff0bd6c54a642abb378c70c61
- MD5 3868c2d8a4e43dd4ae77b97523f60e40
- SHA1 f4568d1587bb04c3007c19d2daa1afca609f8d34
- SHA512 99059c1457cc573d6b562c2e8763a5f8577ee3145425d8c7dbe4d98037cee88d39f8f3e20c82663c43f514827fe110c515bedb9ea1df3463e97d72bb56345600
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hMX:A3k03kHRJp
- TLSH T14215AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 876KB
- SHA256 2e62a09edba1a5e1dc51ab7964e86a0011f298223dbb54050db0ea5671cdffcd
- MD5 7edcef84dbe40c9c7b6da9d781c15a27
- SHA1 3789e615e5306a3ba56ce2aaecf512451e9b3adc
- SHA512 ba84ddbedbbecd1107e440742494f25f1993b533fd4d9d8649f169e8bce4ea775cad8e86a94e259daea690a742a6a3a950966c4550db997b8e9aca41645147db
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hqL:A3k03kHRJj
- TLSH T19E15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 876KB
- SHA256 2643b480b9dc6b958ff30ba0692fb55c38714185f10a8ae1b2f4cb5fcd2160c2
- MD5 6e7febacb97acd080e2d59a4bd25d3db
- SHA1 5e80472faf362797af458f56fe4289974ad74f35
- SHA512 f3677d3df1acbcf0c4977edcd6207ead68c16e1d4cc4b998eb52201493540918b90b0d470f3f59f26d1159806cc7385c8dea74e339f22d369f4989d839ff84de
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hOM:A3k03kHRJO
- TLSH T1BB15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 876KB
- SHA256 c02e2ec1e217dde216f56ec24e117cdbc6d8183873ff55649fd491177421a2a0
- MD5 5dcf7326646a685cfb5adcf7c29cbcef
- SHA1 c7390a7a3b2b689b258d72a2f08d9ffad01c4425
- SHA512 39f10d4f947f128a71311ec7669420a11f3388c79764b9f6508c7e67e87bc4b2bc3fbc879a6307c271aeafeafa47704ce78f5d03013db5d395e57f329229bbc7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLaba83ZDaoa/hXh:A3k03kHRJg
- TLSH T16E15AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH