Analysis
- max time kernel
97s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
18/07/2026, 04:48
Behavioral task
behavioral1
Sample
2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 946KB
- Sample260718-ffae5abz8s
- SHA256 3f04d89ca8dbaedb6073a0bc9fcd42ad96bdda5cfcc274b14a0ac5f86404c83a
- MD5 139b2d1fded769444a71b9b487513ffc
- SHA1 0b036fe2b269175cd0a29aebbb88de54b146ac1b
- SHA512 f36a992803b91104b3604601fd8b96a61d7220dd267d8f9a337f3c5e306f177e58e3e72e687258403fa26c2c1fee9ac305ce18c358ddf7d80128a1b15c724f04
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyb:t/sCv7rTiw2RYwZCUsjKpcZb
- TLSH T16B253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 38 IoCs
resource yara_rule behavioral2/memory/2776-0-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c00000001c5f0-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b305-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2776-21-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b30a-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/3724-41-0x0000000000400000-0x000000000040D000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-270.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-433.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-483.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-509.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-594.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-624.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-674.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-723.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-742.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-785.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-798.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-841.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-866.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-886.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-894.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-907.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-920.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-933.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-952.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1007.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1044.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1063.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-1088.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-1119.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-1139.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1171.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1178.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1185.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1276.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019902-1325.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019903-1344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1369.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000c00000001c5f0-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b305-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b30a-40.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-270.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-433.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-483.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-509.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-594.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-624.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-674.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-723.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-742.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-785.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-798.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-841.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-866.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-886.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-894.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-907.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-920.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-933.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-952.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1007.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1044.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1063.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-1088.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-1119.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-1139.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1171.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1178.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1185.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1276.dat aspack_v212_v242 behavioral2/files/0x0003000000019902-1325.dat aspack_v212_v242 behavioral2/files/0x0003000000019903-1344.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1369.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 3724 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\servertool.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CNFNOT32.EXE 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\BHO\ie_to_edge_stub.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmplayer.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedgewebview2.exe$ patcher.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpconfig.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstat.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\notification_click_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdate.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\BHO\ie_to_edge_stub.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\Offline\OfflineScannerShell.exe patcher.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AcroRd32Info.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File created C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe$ patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AdobeCollabSync.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\ComSvcConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe$ patcher.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\_4bitmapibroker.exe patcher.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\dfsvc\v4.0_4.0.0.0__b03f5f7f11d50a3a\dfsvc.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logtransport2.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\BrowserCore\BrowserCore.exe patcher.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\eula.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\SMSvcHost\3.0.0.0__b03f5f7f11d50a3a\SMSvcHost.exe$ 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adelrcp.exe 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\:\autorun.inf patcher.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2776 2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 3724 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-17_139b2d1fded769444a71b9b487513ffc_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2776
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3724
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 946KB
- SHA256 3f04d89ca8dbaedb6073a0bc9fcd42ad96bdda5cfcc274b14a0ac5f86404c83a
- MD5 139b2d1fded769444a71b9b487513ffc
- SHA1 0b036fe2b269175cd0a29aebbb88de54b146ac1b
- SHA512 f36a992803b91104b3604601fd8b96a61d7220dd267d8f9a337f3c5e306f177e58e3e72e687258403fa26c2c1fee9ac305ce18c358ddf7d80128a1b15c724f04
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyb:t/sCv7rTiw2RYwZCUsjKpcZb
- TLSH T16B253A1766EC0895E566A13489B54606EB72F8561B31C3CF12788B2D1F73BF0BD38B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 7eb2be24994a6a2193ca94f5b5ae378295da8f672342c2c82de14e1db0feea06
- MD5 1dc1cd83a2a388ef0bd4607970a96603
- SHA1 8d2599ea98a69447d2c4515d7ac95cc4089f5193
- SHA512 afa5c6903cca1f4416711ec96416fea0be43142bc88169a0a519dbb70d8ccf4c80ccf22fdd0e12c99786bb82a5bd58d43184974f72f87b4bc1adb733f6b12246
- SSDEEP 24576:t/sCv7rTiw2RYwZCUsjKpcZbP0Le5ji0hmxNrM:x7iw28Pji0Aj
- TLSH T150653A17B6A84661E073D174C5E6864AEA72B4461B3087CF12A8C73C2F63BF1AD39735
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 961KB
- SHA256 598fe5741e2cb99d1b84121e9656c4ef8080c851548f91d5760adf6af1f19ac9
- MD5 27c47145a1c58fc2f2fe1ea2dbc6c480
- SHA1 7df27e2328627657dc3f98b4148d281d69b7179b
- SHA512 3c8def9a1e0591baa6272ea480745b3f3b15f262f73aea6053145367df84946021a1588060848b571b8c303bdb76799ea8755358704543c75465d9f8e9a4585f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybRa:t/sCv7rTiw2RYwZCUsjKpcZbRa
- TLSH T157253A1766EC0895E566A13089B54606EB72F8561B31C3CF12788B2D1F73BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 970KB
- SHA256 fed77538ba95cfc784b4c9a36bdee1ca23520529757177926a18706d772b4691
- MD5 fe1148308b411f3c5eda3438ef97c7e2
- SHA1 f0a7d2e35fe8316aaf12fb4f77fef6515c26a210
- SHA512 865db0b0c0b1d126f34e4138335e39acda4c940eced715f331aa7bdcbad4314fa37ffd8a173f6b69c76a3f63235f2ece942905feb31cfb50b69e192c74c55e20
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybg9:t/sCv7rTiw2RYwZCUsjKpcZbg9
- TLSH T144253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 970KB
- SHA256 39e5dee633739ea684e885859adbffec26dcdf760f4be9ee3898103665f7aec4
- MD5 64e7286b17b181b001b6d981e35ffe3b
- SHA1 684c43badd7250f9ec6c6d7b450e75a677963581
- SHA512 6be3e559898e07b099a31ed023a7e7d7040d13902838c914b5b5f0a24331128ca7eb46c357785881cfaa33abedef27851113e90b2b0281421a4e894707cf3dc5
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyboc:t/sCv7rTiw2RYwZCUsjKpcZboc
- TLSH T12F253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 970KB
- SHA256 0c9ed00bbeb7418b39b95ce4ec1621adc416b940d008deb6c0c79f8b9453a967
- MD5 19cb796691aab5857bbcec81711e7b85
- SHA1 44968956f716c4d3a552c929bfffbc9ffdc14705
- SHA512 0c87daf1b7bf8ccbff3bf7c1fee536993847e3cbfc6b03cc3948c4e1ffbd01cba71726250766d271c317adf2a1d5b234b0bd8042b6f5aa34c008a92fe2f0e702
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybBp:t/sCv7rTiw2RYwZCUsjKpcZbBp
- TLSH T1EE253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 970KB
- SHA256 3af4370c55415d7726f4928e47097469fe9d49c2c432b415575dce50413e3205
- MD5 97ca0e3d26849e53ff6c5a887b50efc5
- SHA1 84c18be6cf5fb9a37d05418a0441ed571d8c904d
- SHA512 1075f9ede25ebb55fbbcf318463bac4af72380124e6aff1cac08f392676d6af793011c80777f8902e6409c1654d39f4c23852d0ce650841b70b5394ae6e6492f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybW0a:t/sCv7rTiw2RYwZCUsjKpcZbWN
- TLSH T1BF253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 970KB
- SHA256 dca424972230ae6fd655cf399e62d139cb72a19406107d7187b588c07cdf08a7
- MD5 93d305a382a68721cc63aa0918b32c6f
- SHA1 f3c4bdba43c94a4315726e67d5c9a640aebee4bd
- SHA512 d7cf9ed55daa334e99d4298169b78de728ff936916da351c3684f53c5410b651cbbcfaaee78c657f88d056f440e5cb13b3a774284e0d044cc57f546e5795bf7b
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybaF:t/sCv7rTiw2RYwZCUsjKpcZbaF
- TLSH T172253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 970KB
- SHA256 ab9a1a1b3b9dadfc2ff374317b537ece46294f014e4b45016d4d75c38afb548b
- MD5 29d1c60b8c6cbb2802329b4f1da82140
- SHA1 1b7efe0d8d1f351a9fe4c4b198b20454e4b87102
- SHA512 cc33a606525e5d2cc36f6c329bc782e876d50639c13b4a78000d8b0ed65ec131f627070b92b0d34b73413b79a2645833d30cb1ca05968547b82e31970d023850
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybvC:t/sCv7rTiw2RYwZCUsjKpcZbvC
- TLSH T1F0253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 970KB
- SHA256 bca56475f50633bca58a479e34450fa4e5ee4771832b058309bc09beb4be211a
- MD5 d7e332bf4bb9ca455d44832a49f96e16
- SHA1 71d6f496c394050ae97bb16b753fe0c44795b0bf
- SHA512 93a008566f2be4f633fe01ae8f048f16abf2c08d92e75a158885b351ded34a1c850990bb328f81c97bb15e3b705bf2c2270940d72f233365c661a5b72400f111
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybQw:t/sCv7rTiw2RYwZCUsjKpcZbQw
- TLSH T166253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 970KB
- SHA256 b51d82843fa979683a947f2831928dc2b79825d3e3775da094b756219b506e66
- MD5 3ba7bf280c1c806697bd9ea45045964f
- SHA1 5981a065d9f51b393e3389797ea0d46aa7139f1a
- SHA512 c025f3f15eaf42dbe2927bf27b2687698beecbbc3553a6f9045533bbec529d0af7569a51485bf2ad7bbe4ea73f0a72966176e897e4a83c29e79842ba17dc2464
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybvT:t/sCv7rTiw2RYwZCUsjKpcZbvT
- TLSH T155253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 970KB
- SHA256 64c81c6abdb6fc4bedce366b591b1f45ba85b304351e7db3d1a200749cd7d7ee
- MD5 b4a37e98d9c38c92124a7a7641a098f8
- SHA1 7e1ebe68a2bf9b4cffbde3911c490ea446522c3e
- SHA512 e72e5af34d3d9d4cea37ddcf35033226af27bb566f28f30f7f8938514d3c286a13501c7c16ebdb4c48312ffc737e06a089c8f7d3b3b7d9b9c041639aa5fdc1a4
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybpu:t/sCv7rTiw2RYwZCUsjKpcZbpu
- TLSH T1C0253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 970KB
- SHA256 7b6cdff269df498fdda1db3e4a607b2f99ab85f4f7552f105f31b6106c46ecbb
- MD5 6544f5738ca85759e693a6e9e9416217
- SHA1 39f9baaf98a99478a2ef190364fc3741ea3bad31
- SHA512 7bff018e48fe50ec286db2e89e993505f8be14add2e90b3934b538460662af6bc66af3d3bee187c63458215e35e609920849545387f46d37578c71245f081f23
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybhb:t/sCv7rTiw2RYwZCUsjKpcZbhb
- TLSH T1BF253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 970KB
- SHA256 488bbeaf9297e759b193d69dafd5f576329d52327933b9d8577458e28f6ce738
- MD5 121903b1468bdb9b933e18fd5b8491d7
- SHA1 6542bfd7aa61938c72a5d83b071fda62ac4649c1
- SHA512 f958abc116609d45d2eca7d83e34595c45ab6922af0c0a734604154cd22394ee4d4bb4b829c84317fc6d8e1a890f90f8c177ffbdbb45f5029d57458df984ecab
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybpf:t/sCv7rTiw2RYwZCUsjKpcZbpf
- TLSH T1DE253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 970KB
- SHA256 a94f18c0e31731f5a98f15bb77f159e3fc9cae77bc3535ffdd190222924bf0ba
- MD5 42a97de6c54f1805ec44967013bcec6a
- SHA1 f10884d7904e3a8251d4ccecbf854238c35c998d
- SHA512 b82e5460e35cabcb504c47fa66c225c0bc142d5a7b4babef64859b70b1ab876c17081aa8d7381a7250581d6ec7ce67dc7a1bef900f1521a49d7968d52eb69cf0
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybSK:t/sCv7rTiw2RYwZCUsjKpcZbSK
- TLSH T1C9253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 970KB
- SHA256 86a88ffdb6126f5508528a2dae1e7eb071c559a1d1999e3f7a3fae1c68a75b95
- MD5 9ee96448157f3ffd1e27106c4080d5ca
- SHA1 7d12b26e35d8f5e2d1c2fdc73dceeb5aeafcda73
- SHA512 09cf497eafd9f57d6737b4b4bcdea80488c3837934453f518b5962fd1b9ce98585d20658810eca5b815b3b6b4a127a60a20af9d43e8697330f5cb5a3f699db0a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyb3k:t/sCv7rTiw2RYwZCUsjKpcZb3k
- TLSH T1B5253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 970KB
- SHA256 233636ec96892a8a5bd238d9c848cc0d263b18ddbc8a6fb1b2d77cf7605398f1
- MD5 05c11853d86d3363e8d8bf417cba0294
- SHA1 c1bcaa4ecc5ef7bb70da0bb24bc749eb4ceadfd8
- SHA512 8ba17314a0b30737674a943cea6f4286826cc7bd1a674644446b41c7484ab76164f1287c24a8a99414a2ca7a41a6b30fc83e5cb24dc36fb74c90076b07ab0949
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybA0:t/sCv7rTiw2RYwZCUsjKpcZbA0
- TLSH T14D253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 970KB
- SHA256 c1f6306604436cc0cfb22ef2ce407d5e399061f70d231f9539123bb9729a341e
- MD5 3741b949bbf3462322967900ce7d59ee
- SHA1 fd5b140b03f1a44ff3fcb565a50168b59eb33386
- SHA512 eed9fe9a5984745029500578ed70da924dc47310de8900008ae8e751605e81f494b7da169b5288c0c647d192e77b11913b3d42fc70943db8e321138814dd6e3a
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybb70:t/sCv7rTiw2RYwZCUsjKpcZbbg
- TLSH T1A7253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 970KB
- SHA256 b95c2166351e9e25fa82cbe2935fa381b2deef2df751f248a17f7d1c513cbfb9
- MD5 078c177677030c981093ead4a15362bb
- SHA1 11ca998218478111a9dd47b2a93618c89ce1abd9
- SHA512 a7a928603cbda101d0a6de84958e4c4587cd92e03878e86137471d4bec0f81d6ddbd18702be11c865681cb0812cfa38db2fb2855cf9eab80149ea29f4e2efac1
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybWr:t/sCv7rTiw2RYwZCUsjKpcZbWr
- TLSH T146253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 970KB
- SHA256 5a9f13665d976372347bc2ccd163a1b249bdb19e85c0bc42f199f5f0022e1fc3
- MD5 70e90ffc76763007527f24cfc6005585
- SHA1 8096503598ae91fdb94901dae58562075e9768bb
- SHA512 3dbe507eac554e081b664acd6faf1211bde1acc74b7e7e3ddb719d393b15d0a5f070eb7d69e25af53c3c614daa5f4a9f2db0b4a9f436d9e912247a44228c2795
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyb8n:t/sCv7rTiw2RYwZCUsjKpcZb8n
- TLSH T146253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 970KB
- SHA256 1b0da497c0b2d3b503786c64a17d8d59ee154bd4c6c87791f9bb7fb6124dce18
- MD5 00a3894cdeb3c5bf00626b174a358eb5
- SHA1 f45c65bd0bb581c4a5055b57231cf55aaee79596
- SHA512 c69bf04b025840a97ed77a7e685d980e7f1a23a8f2ef2d8432241dd54b4ae1c74a67590dff1c9bacf2f44345e516e446deff613c4d40a63c6f235331cebddc15
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyb6x:t/sCv7rTiw2RYwZCUsjKpcZb6x
- TLSH T1E3253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 970KB
- SHA256 f4cf76cc2035d91bb5a7b059b3644c5af1baef0b7b3622793259653f2f749d0c
- MD5 cdf2c8f2a35fd446d0b1f6f7b72ead3d
- SHA1 8a0a07b87fa94d22791d60efe6b925a38799d213
- SHA512 f7c0b7956d2c35bb42ca3e84c97ba04bce035a956fa46a9650941bb50cb218ba6ddd6e9dfeee34ed2be8ceb38b72dcf9bdb56b16056445c230e2d6a22dde67e5
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyb8A:t/sCv7rTiw2RYwZCUsjKpcZb8A
- TLSH T1C4253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 970KB
- SHA256 194e342def81e534e63f37033e7f136b0157ef8c5707ebba24cd887122f9b779
- MD5 7ed357ab852a90c0adb515acbb8a95a5
- SHA1 1a7f9bd24902b5ccb36e52db62ebaa0c506862ad
- SHA512 d06277c447ca7e6d51240d924baf3d45933dcdc354c51b15274b78637d1c031c95be3ec95486309d59fbe83b5b8b01d33b9e892c0e29e7060c280f21ed460cff
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybl9Q:t/sCv7rTiw2RYwZCUsjKpcZbl9Q
- TLSH T161253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 970KB
- SHA256 1a351433d0da309fb5e5aaf35fc9a0748548b92587518a00309c51323128b32f
- MD5 ce5f368418bac7e0187cf721e092fdee
- SHA1 99689ed08780f97b06fac352672417abd07057f7
- SHA512 13c0eeaf40e372d39afe20db5648a9013b1d3c53fc6c9d900db78ceca170151536e20bb782839e582c972873ee4016ed240ec8bc6de49b014ae57f6f9213edd8
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybQ4:t/sCv7rTiw2RYwZCUsjKpcZbQ4
- TLSH T1A4253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 970KB
- SHA256 dbc4538461cef1cf2735ca5eb7964fd5c9e0319e6fb1d1a514e5f4d7465d94af
- MD5 812fea559b10e0172841bf6295fdcd14
- SHA1 032c4960581866499a1c539bd6d2815b2208420a
- SHA512 f5f2f0bff08561d9759ce15592a6e95b89285b5d282729542c418b6c7954c60a914085acc202c910f3032dddb6863cfaf6285a9b270a8e7e2d1b0c8e836b0698
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybTu:t/sCv7rTiw2RYwZCUsjKpcZbTu
- TLSH T1E6253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 970KB
- SHA256 f9215a6e073ae5319b722beb99d5e1f2f95a5e95b1af9c7805fb7667da25dd0f
- MD5 90c0868726afd70c46152a4afc047e69
- SHA1 63817c7781fa86b231eb486d0b085c3f62a18684
- SHA512 14c21dc2296470edca8391feded5805addc6999fa379271698fe834a8f6fa135d062de228a3918ac8a3065693f3409a960c5a6c3fb134f1ef71f770df247dc6f
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybOj:t/sCv7rTiw2RYwZCUsjKpcZbOj
- TLSH T144253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 970KB
- SHA256 3aed117593bd80b3863c90c8df61d60d970c4979e4521991d82a47f13ad393a1
- MD5 e23cdfd7d2805a8f738acf4f0944fc47
- SHA1 eddc5206474d6d0a8db0a2e13df05fee817a4726
- SHA512 197be2c971f9680f6f6b5265b2add5702fced4e29a897f91c433c1b3822d0ddad54f2bb64c5521974055332544f08ec4e4308eb3a8f30e07a7422b89752df486
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyb7g:t/sCv7rTiw2RYwZCUsjKpcZb7g
- TLSH T127253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 970KB
- SHA256 345e92b9be39a21f1ee36bda989bc29bb977487be7a9e9d76ebf107669849d68
- MD5 0d3f06a24214147a1bcc9360b01a7c97
- SHA1 b458b35c01f1bb847bdb022c0983bb248b6549b5
- SHA512 168f7ebc7677cf561bda42ca8d5965354c8d535be8b60e0ead3ab41eee378354ad821f7611eb2a0f19b58a1339cad985623f827348aa2233e9330241d3ca9786
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybmI:t/sCv7rTiw2RYwZCUsjKpcZbmI
- TLSH T194253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 970KB
- SHA256 32b70609b50a15f2a47de2b068c92fdf9f533a0fceeab036be2d859f3923e142
- MD5 f9d2bef0896b1f073e3c5f94c22376e3
- SHA1 f52846cfa331cd7b29b454315b5dc44d44f8221e
- SHA512 dc29c886b0f3346ef1d61fcbcf7f31b67dfc105699c75726914a5e3ba712fd2c12419c494120c2bb27bc8b3557fe0a6f763a7461a2aa12d255a8a27525e6bbf9
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybUo:t/sCv7rTiw2RYwZCUsjKpcZbUo
- TLSH T1D6253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 970KB
- SHA256 33c32fdac2206e39df78c6e2e89942f7c7ae88db426ff9d7bd67857d9e012d46
- MD5 f7a11b15d8219a07e2b42cfcb8f481d6
- SHA1 3a2b118ef7074313b1a95d4e14b0e6c2148f1662
- SHA512 b0e57a44a80930309e6a431408a3fff43fcf8157d660e522bfb23f8b1726101089c11da26ee461bd488f6a36b59b1e56cb1c70095227d9ce3123b67fdf0b7c34
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVyb3+:t/sCv7rTiw2RYwZCUsjKpcZb3+
- TLSH T197253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 970KB
- SHA256 06ae9337442f5339cb33c24bd7ab66676cb63095cbf58fc79e67859be0fcb697
- MD5 3b937c64ffbba8554d0e4531e1addb5e
- SHA1 dbefc2813c5d03e3892a1b8c99e15e5f195bf322
- SHA512 eea9e734b3d47c5ba7f8104aac67856f6b21affc8aeb7764c27484f6a5e58e75108f864945774468d4ff791120c42bb110e6406d74386ca86e3121c74081327d
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybNQ:t/sCv7rTiw2RYwZCUsjKpcZbNQ
- TLSH T144253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 970KB
- SHA256 796bde46124bb3fc369d1ad12125875353453fc1fa48fd6f68d408acf1d9e3a4
- MD5 0305bd2470930fa81e3465f53f83b900
- SHA1 dfdcf9f705696ac9b519a50345da13cae0cd8818
- SHA512 2acfd62ca929e5a35cf74464c524d60ca801ee812f6a239d8ae9aa1cdb340ac639bb2714ffe1d46b5023c47d8ccb52975e760b544209ffcb6ca02f94df018af4
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybCX:t/sCv7rTiw2RYwZCUsjKpcZbCX
- TLSH T1D1253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 970KB
- SHA256 406d76b408ea8e0a51a0619da896a71ddb9c83bcf5dbdfb19e91dfdda9009bd5
- MD5 b7712514d4841386e82543dae5932540
- SHA1 7ff3bc15df2bcbb9133d3125f69a874554cb6beb
- SHA512 3e84b29427405333aeb2294a1104fe97edfcd09e80dd0438b5ed2f975d89ff7366b1c6432eb341015710f4d4c312be1ac10df206238fdafa7b706b0c42adf8f5
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybkL:t/sCv7rTiw2RYwZCUsjKpcZbkL
- TLSH T15F253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 970KB
- SHA256 3b69cf32d631bb64e4897b18f617dd212c5f4d6ae581850ae874a7eb90424ba8
- MD5 b33816bbe2fab8b4f5859f4646ac919b
- SHA1 244e323f8c0c250113296fad7e4174705484ca6e
- SHA512 c9859b62fc16bc51dabf8c9525bcfc4f514debdb47c6276be5d191dabb6e658952c110c279808289661d8b494817cfeaa91814dde3edcbfac54119fe4f380331
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybAFC:t/sCv7rTiw2RYwZCUsjKpcZbAM
- TLSH T105253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 970KB
- SHA256 18bae9338c0c0f3b6fc77fa547fee114b165413fa0e5efdef58019c8ada46d9b
- MD5 d177d5adbf951903a4d00ad5c99dbeb6
- SHA1 8d198b51342c34d7da820b2621e812cc94830962
- SHA512 f4b213648ca8b9a2a6c5feca2122e350004944d7433222d080adb8a72b754d148a9f796f7307fb860e8e9df08f62abc66490ee3a92ce93dda8dc03a5855943c6
- SSDEEP 12288:uE/72wcCvRR5FTjkWIw2RBKwZC2tDcljjKFPcgVybhh:t/sCv7rTiw2RYwZCUsjKpcZbhh
- TLSH T18B253A1766EC0895E566A13089F54606EB72F8561B31C3CF12788B2D1F63BF0BD39B29
- MD5 SHA1 SHA512 SSDEEP TLSH