Analysis
- max time kernel
78s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 11:10
Behavioral task
behavioral1
Sample
2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 949KB
- Sample260523-m9rd3agy6l
- SHA256 0159cd75f80487ea5314e5692563a9f731b2af23df5df75d5e0fe0c825b345ff
- MD5 400f5d25ba9865703d9a43e5cb36f4c0
- SHA1 b9c6d0733281acb61bd0079ffdf5bd9a23c8163a
- SHA512 42169f75846bd526917eeb473afd9369c187e9045d1446cf0a314a1726c98b92d66fc1d824bcd292c057e6aa8fbaa11f3e86d01ae0bb5b308549d3435be43810
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cC:A3k03kHRJARJJ
- TLSH T15F259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral1/memory/4340-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244f7-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/2296-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd0-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000022bd5-40.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/4340-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/2296-60-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00070000000244fa-126.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002034e-219.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000020352-268.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212a9-347.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ab-480.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ac-511.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ad-596.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212af-633.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b1-670.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b2-744.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b3-764.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b4-801.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b6-838.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212b5-869.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b7-888.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212b8-901.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ba-914.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bb-933.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bc-947.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bd-967.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212be-1022.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212bf-1065.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c1-1096.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212c0-1121.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c2-1152.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c3-1183.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c4-1191.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c6-1205.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c7-1308.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c8-1339.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212c9-1358.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ca-1383.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cb-1390.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cc-1397.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cd-1404.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ce-1411.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212cf-1413.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d2-1415.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d5-1416.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212d6-1417.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000600000002297f-2098.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002453c-2157.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x00070000000244f7-6.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd0-12.dat aspack_v212_v242 behavioral1/files/0x0003000000022bd5-40.dat aspack_v212_v242 behavioral1/files/0x00070000000244fa-126.dat aspack_v212_v242 behavioral1/files/0x000300000002034e-219.dat aspack_v212_v242 behavioral1/files/0x0003000000020352-268.dat aspack_v212_v242 behavioral1/files/0x00020000000212a9-347.dat aspack_v212_v242 behavioral1/files/0x00020000000212ab-480.dat aspack_v212_v242 behavioral1/files/0x00020000000212ac-511.dat aspack_v212_v242 behavioral1/files/0x00020000000212ad-596.dat aspack_v212_v242 behavioral1/files/0x00020000000212af-633.dat aspack_v212_v242 behavioral1/files/0x00020000000212b1-670.dat aspack_v212_v242 behavioral1/files/0x00020000000212b2-744.dat aspack_v212_v242 behavioral1/files/0x00020000000212b3-764.dat aspack_v212_v242 behavioral1/files/0x00020000000212b4-801.dat aspack_v212_v242 behavioral1/files/0x00020000000212b6-838.dat aspack_v212_v242 behavioral1/files/0x00030000000212b5-869.dat aspack_v212_v242 behavioral1/files/0x00020000000212b7-888.dat aspack_v212_v242 behavioral1/files/0x00020000000212b8-901.dat aspack_v212_v242 behavioral1/files/0x00020000000212ba-914.dat aspack_v212_v242 behavioral1/files/0x00020000000212bb-933.dat aspack_v212_v242 behavioral1/files/0x00020000000212bc-947.dat aspack_v212_v242 behavioral1/files/0x00020000000212bd-967.dat aspack_v212_v242 behavioral1/files/0x00020000000212be-1022.dat aspack_v212_v242 behavioral1/files/0x00020000000212bf-1065.dat aspack_v212_v242 behavioral1/files/0x00020000000212c1-1096.dat aspack_v212_v242 behavioral1/files/0x00030000000212c0-1121.dat aspack_v212_v242 behavioral1/files/0x00020000000212c2-1152.dat aspack_v212_v242 behavioral1/files/0x00020000000212c3-1183.dat aspack_v212_v242 behavioral1/files/0x00020000000212c4-1191.dat aspack_v212_v242 behavioral1/files/0x00020000000212c6-1205.dat aspack_v212_v242 behavioral1/files/0x00020000000212c7-1308.dat aspack_v212_v242 behavioral1/files/0x00020000000212c8-1339.dat aspack_v212_v242 behavioral1/files/0x00020000000212c9-1358.dat aspack_v212_v242 behavioral1/files/0x00020000000212ca-1383.dat aspack_v212_v242 behavioral1/files/0x00020000000212cb-1390.dat aspack_v212_v242 behavioral1/files/0x00020000000212cc-1397.dat aspack_v212_v242 behavioral1/files/0x00020000000212cd-1404.dat aspack_v212_v242 behavioral1/files/0x00020000000212ce-1411.dat aspack_v212_v242 behavioral1/files/0x00020000000212cf-1413.dat aspack_v212_v242 behavioral1/files/0x00020000000212d2-1415.dat aspack_v212_v242 behavioral1/files/0x00020000000212d5-1416.dat aspack_v212_v242 behavioral1/files/0x00020000000212d6-1417.dat aspack_v212_v242 behavioral1/files/0x000600000002297f-2098.dat aspack_v212_v242 behavioral1/files/0x000700000002453c-2157.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 2296 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxAccounts.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe$ patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\OLCFG.EXE 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaw.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstack.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\GameBar.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe$ 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4340 2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 2296 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_400f5d25ba9865703d9a43e5cb36f4c0_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:4340
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2296
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 949KB
- SHA256 0159cd75f80487ea5314e5692563a9f731b2af23df5df75d5e0fe0c825b345ff
- MD5 400f5d25ba9865703d9a43e5cb36f4c0
- SHA1 b9c6d0733281acb61bd0079ffdf5bd9a23c8163a
- SHA512 42169f75846bd526917eeb473afd9369c187e9045d1446cf0a314a1726c98b92d66fc1d824bcd292c057e6aa8fbaa11f3e86d01ae0bb5b308549d3435be43810
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cC:A3k03kHRJARJJ
- TLSH T15F259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 a37bbcf29d9d31e7938c84a7bc4f186cad87d02e5e049ea3de8f51737ad7c3b4
- MD5 ac3cc3daef226e1c4c58ea9ef156378e
- SHA1 ce16b0217e6b9badb0f7bebb03b2cc0784c67c12
- SHA512 4d4a63850b472aede93bacea5d61bc5084c2d4d66410b6c67ab680de7bac2522dc73d3839623e454d53bcc90b70de0a6010f66d5b308ff062427e38a3687e97b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cC0Le5ji0hmxNrM:A3k03kHRJARJ1Pji0Aj
- TLSH T169657C17F6A802B5D067C1B9C6D29A5AEA713842173087CF1394C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 963KB
- SHA256 5a342884ddbd598b27404cf3f1b0a5133a2ba416bf93338858ca1b332e157a26
- MD5 afb6da66e915629c311fbac67b4b9629
- SHA1 3a51c5c105b7d3e22b609a6f38891516aa7d47e4
- SHA512 8a07135824552a574b23bd353482c121939ed12daad697507c51f367d8856872407146e585798bad596ae14fa4f99c315aa6b6f14207bb9bf03dad06b6c8fba8
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cMa:A3k03kHRJARJ
- TLSH T1B7259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 1.1MB
- SHA256 0bb7f4043f2efec204a3b42def352ada2c7a982d2509875da872680288600c11
- MD5 fdfa5765ee1a5bfe44625beb065935df
- SHA1 2984ff5b97afa643138cfb67039095d0df0a7ee2
- SHA512 dd8c486a532b6b26c4dc45ee2fe65faeb75025ee05f8fa12f4e01d4e45518fea9ac8afdc68811153cc3205991a847e8394511b35d4ef9d447af880a4fd141795
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073crD:A3k03kHRJARJG
- TLSH T11A353807E69800A8D11E8174C7968A22F7777C5617E092CB13D4D63E2F62BD0AEFA357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 972KB
- SHA256 dc49c390ce85bac8caa17083bb274e76eadb1e30b7bbdb7d73e295b3acd0c3e4
- MD5 88d6184c46c709ed68e5c8401d0499c3
- SHA1 09302c0b3fcfa7b26c97f915da7dd5ce70670fe9
- SHA512 74508e9517c102f2f8eaa399cd19c0b73072d2b1c55274120821ef00fd4c2f97d8a663dc16260e869291fe3f019dbd02604b15193ce123ae863d004054f5ccba
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cGZ:A3k03kHRJARJZ
- TLSH T1A0259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 972KB
- SHA256 3e01417e50de7a8ac75afb9603fb3c8a69e6d61dedc1b9725e053d06aee734d7
- MD5 bf8929ca36f17633e417153219e50244
- SHA1 358e104e53c18b13d72e77c272f246b8ea53d8ca
- SHA512 21934675ed5bf3995738d673fdf13feaa974fd00ab93eaa94828940514773d89c02e1b42095d2750f4c3fe3b69ae6cf73bdb6640cc795ac915daa2ae4b70fe62
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cx1:A3k03kHRJARJm
- TLSH T1DA259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 972KB
- SHA256 b183bd76d55915b729cc3fd8f07628c3f817b95b9173997acc3d33171de31b24
- MD5 0e8a5a4746935c985cc2d310b1c35eb3
- SHA1 b04d328a29226189a53eb523631c8c83f1df09df
- SHA512 50053533a625b13f11703a1380a83fb80619b3e171bd7f448fe475c1f77c325cfe7e87a2fcce1b64508923f68c7897c1e825f94f969a6531b25ba19f8cbb3e61
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cl6:A3k03kHRJARJx
- TLSH T10D259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 972KB
- SHA256 e6b08b3096d7cae7c2a4507ba2ceb448ebbeb864a1607d702e9d33a0a951e573
- MD5 bf46332959f7640a9a106f870f1d72d7
- SHA1 bb0f4d9a424b5e444122772fffb5f51b556648aa
- SHA512 bee33612bb5699bdfd97353c3c63e241de9c50df9a11da64809b71fe8d9b1b912d3bbf2e24fed3dce07ff03b03baf2cf153366012e9d4a1c991d486e8c55fdbe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073c7N:A3k03kHRJARJI
- TLSH T191259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 972KB
- SHA256 c9acd5df2ab62ea2a490776f342d9b3d614ade75e5b7c5120d720e1bce1e1ac1
- MD5 493f0ad2346bf0783861031a2fd6c8fd
- SHA1 2213e20b016710e11ab6e981ccc614fa1373b4ba
- SHA512 4a5a354fdd9900eb6335f7363b68c9249eecc2913bbe1ed8e4668fe6ee2f98eb1b1537e6be125d0e22bd2b621a45f3cb92f5c96eff36f18151f88771aa40bec2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cZf:A3k03kHRJARJg
- TLSH T1B9259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 972KB
- SHA256 2eb28884230879a8d0459305e72c20773ab25c41b2fede74574fe271964831a6
- MD5 82e0a20658a9af1ea37ce0a8df7ff36d
- SHA1 ce309f674859c6bf4bfc87bb6495e4416d717c92
- SHA512 a962b57cd3626edf35999d6ae9d0fe95c9068f8e2afda34ceb418b9e94e4d848ab5e8390245914ca97dad4d3b9a7c377ebd3653a9ea30fe5746bc46f25da8e39
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cbo:A3k03kHRJARJt
- TLSH T1DE259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 972KB
- SHA256 c0196c375954bf87dcf9c6a4575449c2dd0aa1a51d15d9f61fe1553647464421
- MD5 e87d0db867fb71713b68c425fdb2591d
- SHA1 0ff4427626f9a8605fd8fe7b26304b4089163175
- SHA512 3e72701da60a90f5ffdad6048af82b69e38c2d00a3cf42cfd4c39b7bfd36bcf4e7b9cc4813063f6aaa5bf0d015d2bd7ef6c4eabbaadb3c85b42db3c23b396547
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cPu:A3k03kHRJARJf
- TLSH T154259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 972KB
- SHA256 a6807af0ba2742f10f8278cb2d354bb2aff9d4966efd0ffe23efafd89a191585
- MD5 ce2f7e406421bf89bde95abf5871a20e
- SHA1 04eb08503df782a2537d2ec2f7dc908eb1a42892
- SHA512 ced8369b90e262eb37d3d9a724f2b0432138eaae666008648e5936c578d426e7ca24482239b374b645f2970075b62367631b8a8a8eced3f69e42ce3e1b0a4dbe
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cd9:A3k03kHRJARJe
- TLSH T174259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 972KB
- SHA256 714d01d55bd4d766eb2519af1740c19c43f5f743315fe8846d4a3f782fd2d89d
- MD5 296ff2b4c25551f6fad2e75d1f80630b
- SHA1 38922bcdcbe322d2e7b8d59052b000bd981934e6
- SHA512 7e0ac7725c1b81a252f6dcbca42976d885e2987ca2e274994b7e39c90dc141be570e8dfdc54b696b54c0883c95efa6bb6c5373bfe1d2874f4b682771431af5c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073c5c:A3k03kHRJARJz
- TLSH T1BF259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 972KB
- SHA256 ccf8a040b875c32e76e77645ce5dae7f867d3c3b67257b0fae41b22801035d76
- MD5 69f4afd73ddcf847c823a5f87064e60f
- SHA1 60cec2063d0701f54e87c9f24cacc3cb45ab200c
- SHA512 f5afc36edd986cf0f2fc3a6fd31b40c903ba2c9de89fbed88b0c03919fc0db4cd68cf805055482ed9fcc7cbdf3b3b303191a5584f04cd02e913eb640bec1eb2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cyp:A3k03kHRJARJR
- TLSH T17F259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 972KB
- SHA256 25983547edf04dc0b9c6a9232bceb82ccdd88cda062cc84e541a1cd7ad3ad8a8
- MD5 d7191d71088716b63de86b8450a45ceb
- SHA1 0141efb4c0711283a7f30f28a7d6efc22b86eede
- SHA512 35e3f93a63e40f452620b5cc6a19c90fd65941bbc79de55185dc783c3ea6c5ab6f2a98c6f4e95e53a0df464fdb39745dd6f2ad85fe65342f05b068870abde8cf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cFN:A3k03kHRJARJK
- TLSH T17F259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 972KB
- SHA256 58630397a5bab239e998b9e2554366e58d7dd4d6d71c6ced136b7fc50b1916d4
- MD5 5f86b94827e8f1b71d43e4385963fe62
- SHA1 8a769996651d72a273badf9835b9ef7493dc3215
- SHA512 ba6d4db1f27923c742f0111f9ac113afd26317f6bb08d9b724fd64bf03b6c82e074bc4c2a9da4fa5822e15db9d0ad715aea66539f57c368c981d8409a91c4c0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cXF:A3k03kHRJARJQ
- TLSH T1DE259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 972KB
- SHA256 8b5014fe5ebb00e20187509c610f4442577d7108a1f4892fe8908d0ed7438580
- MD5 ac551b07e01d43a1a4fd4141db636474
- SHA1 cb4e983fea41649512ad296175e8fe5f927d2061
- SHA512 52195dc2d6f2324e9c32ca38c11c9281f9db6d99d4d48db99b359062dc7ff410a906cbc26d04b47b36e56b12c537eb7f394cf3bf720801f08895efa1f8f7b189
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073coC:A3k03kHRJARJk
- TLSH T19A259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 972KB
- SHA256 1601343bbe45747959083dd4f936131c26e1d14e4eed79c9d8e85da13ad7c30b
- MD5 06ea58ebf65b6bc1c4707588dbf4ba08
- SHA1 b8a5d3e66f1d2c50344e6ed31d66da2a9dcf69c8
- SHA512 bde1da04b5267d80491f6c4137110b43679f2cca24b27fdb600736c38a0f14ea23618ae69e8d26e863ab985ebc0ca0f31d7b164c7f34f69ed00c79f278982333
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073c7w:A3k03kHRJARJ5
- TLSH T1CD259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 972KB
- SHA256 23e8c966bf22b23887e68c71daeb006b56d5ca206e1609ddf52474e5f56a2fd4
- MD5 4d2c332aedc259cfa812f25d139440cb
- SHA1 9d031f6c9a7bf090532458923832d941ef5ab958
- SHA512 a5ff7845f0b1bc1147ec0a9a4ec629bef8708756a3c7293d85149e02d18d0ee0860cb33acaf09a05eeb31983d51637bd3d6853ed0c1f08418960ae1e0f7ef23e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cCT:A3k03kHRJARJt
- TLSH T181259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 972KB
- SHA256 deaa682d6d91fdf3eed4d3ba3e0b9d0ca321fedc3f29cbd798cb19ff9c9e9ee3
- MD5 aea6eda6ba1eade2121d9466b7940235
- SHA1 988b3142f636ec5422647c0c99761339c9c15d9e
- SHA512 0ba2cdc8a6993632ca9430a5bac33931a8ec3d00dd4fc7e5fccea0cb852a83951c4a6a2a44bf28e2f2e6d089bb3ba532ed153ee4779de37b7c075a9cfe8f1889
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cSu:A3k03kHRJARJy
- TLSH T134259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 972KB
- SHA256 5daeceaa2d00346ba650c2d54fd643d85e8e630bb69f83cfc5c464fcb19ee79a
- MD5 7406732eda3807483bd3e7fea6319a8d
- SHA1 881ba2a390dcc0aaa15838ed4b9beda14bf79264
- SHA512 ea539cf469e9cb710e8193d5a0a805b05d3a68e9fd15fa87929bf0d962f4fae853fbd470b1e709be57d7a3204809cff72b779a75b4e2e310479ba91b4210552d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cMb:A3k03kHRJARJj
- TLSH T108259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 972KB
- SHA256 b54da3be598cbbb08753bdd9b022fcf7a7258ad90a8b20388eb62871124724f2
- MD5 45d80f848a757b4a9aace28085953ac2
- SHA1 c8e5a178a0597e214f9a222a9a9a5c19a222e015
- SHA512 82daf9d6183032605f9f43a8e28c435caf1f4d0cd2435225f93d4c7909417c8998f261854834ec79c293e578978c48aa4a09e733d8970d68c5bd8a97f8b33b52
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cyf:A3k03kHRJARJb
- TLSH T177259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 972KB
- SHA256 1ea3294bf2c4cc4dd23160e73ebc505c4895c5835bae4282447f0dcdd882d3c7
- MD5 fbf49f937a6c894a9038a364d1c3141a
- SHA1 8dff9e55844c11ec6890d9ce591524a9fbb05698
- SHA512 0e61bbcfe51068557f8dfae40aaec2a7472748fbc29c1181d0423ef155487870bfe5d7fd9f45817f1b7b5fa13e0c833877dc59eea8b697037bfc60e569cd4549
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cfK:A3k03kHRJARJL
- TLSH T1D2259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 972KB
- SHA256 05d43f4d6534f90b85a6325898961e17f8654234698901812bb1bf589cc83431
- MD5 e6ee06d5e270f42c19bb23c2be0ef856
- SHA1 f95cadd50b92fd6cfa4729c11fe89cb0d22813e8
- SHA512 89c58f3c4d4420783afea20b7b5fde87f05ba49e105ffc782916f81b11005e445d306decbe0e1fe8edb3fd2e812c6f5df7271b2731512dc41c4e34ca970934d6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073c4k:A3k03kHRJARJG
- TLSH T144259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 972KB
- SHA256 3125558ffd00eb3f049b597439540a0237de89422bf957d60922c2dd1000bd26
- MD5 6fd6c46c39c68e395a7797073276d7ba
- SHA1 985597d53c052a1b47f741c0e70f9753819aa777
- SHA512 9aadb826bec64c4fe694f73a12f9684e4ef3a27f6fac0b148b80996c9a5c358d12f6094360a225f36d95dfdfa28456f99410cd628019c2a1fe67534a74e021cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073c50:A3k03kHRJARJ7
- TLSH T199259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 972KB
- SHA256 5a4b43a99639a82ad350b7b5511aa88cb83de9f40002d537a94cd37f0be884d3
- MD5 3098fe60ba388ae12a6afcf04894f218
- SHA1 97777ceb32c76094a4ff24a8c7793bb65fef5154
- SHA512 43cc35b636d936428d425f79370fc7183b6b7f23062e8cc9fd87a2e09b2a5aa9efe53c6c52f13d689a84c3755db999dd4011f8e06aab3353aeeae1b819cb042a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073csg:A3k03kHRJARJO
- TLSH T1E9259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 972KB
- SHA256 dee0e3cfedd27cf2662457603c58a2831e0b925196f29bebebd856f733743132
- MD5 d68f36259c6331237398314c5e9dbbc1
- SHA1 75ebda3b69204abebcc5d269897334e3a5b6f9c8
- SHA512 16a1fc8e3c285172a665d2afa2061facefc8c2bfee4b20292d60e93ddd7c7a164389067d479e7cb3932bf527484e3ecadb916495da852ec470b4915f4d857288
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cJr:A3k03kHRJARJQ
- TLSH T1E9259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 972KB
- SHA256 1d0ffc1cdf3b6acc08152474326a8152cad24ab0d8d69e95d62900cd92c13196
- MD5 c46afa37bfcb5663ac019bb3bd684ce3
- SHA1 29dd6ffe5213271641bd57e1fbd89077d11912b3
- SHA512 c2e53b50756912b58df390a213a23c4d77c0864002b7817d73e023d7c57d69ae6a2726d3cea386148f298c151c609ffc5f6e46dedf7945e331e70bece717c2a9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073crn:A3k03kHRJARJC
- TLSH T198259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 972KB
- SHA256 49f6287dd7d8a9b017ca5dd3c1589f4d0bf5a622c6f4f60905b8df076cfe1fc6
- MD5 e391cc6f9fb6e69baa4e91c3945b8b78
- SHA1 0771b3125815360e5c0910fddfd293ed27234241
- SHA512 6a20edf09f3fd1a3833c982aa012f3447cee42b8e6be47c6b73633d6affe674265052db85c5691f4437ffb8fc37587001575ea80e1eb2b5b1b139c32dfbb5c0b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073c3x:A3k03kHRJARJw
- TLSH T193259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 972KB
- SHA256 257c7c54fa4b6f13406f158939edae2b4be35df8735d567ed10510484928f596
- MD5 e4f761d5ee42bdd022a43a157c5f11cd
- SHA1 6cf8f5bd22d5c7c3f89944f0ca0da30ae4bade20
- SHA512 28eda77e966f1db6c53b73dcdc19cf22cc8890813ce35ef0b91d1aa35eae539e47faf8a26417aa8db3d91f7bfc75216c9a9f0705e249bf72dc66a20707a1dd96
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073ctA:A3k03kHRJARJT
- TLSH T177259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 972KB
- SHA256 885b2c9bb276efe4ccd34369bef3c2cdd0cbe476fdea071da2e1c641b0c4a917
- MD5 26af23e6601cb4b74bc8640cc2fb4eea
- SHA1 f97c0bf78bbb0003318096a38b5577e0ddf7c20b
- SHA512 f3cd50d3c7fdb3e7001b320ae60c0f930f711d90c8a11a0c1c0523e399b59f43214fc79b4ca10c296683f06310e2b1e12d4f1adbbec73f1a429b7325fe07e775
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cm9Q:A3k03kHRJARJ+
- TLSH T113259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 972KB
- SHA256 8d3e022e64405604c5bf234a0ae947a67c6338aefac5c0acb21c474722bce2dc
- MD5 9dfc49d45f9e56ab2b3ea0986e0a75e8
- SHA1 2704ace6ec3ebeee021fd444f63d2a3585926c38
- SHA512 caa39934303f5212d230623c0c2f29ba004389492e7e35c08e12e51c6ba70b71ef31e8507acf7d99d47d918a7df2576070253d71c086c78dcaaf62ebaaae973a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cD4:A3k03kHRJARJ9
- TLSH T183259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 972KB
- SHA256 5149555783442353259e6b4ed63afc85d015e9d6fd24aea6d052a1dad7f2cace
- MD5 bd9f006e2e99076d3386ee81c70da51a
- SHA1 e88f6297d7af296bce98e68217a797837684fcf5
- SHA512 4b90934787fa22fd4d7611844988cced593fa72469156a7a37872635297b5ddd9cc143c94dd0c6b1aa9aa702f3db50c41eb9b82a12cce860775433134640ed0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cqu:A3k03kHRJARJY
- TLSH T17B259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 972KB
- SHA256 d6ff74a2ad0d61a56ead6355a43d08cbd88b25ce3e198d813728bfad7f893f90
- MD5 f12f2a6a68c634f53026c51ab381d150
- SHA1 1bd10b311c86049e41b6659519d12fbcbe6fd427
- SHA512 c3fc1f8e0d5db3364bf3d385467c0970b7c6828f82aee57d2200ecb573d5b50251995e30fb5c2cfececa44c6429d15c7a98f30df113a6274724ec62e7f360d4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073c7j:A3k03kHRJARJy
- TLSH T128259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 972KB
- SHA256 fbf4d1c3beddef70b55504728a9191f9a517cd64a2f48c32533487b582b56596
- MD5 895f06ac80b5729635862bc633caf091
- SHA1 c0b27d98504a9ba130ca0e345f76fe9da2673d9d
- SHA512 3fd90fb7b1f2e76d3e1ebabe108beae376b7a64ddc3d2af67d075d10952917015dc7a5ca625041df4f3be422fcd8b693b719ebee4c9046492a15fa9404c31f09
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cGg:A3k03kHRJARJ2
- TLSH T16E259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 972KB
- SHA256 da110c38aeff232aa7743471b05c4b3593a3a6866751269a1f76fb55862dc786
- MD5 10d1a640671ac51d516ea991285bc008
- SHA1 6a2da4d50939069cca1bd5181f8c9fd1f1e52938
- SHA512 f6ff96a4bb887f4bab44257d26268edeb1c9fecaca58a5cc5c9fcd6aea056655f40049fc5572e9b49f5054e8e1e2a0f68b6a5f0b1afc8db42b8d22e80eb6ad5c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cpI:A3k03kHRJARJf
- TLSH T1E3259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 972KB
- SHA256 3ed974757eb1e892797f41950380f613e7017b639af8d2300531b62f328bb0ae
- MD5 303e86c94e9c1e54f3b77b6d706c85be
- SHA1 22bcd4350a6ed77dda479d9eda5fe50c10f99c15
- SHA512 ad850fefb73f74567de72635afe409f07bb5f06e7c64a7cbd624e70265e91cf63d19cdf7c558810e57ed80457f3c32ab8e63ff4a39c25e38dfee7e88e34464fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cLo:A3k03kHRJARJJ
- TLSH T113259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 972KB
- SHA256 8270d3588bab198165fc76f30720f626254febe0ea1441a454a81f040a9b38b6
- MD5 d461a7d062e182b38156c44b93cdbf0f
- SHA1 86a03de8ff94c68ffde49343b9c9d95f660b5d87
- SHA512 66b8352c3d83bc8b48091f342abb6bf5ec9b16feb0073cb23e91f3a0dd998d0ad8c39d7f33b54bc6cf48a3eded6d0be01edcd5d3656a9eb3c7ec32d89a8d8072
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cw+:A3k03kHRJARJs
- TLSH T1B0259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 972KB
- SHA256 74e42cceb73d8bc2f3be5e6bc1705ad96775632c26170ffa126d338699ff6c91
- MD5 c8e5057afb4a6496b8e3b85fdedb98e5
- SHA1 c932d3e3a1384f67ac30caadc4eff6253fd4f54d
- SHA512 9fc920924bddf19adc5f9fa7582dcc0f7d912aeaac073475901e93e2452f3e262dcc001440c0477f22b44c56bfdb1f6be8b98de14ed8fb4dcb763323e75e1a5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cIQ:A3k03kHRJARJE
- TLSH T138259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 972KB
- SHA256 580bb3300de4ab1fb17aa5a6e65bef38da5dc8a113296797a016f5982560e7c3
- MD5 88883787eb293b401d6464f8fd921e58
- SHA1 483b0c9e41c09fdc0e59b385d96539a4f352827b
- SHA512 d49b6592eb0d132b7dcc12a55cc129ca1b1093faa0edd3ccfd3bdb7a91d9c75f24ffc130271824b43a146a5ad10e2a065f54e110f47c5ae87b42ba7bc1c1c34b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cBX:A3k03kHRJARJk
- TLSH T1F7259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 972KB
- SHA256 a478011757a74b71658b66cc922442634d2fefbf761d5402bda06a310830ab2a
- MD5 894dd17e07baf6a7f22d52266c86766b
- SHA1 ed3a7e4484282da07870d31ddb16fd46cf00058a
- SHA512 48092b6d201c6e78542d3c3d4e10c6120fd266a4a12c84d5dd180c070e7e575b46a0a8b7e5fe7c17f71bca8114285e6109815862f766036892225d99fb4db010
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073c7L:A3k03kHRJARJ+
- TLSH T1DD259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 972KB
- SHA256 9e964a73c8dc66216409664ef3823c29feb826bc2940585d0229831d739cb42a
- MD5 3091cec057a245c0981f388097022dce
- SHA1 78f490111f22350cf9dd066c7033feaac6f53c5a
- SHA512 342f34307f7a4cc7477b6632af4e7db90cb4a81328e0633b20d5458f8547fccfc98b08ab07f738836b5ab5f77def69238140f1b42743b40e93b535f8355021dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cBM:A3k03kHRJARJL
- TLSH T1E5259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 972KB
- SHA256 20558b34c35a7df24fe9ee042df11dec43a58257b931f8a511e659f60fba7849
- MD5 bf7b2f0b030e98e15ce759e8727ea62d
- SHA1 c6ea2b3792ca5953ece1ceba1267f28ad7a2f339
- SHA512 cd34f31bcab7bf619878a391bc0bc6936c3f5b88c97503d32d07bf18500464ee617364f66c6f5471df132513ababdd7dc10e8cc587bbb5a16a1737f2f83ef4db
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cqh:A3k03kHRJARJF
- TLSH T15D259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe$
- Size 1.2MB
- SHA256 96e0debeeeca3c27ff76d1bb20d0f944aad54afbc07852f783f2632adbfe5105
- MD5 e3b346f21e8a60900dec2d0de58c910a
- SHA1 d17aeb577617a4db73a95d2d7a6964128aa8b692
- SHA512 d625fc6c4a96a28369079ce0584613c80fde05aeb0caaddec2d3dd5d6021ae17777042dcf48f1987a2fab82c0d9870c670ab8afc1242a26cc18b7da4a7d6ac1e
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073cQV+PAk2hMH3:A3k03kHRJARJli2WH3
- TLSH T161459D23F7D900F9D11B81349AE99636EB357C52073193CF2354961A2F62BD0AF3A3A5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe
- Size 954KB
- SHA256 b7ecf3706d420003e8f6f41f2401da4861a6ef8ab306c267a469e4c8e583740e
- MD5 5cc112021352d2361fcbdfdecdd2f332
- SHA1 8ca7e4b51e883b298288c6aada7b10c438534f6b
- SHA512 20f79a695bb8fd0c30cb76f648de557b1b6afa1f67002e464569a743dfb8a87be54232809436d8374a88e292cf69dfb5645e9c191b527ea4b3bd694159185635
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPooDa073chBl:A3k03kHRJARJ
- TLSH T1D7259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH