Analysis
- max time kernel
117s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/07/2026, 16:14
Behavioral task
behavioral1
Sample
2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 915KB
- Sample260710-tpzchae12x
- SHA256 7ff1057935df22b59fb39d085d529b9c9a19d32ed15dcc26da6f9caba602adc5
- MD5 6da30a71ea2482bf493de33034300b96
- SHA1 242b34e5096cf679b858bb6614ff01ce264e8eb8
- SHA512 d41c9a55ecc2762976b35664ea2644636b98b91b2311e63ef8e99032a6168dc5db321f1d6d2fcffe1158780aa72fd98847803b031bf0cab3bff73fa8bbce52de
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYC9:A3k03kB56rb
- TLSH T149157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/1268-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000e00000001c543-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d6-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1268-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/3700-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b300-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c96-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001898b-203.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a65-258.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019857-283.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-446.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-495.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-515.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a67-601.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-632.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-676.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-730.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-749.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-792.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-848.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-862.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-888.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-901.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-914.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-927.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-940.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-959.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1014.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1057.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1070.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1095.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1133.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1147.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1192.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1253.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1332.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1351.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990e-1393.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1406.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1407.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018920-1465.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018926-1539.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018935-1564.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000e00000001c543-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d6-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b300-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c96-60.dat aspack_v212_v242 behavioral2/files/0x000400000001898b-203.dat aspack_v212_v242 behavioral2/files/0x0004000000018a65-258.dat aspack_v212_v242 behavioral2/files/0x0004000000019857-283.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-446.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-495.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-515.dat aspack_v212_v242 behavioral2/files/0x0013000000018a67-601.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-632.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-676.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-730.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-749.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-792.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-799.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-848.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-862.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-888.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-901.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-914.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-927.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-940.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-959.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1014.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1057.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1070.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1095.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1133.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1147.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1178.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1185.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1192.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1253.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1332.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1351.dat aspack_v212_v242 behavioral2/files/0x0003000000019907-1376.dat aspack_v212_v242 behavioral2/files/0x0003000000019908-1383.dat aspack_v212_v242 behavioral2/files/0x0003000000019909-1385.dat aspack_v212_v242 behavioral2/files/0x000300000001990e-1393.dat aspack_v212_v242 behavioral2/files/0x000300000001990f-1406.dat aspack_v212_v242 behavioral2/files/0x0003000000019910-1407.dat aspack_v212_v242 behavioral2/files/0x0008000000018920-1465.dat aspack_v212_v242 behavioral2/files/0x0008000000018926-1539.dat aspack_v212_v242 behavioral2/files/0x0008000000018935-1564.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3700 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ExtExport.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateCore.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{9A8DEEB6-1F0A-4CF4-BD83-A8EC662094A8}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpCopyAccelerator.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVLP.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\OLicenseHeartbeat.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ssvagent.exe$ 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\:\autorun.inf patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1268 2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3700 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-10_6da30a71ea2482bf493de33034300b96_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1268
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3700
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 915KB
- SHA256 7ff1057935df22b59fb39d085d529b9c9a19d32ed15dcc26da6f9caba602adc5
- MD5 6da30a71ea2482bf493de33034300b96
- SHA1 242b34e5096cf679b858bb6614ff01ce264e8eb8
- SHA512 d41c9a55ecc2762976b35664ea2644636b98b91b2311e63ef8e99032a6168dc5db321f1d6d2fcffe1158780aa72fd98847803b031bf0cab3bff73fa8bbce52de
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYC9:A3k03kB56rb
- TLSH T149157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 944KB
- SHA256 028c9c3eafcc9c828905384ec848c8b8c9bd55e374dca125e02261f27c802f3b
- MD5 dd3ab63a831d978d2e55f43fda2d6d26
- SHA1 49bd128fc23aaeb0e4a65592c4381ae697647c15
- SHA512 74853050a59c8484d89ec16843e2d89c9d4255af71840df95f2bb1b660009a73b8ed3bc0f4d39bcd7c6c451f21cae0782059988f23da7dc352696ff30a9a465c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCrP:A3k03kB56r1
- TLSH T198257B13E6840FA5D10F81749AA58662EA737C125F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 962KB
- SHA256 500c281cb71209925a48067da2bd14aece686f1b8201013517f72d680811b717
- MD5 70a03e86bfb4fffaba7d0c8cd0b6e6b0
- SHA1 62f4bc1c0ff14fb9e852c0388ff9c8b46978c4b2
- SHA512 24b374e47a2085e69c96759b331f64470b85fd66fdd600fe07adf7f53a628627236edbed042097e40c2f3deed48cac5f4f817e5c47b6581a581ffd88263789bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCQ0:A3k03kB56rS0
- TLSH T11A258B03E6940FA5D10FC1749A968662EA777C125F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 968KB
- SHA256 4e86931aa4c7ad05b5be8d7b3e830ba25e9b3a17f31c0239b8fa42c93370558c
- MD5 35221edd23988ef75600cfb19856a86d
- SHA1 fa4e2d2ae1f54bff25dfa6bb9fa6f0c373bb81f7
- SHA512 217de26231e9fb628382a0bae4b9534f1e99d69ece97e61403de0b5ee58725d2a2fa1b781eae629d01271bc374e1542d95d3de5d7b95cc90d5efdaa6cb4e3751
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYC8fj:A3k03kB56r4j
- TLSH T190257B03E6850FA5D10F81749A954672EA77BC125F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 6ad1361985bb1de8afa444fd5f54be2ea4dcd5be1d4116228828438a1b4ce2a3
- MD5 883e26adf5f5a7924402ae3169c4056a
- SHA1 f328d888d58e39bb7482762f129aba5050e2ef16
- SHA512 42a32c05b46817234a2e51f00019e806f390985523f2167809533861dfd10c4af8a2053b4335423c0ac987b28acdcf564f6d935a56e608370025fd403c0d2267
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCJ0Le5ji0hmxNrM:A3k03kB56rHPji0Aj
- TLSH T111654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 930KB
- SHA256 444effb9a30bceb2a9b7ab7c53beab3e2f55611b5f58c65e80f0ed2bbf9009bb
- MD5 d8d24bbe8936d7beb50a87de5962330c
- SHA1 72cd96763e8bca5108f2912e4b5497ebc104f185
- SHA512 e381ff682625bc41c5c6ba0b3517a64c344ff1fc93dbb293416371b1e3ea04959c87852c22bed6371728fc7e07cdfc61029f96c1c131254c4993054a8422599a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCba:A3k03kB56r
- TLSH T13B157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 963KB
- SHA256 ebfefc32790ad2adf08d3a70e542fb94fabb9664c0041a458968aa5cbd3ec095
- MD5 96795b7af84e037c5623ddd7d2fe577f
- SHA1 7396f1509a8af872ac1d5a5eb42ecedf92ce4307
- SHA512 cfd116630918dd140b9ad471642237dd351d14bad33f836779064c8a488e95142fbde78d4cfc0c0458b7c57b100e78a77c53fceb6c6ea3f50653bb8f76c51d91
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYC4b:A3k03kB56rKb
- TLSH T1C4257C03E6940FA5D10FC1749AA58662EA777C425F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 939KB
- SHA256 6acf9d4cf9623fc8fac9aec552637f62e88c015217bb3377610b42ad2857df59
- MD5 8adb3275e6c91728d07969cb8c2f0b13
- SHA1 8eb63ae3af623c204429a31d7b8dd2baff99b864
- SHA512 1c4ee15b64922ec3206eabcfbf4424f1b65a4b69fc31227f10c829c3ae03b650c4eac4cbe4a8d294304defde23ffcbc88fa0990c48915a7b5db4d108cdd24f49
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCjZ:A3k03kB56rr
- TLSH T135157B03E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 939KB
- SHA256 08b366486f2f5942acab2869cd90120ee8ca3d415b8af1d7f2a680697490ca67
- MD5 3dbf9d4e2ca974ff7ba1ec590131752c
- SHA1 06f1da6df048af664105c03bc85106fbe7e266b4
- SHA512 ae119655ed2300c688883a3ac605aab50f40bd24aa4c61fb7384b740bb1950b5b500424b70c55dfaac3146b6d3772dd7749b9b439f4c1fe0375c2d826c9bfb5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCY1:A3k03kB56rU
- TLSH T101157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 939KB
- SHA256 aaa5727a836e4b22439926f7386c6494ee4d3fa1d34c933a6bfa98aa3d3bdc27
- MD5 dc89de258abc891ccd7af113b3ad9259
- SHA1 12bc611155f14140397d6e5e58a6fb0ecc701505
- SHA512 c1a7399840a1bc1d01a09da497c8ad2a243a39c60812bed7f5ca31f49a0b439c8580f6482f01cefc7e60816b1d0270d6d310afafc50e430ecc50f71abbd04b63
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYC66:A3k03kB56rP
- TLSH T16A157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 939KB
- SHA256 a5ef3a58ce98a13f7dbb90fde90710640fe210fd0db51cefb85751a3964d1971
- MD5 2ed9ec2f42417330935a7ea2e36e5704
- SHA1 1151059682f7bfdf35f516dd07686c443dd66e8c
- SHA512 5f3ce6acb442cc67558b44ac660c502a69c36586318624d60e7655d0ca2348b0f461d9b30ec1d795519cd5995d0f24f6dd91966e0f2cab92701a4e7b30a129d1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCyN:A3k03kB56ry
- TLSH T176157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 939KB
- SHA256 5d854739e3537c951d16c49168fa99d960885eeffa643f8a244df8610292e103
- MD5 ec60928891fe14d2a1fe41b5905df265
- SHA1 e9d48e143e1a7a5f00e2cb8a7d5f800fcf99ac1e
- SHA512 2e520f1f914aa1695d623656a0002290b600bf68b6e50b1a911353a77078599395be545f6e1401a7f34a55324a42db00d8566f9cf677c7f7acccfd6c4d2f6cf5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCof:A3k03kB56rO
- TLSH T159157B13E6840FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 939KB
- SHA256 abc45dafa550fa79751b524e5145b75049c7695345d5d5dcfd2c95fd227e59ee
- MD5 883154940b41cd691dabe629775f4466
- SHA1 7d94d24e963b509b5de63bfa302102fc7dd0b647
- SHA512 edad5792baf291c041a64204eed89f18c1ec20836fb0f66029ff5c4829022f4b8ff1f7d8879767ac29976d2605075ead4e9e65fa087a530df00481d1b8cde0f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCCo:A3k03kB56rv
- TLSH T1C8157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 939KB
- SHA256 d687704987ae264acac4e994111fd98bdf054cfa3dc123d50fc6c3fccf5de142
- MD5 e7677e6fd476e3c855aeb9a0e14d20cb
- SHA1 681309be45b1d71bd93c7d9ec061d8a0e242211d
- SHA512 b66946cf125db0f7d6107fc585d5bc08385175d350b8fc0727c45ecd19f6c78f304227e46546b3bdcec939288e0708f18db824933fb85f9eb89c80ab955fc4cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYC2u:A3k03kB56rh
- TLSH T153157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 939KB
- SHA256 afc971f287186986887ce0e8b310c3ed84ddbcb0f689e56cf003d1bd440b304d
- MD5 6160c19c2b9493050009146f5b104d85
- SHA1 cf2e73130d9710d50186ba5ef05a9c253b037bb1
- SHA512 d691f7499039a700f10bf0740147b78b56a953286f00821582e5fc1866f793948adcc9f6835dbebbeff3b9c8c0b1d7574d0ace99322d8b735ee9bed478a949e0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCq9:A3k03kB56rc
- TLSH T15D157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 939KB
- SHA256 d2667acd12c5afe4fba28ca80adf781dae69e26f5be13a8ca9dff70a9c9e5877
- MD5 ca9320a3358c44c9694dceefd84a2895
- SHA1 3453c00f2a35e49c56e9060bc94e0e26ad85d1d3
- SHA512 8b9816c43a30bc1a02460398fa25d9b474ef12b7b99591f494115509ccf9199687188b05a86fbd446a8ac56a19999b0b64cb31f0c20831bd03d8f8ef66fc7c69
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCqc:A3k03kB56rV
- TLSH T1EA157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 939KB
- SHA256 7448e7750da2c8e77f6258f08cedfc4885f7102b858b99d8b751dbee418eb1f3
- MD5 3df70e8d43a4f458d1e70d73328b7bb5
- SHA1 199361bd483a9959afbe6feb4551a37d51e86f07
- SHA512 cde8361b1587a6c98d6f796cd08c8ff560739a3b16fe9a4c2c6966a2bf4827388ec42678f4e46291cc379f45d30350dad4171b34d7b3b24a263de27ae77166f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCjp:A3k03kB56rb
- TLSH T105157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 939KB
- SHA256 50796efb3dffc843cc62715441c43c96fbd9b36b1c70f2f26f55976d042068cb
- MD5 7a9be79cc82750381c023d197a63d63e
- SHA1 18a84ce6a9046f2b04e9b82f174871627639af08
- SHA512 b2c95229f7a44850aa9feb8597d1a3bc5303c4246b5a08d11b89f3bafd6a04c5f333068ed4b69a0f54afad29f4d400fd20f848540aad3efc3e563200187b99c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCEN:A3k03kB56rg
- TLSH T1DF157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 939KB
- SHA256 5f4f0b9c18df5398dc85fd36e07633fe7d3acf936497dc7c350a855f30b24ca2
- MD5 b6ccf4d3a02c87863d494ebb12688192
- SHA1 fdb10fdf263a77d46dee6b1857500d6349038050
- SHA512 d898b3492600fe4d04a0f728fdc1aa217023ba772867270880adcff5317a2ed1fc9cb9daf183fa1eb4008df0547de09ee88e2ec1891da626ed0c8a6952d79a78
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCsF:A3k03kB56rW
- TLSH T116157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 939KB
- SHA256 e71ad76869dbd68e524cc988da282f83e14ff410f721d0b490d32d41c6704467
- MD5 ed84997912e567bd9bcb3b90246ee9fd
- SHA1 b6b9f64200b00943e964deb89da2a7e0887ce632
- SHA512 ed27bbcf156d26a3e6de40b9a520720fcb501206f3d65b8288d4e8454ff75e07083d940075506a277048ec13689391898a4445324f0a8ea45a41aa6e930d90d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCZC:A3k03kB56rS
- TLSH T175157B13E6940FA4D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 939KB
- SHA256 9839768f6a1049f988cae0cd8025dcb4e21e9517fc7e54b714d5e2349e31b682
- MD5 e2906f3c8f394449d3739cbdfb1e0e1b
- SHA1 75cc81fe6950f746321dd1ed6918bb7c81ffbebc
- SHA512 64ad3eb1402f026f88c3e494acffd5600e7eadce50dec0fc74d9c45612a4a56ea6f9e767480f2e39f838a07100be52eb9a401e4c36fb2e6684e19a8b6c314611
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCaw:A3k03kB56rn
- TLSH T104157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 939KB
- SHA256 f32b147f1f0dead15242db2891f36ed1af4b384bb834a8eaf0847f3c4ea7325e
- MD5 969e5be019bd17c9089317f4793f9d51
- SHA1 aa0dde6d254266e8c983d975b867ad1418bef39e
- SHA512 9d9ec591e87a94dced90c35c821ddc8b92a8a1c5cd935db71199a79e487b898e486aec10c6b2a06afe7c0c658a0f0015bb048b48d288b82a08148ddadfe3300e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYChT:A3k03kB56rj
- TLSH T145157B13E6940FA4D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 939KB
- SHA256 11759f29f51832bd071a6fdd17e5c623873f7a6c9257388f0090266282e3bab7
- MD5 ad074964c6694d770b78de7599bff646
- SHA1 720dafd8d682ff114e6a3b931dd5072df9e8a6d7
- SHA512 4c9b5d13315b4c90cb014b5206575c612045969d2edf06d5aa34ba769bbb57dc15d0ab35ddfd6c7126eef463617e1bef5124d74d3f16f88f42baf18f12c14910
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCPu:A3k03kB56rU
- TLSH T119157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 939KB
- SHA256 36f987b5979b5b08f4b2ae791a7c25f5395f2aa72b148c49dc872772878275ed
- MD5 4a65b58cefc41a546cb5b4f538b0c185
- SHA1 df63bb21591ae4c2164108a44ed5650f1e3b56b4
- SHA512 d2773f3d4657d56fab9b82c2d9bc3564fbfdeeb7b003e64b04b7e3ed6a8afb95352bac7b7246b3e1179bc7f9c0f97d517fe64776ad3337b5c3b95f0b06f86eff
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCzb:A3k03kB56r9
- TLSH T151157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 939KB
- SHA256 9896d1492b7300e75c6e6f73d8e40ddbfd02b4d0245b34423fad6dc70d92abe3
- MD5 1672add9ceb4ef1bd2382d6e04a1f5cd
- SHA1 ffecaa372b05e96f4af89b16f81da3c6dcefbfb0
- SHA512 cfe6d174307d016aa0fc8c5fe592ff4006ea9b93ed3882cb729bc954cba4d116978f5e306fb87509f7383290c44d3f450a44507db2b4a61587ab7212a93100e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCHf:A3k03kB56rt
- TLSH T12C157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 939KB
- SHA256 d8a34194c800f4e413ff59b8079bf8eb43d10d81f96006cb4e871a680eb5f0a3
- MD5 45bc2cd182d4a3e20e8b26c3a2cad188
- SHA1 f856c385ba88e6698ad63bb7e719b942afea4c99
- SHA512 1c3eabd452762ba5b4a8ac4b741f3f8cde209b93d64ded657664c7db20b0c2e64855e094e23e33893c6e23f5474faad99af927b7a87a7866eec646c71e7c3993
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCwK:A3k03kB56rl
- TLSH T184157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 939KB
- SHA256 76af8a22906fb375003b24e13f0e6cab8696a21fb1bd34106ade4efe092159c2
- MD5 5c7efb42805bc045caceb21177c06c53
- SHA1 146ea3bd407303736c9bd925b6e53f67ea6d9989
- SHA512 ad7f97113581adf705f20d7dc009f58b188f985010ef1a53ee0f1504997a7456a7bd46dbec88986bb1af8ae383dfcf79ee79fdaa56fe5e86895297208770a55e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCtk:A3k03kB56rM
- TLSH T1BA157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 939KB
- SHA256 10fa75c491a8d1e662dd829928db77e2211ec97399ec86c3a5e895c8dd467ba5
- MD5 71ffd04b81f06460c6343cd761cc8253
- SHA1 e2627fe27c12a75625360ca156c17d28a1694d7b
- SHA512 724bd4fd3fbf88be8cb04312035dad89dd2d1e82e7a04353e3cf2f1093c744b35a26f0e2bd58076bb8ecd8794f2f571f030ed5d4f4c8c0294dd003a6bf346191
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCy0:A3k03kB56rl
- TLSH T180157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 939KB
- SHA256 3d1d7db8f184f67a64ff41fefbeb959f16cb6eb7ef6bbb6a9c3fa6c285c549bf
- MD5 8e390631e9e5ebfb1439002a1a4297e6
- SHA1 12917e9f7df8b3501c943c6a196fcf342a8eb54a
- SHA512 a68022bad9eac30d11098d359728cc05d86b37956bb093d21c0bdd03eb006babeb2165f9f378f16ae1d183b15c213f76c4e97d7b5cf8a7fc513cada2d7834814
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCBg:A3k03kB56rE
- TLSH T1D1157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 939KB
- SHA256 f250bbbda75e7f8f2f546356e368f16bed7031288f1ba037cdf7451233da91b7
- MD5 cf8d1907074348749d30b7f11f4af453
- SHA1 bb84c93528f883e6fea934be42ff6bc4c2b8ebf5
- SHA512 935cc86fe7fb2d6427822556f956f861bd00bc636fac2684e425bd87cafc7e42ddf960e849d452c5270e23dc1888d86b1921e2cd24829624d1cb768dfd793fbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCor:A3k03kB56rW
- TLSH T1BD157B03E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 939KB
- SHA256 339d1f09c1ccbe37977975d168e4e0340418b1656b26383ca3f9a08a59866f31
- MD5 f9adbfdf229e07dd1c50ad8ae108010d
- SHA1 f30038ec3d5e631ff17ec1ce4aa25b498ddf0459
- SHA512 56b5a535cdaa0e8e0e1beea0cf7db27a6ab7db504610ee1d7e099815c85d97443bd208640710c180f87215044aeac23dfbc1ad26bafb082ed27cd28f58b7ed5e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCGn:A3k03kB56rQ
- TLSH T1ED157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 939KB
- SHA256 3acd8d782fa1f3fa64b3d2be6f3294bb3d0cbb9e1dbc0ebbdd84d28dd20ba215
- MD5 2b98531d337e428029b611465f4e5f9f
- SHA1 f1c63b36b03851eeacdedbc0fcd5b839e9cf001a
- SHA512 ce7ad5653a980d150239de8c9cf9f9ceb5e635b34cc6e04558e09afddfab2819117c4f62db60cf1ebf6e4f6abf7b6083d4bb4bf1c3c60531a36e8e1d8c5b1720
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCMx:A3k03kB56r2
- TLSH T123157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 939KB
- SHA256 08a94deb65d99cfe61e77116c2fde8f0ff3d02ab322c6c12c820f3829491081d
- MD5 ec9da527e7a234b758adbcba11ab7f3e
- SHA1 3c6ae97b608778d354052d51562efa4640f141cb
- SHA512 abf0de7b5c310727daceeafeed3510329d9eb4f40399668d95fa68c148bfcf777b3ced409127a8c042c29b8ef0aaf33929605dd995006d139d192ab35fb72ae7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCGA:A3k03kB56rt
- TLSH T1FF157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 939KB
- SHA256 c1e7d3d37a81ecf642316b1ead94251cedcf2e5bdf86521222538e7b9a3f87c1
- MD5 91ceed10687b730eab4b69921f68bcc4
- SHA1 7df02050d1a5a2c3a090f39448ce5ade0a4f3d5b
- SHA512 7c39bf52406c323ac96a89dcef37325840c72d9b9481ef095b5a705e172291f044e9a6c318fa58c3e8d2316eb81fabc7c3477b11236ff8190efa152608976409
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCf9Q:A3k03kB56r8
- TLSH T127157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 939KB
- SHA256 ee51c940460cb33aafbe4a09697e1e7c25d9de15e78f1ba17a512194d9c42346
- MD5 a426ccbcd1e37c8e0ef7a93fcd189a17
- SHA1 471bf56e5989be025ebc6736e40406e08b10e769
- SHA512 3d0210f65a6c3584beaa4978b71301db4eae0efee1010e8d5a2deb24e7a86bc7b025bba71e17abbb6fa2301f3d2ac4822275f7b0181a2f9b95cc4f74217e9205
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCW4:A3k03kB56rX
- TLSH T184157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 939KB
- SHA256 51cdc303db3f52c33cb01cf6e3ef8090afc57bc0f97e24b775ca2d1d11a8d40f
- MD5 1fce9603cbba1f00e35a8e0a46d88185
- SHA1 05c6561fd78da366c028f029164ddfee320837f8
- SHA512 cfadfc5e62fb4dfd48d0eeb7e9aa9a4422a2f084026480c0043a630845711a062c58d3248ad2f1dd0229bd0dca179412f59cb4bae3d68bb26f5fd280a3ebee26
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCFu:A3k03kB56ra
- TLSH T177157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 939KB
- SHA256 82613438cd585ae182ab2b877087b4ea92bf9578a6ce5c52a4986417b297426c
- MD5 fc72565398087921d6e360e120b0bbb7
- SHA1 44f6ab24c746f25cdf9c488b9bd830b7694f609e
- SHA512 cfa1ff42c163baae242ee0770f675cef1952aeba725ba8a6de350073662d9741851d42a93b6a2af9f4303035674087d4a96d63e0cd8e5aadf5bb238d1ab3b4c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCYj:A3k03kB56r0
- TLSH T11C157B03E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 939KB
- SHA256 1c96e42e16aab7388bfc999379e2594cff3865ef242ed9220fc125500cd7fed5
- MD5 717a6011cfbc82c26bbc4e5c33ac2164
- SHA1 6197bb22a815bb8db5452fe13c4beafb809e0125
- SHA512 847b90b557b9b4183865b615a3dd20e65982a544f735d6ef855101a08b86450aabf35b31dcd50207d244dc3516a77830851f539ed7c0a5f01e814f6837833dfa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCpg:A3k03kB56r8
- TLSH T1E5157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 939KB
- SHA256 c2206276b33ae0900e6db59141f8ee06c90c8c22e6b8c9c8a8ccf3d036d1d216
- MD5 92b6c4b5baff01aee5566f3409a45d1f
- SHA1 f5bf20313217a1e7430785fec1b05d8d48995edb
- SHA512 242fdb9bf411edc72c4a177e47da3339e1b26febe132a8d702c022eecfd211dac8e6bd57f2fb7df9dc8e912c109640a73a7adeb8fc64e661b7edd1edc46630f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCwI:A3k03kB56rV
- TLSH T153157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 939KB
- SHA256 e8a89e80df23cadf8d839fa217a1fb47606ccc3618ef6117a18699460c31d7e3
- MD5 23aa369386e29ce28028c3e76ae2bd85
- SHA1 d696cec04ee523978f6b07f8f25fb7839e934fe9
- SHA512 75c07b105e86887af6f37d660caa6be160538abab08848737a404e2e4f3497446c2140eaa06ee0b3596d75c0d3d3802a6d6279bed0b320519f2f415c8a694534
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCyo:A3k03kB56rD
- TLSH T15B157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 939KB
- SHA256 17556dc02171698c6e5366994e4440c57af034e5bd2f22957449e6046b1c446e
- MD5 8f57c290d43504baf27d8592a4d92a3f
- SHA1 63b4a09b2e0275a2de81e00d656932fbeb169c8d
- SHA512 fce84096ceb0b85f86c00feac27786d4a1bee1bf103ac04710d8813bb700753f89ba0ebe43b9ac6de5a7cac0442e6f81bda58d74d73163b961cc9b89f6096b31
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCp+:A3k03kB56rG
- TLSH T1BA157B13E6940FA5D10F81749A968662EA737C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 939KB
- SHA256 6b7f65bf0b472cefa41c3e9ffc3ced158c3aaa557fd7d68742ecd524fdb111c7
- MD5 4af0be5ca29c834cfe2c454116a14408
- SHA1 c575b6b5ace6ea283afb55bd057c4a93bd2a2438
- SHA512 91fc59a95f78bb9abeadf62d2ab7930cedb0c0e9af07dd336aa078ecc00e8966d3c0a09a148b170b826e611f8a10272b955f42418c4099e54bea4aac1b6f3589
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCXQ:A3k03kB56rC
- TLSH T1DF157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 939KB
- SHA256 a8da38d38a1bb43d4198ba288ba2e6f00b61060768eaba17d96d7ab71bc2e530
- MD5 f572351224cf4ac48eca29770feb7f44
- SHA1 02c0683ad1b50cac91b6ae539ff1f7d3718ee6bf
- SHA512 f521cd0f13f49fa654b346f45f027f575bb51ad8b2bc31770a318857ce281f033c61aa6aa4cfb324d132828c48cecdbd86c17d0b4e50ee692dec9d7254d1afcd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCsX:A3k03kB56rS
- TLSH T1E6157B13E6840FA5D10F81749A968662EA737C425F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 939KB
- SHA256 9f77e77e7b4da8b3d4b8057e063f1b6f424f3e3068a0916a99eafdbcdb5d0c83
- MD5 95dcd33091b887ddd81dbb129d69037c
- SHA1 fe02037f77684f3601041216d02e4992e434a8ff
- SHA512 471c2c70cb21a66114684ba25f951a945f02bef420cc87529f1c32b99c6c8794543fd379e575bfae488da0412a1a492637856b6b27e1312124b04e20abe8cd60
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCKL:A3k03kB56r8
- TLSH T195157B03E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 939KB
- SHA256 f2d885db24ad837bcccfebf08a82cfc41afd18e99d19359433c0f0175785279d
- MD5 921054f81faaa8773a96cb4c2d038dba
- SHA1 ecb3d509e0ad01f7fcc7833a7b4158dd26b15995
- SHA512 f72a16769aa6f9383d844f147bf577e6ee3e29d65b271ef31dc9b13cca3b9e20dd79f71f674aeb5dadafa70d37af157b23d9e5e50efdba20ddc5788516ae0ba6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYCuM:A3k03kB56rN
- TLSH T114157B13E6840FA5D10F81749A968662EA737C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 939KB
- SHA256 8bcff4f64f8d5e27a4c135505b4a52434697ffa5f313f5777e90f9d1e9039bfb
- MD5 1be51ee8ef890b8cec431fb7110b0045
- SHA1 f2d8b046fde703bb812e2cc396c2ea24b8912109
- SHA512 b768fdadae0b1259be6667820ed35894c389570fb3baee5b0bccc209a08cd8b4a2dfaece560f7fcb44df42ff759cbccc9fe19a733555ca81fdd671a4b50d844e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5Tvinrm5OaEBYLkdYC3h:A3k03kB56rn
- TLSH T1BC157B13E6940FA5D10F81749A968662EA737C025F6093DF2358AE153F72BC06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH