Analysis
- max time kernel
122s - max time network
149s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 17:49
Behavioral task
behavioral1
Sample
2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 906KB
- Sample260628-wd2plaaz3j
- SHA256 e84ad000d33e97ba3e731cc880782339a438911e21b494cdc2390969d8184645
- MD5 fa300d1e16b59a8d9ca80969c836aa37
- SHA1 0cfced0222499371799c1e0ae771c8cce1b7748a
- SHA512 ab01307b81cacd3b3dc642968c97688e6c16e047e25a90e3961eabe780de201b95cdb58bd110ab56a0689a9c1e81e42b9ace5bb084045589fc647e19d8b19cbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgc:A3k03kB56rZ
- TLSH T12A157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/5940-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c58b-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2d1-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5940-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2fb-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/4540-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c84-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a28-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a2f-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-306.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-325.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-357.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-376.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-414.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-427.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-447.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-460.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-462.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-499.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-518.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-609.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-634.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-653.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-744.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-763.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-806.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-813.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-845.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-877.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-896.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-916.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-954.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-973.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-998.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1029.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019900-1072.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019901-1104.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019e07-1238.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019e10-1360.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018912-1492.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018918-1535.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018927-1567.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000b0000000064b6-2034.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c58b-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2d1-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2fb-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c84-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018a28-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a2f-211.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-249.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-306.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-325.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-344.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-357.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-376.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-395.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-414.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-427.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-447.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-460.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-462.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-499.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-518.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-609.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-634.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-653.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-744.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-763.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-806.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-813.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-845.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-877.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-896.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-916.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-929.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-954.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-973.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-998.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1029.dat aspack_v212_v242 behavioral2/files/0x0003000000019900-1072.dat aspack_v212_v242 behavioral2/files/0x0003000000019901-1104.dat aspack_v212_v242 behavioral2/files/0x0003000000019e07-1238.dat aspack_v212_v242 behavioral2/files/0x0003000000019e10-1360.dat aspack_v212_v242 behavioral2/files/0x0008000000018912-1492.dat aspack_v212_v242 behavioral2/files/0x0008000000018918-1535.dat aspack_v212_v242 behavioral2/files/0x0008000000018927-1567.dat aspack_v212_v242 behavioral2/files/0x000b0000000064b6-2034.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 4540 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe$ patcher.exe File created C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE patcher.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Mozilla Firefox\firefox.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ielowutil.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\identity_helper.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\XLICONS.EXE$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\pipanel.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\xlicons.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\ConfigSecurityPolicy.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\misc.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe patcher.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Mail\wabmig.exe patcher.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateSetup.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Media Player\wmlaunch.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe$ 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\accicons.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\identity_helper.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 5940 2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 4540 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_fa300d1e16b59a8d9ca80969c836aa37_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:5940
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 906KB
- SHA256 e84ad000d33e97ba3e731cc880782339a438911e21b494cdc2390969d8184645
- MD5 fa300d1e16b59a8d9ca80969c836aa37
- SHA1 0cfced0222499371799c1e0ae771c8cce1b7748a
- SHA512 ab01307b81cacd3b3dc642968c97688e6c16e047e25a90e3961eabe780de201b95cdb58bd110ab56a0689a9c1e81e42b9ace5bb084045589fc647e19d8b19cbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgc:A3k03kB56rZ
- TLSH T12A157B13E6840FA4D10F81749A968662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 935KB
- SHA256 75acb0dce261f06dd882eb4b22ed61757761888b63847c3f56600ece1a623e44
- MD5 c3ff8a50fc314f2112e78b21bcded966
- SHA1 783082d0dc568146901038da1ad6321dbd4c356a
- SHA512 c60dfd92b91b4c1301263973f9cefe5fdf979d52960ce19477bcb8d0bcada25ad6b10a6b2f65448f0195f6816f234afbe1f068f5cec2cb38a152b23b97d2cfb1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgGP:A3k03kB56r3
- TLSH T1E8157B03E6840FA5D10FC1749AA68662EA737C125F2097DF1354AE153F72BD0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 953KB
- SHA256 0059714f9844b334c05112527063600fe12bdd5a70222e0e5d8fb1b2104ce9b5
- MD5 865b02709287d473135446b301fc5b4d
- SHA1 5a8068836d6dc377ebe5cb22fa752ef6a9ad9259
- SHA512 a2960be153c6428b2af616af6f6aeb36df631935ba9f8ef6daaab6b251effc61098430781fb6ceb820978adcf3c8d6b2b25979ae7473416b00546c2adac0a33e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgp0:A3k03kB56rs0
- TLSH T1D2258C03E6940FA4D10FC1749AA58662EA777C125F2097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 959KB
- SHA256 fde51b07c7f8a26a6c7d0375c62e935d0400731c4994b28d00d547b75f086604
- MD5 dd11ba035f1757c7f3a430a434efd841
- SHA1 bed4a1583eab8dcfcd6a308a410dc404751de886
- SHA512 cd18d8604dbb1f4370ae358695efede7eb31f34ae1679a0b5cac23b79b3a99bc4cb968d3f9f36b08e4f902d2c5a9305973f205426d4d88a244d0e7c698be3ad7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgHfj:A3k03kB56rej
- TLSH T10A257B03E6840FA5D10F81749AA54672EA77BC125F2097DF1354AE153F72BC0AB3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 d8cccbb9bb52cf09c887755844891e9dc5b8c0112e6bf4e875be955ee5015ed6
- MD5 8f01f822cc2cb59e54ae47bc746fc7d4
- SHA1 66db7ef8d6e8bafc7c2aae99d09b20c2fbe607e9
- SHA512 261490f5ca9db0d485dc5844f65606bec19260ce66a794b88a48fcc6d61df2d6519dd5ac4329ae001659ac7ca39890aa6f0e9039b9860be598972714bdb636bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgk0Le5ji0hmxNrM:A3k03kB56rFPji0Aj
- TLSH T1D8654A16F6A44BA5D02FC074C5D29666EA733C421F3087CB1354EE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 921KB
- SHA256 6172c24fc344515e16d42fd13bfd06851e46b45a11014475d11344a166591725
- MD5 08ae7652dd4990842554f397170fb1b0
- SHA1 ddf797ee83927aaa8d6c9790a49ce3fea51ae772
- SHA512 65aaeb64cc583a4aaffd8b6ed3a41d1f8faa6bdce33ac2cacfb22c9136cd372277e9610a6a531f407d43313d4b2cd0e161954f6d6fb01271553d2ca9a056e30a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgOa:A3k03kB56r
- TLSH T1BC157B03E6940FA4D10F81749AA64662EA737C125F2097DF1358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 954KB
- SHA256 4eaa1a2be936dec3a6dadf6a796a35e0abee94bef2d4e81243191749ce43e820
- MD5 7f12a44e1f71c48ba2c7e699bb708fba
- SHA1 7d3460de0a3bbb0ecb4297e0c723b9854edf824c
- SHA512 7afa8af4a8cf2d28bf66f362e576ab74129762a8ca907304dddb81ded0a8258453607a0d599b31de065269726534840ce6a591165d1561903f28a66657209994
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgNb:A3k03kB56rkb
- TLSH T1CB258C03E6840FA5D11F81749AA58672EA777C421F2097DF1358AE153F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 930KB
- SHA256 c0a5ee7ee03105ddadc54edfe3a636f742e02cba33a8a32a979baa0c2f53f3a7
- MD5 14e7265bb7eb70f0116fe00b72ad88f5
- SHA1 0e2a6b45c47af1cda980abf5ee42fd79eeffa7b9
- SHA512 eacfa2c9a3fe48251e87aa660493f544e27a2497f318dc3f0338fde1b26eeb09c4ea8209ae1a596773de6250477bf1af0deeb9a40a3fce4eecae68ac1b1f2a25
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgQZ:A3k03kB56rJ
- TLSH T1B9157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 930KB
- SHA256 88fa8e0099145d38855454bdb993992a64113b874d65f6907798084bc613c21c
- MD5 996b3815eb0bc5940576f9fa3b46e6d6
- SHA1 19fe5a9ed4cd6da0e029ec2a04f5a4312ee482b4
- SHA512 fbcf1feef42f2428392a4786e5b7b3e7d1f1ea4e2e3054ee8a4d47d5979245cd9281286acb4a6b24b1ea4c838f21710e3a271bec231f996320359a54fbcf7a03
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg31:A3k03kB56rW
- TLSH T1BD157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 930KB
- SHA256 277713a1ad473d3f3fa2f0c78689060bebcb4f9b76ffa81eacbe115c0b99bb64
- MD5 6ba2ea082654b3132a967ec8e2296d5f
- SHA1 22aaab6ba6fcde83ce782d0b4bfe956e20a8e997
- SHA512 2d7fede782718bac3e3f9bc65533cd585cd52270ae16873167c43d58a1d47b48279958911c9d6374bb85a5819c137f910cfde83ea7e2c240d4bce4a87a18c8f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgpo:A3k03kB56rd
- TLSH T10E157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 930KB
- SHA256 6b6309e5792e37ce458c8933ea38e9e7e5f6daf8d8b0f42210c8ae923edc6acd
- MD5 fdcebe74ac96b17d28d08a502f52726f
- SHA1 55e77b49542907a73b9323a03ef48c605dea4a40
- SHA512 02e563ef17434d1354ab0fb395cebc63cf9a60199aee672db0fa84bc46e5eecfdc6246a683d7d4ee10eecdd35c34993db0983b658b932992846927eb9cf3883b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgZu:A3k03kB56rv
- TLSH T143157B13E6840FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 930KB
- SHA256 4336c7c82a50af503587c2bd9e3422d7edb5fd0d5788354ffa3e85df270c6f7e
- MD5 273a6842fec6e98e50c1bd4e0f1e894b
- SHA1 0088375d744a7df14283345eb088e36b5cac383b
- SHA512 f2840f2612cf21e9b445d100ba4d3fc0bfb43722265a453b495a42c52920d8e99fa8bf2e89338afc6b863a68944beb525a7f68aa0325c6cc219801533852c7ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg/9:A3k03kB56rO
- TLSH T188157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 930KB
- SHA256 2474ede6110d04e74fbc842fa6d38bf464912ffa49168fbd24cb4af636ed02b1
- MD5 f734dedd0ac712d3a51956d9714d0a09
- SHA1 0bf40eef16523442bc15a12223fa398830ae500c
- SHA512 02d5ba840e6931b7c5e163c07da6aa149ab99fbfe75b197a469900371f30f32420ad4bcba3575325471e473fa82bbf4710cb2abd2c0e70f0c76737327be5615e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgbc:A3k03kB56rj
- TLSH T169157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 930KB
- SHA256 a7cf4d72dd72e4f07da29ff15a518e30c7e92e49aa5872775f9e6fbf1c6460b9
- MD5 b50642c1829d042e6133d9dcab33cfaf
- SHA1 51b814b6860a78ca670ddf30325dc5e4460986ae
- SHA512 a07616b60389ef842f86b7f77cf8f3180e7d81a8deb6b05d9cfb9934e4a00c943ee941cfba138f48c07f0a9bba6d4cd7edeb95c51c56e1c9de4c71b8586724a6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgEp:A3k03kB56rh
- TLSH T127157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 930KB
- SHA256 3a530517f11d0d0be7d5166cc4f01a1294b7d03ac0fe8fd4f003caaa8e735db3
- MD5 7cc3cdb4bf1cb6ddb7414c1096ab8390
- SHA1 358958749e987b7f5adc4799bc98c2aa45e8290a
- SHA512 14c84c027e3984a1976400a5e5bad0022c306162cc9052cdc21f8e1807b2333f46d6aee4df38baf9eeae44285a6805c60c8791889bde8bff3e1e1db480e36669
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgLN:A3k03kB56r6
- TLSH T1B4157B13E6840FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 930KB
- SHA256 b8830146e48c3ee4cc4782b1c248793f6a0760aea45cdc0ee1708bdcb21f5c4c
- MD5 9902d8d8c4860fcaae0e0de21c3f432f
- SHA1 d2b03a4b35221637c7c7a53d1deaabdd85f96b66
- SHA512 143deb0bffdf669953026d8ada202192129c41088be46a7c0fd7935d96fd5926d8607e3d99fd911ddafa478644d3d6cfbdbbf4aa72c0646f7c38380811c03e40
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgZF:A3k03kB56rA
- TLSH T1BE157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 930KB
- SHA256 8133ea75776aec59fcfc46e4201f31463ecbb81b22d49651748ffda7431ea796
- MD5 13a41c8b752c1ec18f766578f0e88ef1
- SHA1 2781b177ca12e2c97a9f3328014be1ce8f74bff8
- SHA512 3ca00fe6924b1eb5d7218dcb5301cee640295b2ea0dbdd6c9e27b76bfd9d29e4b48feb925ea988694facd86ca63769598e19db08e862e013a27e7592865c1271
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgyC:A3k03kB56rU
- TLSH T14E157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 930KB
- SHA256 dce7774aab065517bc6f85fb8d212098dfb9eed28c4ee859f84452ea585ad7c4
- MD5 14bceff3bdaf3b65585c9cda16db1f70
- SHA1 8b05845573ac33af984f294aed8b2e5a3705bcb1
- SHA512 38943a2f01bdb109d1d80c53d6be1779efc3eb7fbb20a4906c3a932f49de7aa38d39e10c8d61fabda9a56b697f291142206441ea3e84dd0124530b2aab1eb0bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgtw:A3k03kB56rp
- TLSH T1DB157B03E6940FA4D10F81749A964662EA737C125F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 930KB
- SHA256 6f6ec4935157351f1a76fdadeed51122ce1d1dbe57381b65568c7e7f402e9373
- MD5 8557c2aea513951295628c480db93b2c
- SHA1 1f4287bfead04ba988598a0951979d23375bd95a
- SHA512 dcffdc92ab357e320cfb9b908219bd990169402b4176c2f7107b31459a556c7703de2e7dec87ec8469383b223e13c27c9dc81a452337aac789f0818afd27c54e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgcT:A3k03kB56rd
- TLSH T1F2157B13E6840FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 930KB
- SHA256 9165887c0eaa0f99d82edc39c6c972bc39ed4b19685c64e7f3fc191d118a166b
- MD5 478b7893f5c474f067e7e5e5ccb6075e
- SHA1 76479a4af0aea4fbe5cc73efb97cc17b12b35264
- SHA512 bab123dabeee319a8fc05a63ddc675d23e96e12e3e88ce59c2d20ae7a2781084ff3d8e4422d8eba29fded4458cdc4fa17625163affecdf8b4299f05e308c6023
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgwu:A3k03kB56ri
- TLSH T160157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 930KB
- SHA256 36e7407cee1a8f328ca1012d0fac3e2db3a534407e9866ae0067c2285a9046eb
- MD5 e84fd50e5b05612634907e1a3801d696
- SHA1 3dc429a24ce59dffb851cef32030971c20b4461a
- SHA512 858bc1b92f79d7145abdae51f74bd37cce129c76f9e83ace29c38178d4d0de9ab12278b562b5ddd51025ec1b12bfe100d4ec4af314f9ba0c6f246f47926d9331
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgOb:A3k03kB56rT
- TLSH T18D157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 930KB
- SHA256 a108c72d8b17d901af59b900c1f89136d0008bb2c9e75b721d7e4486959350a7
- MD5 45002db1e05ee7efd1f1359a380040d5
- SHA1 6fff31c983f3ddb1c3b97193f34b0d18d16ab838
- SHA512 949de141f5edce38d798af9495bc36479dcf610b082e54107d1bc3a6914d7cba31a188bd2363062198d30e60353e07ef635b58af4fe1a6678b4a7b735eaac319
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg4f:A3k03kB56rL
- TLSH T102157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 930KB
- SHA256 bcf309c264f5dc9684658e001ed73a9707f521d0400c79abb5cb2d81989db1bd
- MD5 de9b1670b8ded7553940ce6e8acc0223
- SHA1 549fa8a1461fd290f8114275b9dbeb96c27e5c95
- SHA512 0d298c57d738f252ec9025168089018ad5be50fc99649d78eb19daac2d03eaf44fcbf9f49169a310ecc6c29d2b218bfddcdcec6ee0f149eb2e17e2bf73eb4dd8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg1K:A3k03kB56r7
- TLSH T170157B13E6840FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 930KB
- SHA256 caae0d85029863c76fd37c0ff44365a2deac29b98d3727cf033b5b4af178d938
- MD5 7655fc4d649b8d8e3d8a5845bceadd19
- SHA1 3bed295878109aa2609066dfe0ca03939e8df2a4
- SHA512 0733fa45f4969d83d9dd4f7550dd4ff25fb5f3c00fdfeeed46c36460530e0f5643161f4b12f421dd0fa6e658ece924f836d228dab73047c6776d3b9438238b18
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg2k:A3k03kB56r2
- TLSH T1B8157B03E6840FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 930KB
- SHA256 07d7651fca7bc4cd91ee4f9745c1e8cc3c40d33f0e26fe8619507af52f66bb36
- MD5 ba13727312a4926d0bc39cf8b4ffd35a
- SHA1 d881c7d35dbfeb98030a8be0c30c5116ce335860
- SHA512 ac96ac1d1f513332c28c12f4e463ad89a9f48c38a55e9397ba958ae0924bf3803848f0919b3c80f2770f0afe43a0325d0ee067ce3bd213b609efdbfec7707541
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgT0:A3k03kB56rL
- TLSH T1E6157B13E6840FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 930KB
- SHA256 148dd9d3214ab682cd29f760dd3741ce8fa08a70c6061b0c60c6b077c387932b
- MD5 6dfea4e358d313ea951cc716082f2c12
- SHA1 315f31da9eb5e431d2631036ae940d9e67de2578
- SHA512 6c694646c0ef2c52dbc2893da62e05d4ac7400a7b10da3775895d881a18757f85d4c30538230af5dc3efd94a4e5c8618b3e89365ac642945db486900d25b6ee0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgig:A3k03kB56r+
- TLSH T120157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 930KB
- SHA256 79e94be98594082b17596221a8c31ae57801570f5b0b3a37884de02a43286484
- MD5 60ec0f9220353156fff0b9967f68e15f
- SHA1 7b9ed011c58fa97c43b7a2eaa63d5603f4343011
- SHA512 2a0912ecc11ce08d4398532b46a43aa19edd5ad0c8bdbc3487f3f60a8c711430986e9cec43c5fdd104fca9bebb04371f583b0163e2ae45257967797364aba4e4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgDr:A3k03kB56rA
- TLSH T108157B03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 930KB
- SHA256 3ae7285fad0dd5d7071cf1ba7fff179204494571dcb2c0b141dbd346cc8904eb
- MD5 7be3db954d18e34185a8a51c2133e95c
- SHA1 8a7a8d129c0e7ae0c359a155dd7d91e74d70d58e
- SHA512 5869330123cea6e0738150cadbc0410c5a74cd6d2b7bad17a3debec75461984a039e4b9ffdbdeb3d83928dccc12dba3ad7e824ca4a181d1a64f5fcbd13a73eab
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgln:A3k03kB56rS
- TLSH T190157B03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 930KB
- SHA256 f026e601a12ff996e6a30093615dbc21c08f9491f83f678dc6c0d6d5d45e6b16
- MD5 181f33bcc548c88ea2236241470e4338
- SHA1 68ad58d1eabda27a3c7993a53b853e8c74b571ef
- SHA512 4b02997c0f0cee18a7b1249048e8f00e697c41023846eb5d7b304ad7ff1fdc5f6eb647cb7f418adafe5e6ef473d307ac68b04660e6af5bef0cc56d2cd8d4d40e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgRx:A3k03kB56rg
- TLSH T1F6157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 930KB
- SHA256 5e3e5963d944795d89e29e706fe12fbb3d16c42cc69fc9451cafcff829a3713f
- MD5 28ff25a0bf1a1fad41fd45cf0dc50174
- SHA1 983861cf290e29e6b7b5b1862fa8a332d6f0e3aa
- SHA512 d761caf5651a764be18d869c275d2e9a79abb9ade885953f7045a59f0f59375d851b86fcab824fea5c6f3331378da6e6ab05ec3065320e2ab7760090be1d551c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg/A:A3k03kB56rD
- TLSH T112157B13E6840FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 930KB
- SHA256 65303bb0c73eed26182ee508726b79ed2d5458a64368a449ea7854768ec8109d
- MD5 986a576a2c5ee84f52315f0184dcb297
- SHA1 e22d1e00663b53f822551348a0dea7f6c192be7e
- SHA512 9f5c3ba8d325e416b61f7dd427748e8dcde8c088bcb3e30eed79acf1d3a24d43ea3f0da601aac329cdf1a95b9d8de0736312bb2edd71e478aee6c8a38dda90f5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgQ9Q:A3k03kB56rO
- TLSH T128157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 930KB
- SHA256 6e4c2c4fda7b30ceb70f05cde9a90656ca4fca86bf7958767fbec91b4e39de06
- MD5 c02822f439e751ec42f2681cf5b9c747
- SHA1 298e2ced3fe1481b6d59ecee1b1b93d0de4f4faa
- SHA512 516b7535880650405c42e7217f68e3d40083bfb650249aa418fb146c699345ebb16f443718d630b3a50fda5f1e1ec1b8a6ec750683f0e070cf8a6d13230e7409
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgx4:A3k03kB56rt
- TLSH T105157B13E6840FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 930KB
- SHA256 5b3cae7ccf59ef77e6064f98a3f2cc122f25287f636c240659b70fd75da51598
- MD5 02ba0b452ad96c9eb0338df0e26f4a21
- SHA1 2c1f13932fd6372a0cff06907d42f94dd9670403
- SHA512 61b10d9d6ec1780ba4b0f7add6abe212f9d07e2837eb6c8b3ec8dd5f1d050c56a7219890a13ecdc840f700db8e6bd4e89eaec0788e07647ab3eaee54eae61a86
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg0u:A3k03kB56rI
- TLSH T194157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 930KB
- SHA256 f84f5eec63426adc6cdfb2dc5913466749f653f61c352debcaf83713ec453c35
- MD5 0f7661ed2c4b0d6673da0772bb9deb08
- SHA1 465f77a86930f56fc9c0a74e7dc85327e3d102a7
- SHA512 04ecf029f27c822b05a9d047fb14afa695255974bec26010e239bac6df25cd479f379871c95a51e6fba664f99a4f69c397ef79979344ba803a54395206a4b428
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgFj:A3k03kB56rC
- TLSH T164157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 930KB
- SHA256 9f07fa3b26e67b0ab2c879fa827eabe91ff5f1d1eb04428ed799182ee3e94fe2
- MD5 9e64e7fe3a664d1250409bf23f5b7750
- SHA1 8ba1bd57728157f848b03d84d37e66329ece8d2f
- SHA512 739ad358994b952080bc85f9dbbadb9ef8766674722cb07d9dfc89e0b09aec2ad2b2aa63b166ac669598edff0239295d74285ff715434202b975a573f4bfd109
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgMg:A3k03kB56rG
- TLSH T1DB157B03E6940FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 930KB
- SHA256 3b08e60d122e93c7d549d4e5c19e01a8455af99a8170fde1abc87888c24295d5
- MD5 4f84b04dcd8182bb6f09abaa01d7362d
- SHA1 365cf7855caea79b3be1bb502572a22da8280d6b
- SHA512 ade3b2ad62842f52434d8c7c1ec2cc3b90e07311ba75b300f62ee1ebf4cd997b0188dc5af39063c664357b372eb9d170fdeb64a800b338ba4d8ef06e6c011f3f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgTI:A3k03kB56rP
- TLSH T18D157B03E6940FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 930KB
- SHA256 2910e1360e7c6f546f48cccbdebc27550f274585744713d3aa7f7ba51e3b22b7
- MD5 bee75c41e42738ec00c890ef93c4a03a
- SHA1 0e16972e3a9750038fd159cdaf79b13c8541fdc2
- SHA512 8dcd5912642096f7dbd9808c31c081c32dd88e4fc1f2ecb54a3f1a9c4308bc2ef7822def451f72e0397dcfb7550bec043d8cf76faf64b0c9250b860806ffe65a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgpo:A3k03kB56r5
- TLSH T154157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 930KB
- SHA256 3e1a50ffcea6a37a5850845d679b2d09cfaf39360ccf1f998e74bc02b944eb1f
- MD5 321263cd2be7e19feb756858c60a33f5
- SHA1 7b9dd2164a96427ad4aaca8459030d5d70b4a236
- SHA512 1130724906af8a2f17b41f9e4a456d0dc7ff6971c62f37304724e2436420a47e97435ce6a455f12f3547defda6ee910dad12b3324b306a9a6f09a8cc1aadaeef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahga+:A3k03kB56r8
- TLSH T114157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 930KB
- SHA256 c91d00e752f4cd50bc58567e6d969b47050d3c64e7329edcb84703688f74ca36
- MD5 da9fa0c1718f333712227df2d30ed7b7
- SHA1 a3db643984bc3fad35ab0521c19e19420afc2284
- SHA512 e3d77863fa11cbfea18e9793fa888a2b625878b7ea8f14ae28a1aa81bb623433780de23407f73883f8a29d2d86b1aa16c0883a1dd079825bf49778091dee3c9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgaQ:A3k03kB56rU
- TLSH T1CA157B03E6840FA5D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 930KB
- SHA256 3983192f4598cea2b72fced770efc2091da1421a6357f5867837497a174ee20f
- MD5 9390d4594366133dfb52ba788ab1fbba
- SHA1 776dfdb5a8b13292ebd2ebbe55dfcf316907f999
- SHA512 28e7311867c2af2e82ec9d2a38d8b66b85c4b786bf83cf97dff7665543e7b4a87b661a373dd1645c5cea5cf181acf48e39d8e0c61c02205ff71bbf2380f3e6c2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgrX:A3k03kB56rU
- TLSH T1CE157B13E6840FA4D10F81749A964662EA777C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 930KB
- SHA256 afc0ff309297c80d142cddd6e1d60e7ce10548804ed86ecf7f968ff92ab2df08
- MD5 d3022b3c9af9e7442a70798ffb651044
- SHA1 aee2d152657134fc5ca703a51afa373d6ac7d86b
- SHA512 9cc23aaa43c99f0b0f8467a921962e27acf123716e9fee7e44b3b53cb0becdcfc03b6132952eb59a2929a32ef244d7803b167679c37a72ee7d2e79992fe01048
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg5L:A3k03kB56ru
- TLSH T170157B03E6940FA4D10F81749A964662EA737C025F6097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 930KB
- SHA256 c7b51dc651c25d3965961dee649892987ce5558319030c278f12e4035eeed465
- MD5 eeccf442242308d1d0d2c2a77f580642
- SHA1 77ed5c2d98b64bc51913764d6df067909be2180a
- SHA512 fe3db264ff5ce98375b0cc1045f0a018981f95c3292240e89a1ee7c6c0ec3fc25d43365327f6a1b7687cdae2f53039552a422582316f9f8bab3e7bdeeb35a28b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgnM:A3k03kB56rb
- TLSH T11D157B13E6840FA5D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 930KB
- SHA256 961f643d5e27df158ff8f5357b39fe7c667e1f2e1be3801bbdcb11d315dd0c29
- MD5 ffea047c8f4245e51bdbe8b171761cbc
- SHA1 f1fbfecf98eb108e053338623c08dd28acee6f29
- SHA512 a996cf04f07a9974b2647b8f33ec07d0f72d848b43e85d7baa87e20289f16fad079a388a4f9dc281900e4ca229772b7e4568b0da86c4eb90d0b28e6fc3b2d123
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgQh:A3k03kB56rV
- TLSH T169157B13E6940FA4D10F81749A964662EA737C025F2097DF2358AE153F72BD0AB3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 961KB
- SHA256 3276a2754fc0c4a4578a116598ca19603e669a501cfd52d00a4ad0f0bb269d80
- MD5 f1ff50adcff1bfea9db9a41264c2d6e3
- SHA1 aa1b2817728265c216bcbace982a97db4ac24b43
- SHA512 7904ba20aad66512fa142e16e13c649c8410bd53cb8562b3349346a8a4e6c6045e2d03dc901bc5f8cdf5d0936e7ec36d6f2ca6d31ad626969d99b8fe46c08aff
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgS2+:A3k03kB56rO+
- TLSH T191257B03E6940FA5D10F81749A958A72EA777C461F2093DF1354AE253F72BC0AB3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 967KB
- SHA256 13c111d238fc40225ed337be51af802087e1cfe826d4bf7f3765909862fa1fe7
- MD5 0e39cb846c5dbb947cfed96ee9666e2a
- SHA1 5ac8c7000a5355fdee79b56bc0a2e237c7ef62e7
- SHA512 d30f39f42c44ff0247f0777cef71a38c913a170c402bfaa81911d53c7e2a54dd55c1adb082c11b07c0407624eaae743b828e29d65c19a6dc0672a9ae02505bf3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahgN:A3k03kB56r2
- TLSH T18B253913E6440FA4D10F913096994662E673BC0A1F2097DB177CAE253F36BB07A3D66B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Package Cache\{4d8dcf8c-a72a-43e1-9833-c12724db736e}\VC_redist.x86.exe$
- Size 1.5MB
- SHA256 b5487653cc62ef829e8d45fbc96e6be60de63a2448458b9e27fe2c74a3838075
- MD5 5e7bba974e6e5c20214b31ae258a4985
- SHA1 099d8db362f82f406431bdfefc7e6718eb8f502a
- SHA512 6ee84cd4a33eb08e6d6b13b8876396a7278cd64f1dffcade84a5fb84497c6739feb772c08e29b36138c814333cae8096bc2411f7172f8dd7e4c0a3fd26cfb8ac
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdCKaEBiXKahg5MysZgjS1hqgSC/izGfU2JGV:A3k03kB56rcRjvQo0nGH1
- TLSH T166759D22E6900A65D2AF4172AA989231EE3BBD141F2087DF53D4ED183F756C06B7B347
- MD5 SHA1 SHA512 SSDEEP TLSH