Analysis
- max time kernel
113s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/05/2026, 12:35
Behavioral task
behavioral1
Sample
2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 949KB
- Sample260528-pse1tafx4m
- SHA256 e1b45a870d590e1910ba3f46e973946bc132e5a6e6c8efd9ebec176a31e95023
- MD5 561340e3985f1bfee0b88fc1b20288be
- SHA1 efd77e42ac17401099eeba85d381881e789eb5a4
- SHA512 48f3f94cde8385698798e0845aea866de12ad5529c6b8a70305cbac819ec5c453fb486883eb575b69e6f5b1fe2808e9862b1e5c10ee7dbcebeabcf67328b0647
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKp:A3k03kHRJARJ5
- TLSH T13C259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Custom signatureDetects executables packed with ASPack 43 IoCs
resource yara_rule behavioral1/memory/3728-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000700000002464e-6.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/1096-7-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000a000000022953-12.dat INDICATOR_EXE_Packed_ASPack behavioral1/memory/3728-58-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/memory/1096-71-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002362f-165.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212eb-284.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000300000002362f-447.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ed-502.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00040000000212ec-569.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ee-606.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ef-631.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f0-727.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f1-748.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f4-792.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212f3-805.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f5-854.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f7-873.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00030000000212f6-892.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f8-899.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212f9-912.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fa-937.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fb-956.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fc-988.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212fd-1050.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x00020000000212ff-1069.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021300-1106.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021301-1143.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021302-1168.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021303-1181.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021304-1188.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021305-1249.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021307-1334.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0003000000021306-1348.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021308-1373.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002130b-1387.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000002130e-1400.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000021310-1401.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0006000000023224-1719.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0002000000023143-1773.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x0012000000016919-1963.dat INDICATOR_EXE_Packed_ASPack behavioral1/files/0x000200000001e510-2138.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral1/files/0x000700000002464e-6.dat aspack_v212_v242 behavioral1/files/0x000a000000022953-12.dat aspack_v212_v242 behavioral1/files/0x000200000002362f-165.dat aspack_v212_v242 behavioral1/files/0x00020000000212eb-284.dat aspack_v212_v242 behavioral1/files/0x000300000002362f-447.dat aspack_v212_v242 behavioral1/files/0x00020000000212ed-502.dat aspack_v212_v242 behavioral1/files/0x00040000000212ec-569.dat aspack_v212_v242 behavioral1/files/0x00020000000212ee-606.dat aspack_v212_v242 behavioral1/files/0x00020000000212ef-631.dat aspack_v212_v242 behavioral1/files/0x00020000000212f0-727.dat aspack_v212_v242 behavioral1/files/0x00020000000212f1-748.dat aspack_v212_v242 behavioral1/files/0x00020000000212f4-792.dat aspack_v212_v242 behavioral1/files/0x00030000000212f3-805.dat aspack_v212_v242 behavioral1/files/0x00020000000212f5-854.dat aspack_v212_v242 behavioral1/files/0x00020000000212f7-873.dat aspack_v212_v242 behavioral1/files/0x00030000000212f6-892.dat aspack_v212_v242 behavioral1/files/0x00020000000212f8-899.dat aspack_v212_v242 behavioral1/files/0x00020000000212f9-912.dat aspack_v212_v242 behavioral1/files/0x00020000000212fa-937.dat aspack_v212_v242 behavioral1/files/0x00020000000212fb-956.dat aspack_v212_v242 behavioral1/files/0x00020000000212fc-988.dat aspack_v212_v242 behavioral1/files/0x00020000000212fd-1050.dat aspack_v212_v242 behavioral1/files/0x00020000000212ff-1069.dat aspack_v212_v242 behavioral1/files/0x0002000000021300-1106.dat aspack_v212_v242 behavioral1/files/0x0002000000021301-1143.dat aspack_v212_v242 behavioral1/files/0x0002000000021302-1168.dat aspack_v212_v242 behavioral1/files/0x0002000000021303-1181.dat aspack_v212_v242 behavioral1/files/0x0002000000021304-1188.dat aspack_v212_v242 behavioral1/files/0x0002000000021305-1249.dat aspack_v212_v242 behavioral1/files/0x0002000000021307-1334.dat aspack_v212_v242 behavioral1/files/0x0003000000021306-1348.dat aspack_v212_v242 behavioral1/files/0x0002000000021308-1373.dat aspack_v212_v242 behavioral1/files/0x000200000002130b-1387.dat aspack_v212_v242 behavioral1/files/0x000200000002130e-1400.dat aspack_v212_v242 behavioral1/files/0x0002000000021310-1401.dat aspack_v212_v242 behavioral1/files/0x0006000000023224-1719.dat aspack_v212_v242 behavioral1/files/0x0002000000023143-1773.dat aspack_v212_v242 behavioral1/files/0x0012000000016919-1963.dat aspack_v212_v242 behavioral1/files/0x000200000001e510-2138.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 1096 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\BHO\ie_to_edge_stub.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe patcher.exe File created C:\Program Files\7-Zip\7zG.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge_proxy.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pj11icon.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe patcher.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Edge.GameAssist_1.0.3456.0_x64__8wekyb3d8bbwe\EdgeGameAssist.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnscfg.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\createdump.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmclienticon.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\148.0.3967.54\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\BHO\ie_to_edge_stub.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe$ 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3728 2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 1096 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_561340e3985f1bfee0b88fc1b20288be_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:3728
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1096
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 949KB
- SHA256 e1b45a870d590e1910ba3f46e973946bc132e5a6e6c8efd9ebec176a31e95023
- MD5 561340e3985f1bfee0b88fc1b20288be
- SHA1 efd77e42ac17401099eeba85d381881e789eb5a4
- SHA512 48f3f94cde8385698798e0845aea866de12ad5529c6b8a70305cbac819ec5c453fb486883eb575b69e6f5b1fe2808e9862b1e5c10ee7dbcebeabcf67328b0647
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKp:A3k03kHRJARJ5
- TLSH T13C259D17F79900E8D10AC1789AA69A22FB757C56173093DF2358C6162F63BD0AF3E394
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedgewebview2.exe
- Size 1.0MB
- SHA256 4913e9c5a39c1e65b4e5e182f37fa4058573c1ee5233a6b049bbdb14c5fa27c9
- MD5 4bfc214ccf1362203312a64da2f5294b
- SHA1 9cc523fd56e77b4d7898f3cf891f7e038a73ab66
- SHA512 02b268cea7dc71c66ca8fc67ced9ec47464f64445874da3448250cd5b9a046ce4bb2af874eb1d9c2a6effb01c6db8ffc2dc5f737041629ca33ecfdb8b10908f9
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK0Gen:A3k03kHRJARJjI
- TLSH T153359E07F79900E8D11AC1749A968A22FB767C66073097DF1358C6162F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe$
- Size 1.0MB
- SHA256 2776bb1a993f2c03ebf5799fff0c2a4f96df48e3d0c93f945e72074def810090
- MD5 d0270834da7442f9af70731fc9200a51
- SHA1 ea36b9ba691f91fd20356eade568dd0a48c94f0e
- SHA512 b55087e3290131c3855a680869707a464630211db50f99ea2e6576760a8ecc07477b8b1b0f8181fc082dcc4453034c24bf2b6fddbbdc39480fdc69b507a9cf3c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKTTjE:A3k03kHRJARJvw
- TLSH T14C35AD13F79900E8D11AC1788A968A22FB75BC66173097DF1354C6162F63BD0AF3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\Installer\setup.exe$
- Size 1.4MB
- SHA256 8ff581a0aaa68c0db027ae80c13b48beb40176583b22563f7acde181c24185ce
- MD5 d808cb436dbd83b2a2e139652dfcb6dc
- SHA1 b1740ac2f2d8d1ba03bbe7d2ec4b6e367cffdb38
- SHA512 dd2cdac99a72f32e23db235b25163833f41ea80230ab80f6c1658dcd2c7beb1330cbb77fd8d4260547593d8c3e17c11cd7f61816046a7f8002aa5b82c6c59331
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKBUr2d29dBrtpDiI:A3k03kHRJARJRUidGl
- TLSH T12D659E03F79800E9D05AC1748A968612EB767C560B70A7DF13A4C22A2F77BD0AF3E755
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.5MB
- SHA256 65518f2e1bf77ac6493cf9814f9824859ec7642318bd9201cc5ed124f1a9ffcc
- MD5 62f763b429670573b0b2b3ff6b2f6025
- SHA1 6cfb8aa6badeee9662e2d0b63774513f6f75257b
- SHA512 3a19cb131ddbd2821923bff5deaf301600f35ac1f8cbb5fe72efc977a3c82ad1cc0f80f1d54074f87cf289ffd55e6cecf3e4c027db36f355e41ad1e786132b67
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKV0Le5ji0hmxNrM:A3k03kHRJARJlPji0Aj
- TLSH T107657B17F6A802B5D067C1B9C5D29A5AEA713842173087CF1398C7292F67BE19F3A371
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 1.1MB
- SHA256 17c07b119e2bd53e64bee22ad973daf499c04b032f1d439e00b348e43f2da160
- MD5 8f4815373c3c054594c3418acb8d7b5f
- SHA1 29c4d3c30ba3aa18048c87933475049b03ed7479
- SHA512 03e055c48f99e8e4f063c17392c8d682dff1b1e67e7bfa212f1aa0f8fbe4c2fb8b8091d7efd7a6261445386cda7216da9d62d997ffc1709deb4cb86867ddd0b7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKuD:A3k03kHRJARJ2
- TLSH T157353807E69800A8D11E8174C7968A22F7777C5617E092CB13D4D63E2F62BD0AEFA357
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 972KB
- SHA256 b95ef56ee4dbf91e85f035375aeb95dc4a71f1f1bb9b7c215cbe4623a9d799b1
- MD5 6f48a8b06113847579d5a3a10f74cee2
- SHA1 2ef29321cf0435026aeba7966bd2faf77f451b3e
- SHA512 fa4135ef2bc654b48844a6877b691d6393c170f3f20614fd8ef5491b47679621874cd34af1ee15765658051897f064e3a044455e89b6da1db36c45691e7aed2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK29:A3k03kHRJARJu
- TLSH T1BD259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 972KB
- SHA256 c9f8b1fc5f826eb815f84885be836703d74a422e33d66a8cb47a0ae2cd670753
- MD5 3fdf0e044cd53ae4c48abd117b9e952f
- SHA1 b6399c5d45877ff50d87e0ccb41fb72b7d25b0db
- SHA512 6ac383398e92d91b1923569d823654e989bc61ef1ce55c13ab0e0131de06fdf55ea00b60c76fcc34b2acdbf70963b040914267ce7a52376e8fbd4b26de7194c3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK2c:A3k03kHRJARJD
- TLSH T113259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 972KB
- SHA256 5b8472762adb14e77f8cb21635e828d963fe696f11ead742d9669d1a6a304956
- MD5 b73fdde2726a0e5eb5a99b67faed6260
- SHA1 57a5f27e944e9859e3c3ea7bd64e5c8794d3e337
- SHA512 7afc51f0865ece9dd0200deb21084b94f51db10842689ed7259c2248ebd515aa1e519ca1262ef20a78b5e28ff0ba678cdf0a48aac1c05bb473ae6090c057cc7b
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKvp:A3k03kHRJARJB
- TLSH T144259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 972KB
- SHA256 375887bfeefbe325a58311171ddcad8b28aaeafa481ac28d89376af57488cd14
- MD5 81f994daaa35fdc0c4eda1f5b0f1da21
- SHA1 48d9bad17241639aad726c72dedd60cd54dbc500
- SHA512 86ea18b79e8d84eed2ccedd62bd5722db395feb047ae8f45ece8801a41490ec58c81231b61547b8bebda5fee45b809b44d38f0b60e3e252257b653305cdc5525
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKQN:A3k03kHRJARJa
- TLSH T17C259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 972KB
- SHA256 5ba1d268f48db0cc7c1ab6d6c38c605e0e55580f71b76aa5ce2fb1b8acc4ed64
- MD5 bdc807b963ae3e061e0bec7cb2af9ed9
- SHA1 0b8b3cf11a448ca0ad44fe4d251e4df655b4d4a6
- SHA512 cec21ae62852e54cb56ed487d9678cc463d7033be224af2f4520e7b1b81144c2dd7743ab1118b4bd0dfcd4795e61f55548678e9772da23eeee04e381ecb808b2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKYF:A3k03kHRJARJg
- TLSH T10C259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 972KB
- SHA256 1b44d1910a1047b03ed19477835d57b50d9058896f87f9c63b30f479bf28538f
- MD5 163db623ccaac1d23dcf3efcb988385f
- SHA1 909334c829c08af1f76c51e9bc4308910d2f7133
- SHA512 c93933d948340d58bc4d7a75fd1bb978e1c621fc7e9874332235e9c0d03cb564fe5d6b810f313b7bef1d73eb747449505fade0ae8ffe68ab30aac4e39abc9acc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKNC:A3k03kHRJARJ0
- TLSH T1FB259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 972KB
- SHA256 26a7610fd61e2bcb12e1575301d3f93f9c757c6190ef2b9eab81f611f5d5c534
- MD5 e75e2caa7ba319f34ceaa9eff05f3c77
- SHA1 528166a756c915b26ad2cc7eb2761b0b3d960c77
- SHA512 2249390b99394758597102d151163b926603bbe926f9aa17f3e3a008c715890a045d572cea35e412c35481676eb9ce9154bfa09bcda962088cfaba5ef64375e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK2w:A3k03kHRJARJJ
- TLSH T183259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 972KB
- SHA256 693f26bf95b72b89e906fea4f6dbfa0d308c9c2227e0976b7fc685781b001934
- MD5 e13b7eb6f2aaa01b83532627908e8ff3
- SHA1 601085d8b95b107fea96c9085c734b84c8f994ff
- SHA512 25ebbae42e86bf06269d5ea32a5bc899888b7e80b248421cc6acebbf06df5ae8d0a861104aba497fa592077cbd224e992f7cc335721c95505c5087dced389a23
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKlT:A3k03kHRJARJ9
- TLSH T1C5259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 972KB
- SHA256 7d6732c0aee5446787777096f82468dbe39361547b741d2490ff57e1e056d605
- MD5 90f9fca839e60ead0a323807d173c0f6
- SHA1 4155d10cead6beae10741e88371a1a79d745cf36
- SHA512 93dc394945449052b01eba24def70fff00cdb00f4e83fd788660e9efeffd96b83c801eee9a2f321fb14cb4b37c9ca6c6f9ccb74e064f1b730ad793b0e4cc80c5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK7u:A3k03kHRJARJC
- TLSH T1CF259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 972KB
- SHA256 ec039d14b3be9a41a54407fd04410ee2533d0a8cc11bbe5126a256128dd7fd07
- MD5 74dad0c029db10c7de9810815c47bad0
- SHA1 8ddde75e7575ee4d27f14daa67f7ac263834594d
- SHA512 01ae59ba639e605d8f4587f596d5e2e6cf175081c88922ef29f118fa4e1d0a3566a6677369839e3f5c81514bf9088b78736fee35a0d9b15f3f8e4f3b21ed3adf
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKfb:A3k03kHRJARJz
- TLSH T106259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 972KB
- SHA256 fa1ff8f7a23f9d47ed997fbc9cbe96c81b2cab1d7773a3d0f0b0e93183f5b99c
- MD5 3f43493c52655e242eef7742856aa163
- SHA1 140853aed8ea327d2a47d82e5256ae4c0820aaf8
- SHA512 d9e41c9c21af867089be53a347a4a492c8568f51753cd17ba608b2f005802cb2d42f865eafd2b3f8f31e4b553032092b1534ceb6d800709ace3c8025759f9687
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKbf:A3k03kHRJARJr
- TLSH T1AB259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 972KB
- SHA256 56e2ca862f106eeb620152b78b4d76f6deee412bdc37c9c4fa3b13f4bf8b25e1
- MD5 96df4e22fe98b81f55becb86cdfd5b28
- SHA1 de10532b67aeb561b1a7b1d0af4a804f52db52d4
- SHA512 3e1a30dae20e26225891397b3be70e7e5792a6b4334bc22f4464ff0246719b07510b08690dc0d306763ee1bac54e69f9232e3fa07ca0118e21e423449455dde5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK0K:A3k03kHRJARJb
- TLSH T122259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 972KB
- SHA256 346cee35b7074c1ef088fb4e19a46813f9b28d2adf13a6c2fef95711990437f2
- MD5 6db2a4fea9adea869362708c8d981911
- SHA1 71ff502add88fa5a056eab500e7624f4afe83a3e
- SHA512 6edd3e58806a572232d58fac60087fb1df940a49c7f29e34e96d137e1f3195eb286fe7c232261b42d16898a1d4cf4ca7d16d882d61a1578f6598f15f2ccf8e48
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKpk:A3k03kHRJARJW
- TLSH T16C259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 972KB
- SHA256 866b5bb95c5f317ca0d57e6df1b8253a916bca12a6d01125b94cd373e13ab4d5
- MD5 e0f49476b93535c37b90f581179b958a
- SHA1 00c8ab58446c9d6e5c11d1dde40926c2aeb4057b
- SHA512 2517632c7eba8037752b8ebe17cbc486cde571f5c625345f4b96909f0700b64638aa93b1d2fba921f790aebc317000036622b66fd621bf8288c5a27d7e2d6462
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKG0:A3k03kHRJARJr
- TLSH T1B3259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 972KB
- SHA256 ddfca40b8120a8df5d3e25ac1c40632db95636af636fefde7639399c29f8fdfe
- MD5 1d160673518332598aeff0148b1c7aea
- SHA1 e352480858381bb7d0f75be5f7d3b7334de28abc
- SHA512 fefe3662eb6c1ab4a5c64088f841b85a46c8ab53a211b042ab21b0fb71ebee58a9ab52798b1c23a6bad0bbd1fcb30830fdc0ee3197c8a9f05098c567175c8609
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKVg:A3k03kHRJARJe
- TLSH T18E259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 972KB
- SHA256 d9b256b596faa1060b13e2a1311cd28ac9b60ad2a2d28c1a4f644b8610f99d4b
- MD5 9b92dc10faac6ae9dedb5ce699de36b7
- SHA1 61e15df08f70e3aeffd3fd2bff5a2b08822aca8d
- SHA512 c58de0a1d3aeb6191c92d9939edac61f132a061bc81c430ffc954a2c08f986c3054f9bfaa49a86874030eed63f21475d55266ed1dffaab58c84b26751e3b18dc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKkr:A3k03kHRJARJg
- TLSH T16C259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 972KB
- SHA256 266d558c9e87a84641348358943fdbb6c93451e75a068880bcd61e824f4c5e55
- MD5 88ca981370eab0137b5f2162dfc6a772
- SHA1 472a553bd931ade385b73480cd0f8f1cedd435b3
- SHA512 04ff9cc78bce1c08ffd2ad66e9a88b470bbf740eba741d0018f5f29bd462395a992ec7454215ce8bfd0f76a8cbf0a451caf4e89867098a229714933582e027e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK6n:A3k03kHRJARJy
- TLSH T1F5259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 972KB
- SHA256 4a860b1ff72a3d9bcb32fbb3fca31d8f727f173276a71174b58050c3132eec5e
- MD5 49770383626a96c2c605174c3d47cefb
- SHA1 1c7c2a34301ed6455d9c0c262db0f142934e047e
- SHA512 3378211b69691f9f6eeb75656f2d5a113f4c047c74151ec4faf49e78930a1d9a97a1cafedb0bfa53ec2d2937298139e621e728abee1d35b7d37400d06b4b99d4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKQx:A3k03kHRJARJA
- TLSH T1F8259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 972KB
- SHA256 46d4023875e8f84dc036272e1409c5ab3e48c8a392516d80276b588b927f839e
- MD5 f4318a562d3dfa4a8f45d6fdfb71a1e0
- SHA1 586ffadb69eb42bac0c86639281391c85c99ecd4
- SHA512 79128abeed73752702f53783553be1245b0f858e10865dfb550fc2eafbafdaf0f1e12d23bd0896aedbc23fe8268c6cd4cceb9b4578fe762257fa7b4bc37a490a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKSA:A3k03kHRJARJj
- TLSH T170259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 972KB
- SHA256 3b8a4c89b182be02ca18cf80084e772eaa3b86d860cc4ba35d3063207398da55
- MD5 4d8be8c4a643990e398ba54f87493ab9
- SHA1 13ccfa92fe1607e144a84b418424ec360a5fc2b8
- SHA512 ffab7887443449a47dee31d30b69807d79784ebc77647f67978295842bd12745ac0dec454f09e0e335b0831c8f21a69b1816e05a260d9107ef9ec9e852cb635a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKr9Q:A3k03kHRJARJu
- TLSH T1F1259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 972KB
- SHA256 7cc1ef5ca8a8e3dad752e2bd49d98bff307a0e59d7d0ab06d81c6e8f94efdee8
- MD5 5388f277b17d71835972da8d19683b63
- SHA1 c4979d2299d1d7bdf7e5576710cd3765c78258be
- SHA512 63fda25384422cabea5d48741956b62c2c957364117ba85dd0f91eb098f970de46f2bc5a7a72956a81551d35a41f7dc9c435d716293b924c2a3166fc7aa8cf2c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKa4:A3k03kHRJARJN
- TLSH T1F9259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 972KB
- SHA256 ac9e492db7ee296193619f6dea8dddc0721c1b052db67f19203c1fd0a1d112c9
- MD5 f3867f425c6a5489c97db24a39fb760a
- SHA1 450d8894db5f54fd76cfefe3815d591909e69f42
- SHA512 e08bd23a952f887c3bad889b81a1a12381a851322e9756536b32f886eb2899b62831426634fa75ee3138a8f11a4f16e1dc0d26f9b101ccc895905757c65cd6f2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKBu:A3k03kHRJARJo
- TLSH T173259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 972KB
- SHA256 25ca7e61841220670497241c54e6ee59ef830177259292a20437cc721a3dbc69
- MD5 b84cee1862af53d4937399d693ea9099
- SHA1 e415e2339bbc5712e9f2926aa964e3a2d1cfd590
- SHA512 816a27d9bf404f3be3187664dd4af43a7bf0234320a41072a9d10870d529d577dc903c50ad144d923b94b2fff990a8945ba767f523a405d4ab86b0bcbbaf6757
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK0j:A3k03kHRJARJi
- TLSH T19F259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 972KB
- SHA256 3d9675cd09ef2f1e5e8033851236c09a4017ab1b9a938fc72d65c995b46a2ebe
- MD5 cc6692ec5953b2f4144996ca1d685c0e
- SHA1 af58d8a12d41f66f492f6ac61aabf9ab0d998090
- SHA512 affe1f204c8ea3401ce6e7624a3e224520667fb87322cf5b0802a5fb0341428fc449ca253ce00bbc0ca7d5eac3ad7d0f2b2b293bbef594e0c337291030b11ed4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK1g:A3k03kHRJARJm
- TLSH T1EE259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 972KB
- SHA256 f8543acd0afefc9ce542ad15b8c4ab2c6c78b5d1ee151d6fdaba1853b87a3850
- MD5 5f2d4561245cd2ad1ce9e5bf6b99bb44
- SHA1 4c5898002de60f792e1dda8e30229d8ce452aef8
- SHA512 c721e09a9e46cb2a95f7591519ab8d38c16a5023ca1d16ea6a91a01a92e5ab98d70137b5a1db6e0fd649af71b9a3a83252b09dd2d3207af37815af4cbb693f3a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK0I:A3k03kHRJARJv
- TLSH T158259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 972KB
- SHA256 5605613ea755bf22dbe975e4fd868892e10fb1a8ea9f3c72269aa3366b66e646
- MD5 d73dac9083e2020f0900fdcd0cacf216
- SHA1 1e41d486a2bdaec569915a4cffadf6fb1f599a4b
- SHA512 7ba1f044736657ad6bfbea565048ab9506f90a1b4210d3934b70b4839f54bb755b7873a8c78c2797d9fc9de516b7c5b5d90b228b7ff7e3d830cb9fd379cab174
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKmo:A3k03kHRJARJZ
- TLSH T110259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 972KB
- SHA256 42c076d64994c0bd9cf0fff8c6143d6d61de7921af7abf8f5f7de21266d66edc
- MD5 4c4fda0c7da648fb946c68db600bfdba
- SHA1 a9ad2de5d6b2c8e32fbe543bea0bcdc743d629b4
- SHA512 03491715cb291bf9bd05b9541d73eeaff1b0fb2ed5c2478d88ed4848a8907ea1225041a0ca063cc88212f821b36cd312cb4a0076cea0aad06c13fba95f1c9783
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKN+:A3k03kHRJARJc
- TLSH T177259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 972KB
- SHA256 a2cf9d4ea0cc2b194f8ab4823ff43d89726effd7190590c5bee053d1c7ff8e29
- MD5 7f1fac46d174ae5359efc0e6e614865f
- SHA1 e4a3af3a2ae00bebc1274e912cc03eacf0fab138
- SHA512 63a79bed007ffae8e5871f2ef61f0b115a4da74dbbe8d5a7645d360d6c91081324894e83e4a6509785a48024de299f60d9b8230dc440ad5e1e9aa07adc8a0a1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvK7Q:A3k03kHRJARJ0
- TLSH T1DB259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 972KB
- SHA256 fd246478d4ef30729498fa44e5d039f14658ecab2c7ce705d9a6b18c161e4b9d
- MD5 a093829e7cf246fe4e661f85505338ef
- SHA1 e07c6c7a28e16a98eaef8c8c4246ab1292bbae21
- SHA512 66cb7d072707b1643b954b4d8bb517777698a9bf497de713a26a9d6bdea05117ea9d3d8de63fb7696587bcfe8e8aa5ff60463a4b773b54c13017728dfa5fa04a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKwX:A3k03kHRJARJ0
- TLSH T1C9259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 972KB
- SHA256 60fffb41084add10c54d196cc8cdc24d6c436311a7142eb56f5fb6ea288b634e
- MD5 213070887a30389b6dbf27eb4af1d467
- SHA1 fda3b58f2530788d09ebab518d0da97928fd643f
- SHA512 134411d60907980cbac3daa634c57081c189e3824848180996bb4ef8e6006f5b69e1e577429368cfe25882ed160e3129d5bb95a4205f9fbed8446d4acca1dbb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKGL:A3k03kHRJARJO
- TLSH T11D259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 972KB
- SHA256 6c14082475f769d498671b72973ccefda76d4d8a40e68edbe6b79db986759de0
- MD5 0df6943118584cb995b3711471e8adab
- SHA1 19822a5ba4487095ecabd0c8b75c07a99836d6e5
- SHA512 59e3ac1bf631fce0764625580f3aa2141e3df59ba4d512998a06504fe07def98c796e97158b6c5b49ba3b078e65bfd9112e567ea54060793a56d73815b0fffaa
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKaM:A3k03kHRJARJ7
- TLSH T1FD259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 972KB
- SHA256 3c6c47e7c65fd7d0e07d8b0621b9de45fc60fb1dc33743e290c615bd246609e0
- MD5 7c2e6c8817f6226e04dc9c3123388692
- SHA1 667dbccb17e3d02f80c63fa8b2d16abf50b84e1a
- SHA512 003ba7da600d6eacc9daf44f68d161da6c6afc4a3d5893162f771a722d35bffe62fbe3ee39f258066c30653ff314c46ce5fa73b224cd0440dc79cc87ae683074
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKLh:A3k03kHRJARJ1
- TLSH T1EB259D17F79900E8D10AC1789A969A22FB757C56173093DF2358C6162F63BD0AF3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe$
- Size 1.2MB
- SHA256 f27fa0f07e0ff070d999457440c567f18750ea089695662167404688fe363d1d
- MD5 87d4819e8e7a0a975f4bd0e475a83e31
- SHA1 516b6a83beb2728324d2a24f58c8ed9ea0f6072e
- SHA512 3353d28f6fddd0a188a75715c3f7e52a52d0f6fce87b536b4a15534757d9f1accf5036982935453f8357331f7c567b3cb40550f82f5aa6860ba33e6371742531
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJlancMJlPoopayCvKFV+PAk2hMH3:A3k03kHRJARJ1i2WH3
- TLSH T156459D23F7D800F9D11B81349AE99636EB357C52073193CF6354961A2F62BD0AF3A3A5
- MD5 SHA1 SHA512 SSDEEP TLSH