Analysis
- max time kernel
95s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 21:49
Behavioral task
behavioral1
Sample
2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260728-1pm3ssal21
- SHA256 94fd6bb096c0c30d14f75d8cf032ee978a148de83bf774963de05038269238c2
- MD5 ef319d2e0be606b9b2a4adc56cab8323
- SHA1 be7a748ef7e8f0e773fd224f646f1da4df9e21a0
- SHA512 d39118dee528a26e9ea5af2ad02a6646fee58df9b1ec3b7b4e02bd1721f53583e040614cb26296f7278ecf6be985aa39d3eb90557764c51d1f3ce919fe102e7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a:A3k03kB56r
- TLSH T14E157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 51 IoCs
resource yara_rule behavioral1/memory/4328-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4760-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0007000000024528-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022b83-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4328-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/4760-23-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022be9-42.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000215f5-61.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202b0-202.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000235d6-258.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ec-319.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ee-452.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202f2-495.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000203ce-544.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000202ea-605.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124b-630.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124c-721.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124d-746.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002124e-790.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00150000000202a5-798.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021251-829.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021250-860.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021254-879.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021252-898.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021256-899.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021255-918.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021257-938.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021258-957.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021259-995.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125a-1044.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125c-1057.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002125b-1094.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125d-1131.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002125e-1144.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021260-1181.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021261-1189.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021262-1221.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021263-1312.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021265-1337.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021264-1350.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021266-1381.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021268-1382.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021267-1389.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126a-1396.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002126c-1403.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021270-1404.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002126f-1406.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x001f00000002021f-1561.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000400000002318e-1677.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0009000000016910-1877.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0004000000000725-1994.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x0007000000024528-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022b83-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022be9-42.dat aspack_v212_v242 behavioral1/files/0x00020000000215f5-61.dat aspack_v212_v242 behavioral1/files/0x00030000000202b0-202.dat aspack_v212_v242 behavioral1/files/0x00040000000235d6-258.dat aspack_v212_v242 behavioral1/files/0x00030000000202ec-319.dat aspack_v212_v242 behavioral1/files/0x00030000000202ee-452.dat aspack_v212_v242 behavioral1/files/0x00030000000202f2-495.dat aspack_v212_v242 behavioral1/files/0x00040000000203ce-544.dat aspack_v212_v242 behavioral1/files/0x00030000000202ea-605.dat aspack_v212_v242 behavioral1/files/0x000200000002124b-630.dat aspack_v212_v242 behavioral1/files/0x000200000002124c-721.dat aspack_v212_v242 behavioral1/files/0x000200000002124d-746.dat aspack_v212_v242 behavioral1/files/0x000200000002124e-790.dat aspack_v212_v242 behavioral1/files/0x00150000000202a5-798.dat aspack_v212_v242 behavioral1/files/0x0002000000021251-829.dat aspack_v212_v242 behavioral1/files/0x0003000000021250-860.dat aspack_v212_v242 behavioral1/files/0x0002000000021254-879.dat aspack_v212_v242 behavioral1/files/0x0003000000021252-898.dat aspack_v212_v242 behavioral1/files/0x0002000000021256-899.dat aspack_v212_v242 behavioral1/files/0x0003000000021255-918.dat aspack_v212_v242 behavioral1/files/0x0002000000021257-938.dat aspack_v212_v242 behavioral1/files/0x0002000000021258-957.dat aspack_v212_v242 behavioral1/files/0x0002000000021259-995.dat aspack_v212_v242 behavioral1/files/0x000200000002125a-1044.dat aspack_v212_v242 behavioral1/files/0x000200000002125c-1057.dat aspack_v212_v242 behavioral1/files/0x000300000002125b-1094.dat aspack_v212_v242 behavioral1/files/0x000200000002125d-1131.dat aspack_v212_v242 behavioral1/files/0x000200000002125e-1144.dat aspack_v212_v242 behavioral1/files/0x0002000000021260-1181.dat aspack_v212_v242 behavioral1/files/0x0002000000021261-1189.dat aspack_v212_v242 behavioral1/files/0x0002000000021262-1221.dat aspack_v212_v242 behavioral1/files/0x0002000000021263-1312.dat aspack_v212_v242 behavioral1/files/0x0002000000021265-1337.dat aspack_v212_v242 behavioral1/files/0x0003000000021264-1350.dat aspack_v212_v242 behavioral1/files/0x0002000000021266-1381.dat aspack_v212_v242 behavioral1/files/0x0002000000021268-1382.dat aspack_v212_v242 behavioral1/files/0x0003000000021267-1389.dat aspack_v212_v242 behavioral1/files/0x000200000002126a-1396.dat aspack_v212_v242 behavioral1/files/0x000200000002126c-1403.dat aspack_v212_v242 behavioral1/files/0x0002000000021270-1404.dat aspack_v212_v242 behavioral1/files/0x000300000002126f-1406.dat aspack_v212_v242 behavioral1/files/0x001f00000002021f-1561.dat aspack_v212_v242 behavioral1/files/0x000400000002318e-1677.dat aspack_v212_v242 behavioral1/files/0x0009000000016910-1877.dat aspack_v212_v242 behavioral1/files/0x0004000000000725-1994.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4760 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe$ patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstatd.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\elevation_service.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\identity_helper.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe$ 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4328 2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4760 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_ef319d2e0be606b9b2a4adc56cab8323_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4328
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4760
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 94fd6bb096c0c30d14f75d8cf032ee978a148de83bf774963de05038269238c2
- MD5 ef319d2e0be606b9b2a4adc56cab8323
- SHA1 be7a748ef7e8f0e773fd224f646f1da4df9e21a0
- SHA512 d39118dee528a26e9ea5af2ad02a6646fee58df9b1ec3b7b4e02bd1721f53583e040614cb26296f7278ecf6be985aa39d3eb90557764c51d1f3ce919fe102e7a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a:A3k03kB56r
- TLSH T14E157B13E6840FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaws.exe$
- Size 1.4MB
- SHA256 c24dde500b38b75b4afba27d4ac0008162f2a205d1c56de86ec432499e96b441
- MD5 f8d5cdbb09046a9589d419fcb987181e
- SHA1 5a4dd9a0d2cbc74bf242dedc353b091ac8102b61
- SHA512 14b3d4e2ee268930c3bdb91c637dca1601128a726d985d893d56afb354896469a14c62030bf5c7b1588e68ffa78630931c8c418358cb11d4e2b794e9f27cb66f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aT3Td9CHKy7GZO:A3k03kB56rsTd9CHKyao
- TLSH T1B5658C12E7D40EE4E02FC23499A64522EA777C561F2097CF1358AE153F32BD06A39B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 046a4e424d04b63ab2caba4b06844ef41f7874aee7d26383a86fa4b781845b08
- MD5 b695882ae56039a5b6dfbb47b48496c0
- SHA1 dcc6456dcf8c63aaf5699f7ba3d8ca342876d81d
- SHA512 e93b0958bfaa969c971e1fe82d5722ab402664d5bef37f88f30c19110696e69ccaf38b0c18cf79abd4f342aa03ef5e2048228d7ad455816c4f5770d7c251c801
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3abUr2d29dBrtpDiI:A3k03kB56rqUidGl
- TLSH T1A5657B02A6940FE5D01FC1748A968662EA737C461F60A7DF1394AE253F33BD06B3A357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateBroker.exe$
- Size 1022KB
- SHA256 dfe1d4f3f5046aba2dce11f8360672958eccd8fb4e2fa18c29a6096fc136a116
- MD5 2435317e96a3fbe3a4715c8107c19c56
- SHA1 36bc357fd27681c769862a7477ef4d3f26630f63
- SHA512 f9f5bce4968272f5b5f7bf47e9edaf2eb4c4985432aeb630df99fa837d03f463b5f80751a39c127b14c0538b1e1ffae5e4f20996674b2c9e9bdcfe0912ef8338
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3asIxITB1i:A3k03kB56raxI11i
- TLSH T14E258C03E6840FA4D11F81349A958672EA777C125F2097DF2358AE253F32BD06B3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\pwahelper.exe$
- Size 1.0MB
- SHA256 23fc2a07c85b8cbca779e923df5c0583524a928ed54e1c097f8021af41792daf
- MD5 3be731c8261b00e11226aa43fd68f000
- SHA1 c85dcbfc1d8b5bd448460bd6e640cf9c3bf3276f
- SHA512 60d3a0871455aa7ca39f2066d54c8f2289e5bb27e8a82a9954449413ebcea49223ae97bf4dcfb79bb9bf72117f49d84d4721b071326d520dc393b1f121f19cb6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aqGen:A3k03kB56rwI
- TLSH T12C356A07A6940FE8D10F81749A958662EB737C121F2097DF1358AE153F72BC0AF3A697
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 05d375ece81c481d54e4e9d6c79fbd9ac2188ddcc1d8d7853f470bb0521797ce
- MD5 63f2b44a2aa6c96a0b58d4d3b8a348f9
- SHA1 89c0347cbeb8e91ac4f353b4826cf67e0ee81824
- SHA512 a2fa57aa40f7b3d0349fef0273f57cb906b6658c606b83325ba778c13f6f6d86db6eea5bfc3fa7ab115993049e61769908793dc7bbc0b878c5ddf31024a9a514
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aP0Le5ji0hmxNrM:A3k03kB56rePji0Aj
- TLSH T1FF655B16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 bbd30aa350d8f5a7aaeccc98be41d6d089f8e9547ed7f3d7bf2e834206b7be18
- MD5 05ba98c370f6588f853627c09b2a6b59
- SHA1 789be13ba811bf7093c5d2b5b07c08778574298a
- SHA512 d8e4cdc3d4db64b6b6ab855e18882572da5c3b4a78708c19f1352e59ddc6cf04044f4fd383d7e3f90596b2b4a4bd2fd0700e602c4d6835d947237697b78265fb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aRa:A3k03kB56r
- TLSH T18F157B03E6940FA4D10F81749A968662EA777C025F6093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 ac5abf3a09e649472cfce7211dbcd9f487c297cc734546072232ed0231269014
- MD5 c2a8173ae3e77f65ab4fe9fc53cf9bdd
- SHA1 69c806da6fc8439d1f2ae85f77e4a787a7bdf36c
- SHA512 e6d6b04cd648601e812448293343f144b8d893d453b49bb62c9df6ed33c01ee8e98d67eb0f56d49633af7f9f2a312ac6b6234efb2d9c84b80a5d8ed33897c6aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3ayb:A3k03kB56rTb
- TLSH T1F5258C03E6940FA5D10FC1749AA58662EA777C425F2093DF2358AE153F72BC06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 947KB
- SHA256 3620dfbb6c7622a02ae2e990a140a95fc9b2eb9235898f774612cd66cdc3b11e
- MD5 66d62eb9726444e7a312017bfd02b2f6
- SHA1 8f8813244d7e846062be3a9e4615cac986b1afa9
- SHA512 29cc73b44cb5578e5444094f7fd93187ab0ac77aa81c3a594ae5bdf55558edc07c33f23b407ba8bc35b115ac77d604e7151c4955cc675fe9df021589a56743ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3apZ:A3k03kB56rs
- TLSH T151257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 947KB
- SHA256 3e1abdb3fd6256f4d8dbfdd1ca612e895e8f4e88e0a058e0ad9cca85242d8108
- MD5 1fe0d61276a6853dd763b8db2eefba1f
- SHA1 a05def30562ab39e911bb91315c249939b9031f4
- SHA512 0a6ae4f5ee1e71f45cbe85e147dfa440cb3862e5c471bd5de9c1cf76dc8f14973ae78e520926c4608d191810c7028a0cef8017aedfee99efa84cd49d45a7c1ad
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aC1:A3k03kB56rj
- TLSH T1A9257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 947KB
- SHA256 b336b7a88c891d4dcd58808a3b53b9956a45abfefc0df847d0e425a486e68914
- MD5 8d03e0fa6490b5796eb5060f1de53d12
- SHA1 e4d7470c031f6be584ab2b64c60595b18c01040c
- SHA512 c9c67e291cb668854149d444d3cf9cd9ff7b28b66a0227b367f9243d6766e3103aa55884060185a80ef94d8a2c09e28bb2f6b43f46b08f5ebed47cf91e3e8645
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3ao6:A3k03kB56rI
- TLSH T1F7257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 947KB
- SHA256 0cc643fb60b5eb02453c901a228c061c68986b80b20dceed60dde1d9285df663
- MD5 0700a94297384bf91ae67873fc625993
- SHA1 deeabe76c3c0e53e120a0af790b77f5b08b3d54a
- SHA512 b08e3c0f4ced527b6ecbed13fe78b00c613a911461acf47040f2cd02c77af06b84b6e8e29491c255ab90cd04195d0b3ecb43005e4bde73fa5f3d9eabe65eebe3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3asN:A3k03kB56r1
- TLSH T1EB257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 947KB
- SHA256 acb27dae6513320234a48d9dc70f2359ab6b82b61e30e5f81e74830323acad64
- MD5 f8e3481fd01410e1149e2852eaa11bb0
- SHA1 2fbc75c06780dbf4866da78e29e6f4cf3d2f3088
- SHA512 64804e51a96d7a2ebd5c1c201f1a87daf22c7673a126158b32350adc622f79a4c1ce6245b4acbf71298f27077d45c260e48817541edc8dfad80c359f09501499
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aif:A3k03kB56rt
- TLSH T193257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 947KB
- SHA256 d12a54bba30ae0ef98dfc4347d27a67b24cdbfdce260ec6a7d5efc297fbdc76e
- MD5 1ab9fecbd232f505ff36727522650c1b
- SHA1 4c7bc8596b6eeac27bb55bcc8dfc2d8774046f45
- SHA512 bc0b6a76612b11cf879a85e979025ba36f3af332fa2378a35383e5c204c445ec603f42311cca161501cd75d9d79598be9d0876db3d3b3e23041d52bda1c3c7a4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a8o:A3k03kB56rY
- TLSH T1A4257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 947KB
- SHA256 5e27938c74b3ee319c73c5551b55374911cb6eeede20d34d25f0c663062ae6ea
- MD5 3d55df7d17a481f6f1e0b054ae81fad9
- SHA1 b64294d3002378be1e96f0196f32a231701bc1e2
- SHA512 602c1a98e7618ccec233db83c2ecfff7d7f0be4108f80d6a9233e5da02a2271d0fd59142243f6e3aeaed59fc9575b0edb6e8875f41242eee146fb0d61d8d1d1c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3acu:A3k03kB56rq
- TLSH T136257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 cbe1f3368c0f143049996823a651430910934b7612af8614c433c15a1871df2d
- MD5 11ecbc503847efd911030b3123f802f1
- SHA1 2260f0acf689e968c81697bfd9067ccca9a96fa1
- SHA512 92890f3537c44176303e77b9ecdf3f757efadf6511d883c6c3cec8d406c2e29ac9af8f3ff407a11f134decec5c55a28d7dadcd49a84360a1d64ad46defc9373d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3ag9:A3k03kB56rL
- TLSH T10A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 25d6e4e253ef5f297825a54bf11edddc50a86630863db63284229b0dbddb1e47
- MD5 2e0e15c872103655302d8e423b5384ad
- SHA1 0a961deba14655a3397e74b000de5f2717ca93e7
- SHA512 a9c4936e1aaad9512772837b40abbec31e1e6cc87b5b10a280c6bdb4d592f2173a586877640eb0d520d4188139af9a2188de1e87db1ed5015f14364e90e6ce6b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aoc:A3k03kB56rC
- TLSH T157257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 b31bdaad322809db327efba9a4389307ca0e95f0c17a67d99ce087a1a5fb9038
- MD5 aace834bd103b1f480bf1f8dbe46ae49
- SHA1 f1d49a8118d27373c2cd5ac1b9ed0d1232a8b97e
- SHA512 da737497b0c981aa667b3b241687bf7680fa1dbf608b9ee21f5b776733edd775a372a005f6236eb0cc9bdf9cc5341e35dc3aabdf7e159f90589a2fc8a4663b09
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aBp:A3k03kB56ro
- TLSH T19A257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 652deb78815ee2d4c40feb41dbd9236073608ec5eba9870dc47fcdf6573866ba
- MD5 88d7ef24b0fe3e9cd7d1e0dc29638620
- SHA1 b2f27ccf5094515397490655bf6815a6cf06d498
- SHA512 e4bd47216d7d7024835e1354d2cd0e686c3cdd5ee6f220f3828d1548250be28953f368c337068561da273fb810577f186b1ef45546b90219a3d650dcd134d573
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aWN:A3k03kB56r3
- TLSH T1D7257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 c644919d1d831b10406c462b4684126605bc332f59bb669b65e2211a87558339
- MD5 6bf96cb3b73114e1eaca26c576638ea8
- SHA1 50f3d14979bf8868bc2d6d9f0998c7545d2a7f06
- SHA512 c1d7534b555dde388c1e8ac8a7abeba210e48d342529061b2f7c736e6b5bce7ec10f3c132ba23c3722a838c0cc5b0452db6675fc59f734c547a5da7efcac24ab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aaF:A3k03kB56rx
- TLSH T145257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 4ef2d3bbf4f1abd1aa5a2b141548404fc57330418285d261f3a5d957e96ca314
- MD5 71060f56e1407c31aff43854b9e7a7fb
- SHA1 39244df143b69a3da755e56dcd10730d16febf7c
- SHA512 473102d05ed572450fb59a4de83e3cbc099f545e90d11397a28b12486df37ee6780102a2e3fe100708787a4d4497df5682d2cd50e4ef1086648bcd5f3ff48387
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3avC:A3k03kB56rd
- TLSH T1E2257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 ec95a82699fd09e86582fe7a03e2d4bc84ae0aa22aaf6e6719df699f27b82893
- MD5 109b1d9c26b49ae3547d32df6af70499
- SHA1 1027a345f753de734d4db09c6035adf1b2b41083
- SHA512 3d8659b121c1062e909bbbaee5424d5ff8ce4b9c663e4ea98fb6470b7a7fdb6fd4d2f8411df540073f1ad2909803c493d80e60d71e9ddd836853873aa5f1047d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aQw:A3k03kB56rg
- TLSH T1BC257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 2244688147c14062c07e941986188047bffbfed1124072927cec6082af165f86
- MD5 b0f65bdcee246c6e5ccbdb028a66e75f
- SHA1 6014365e2f8e28dc69756f5814ec4dbb1a2b3a4e
- SHA512 e217c4e953c909996dfa4793d80222e2fcfb8d102c4cffe78680aa7b4ba9e3414bf319974dbbe9a8e3ccc2bfff68019a9340a32e2212a3a68425464e30208189
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3avT:A3k03kB56r4
- TLSH T1E2257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 84ff9cae5d0f916f3e45c7de42c090f088febfd1b26005b98790e880f9a5d0ad
- MD5 24b9b0187f6fef50073f2577ad7bb2a0
- SHA1 b529a90d352efa7331f100be0fbbeee9cc6532e5
- SHA512 61a1c25eb9b12657f6e766eec89c5d35c22065b935809056292eb05e6dffb93e1f8f55019d87317f95c6feb46f6a07716bc6e2294fb370858b5bfe7c92cecdca
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3apu:A3k03kB56rH
- TLSH T1DC257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 696b6c75904e15b2ab83ee356595881ffd1f4dde97b2fc9d208f09202e344097
- MD5 16391b7543cdf90e88cb5c42c11488c1
- SHA1 f4b3cc2bdc7b6a82554de360f5aa4221c4b9ea83
- SHA512 5508e1443d1102fe294762dafa22355e74a519d0073103dbe38be25eddaca017fed494c92253ca6d41327d52ea18d1ca09b57ca41f3d2208147e62b17eeb6f8a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3ahb:A3k03kB56r+
- TLSH T171257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 48ba77614c47ecded625ed639f147cdd1eb1cbf0cf0e8479e1fdfdcac2fc501c
- MD5 a6c72b04f69ecf96080ba58b9f882a85
- SHA1 7b9eb5ba2947dfd71f51b21b31c7253e15829a68
- SHA512 9ac785d9b6875aef1cc2eec7d574ed5fbe1f98a6160523e92d251f4a3cd00d96843499c23276486ba745724f1d0b87156776e7c2913c670e62aa3340a1a61f63
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3apf:A3k03kB56re
- TLSH T13F257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 3aabad8f2f86cc5a03824b2b6b6c723c3c8a9ebe14c3a1d86eda3611fce75683
- MD5 7669b53e85f9c8916a8e5d83e393fe51
- SHA1 9cfc6bb856d8b46f418e2842f81086fc195e97ea
- SHA512 ca62a431f34e5614af54ddd3865b82fd5c2a1efab7c2e4f777288b5fc9c16438c6d02eb96efc542127c8d9d38850d15a0b45a1d404e2875ecf5bf8ab705a923f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aSK:A3k03kB56r+
- TLSH T18D257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 79d8c6ed3b5c86fb0bc723edf774e1577a6343bba8125432bc114cf96b362833
- MD5 1273c3a266d950cf359a3ceb75030aa8
- SHA1 e99f83509061e74b8203b5f62119d09fdb9e4e02
- SHA512 2b6953c816e4751a87e722553ba3aeeea7488475742982ef4e70aa906fef891614f19c52295d29870f72039fa1fdf37c12f6ff5f665443b87e05e70ca2909637
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a3k:A3k03kB56rj
- TLSH T109257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 9515765387652bac8ffdcc3ad94f00b1f9f3002954d15ec98aeb1b9af280f5f5
- MD5 9675c428d5e01c028d23c6d635c9e6e4
- SHA1 afccb14510fae0bfcf92623e72b5d11f6dfbac30
- SHA512 9c1bd0a3c497c26b0a5dfd0c93b6b7f5190c7fd3908174d27d1be54e7d34218d3a9531e270b4ee13ace2f70641016c8d2957d0d58196922f8315c2121b053558
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aA0:A3k03kB56ri
- TLSH T1EF257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 04589b15078ea65f3a4ffaef14c77ec413140f9c2dc7b8e5c70b39d0761e7393
- MD5 f70d4d1408299ac2a607110306a64b7b
- SHA1 fa99fadd46d6e63cfd94f133799168281ed01855
- SHA512 bbf395f4b3839ecc95a5cd186d654baa5a4580c44d286192e8a604f44eea753aa175b649576358856915712fb620d60b2cde3390b698f063358af544d5e5a6af
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3abg:A3k03kB56rb
- TLSH T1EE257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 a8afdaddc094f4eeeddeb8fe5487919060ebf1cedd856056185d6de9a0532760
- MD5 3725071cc11f9ba1076eb2404c8de7f9
- SHA1 17d918b531172bf4f907d8d7aed7960ce3423bce
- SHA512 40e7c65c90ca78de82c804eeb611b2fde44282ba6cf38217d949714e501678b9b2b753416ad5547ac8d6e35968849b7f09a7c86825c9bfb27ab53264a8705743
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aWr:A3k03kB56rN
- TLSH T1B8257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 7cb21e459b5b8d454bae4762562735b1574925f53bc6be5b9e5aecd9fe0a4ab3
- MD5 88bf9d2bf64b410c847b12f1e0bab429
- SHA1 9663adeae433b79e742a512c8f9509a1fd87e667
- SHA512 599dc8deb84c5a31537218e487d60086f00d8deedad866315275256f8dbe160b8ce1d1f7b4d6d63d15a14f2c41237f00bc39a223c7126c2c9a77be60c559bd39
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a8n:A3k03kB56rP
- TLSH T1B9257B03E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 f5dabdd342d12e19d25489bd24994558a722bfe7fda66c118481675aab63e98e
- MD5 46068cd84b939e321712e04960c1d3b8
- SHA1 9feff7c782878e744db98b87deaeff6ddf2bb0ef
- SHA512 0ae95ddf313a3cba1db86eb7e8e3623f79829ffc1353094fa6ab95fd265f85694ec423d5365c2ca362836b567f44c8d2ff6fec08114284e21feb1307b9bf4d37
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a6x:A3k03kB56r1
- TLSH T18E257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 dd6e8cce993335d1acbbf7cf8d8498839bac1b7e767cacbc7bf42e0d817ab92f
- MD5 cb11a15fa1bdc4c35bec325653aa9bbe
- SHA1 b66bdb08ef9c3ec718918bfd9cb174f8ab312796
- SHA512 cfb8d646e34cbebaae81833430190f18acfc4227e23f0da22657a00f64497a2b7466a360538356c21a782fed3abfa66a36d9b41b542462924783ba90aab8792f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a8A:A3k03kB56r6
- TLSH T1E4257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 414d44b7b54da11e73af41811d65386e1e3d2adc1cfde704e06b21d6df6f690a
- MD5 d363abd44aae14a03f28413f1549dfb0
- SHA1 4c8e984664d92611aa6d2c8b0bde8f73641caed4
- SHA512 0bc5a7fc077a1083673795dcd5f87992a1a5e0f8359af98de4cf5597d46b95eb252ae2bf59ba61330a87f82814c076a884002544b05baba9a70e35d53cef18a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3al9Q:A3k03kB56rH
- TLSH T110257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 7c465f5a9fd65a5fc0262f66535d13156750a79d734a85402384147683263d41
- MD5 32e34060099dc7d3d3b3844aaa8be3ba
- SHA1 25a617056b8f9c6ebeab8e25f975bffb5308de00
- SHA512 09a1a6d6521a7c152d06c5004238dfd7ee5fd9f7c37c423c960299de6fa1e066148f7d8819ab696da999fd7d891af1e30e9b856129eb49849d5a8e9e85d38bdd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aQ4:A3k03kB56rY
- TLSH T194257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 150361d48fe5de4b3a0d0eeb32f23132aa544f8bb4b8f11adc4a2004558ae714
- MD5 b5ec0c10461870bcd2672d32514bb9a6
- SHA1 b87d0fefd0d29e57b8de8063b0621fbcd8d8ac42
- SHA512 8e650f06e30ffe5533b73255c70e647ad324dccf83cede3bc98c6527e091941addb6418700f482b836674cdd18b1a828166d095aa709de01b608ca1d8aa0b9d9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aTu:A3k03kB56rp
- TLSH T15C257B03E6940FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 7342284125fed7542ab5b371ad7d3583e82d9c8effd02f5e3dbcac470f70431e
- MD5 94183e2e738d7b08a58314623eb45b42
- SHA1 b45fbccbe718e994b86596aa36466b4d9c58a583
- SHA512 95342a77e07ed79148023c364752359b27e4ff1bdb761c995def7f3e8322a8967754739bdee15d61e35627e5991db9c7dcb274eafc3f37f01df77319722750b9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aOj:A3k03kB56rz
- TLSH T152257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 900839bb101e4942118fa3b8085e2e89d09595f217c6e78d9c46f5b66369e295
- MD5 d64d51a57222e1489cce8bbc34eab084
- SHA1 c3ec2be3f371230b444c8e6bba67ea601567fa44
- SHA512 c35987bd6848757061eeda8ae9a86755a989135110007c5761e8bc16210e969469c2b1994444e50260718bfb3b0959c311907a16fe998db66f771234c9674ea9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a7g:A3k03kB56rb
- TLSH T14B257B03E6840FA5D10F81749A964662EA777C065F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 bc90db8ed6459f74c33adb8dd8a4251866fa204829b0c533b45a2cae27f2ca24
- MD5 0a376b1ddc2af1ab5733fd1dfa51b47f
- SHA1 6127df172c7382a6ce4983b2301b3a0badc3070b
- SHA512 6254b8f5f735256583a372b5fbec7518a17b721ce5a773af702487263c0cb77e106507a6c70032a7ce096383e48542c3c2e0b532b7842fc4050494dda22b2551
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3amI:A3k03kB56rS
- TLSH T1A7257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 fcc29f4560dd4de1205f51129794906be0d40eaeda4272f5806bc4b498858193
- MD5 abfe8ae810bc42ffc011d8627149d5a3
- SHA1 a14560025ac4bdbef29987beaa80fd1d329a2745
- SHA512 609ecc84027ed4a1ae4e9220cfaf90e106252bbcab82759274f3f67ab921ccde74901d41f66c1f6bf2ded180c4d307634d76554ce28857c6e058bcb7233596d5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aUo:A3k03kB56rw
- TLSH T173257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 26249fb02af64e33b58b9eeeb68e42cee5357fe959e042f322fa579e83e1341e
- MD5 a8e38658a95ce8fc908b7965497474ef
- SHA1 ccbaee39121b2ec56bc8ba9d8d4eea4fb642eafc
- SHA512 927cc832c9ad344021cbeaf00068c1fd25b7bc19e7f3bed69867da4393111c671ae99ea46618fceef03dbe1c6534bb08f587842ceb01cc0ffa00bc76863a333e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3a3+:A3k03kB56r9
- TLSH T103257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 59c38c16e808f0ba63a7a30d4769b5067badb7bf4c9d2255e627caf896153c7c
- MD5 6e5ae56b7ac8a913f63424a5a9b40793
- SHA1 278ebc5602a8f9a72fe82db1be2f41ed3d7f637c
- SHA512 df8da40a55234787245d062cabfe1c24f88db449f0ebaead2deb9f56736f382812799611fb961b28fa4ebb2a690351a7b36767135de6cbd7d1a12288c345214c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aNQ:A3k03kB56r1
- TLSH T1A1257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 f4c699138136541c00fabaf45169224df23762f340506798acb2e3a965c8e061
- MD5 127fc167598564bfcba84cfe25ab9abf
- SHA1 042a08bdef991dd130166038113392e18ad461d7
- SHA512 495a41072c022068d0fe152bf3f90754b67e981a17ecba95653c3080e625f7c171e263441c8d72b3ba729497e5212bc290848e37c3a98d3dbf0e0a7a9e9a1540
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aCX:A3k03kB56rh
- TLSH T1DA257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 257cef2e8448f9271874529690cf294a39d33ca44f274c7422d2f857b3b23a3c
- MD5 a29c6095b711e084af4949f98e9eb7ee
- SHA1 f21648b10adc6c025eb06c5c06e92e263b0257fa
- SHA512 fffae1565f218bbd9297ac498c9024659fd9c56a759b4708d945e32939a791744cb91985f940ca309047cfc7a797754bf1ecbe3014ae15e2903e285902416a67
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3akL:A3k03kB56rr
- TLSH T1B1257B03E6840FA5D10F81749A964662EA777C425F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 4be4e634f8ff69adf1d9c05866e66482403d80290382f78feacd5bc984c8f1df
- MD5 dca9a9d27abc44d25ab4fa3415bd7e50
- SHA1 1e0936315e44780c57cd57a5c9a6241b1412962d
- SHA512 aa904f9037180c1f243e8e6f2628c1a2f3882024265b129df4109dbb291fc0750117d4fdcea719f471a587a544286d27a137f74964be364eb38e58bc9a64e2f6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3aAM:A3k03kB56rm
- TLSH T144257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 66e91e0167e8e411f7acdbdea9c9a8e58c677bb7c25f272e9d26a5f4da337782
- MD5 ea7c360fbeab8f4724e6fe9a1557c420
- SHA1 7baf98931b28a0c17a7a64939f9a0fcdceeeab24
- SHA512 393423416c12c70279d04573ee49bd3693dce1f4644f194a4b71f646f58326d338223cbc8d6d119cc37dbb200c7a11f296622703af5c1d0c13974deb7d84e52c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdjQyryT2E3ahh:A3k03kB56r4
- TLSH T1CE257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH