Analysis
- max time kernel
94s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/07/2026, 02:53
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 938KB
- Sample260707-ddldhadw4r
- SHA256 3d0588299cc062eb0f307f8d52f2178d0c1167bc6165b1cf82a852ffc5b45a68
- MD5 77ef3e9c35b6764401cac1928c0f24b5
- SHA1 52c439ef59361f7360bffa7e75217f3da4a756c2
- SHA512 88cbf3effcd31115d7cca82ffd60b848a808c935ca7a57c20505ea84c26c9e87b5861903281d805bedf8ea542b7e2fd4d6163bfa9240c40edb28b0993ce4840b
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaoj:J/sCv7rTiw24DtD+qBAaoj
- TLSH T155153B2777EC4865E5A3613048F88656D976F8551B3082CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/2184-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000a0000000187c8-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b30a-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b316-39.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-274.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-461.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000198eb-492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-583.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-620.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-711.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-736.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-779.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-816.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-847.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-885.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-898.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-917.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-942.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-973.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1034.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1053.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1120.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1164.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1208.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1317.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1330.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1361.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019907-1368.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019908-1381.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019909-1382.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990c-1383.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001990f-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019910-1385.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2184-2028-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/2348-2047-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack - Executes dropped EXE 1 IoCs
pid Process 2348 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateCore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe$ patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\idlj.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe patcher.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\jabswitch.exe patcher.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jcmd.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\orbd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe$ patcher.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe$ patcher.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmpconfig.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE$ patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgewebview2.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\BHO\ie_to_edge_stub.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe$ 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\tnameserv.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe patcher.exe - Drops file in Windows directory 63 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2184 2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2348 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-06_77ef3e9c35b6764401cac1928c0f24b5_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2184
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2348
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 938KB
- SHA256 3d0588299cc062eb0f307f8d52f2178d0c1167bc6165b1cf82a852ffc5b45a68
- MD5 77ef3e9c35b6764401cac1928c0f24b5
- SHA1 52c439ef59361f7360bffa7e75217f3da4a756c2
- SHA512 88cbf3effcd31115d7cca82ffd60b848a808c935ca7a57c20505ea84c26c9e87b5861903281d805bedf8ea542b7e2fd4d6163bfa9240c40edb28b0993ce4840b
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaoj:J/sCv7rTiw24DtD+qBAaoj
- TLSH T155153B2777EC4865E5A3613048F88656D976F8551B3082CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 ae7778c6eb8d567523a8de9acef3b4a7c808f18f8f83c1b630ed0935e5b591be
- MD5 c475677545ab87632ed248189ead71ea
- SHA1 ff3827dc4749726a8c0759a5567ce64110755fff
- SHA512 12473080d2b363c7d6f948936cfe3e160ae20b3de748b85c3dd3dbd609bf4dc8f52d7f1a61edc679956e8fce53d75c7dd0c6e2348080ab5706c42bba0333e926
- SSDEEP 24576:J/sCv7rTiw24DtD+qBAaojP0Le5ji0hmxNrM:N7iw2G+9Pji0Aj
- TLSH T1F8655C17F6E84661E0739174C8E5965AE972B4450B30C6CF12A8CB3C2E73BF1A939736
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 952KB
- SHA256 4866bb751724462131c872f2e80dabcded7a89bf974961b5f42bb9e4e35d0ef6
- MD5 339dcd5fbefd28dbb304266f5933f14c
- SHA1 d23ecb6380bc323d132f430248edc4c76d58fe00
- SHA512 b75e66022005eda6ed82360dc883b6711d86374f1913414be27c3c0a4f4436e30ed8181ca0567fb9ce6a19b9be32c55a314f67ca6be97eaaf1484918fe71f596
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojRa:J/sCv7rTiw24DtD+qBAaojRa
- TLSH T14A254B2777E84865E5A3613048F98656D976F8550B30C2CF227C8B2D1E72BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 961KB
- SHA256 2bbd6ac34e6d0928b6a7b7ebf72422997452e5f9bc03f3445fee66fdf5d9cd95
- MD5 b29496df0ea02df4c4ea529fed2aa6e9
- SHA1 e6e6e6b4a02ff41f0e9bbfaa63deae8849769e49
- SHA512 b48e8a7f0fca74670d9f79688cc31deeb92e6056cf9d8862cca9f570e3b1d4d30c34d82f18c0b82388f5f8ae47e6c3f08ed12e75e1eac509ddb18933c0c38e6f
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojg9:J/sCv7rTiw24DtD+qBAaojg9
- TLSH T1D2254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 961KB
- SHA256 402597b2992e4711eca120069cbc27d995e1f88e3577eef20bacef48319c94c4
- MD5 b8515e0ac11f0941c9b4c39b0ff21ab9
- SHA1 9fd9b1659261afa806d9d92cb40f05f36fb2b860
- SHA512 c7cc92ca5351777a90c3471cadadebb714648e35439400abad8371b639c003212413273af7bd9f15700372c888fb8b3eccb55306cf22a39720c1fcdc57bf5035
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojoc:J/sCv7rTiw24DtD+qBAaojoc
- TLSH T10A254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 961KB
- SHA256 2c663bc3b629508d05c29cc9da31f4fe7aaa60a194f1e2f032052ecf3296373b
- MD5 c7b9c5f3a08b4f10a22e3433b5b9846a
- SHA1 709e888248075bb8289b53a7b651f0f3e21426a1
- SHA512 f8fd9195d4169dbfd0e12bf5bfb96f808baa2a761c466f2bcddef859e02c43687db80130478680c2020074b8c20a3e22e6ad9db02781c58b276db8c8a5e929b0
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojBp:J/sCv7rTiw24DtD+qBAaojBp
- TLSH T172254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 961KB
- SHA256 189ea60e59d4dfc5035c13e8de854c7728afe4d4481ce16614c0f1c0c92611c0
- MD5 dd339a4f9a8c25de0780ec385c8b3049
- SHA1 f1e11a4ce5cea49ecd5aac93633c20eb775878dd
- SHA512 4006e349bf73a6e07dc66bc338d79c8b9c3003c1e7d70c209be912d3ffee8570330f9c4f433a4b92f50c1dd1792e7f24085772a067025d564b4f0ad88e44194c
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojW0a:J/sCv7rTiw24DtD+qBAaojWN
- TLSH T146254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 961KB
- SHA256 d869a39149ef061d3fd5658d971239aae63c8adfba476ef11e98cec6e13babcd
- MD5 de737fd4de1e8dd0851ff9dac39deebc
- SHA1 f9ac1483838f41078565a10995e642432bcaec71
- SHA512 e6d92a33442a469ebe5d6bc750de39ebb12c12178b5ae8dc23385d13258e936118527f09203d3e6531d3ca36475cc82349eab1007573b8a6a00016f8dad2a9f1
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojaF:J/sCv7rTiw24DtD+qBAaojaF
- TLSH T183254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 961KB
- SHA256 558328b61b4a6427e679e37b1a3c5a2ba18671b4772d5ce4f8c29a1657046c38
- MD5 90ecf87c7e63ad6722d14ab648b3d55d
- SHA1 19130bc1a006a7f084fc5d05c6174dcb8a6ac473
- SHA512 1fe5fc9e2fad2e031f982994ec9fc41ddd4841fe8e5fc0ce3e8d8bd6bc4fe1a76a9485c54b9e735d99a9ada819e7d1f4a07d8939baefc49376f5c1cf99b26f9d
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojvC:J/sCv7rTiw24DtD+qBAaojvC
- TLSH T1BC254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 961KB
- SHA256 bfea40d27c24ebf91d03d881473d7603c341ab064319373f6a86a98651aa191e
- MD5 32291779a930465a9b51127fea144f87
- SHA1 021fff8d5b87273d3866a9f0a9d89a88577867ed
- SHA512 0fa8e671d6509a4c9cd156ac72adbc14caea07cd1220b1ea7b0896962ecd285b8bb4e1ca65f5138fe2311ea34727a9c87888363cb708bfea577ac2945f3b76e1
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojQw:J/sCv7rTiw24DtD+qBAaojQw
- TLSH T1D0254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 961KB
- SHA256 f0985ed01bd42f298472a40c59e4cb55e9445ac66261cfcb15f36d39502b8850
- MD5 6e7683a6fa5ad0aa081be2fe5c3742d1
- SHA1 a554c59d7a4163b07eebf86477283040881887dd
- SHA512 b336062631ff478222d2c94af94360be29600cc2632caa4d5e8c7cf5fc7e803f58279e5600075347bfa62aaafc0caf5cc5d6ceec31f1767b12f0dc52dca44602
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojvT:J/sCv7rTiw24DtD+qBAaojvT
- TLSH T1A6254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 961KB
- SHA256 18cad4a368a885a82c1c1f08ea3da6ec9760db7d64cd507679a08b5d264cf78f
- MD5 14aa7871cc8548b92733c186c307f147
- SHA1 2ef035aa54fc0eb4ff55ee594310d6991b3f0b16
- SHA512 6c499a6d54df89d3b8e66210c3857f0d14ce9890feef7f8c76542c1dfa596f2b73b0d0356ad2be4573381bb11dd72575451af33a6e91f18dd75ecdc3b893ad94
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojpu:J/sCv7rTiw24DtD+qBAaojpu
- TLSH T17C254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 961KB
- SHA256 f0d632fe42ab5ef1d92df626c454ef0500e39cd2c08dd293106298b4a2dcff53
- MD5 eae962a5d0d0de69ca2d0b63cf29226b
- SHA1 0f52436600af67705d85e23a3aa1f593ad4070bc
- SHA512 a3d62529d98d15985727b1d3a5b4a00af29dba17f47ca5996d3ee3b4b8913347dbc3b4a1b31a3cc15042f8dd95147e1e76da649f4fc8692b2b16cc5af93c0376
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojhb:J/sCv7rTiw24DtD+qBAaojhb
- TLSH T1B0254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 961KB
- SHA256 8b50e13276073e4c7e023fe085d8d1c48151c22cef288d6bc1ce2c58bb59d0cf
- MD5 d45671d4cdf3fcc2871a37a3a5f3bd0a
- SHA1 3a965cdaaca82b0dedcf7b790196fe91859f16b9
- SHA512 4003712e92d7362e4df8d95be2f330c308e7c2ef858a8d309c558549027df97f396191938d257d318e2b416460b396025ff84ac57fb2977b1c228ddd119d26c7
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojpf:J/sCv7rTiw24DtD+qBAaojpf
- TLSH T174254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 961KB
- SHA256 f16ed8248e0a25e3fdb4cc3fd0a40c28aae8b7229917549a59aad0a27d1d3d5d
- MD5 9d8aadc75d34bbeef135f255de5e049a
- SHA1 20c8a1314d0819147fda58b0af645ce3ee5d7f10
- SHA512 dd01baee4f3e0115eef64dfeaf1364f9ef227c5d6bd7842bb5a2ce3fd6143a3075deaf033a095aa8e9ec82497e0f42d30357dad8077ba1f1f24f6d1234e8db48
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojSK:J/sCv7rTiw24DtD+qBAaojSK
- TLSH T1A9254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 961KB
- SHA256 22450de3520517a88855d4bcd2d8f9989d9edaf4cf30bdd1a82860c632e7f162
- MD5 2e98ae71e7ab488de5b1c5bcfd74f37f
- SHA1 b24b7c5c8af0ad5cdb0fc31ea5d5ed0559fe0c8c
- SHA512 432e34eca3f07c1793e185a8db46f97c397cea560db8cd990c4acba1777326da715fe004ac9352a4658ab1743e4ebc77edaeab5314c5d96cf57440a8b831cba6
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaoj3k:J/sCv7rTiw24DtD+qBAaoj3k
- TLSH T1DD254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 961KB
- SHA256 9699f68c65546253936ae3f8fa02e405bdeaff5c5971f37fd695ae5300030e86
- MD5 27fde11e9f735725937f4ceb36ba571b
- SHA1 9f8577720d7aa17c01abbee6c28c053a4ddd22f2
- SHA512 dd12f9e5f00f0ff3a08fe64184c62cd3cb8a6376488e4f5aef4e78552df85a7ddc692c8771a822f6ced35814d751ae4c30c48ac7c657f7f72d67a94211e7f1d3
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojA0:J/sCv7rTiw24DtD+qBAaojA0
- TLSH T133254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 961KB
- SHA256 8b2f2462c7120ee1fbc198a9b06522c9f6782d05529874ae819ee1cf3b4b71b7
- MD5 b1ee25a9718947ab45df2887d4e6c846
- SHA1 6f0bb226a1ae1b48ff64b767d84ff0a7090b192d
- SHA512 71e41388a9e4906637d831d9bee85a75a5723dae68ecd7f585f3fd52a3c657a95e383f05013a4f6cd99651d6e48bb4a2419f5537691d462d309788be687792b5
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojb70:J/sCv7rTiw24DtD+qBAaojbg
- TLSH T11B254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 961KB
- SHA256 414996b806989d412a7bed5000ebbc689241d2c7ba6592724d606129ed1973a2
- MD5 798af7b37223775943d0e1fc359c33cd
- SHA1 dce967cbc5d12c3a728fc452f7ca5dedf1ece2cb
- SHA512 e60d8d8551213761da574eb607e5d3519a097404c04aa4aea381f4c68ec3abac29e2b63a7fcca88128326f98292ddb5ed7203f54e14a23009a0c9418ed8440b8
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojWr:J/sCv7rTiw24DtD+qBAaojWr
- TLSH T130254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 961KB
- SHA256 f12c0df9c1a91528d3343bb012f217a40eee6e55488a4dc2ff953b3b336997cb
- MD5 6c3447eddeff4fe5ff902158b1aae5b8
- SHA1 4aa6ddbef5f089ea1fb67a064fa26e6d23284ec2
- SHA512 fd2973ef6cc322027e982353591fe6e840b13cb96e44b2dcffec77f70b80ffd9f5e259a64f5f6daed1fae0ba764bef632850bf5c2474f0bac83390ddff3182c7
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaoj8n:J/sCv7rTiw24DtD+qBAaoj8n
- TLSH T1E6254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 961KB
- SHA256 6398dc31de87b3241f3f56a4ea3e9322b85f419436ce9d81eddfb8250540fbf6
- MD5 42dbd5bd9b937444d583425d3aa34d33
- SHA1 ffd24cb0b6972ebaf096923789ecd3767edebf92
- SHA512 2368ca49dd8ced9af326084a244d331f07fe51c1741b032ff84f169bc9c91eb3c8ac46d0ad524a9d7878b01715f69a55ffde4b6ee08e474661fddf668b2da3a3
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaoj6x:J/sCv7rTiw24DtD+qBAaoj6x
- TLSH T118254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 961KB
- SHA256 19b900364840704bc11174f45bf4ec7bf552e7a014e9067160e03abb15d619d7
- MD5 dee94d29188d257796ff6d5a5a1a3fd9
- SHA1 dee467b0606fcb31bbfae68037de2f01d7b4ad7e
- SHA512 f92483c46e8fea679e0ba0ff1d8f909695fdb5cc74cdd8bdfcbb9371b4f4a38633d119840b15c153fba8974c5a932317f7a93969d6c09471e6244770424550cb
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaoj8A:J/sCv7rTiw24DtD+qBAaoj8A
- TLSH T16C254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 961KB
- SHA256 a02bbeee0e731a393fd11afefc1d8b7dc8aa5f6d3c223f438125c0e232fd4438
- MD5 272e8df1c0a37cdf91300d3352ac9dd2
- SHA1 f9bf4c167f81ddd63ea6ee3a560e102af682fc68
- SHA512 b448e55f4fdf81a816ffd65f2f9d2fbe6e4bcc41053ffece7aadcb8b23c88bc1fbd292350d1b52afabe60d5392b804fe3b207d792bdfb574164d1e7f6b9ae375
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojl9Q:J/sCv7rTiw24DtD+qBAaojl9Q
- TLSH T124254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 961KB
- SHA256 f09906c83792448e90e48dd95140c41c80cd83eaaf7ded2c21178a238432d525
- MD5 183b193d98eef9df8b087616a42641d6
- SHA1 5dc244cea78a6a5f664e245a97351768bce791b2
- SHA512 0725f59c8e31ef34234410c441bda70f9dcbd4bc838022731efc6d198e6d71cb1564a2b8edcc8897d3fca7439d4509190243243dd07c57238ad406183ee3b6cd
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojQ4:J/sCv7rTiw24DtD+qBAaojQ4
- TLSH T157254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 961KB
- SHA256 32217850149bcdf3a47ccee74468c9f0ba7519afcb0efc940796e7dda2ff94f8
- MD5 30c450612777991e193078b7a77a8649
- SHA1 5fe069aac3994150490d9fa97bcdda20371b2f7f
- SHA512 37efb803ece700b5b9903691fbeb805bacf46174b6e4fd4ce32875bcd3d1910ad714a30ad4baac9889dae390b6b4de0363889a682522a2884425988261e9435b
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojTu:J/sCv7rTiw24DtD+qBAaojTu
- TLSH T1B9254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 961KB
- SHA256 ae52aeb66fe728e77fcf08858eaece7f11e70ff8bb0423844dbacdaddab3728f
- MD5 7834ca628d57b8057066ce3c71fc6d8b
- SHA1 06b41c29a55c92ea906aa7eed6d0f31621b7a769
- SHA512 c4c7dc7813e8c9b4ba6881d339ff68ac4df9d9fa2b4bf1fa2259201ef202ba7de6133f49782a2bd626ad0a10e39408854c9fba34a96695739cab52a3faec1404
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojOj:J/sCv7rTiw24DtD+qBAaojOj
- TLSH T170254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 961KB
- SHA256 ed8591924ecc6b4ff1163233918ec566584c3125ec0229d4e3ce3923b9ad3a6e
- MD5 19dbab8986f4ec51d238b4d8bc8034de
- SHA1 f514de7983a5af3f7ed4dd3294b0e791fce3e709
- SHA512 63499cf26e4365413f78eaaa5b7b14240099e925a9b06381ee77e808b29ae9bfcf33d3d9b84625b22a7500ee4262934ac3b47c6ea3334b958485ea3309733f3d
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaoj7g:J/sCv7rTiw24DtD+qBAaoj7g
- TLSH T1EA254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 961KB
- SHA256 26c54ebb394682a61f0dda45da17b6af5de896054654786915d1bb4a56cf4cea
- MD5 c7923f7250c1d29b78c0d860e7ae78de
- SHA1 2a2ad4ab6d8d07c97e7747ddb18ab1880bfb12c4
- SHA512 36f5853ab9f4f8236080ed77435350c891ae00221874359db8f398cac880d7635178d3e0ba8da5d5669d2199bb379eec7be391b234c68544dddb698fcff46c5c
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojmI:J/sCv7rTiw24DtD+qBAaojmI
- TLSH T16D254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 961KB
- SHA256 188c4e7c8911794409034e81bad943cd3e1566b41513ef8fadf9e8c315baaf6a
- MD5 8e0b198ae555a1e7113dbaf20c3f092b
- SHA1 6a8cd5cd5f74d445014730195698c9a63c7fb94a
- SHA512 5f71f905e7c2f0dd51fc9898e1071f9149ffd4aa6033bbcfea14d39f97054b515c24203299d55ce25c9bd52fe4a124dbe50a4e4323cd35598101098c2065c996
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojUo:J/sCv7rTiw24DtD+qBAaojUo
- TLSH T161254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 961KB
- SHA256 1bdba34b6131cccba710de6de840cf1d085b4d4c003d0977664bd07ebbcf1ff5
- MD5 89e445dbf7b0070e7c62ff71dafd3f07
- SHA1 f14e48a06eda753cb4e8b21b18b366807d07d8e9
- SHA512 33147adae0d3aedf635abb784272e68e0978c3a904676f70cb3d7b7db6514561d968992b89f941dc0ab0d598d6f05617fd8fd5d256eefcfbf92801ba3d15526f
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaoj3+:J/sCv7rTiw24DtD+qBAaoj3+
- TLSH T147254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 961KB
- SHA256 8e3c8d6223c8b9bb4b2330bff298a8c11d740ec2eb44d3a1a0b9944d96591444
- MD5 ac3ca9e3fbcb0459f97e1cf3142fb87d
- SHA1 d68677caf57f440080b8d72f8e5fdb03d0400ba1
- SHA512 49e60ed2b5a65e9b138ea074c40f1cc4f6e6f179312d4eb715f2b28703c3e4f52673ae4b9b7adbf6c9f8fb97cfe317dafc3e7fa1da084098209a29d2e07bcd25
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojNQ:J/sCv7rTiw24DtD+qBAaojNQ
- TLSH T12B254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 961KB
- SHA256 8f9b0dbdd1ce6e9b3bb91879c3a1ebad09144f867c876e411415405bb5ad2888
- MD5 7b01d0c1f1908e56bf5b9d88b7ab747a
- SHA1 d2da4be9c640c1d88de061aa513bc4c14a44c92d
- SHA512 f88932ea6c76944d6a1bdfba32cc7f111be757a8438df17140953ca25bdeae1f6fc6b34a9dd12214a56de341c63867759ef45fc9a680273a6c2ddb5ef06f0f7f
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojCX:J/sCv7rTiw24DtD+qBAaojCX
- TLSH T10D254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 961KB
- SHA256 ba31c9b86210a789982ccc28c718eb3d31ffd8fb24d21c2b37ec558418fb854a
- MD5 a2716d5ee6f9358b2aa53f2da58d5364
- SHA1 e2a06aeb8db8301204b20db4f02591850a491d18
- SHA512 ac5409d7791e380f11eeec47c289127788a9ea2b271e21569ce626b2b250f32210f1277032c8d547de554239b5914013803d4c8afc96f6b844a20ddf659951f2
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojkL:J/sCv7rTiw24DtD+qBAaojkL
- TLSH T19C254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 961KB
- SHA256 35e216f958e0293fe90119370f8e40314ffdef34dbff93ff4c3c873d9144d2f3
- MD5 cff5d91e60054988ba711c12d5d198cd
- SHA1 bc59f979494e0adb19edd4137c288866087df90b
- SHA512 ecaeace6c86689957edd65318f34ca260003a87219eb5b41356f03f395d6b41d3b1480a07369505a395a9e1a61b37b9ed66d2a33d984c065d747e2d9d14a709f
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojAFC:J/sCv7rTiw24DtD+qBAaojAM
- TLSH T120254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 961KB
- SHA256 aa670d476d25e98b6046b01e2f1b4b2602aab3959564f55ef16c902b1be57390
- MD5 f1999a5cfc5b9efe05f58f437de91fda
- SHA1 f44cd77ddb78106127fa88ae943d18b1103966c2
- SHA512 569801fa186ac679b6d6d849e0d2af338dfed5c917570da67f95a30e8ef02152ccd9da6ccc10cd1b92ad64e68fb5a217f5612b289b6299fff4773145f4de7465
- SSDEEP 12288:cPE/72wcCvRR5FTjkWIw2JK/7taY+FUBAaojhh:J/sCv7rTiw24DtD+qBAaojhh
- TLSH T1BD254B2777E84865E5A3613048F88656D976F8551B30C2CF226C8B2D1E73BF17D38B2A
- MD5 SHA1 SHA512 SSDEEP TLSH