Analysis
- max time kernel
131s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 19:45
Behavioral task
behavioral1
Sample
2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 853KB
- Sample260628-ygf86scy21
- SHA256 2360e8c1222ba91a5686baf4feab9cb7c834cad1012d17fa69d4aa16d5bca614
- MD5 b1d7f1cf8c852f67f22d3c9e4db3d929
- SHA1 0aae2709941a29302339e15722c5a58942a135d8
- SHA512 7cdaf0382153a4508dbbc5e16fd51746b4a4580ea2cbaa1c63871e771f92295aafafa08801f885b550a937f3f3ee7381472f400c460bb7fd0f331f766668dbf4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea:A3k03kHRJ
- TLSH T1AB05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 52 IoCs
resource yara_rule behavioral2/memory/2600-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c51e-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2be-12.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2600-15-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/792-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2df-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c7d-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a52-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000019842-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d0-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00040000000189fd-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-295.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-320.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-345.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d8-370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-395.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-432.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-451.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-458.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-477.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-491.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-493.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-494.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-501.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-514.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-515.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-516.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-523.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-524.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-525.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-526.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-542.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-567.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-610.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-660.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-751.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-770.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-795.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-820.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-834.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-878.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a8eb-921.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001a3a2-1031.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001a4d3-1094.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000700000001ac2f-1155.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019dec-1350.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019de9-1396.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000c000000019de5-1422.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b0-1876.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c51e-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2be-12.dat aspack_v212_v242 behavioral2/files/0x000300000001b2df-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c7d-60.dat aspack_v212_v242 behavioral2/files/0x0005000000018a52-228.dat aspack_v212_v242 behavioral2/files/0x0004000000019842-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198d0-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-249.dat aspack_v212_v242 behavioral2/files/0x00040000000189fd-262.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-295.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-320.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-345.dat aspack_v212_v242 behavioral2/files/0x00030000000198d8-370.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-395.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-432.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-451.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-458.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-477.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-491.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-493.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-494.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-501.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-514.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-515.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-516.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-523.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-524.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-525.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-526.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-540.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-542.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-567.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-610.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-641.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-660.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-751.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-770.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-795.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-820.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-834.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-878.dat aspack_v212_v242 behavioral2/files/0x000300000001a8eb-921.dat aspack_v212_v242 behavioral2/files/0x000400000001a3a2-1031.dat aspack_v212_v242 behavioral2/files/0x000300000001a4d3-1094.dat aspack_v212_v242 behavioral2/files/0x000700000001ac2f-1155.dat aspack_v212_v242 behavioral2/files/0x0003000000019dec-1350.dat aspack_v212_v242 behavioral2/files/0x0003000000019de9-1396.dat aspack_v212_v242 behavioral2/files/0x000c000000019de5-1422.dat aspack_v212_v242 behavioral2/files/0x00020000000066b0-1876.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 792 patcher.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File created C:\Program Files\7-Zip\7zFM.exe patcher.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\schemagen.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\orbd.exe$ 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe patcher.exe File created C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ORGCHART.EXE patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_click_helper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7zG.exe patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe$ 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmprph.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\Installer\setup.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe$ 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmpnetwk.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PerfBoost.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\SCANPST.EXE 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe$ patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe patcher.exe File created C:\Program Files\7-Zip\7z.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe patcher.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe$ patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe$ 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2600 2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 792 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-28_b1d7f1cf8c852f67f22d3c9e4db3d929_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2600
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 853KB
- SHA256 2360e8c1222ba91a5686baf4feab9cb7c834cad1012d17fa69d4aa16d5bca614
- MD5 b1d7f1cf8c852f67f22d3c9e4db3d929
- SHA1 0aae2709941a29302339e15722c5a58942a135d8
- SHA512 7cdaf0382153a4508dbbc5e16fd51746b4a4580ea2cbaa1c63871e771f92295aafafa08801f885b550a937f3f3ee7381472f400c460bb7fd0f331f766668dbf4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea:A3k03kHRJ
- TLSH T1AB05AE13E79500E9D10AC1749AEA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 951KB
- SHA256 970497c191b4ab75acde0b0918e7ede6807c592be633311b7d8ef89abd944444
- MD5 2fb0ae5e10a17208d31187fe1a0fbf3a
- SHA1 431fa3970745344be1e04eaf6f89e9aee74de33a
- SHA512 898181c4000914c42de2caa194b9a55511415c3d5e84288cc69c4d201695c48802ac2efe46f86981244c90805614530bf8f751c18742389bdccc14b5400d6af1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea82MqDBxc:A3k03kHRJmMqlxc
- TLSH T10625AE03E79400E9D10AC1349AE69A32FB75BC52176097DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 f186d70a731c3371b42d3cfcfd93d19faa2040bff7a8e63945cc81a56362fe5e
- MD5 e154196e736ce9f4ff31599ac9380a06
- SHA1 93a53623a5de3afc489d3e151c2573840afa7e67
- SHA512 69e522ec0c93b41fe95b8d26163a4461d8c44f3aced91ae82b3b41f1495d5c05f7a0780af120126faeaadceeed5fceaee471a9559e2a714646a09c413e26d588
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaP0Le5ji0hmxNrM:A3k03kHRJMPji0Aj
- TLSH T195658C17F6A402B5D027C0B9C5D6966AFA7138821B3086CF1359C7283F67BE19B3A771
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 867KB
- SHA256 939cea9a7883c73b676b7d970b75fc8ff9e1c4ff3b178f5f39c6e3cb7c977e81
- MD5 7a0978587dcfe3f930d138410ef93d6b
- SHA1 2cacb249cb5deec1012b6c47a255c05c26bb5ade
- SHA512 f97c2b28e75ea7d1728dba8cc64d1a4a9b73762fe9825ec7ee6eb04a3e360f4a89793bd3b61cf8153729665b06858275004196b0aab1bb67146347ce6ee60ed0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaRa:A3k03kHRJ
- TLSH T17815AE13E79500E9D10AC1749AEA9A23FB757C52176093DF2358C6152F72BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 901KB
- SHA256 82f205232369384b5629a4e731bb9bc2087910c3728ef2b149396750a1d7ed12
- MD5 ba0d2e3e3bac7741ca100435e53c1f06
- SHA1 f4a64abfe28ad891415c977600a825626f6026ab
- SHA512 ead2b89ff27d96a0ce487314a2b376ac5aad9261037249b9aff78b3e8ecc7be734125a35e07ced4024912a6950cf8d83fa0668a0cf416a80cbd46adc1d62c965
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeayb:A3k03kHRJVb
- TLSH T123159E03E79500E9D10AC1749AE69A23FB75BC56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 876KB
- SHA256 f9b74b7b31b6272e2e3f16c6c59c77cf21a37baaf37a890a7a5a21424dbd2a74
- MD5 7ea552af581500f77e7facf8f3fb66df
- SHA1 b13da939066eee76ba7a41865aafa178bf9c3c11
- SHA512 cc0fff00c9330fe364aa1cd43565700f460a1ff95a51c8f297e103e597034320f7dcce497ee94c3912a6cfe1cf4406ad4a61221b9ec667e026a5e805ee927aea
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeao6:A3k03kHRJ6
- TLSH T10115AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 876KB
- SHA256 d7e6ebb399974b74c1a66f363e2ecd6dc795ef18f8c614529d5996b3089d1db7
- MD5 a5fe58a1d52d1f27529a8d3a57b47bd0
- SHA1 e00d71385b2a4bbed54568d38dd97376ba848446
- SHA512 d97831112f0254d0bca86ec718d3f3465ac48e73931b6a9f332212354531af5294ed9d6cb52c31f51b4ac101b142c25d4e91d3d3b05b68d7a2df8bfc41244358
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeasN:A3k03kHRJz
- TLSH T1DE15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 876KB
- SHA256 221de20532c753bb91ab7a49ec75ba0e527024061b9dcd2f720a47b32ae508a0
- MD5 c9ce3e6ec43984ae07beb7d7b2b062b9
- SHA1 997d986f3b5d4de0d9746f3e6f9ff14025c2d957
- SHA512 928041b8fba1e020ce04b7602801ffe83cc2bb957035757f1d5620cac3ffaa1861605bfd6781c280d4d29122dd7018d4016ce73694165ef934b5577f0f1ffeb4
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaif:A3k03kHRJX
- TLSH T14B15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 876KB
- SHA256 b32694eb83bedcb2459d628219cd277d6fd91ec7b05f0c40a139e7937c63a872
- MD5 b774e96ffd3ec84d0b65c4fda0cc5339
- SHA1 9f4762188d4f25cff4b20fe1249a2ec5ac110aa1
- SHA512 36b9c577686a7418043ad13468be1401e1dc75c0df9f6a0ee2277e732e3e2591a0c1a83d59c06d7032c79ab13ef3cecd610eae76ff57bc6776170aacc81bd30a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea8o:A3k03kHRJO
- TLSH T11015AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 876KB
- SHA256 a1899d995b8ed7660f2f9a13ca7531d010f247744c0be276994de524fd8bc011
- MD5 330d379b9e74c59b72c621f0a4450e18
- SHA1 70045ea7383e197de21bd0a8e249fcefccf27227
- SHA512 3cb64bce59a0878d0b232dd509985518d1ce966135506cf5d718e4bc7c111634e475232fe221024a24bc9571e922066a38ed93eaa555e202c175b11f83da9232
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeacu:A3k03kHRJo
- TLSH T16615AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 876KB
- SHA256 4a17078603cef5ba02716204bd87cc7e53d01557093b81498464f1bb16d320e7
- MD5 be721a3c43d658206e8bfc468c7f4ee5
- SHA1 5d325f62c017fb473b27033de23398c6bccf36d9
- SHA512 f1a73ca4a6bcc91e1e7b6940f0b2dfd58cb5314ef011254c039c6852fc3ac2974feeb170b087bd4d2cb15e5be5997d8b788617328c113f51abb0a0227dc91385
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeag9:A3k03kHRJ9
- TLSH T1DC15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 876KB
- SHA256 6d3d5e1966733ab90b1d360737cc99748ab699d87672968059c7c090e9762911
- MD5 5f66e7bed418e3d511cb4b66ee3d1281
- SHA1 50662a860ace37394f89b37b04da1ef6c3f96887
- SHA512 92f1b95bec3cacf7405401242bb9cb0514f6fe4153282c54afe072fd9cc75250f2f9a8eb60b3747a3af2e579beb5a20c1992695f9be38026631e9f0439b9e78f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaoc:A3k03kHRJo
- TLSH T1F415AE13EB9500E9D10AC1749ADA8A23FB757C56177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 876KB
- SHA256 efe858326986ff9676d8bd7b1c0379525c5b9ae7f51dc2f692678f8a6c14586d
- MD5 2f96e9aa4369426a379dce9f02fd0085
- SHA1 e7058fc5a8a008faba880c588860789600f13ee2
- SHA512 0c8526cafbbbe84cc5f7ce59bc72e63b1e2cabed27b0acf989408139d8aedc961cb20941e47cd95f02aec80ec57722cb113c00d01458424397d07ae90eb9dc45
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaBp:A3k03kHRJ+
- TLSH T16515AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 876KB
- SHA256 65c353323d18f2255f8fd7b294e8ef14841756be1e1a4e91fa9cabc0b1874c06
- MD5 cd9a1a97e2ae4b445948d94a82ce6dda
- SHA1 555e607ccf73b9b28c0ebef76fc3b4c5336bb3a5
- SHA512 415e3fce88ac306766d1d345e7c7c6003b83debbea6990661db2e4d2a3dd517e24f5708dc9cfaca51b45fb9ca5ed4943b4b6b3b2bfa89f6f50cb360ecd0ee061
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaWN:A3k03kHRJx
- TLSH T14515AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 876KB
- SHA256 bfe0956ebd48ea34a82e82931a5fa45c23b4f8788ed8dd72e1a51eece41d69a4
- MD5 057db647c5fe7349285e5513adf4057b
- SHA1 7a7add85de1181a7f49ec135ba262e3094c05b47
- SHA512 6b8b12bc78cef1b56e6e0cedf90c3154df4e27b1ffcecc42478013f1e4b78b71bc2c791982c53d5170f2eb04ea210ad6cf3ee02456721cf766c9cb4da2c5f468
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaaF:A3k03kHRJD
- TLSH T1A215AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 876KB
- SHA256 d031d559f7161208b4ff6bae93328df4fd39cc8ca1d8f5e9fc7fd9fcca2e0166
- MD5 daf51efbd14d3d9aa5ac0c8fa4ecddc0
- SHA1 0628c1e538a7170f9027c3b93db3499792cdce85
- SHA512 b159d90812f953309a4a16a094fc296f638ab95676cd8e6fa93d7693fc74b8fc5662a0113dd812ee188fb0d4ea25a737027e609beb7ce1dd969692fbae83acac
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeavC:A3k03kHRJ/
- TLSH T10D15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 876KB
- SHA256 24122771796f2a274a7b7da6145030bf6b8ff6c10a3e4bce36eb1838d158cbc3
- MD5 86007fe430d4b714878bb31091c25af8
- SHA1 1747aa30581542ed7769befa15353c909f109254
- SHA512 340624abc9d02f28d1bc9fb73bac490e6e374a5a0ce1ea9e38ef209be20293bdf49ce96c2968e86125f08b24f7169910cecd00db9bc59cd68eb3f723a70d744d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaQw:A3k03kHRJa
- TLSH T1BB15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 876KB
- SHA256 a6442224fd4c019c07eec4a80d9038f8e4e5a5a4d1873b0026ec6aa64f184c76
- MD5 941192f5053ebdac5548c59eccc49616
- SHA1 5ca76acaf5203cec80e730285242a0d06ae4d0b2
- SHA512 4d0851e99e61e5bf5bc896be8a3ece76a12617571fc895631fdaaf8d54755125f4d62775a15474554e65b624a6628034e066f8d31573e9440a9b65ac1583ea2d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeavT:A3k03kHRJK
- TLSH T12D15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 876KB
- SHA256 c3bbc8ec0033d7cd47daa45594fbdca88162de8ad20a96e299e79b07607222d2
- MD5 99f5cab57d8c5449d3eefe81b7f87509
- SHA1 9c2aeca1eeaa71a10d40b56afb3f6f98e42ae4e8
- SHA512 010d421e0185c4138e6cdd31c7b23338214262d21d1d88db53b7fa2ce540476ce7ef09c351513cf83b645f73867a1064d9eef03210f13de7176924990e4c0f03
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeapu:A3k03kHRJF
- TLSH T1CC15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 876KB
- SHA256 aea8646dcc9eb3344399d916df485f4b18c031ff8006ca1988244f8b94a39a80
- MD5 592ee2c5b8558988c432d10cfb36ea64
- SHA1 d3fb0a14a2f0edb5c5d9232751176aa81f2a47fa
- SHA512 b4cb276dd429bb37f23d90ff6b0f7488c054c1f2b602d613d22b0cc7fb39192108291592acade6d6cd03c39c515a6f7347d07691055359a4cd3e273b59051a0f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeahb:A3k03kHRJk
- TLSH T1F815AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 876KB
- SHA256 14ddf8cc17d03be07974e580bc055b00c001d4b33c002f7c395def47d52e7c70
- MD5 ad4abbb6f0a517c9e7dfcb25b05c49a7
- SHA1 9f79fc9dc5281c08ae681c47046e0f0faa5ed41e
- SHA512 1a0290f845395c841f523a75540675d0df0dc46e5dac5b2971ebf36f670f656c7aa9431b14f5c448e077baa124e0284cb692076f66448406e474abccce3d69e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeapf:A3k03kHRJ0
- TLSH T19115AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 876KB
- SHA256 6e0e2316b5140d58465aebc21d08d7a8a3d3be5d907dd5631c680442b225f2e8
- MD5 3cd095ae7c9db728cd2a2fe929d5d9ec
- SHA1 08202b3cee291ba8a91a78e94bd97c630bb48ec7
- SHA512 5df9aca931b9887bd3747e22a212b4df46683b75dc6a79f5fef06605703ad28c7489b4765800fe376952f76ce4c5cf5a931c677ba191a2356b67bbc5415a10e1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaSK:A3k03kHRJk
- TLSH T11515AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 876KB
- SHA256 654f89c8b0c3597d51b03ea3cf14c626cb58670b954dba65bc1f2df2907fa738
- MD5 fe05ec8273b33e507a1ac3ea4a5027ef
- SHA1 adefbafeaf493067f313ffcfed21e91617af095c
- SHA512 4e049e94490277ed4eccb7a50cfdc084d9ad7ea42de387750779245a926dcfcf516f684a4e0f03b55b0068715c5828fc14340c64d0edd4890e99a2cfea67f383
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea3k:A3k03kHRJ9
- TLSH T17215AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 876KB
- SHA256 1cdb61b3502ff5a9e1818c57d79027e99e5591a0e6e7976a7e8a3e53110211df
- MD5 a3d48501e8962788f77194b0246668c1
- SHA1 99088bf7d04074c45990de0de8e235992025957f
- SHA512 3c7220bfb256ce656929fd97ae651e455e428b67094996394f8b776844a83a062a365100c7b168fb342c85f7f7a2b8cd56a84e267da359aabfbdf85b5af7d380
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaA0:A3k03kHRJA
- TLSH T11D15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 876KB
- SHA256 41799231d1eec4b30d6f4c857b769a76894def459a06d3e271703018894b0a93
- MD5 b518f9fdd389735d5bf356f6aa0bc617
- SHA1 4e5298fa2c378b7d7b8c20e8f6c85b298d6d563c
- SHA512 767a88072f121cc279d093768704beffb005afea8001a729a7b6f2172568f7e23d042dbb1ee1210e62344b2149d14a674df47a76d9657312e2daeb6835b13271
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeabg:A3k03kHRJ1
- TLSH T1EB15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 876KB
- SHA256 1b8d363d9c41b14ddf153aa63f9763fd765a16edd573917127575af289a9e60e
- MD5 444b13c5177c7551b376254328172ed7
- SHA1 a5c61bacf090201ba80a35fd599ab12757bd14fa
- SHA512 93451d65f7c54a689f0360d2ea359ca81dd3a1d74701af39ce3d5b311c2a9cdc2c913046b1fc322a153e05b7c69da88d196cf542c1fb85e697294c3f3dab3ff0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaWr:A3k03kHRJ3
- TLSH T18315AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 876KB
- SHA256 8bccf64b544ac6c64f04801b446d37da3b40eed43f4ca77c1aa434e41a69fa7f
- MD5 d192ae25edd112eeab172976b5de370f
- SHA1 1659c4d769fb62eb89c57829498643afa6e3d959
- SHA512 25418aaa2ef70bb4fae985c51352948acef07d756e912abd35e3dcfbfa101c5f769b74d00da0f8314947e0d50bb1a0d31ff11735c729df336072a6117429446d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea8n:A3k03kHRJB
- TLSH T1DB15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 876KB
- SHA256 0ea4c91ab67f7a27ce9426a81784949c51465e1a95d203a7b1c983dca1f8558a
- MD5 b8127d268df756b69fcc78163d5d2a27
- SHA1 707cf254dcc61b5f837c902631bdb8aa4cfa8cce
- SHA512 1d01f92877be01583d43198ea252890a730f258fbd0224ec0b383a21ab58ac18cdc2e3c55579e93f4339ef547b6a8bb8af811967c031ecbdd0a5d0b03c5bb7d7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea6x:A3k03kHRJv
- TLSH T11F15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 876KB
- SHA256 7405ae9a16f4526da405fbe82bc1e849de1551de84018e3e0a1d9ae65e73b7b9
- MD5 55dff300488bfefa296fd8b3648a0da9
- SHA1 b6c42e31141f8ad308acb2bbfd10ae306c4f5b5c
- SHA512 b9774cef53b92df76e10868f8d76cc9f1faefad18fd11f49b30164118f30cca584a9c0d8d68c0bb54ea47579d9987656bb78350784cdc129fcbe2c3c0a964e85
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea8A:A3k03kHRJw
- TLSH T12915AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 876KB
- SHA256 cf4cfad5b2826b12f311e717ebb8950419841a14fbe490c14026c6520514cf43
- MD5 e230c57c06da1182d8158d2ef63c27ad
- SHA1 aab7d43736e8d2e531ad07551da21cf2d2789e6e
- SHA512 efc6bc4bdc477d24c8a8ec83a5a129c5d9673727d5381644cdd51272f742eb4c953bc252892a73b3135c664fa73aaf822bacff3ffa14a53d2441958e6a0b9c5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeal9Q:A3k03kHRJJ
- TLSH T10E15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 876KB
- SHA256 a0d1ccbf8f4671cff2c98c0fc5c389ad3c9f1ea76673b8aeb3b6e83e880b362c
- MD5 9a9e90683fbb66e5a6f6daae2620a917
- SHA1 46fca673b120c52fc90f3c73c935f8ab08955a49
- SHA512 1b17fb12d08ae6b3fe1debf1142d16e7e5141fed9c88008ecbb3b3ee580f2b8dbf3587b2efc8953b51ffc21ede7eea38b548fa37d12e740bda0210ca429912a7
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaQ4:A3k03kHRJe
- TLSH T1D215AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 876KB
- SHA256 07f2f145b44bc2e613cbeeb0812396649f9b6ebd3d154ac99f34fe69a229dbae
- MD5 1dc07735afae82bab6242c868ea8731e
- SHA1 f1650fb5fb9d8a2067ca05e96fedcf4093d5f33e
- SHA512 8cf1fc08708f7e9186f34f20172f11545893481b487b5f8e9f3ab941c4a7d712002c2a199fe9cae8728e2809007b5cc669787e033249783b29a2d6648bafd801
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaTu:A3k03kHRJ/
- TLSH T1A315AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 876KB
- SHA256 c5c224264718090751765073b9a27184d933f82c4f9dac740f99187f90372621
- MD5 721af9bfc05bb587e7c841293af88c6d
- SHA1 062ccc77356b5e5a44f77450fdce942aea502186
- SHA512 6a152c0905dcf0be01aeaf29887d126462140abf3c58157ea619238629c7c972d9ea28eebaab8c8b28c86fb415ba6110ecf4dbcc5ce30306f784c77a9d1d9d70
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaOj:A3k03kHRJh
- TLSH T15715AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 876KB
- SHA256 1557621e5f0aa07fc0e8f07d7092682026a581e896a4cbf30ffd30ce2b758aeb
- MD5 2a3fa4b16d4250c940cdd86bd95ca36b
- SHA1 7e5ed7139217f83904bbacec7850ab155bf02bc7
- SHA512 9d388f225b95e6ef94a8f5add00d662b60d0eeac026ea82f5fb31a68448e11cf642292b99cc3445ff2de9522e6ae0540509074b10e1d1e786456a315f08a1c4c
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea7g:A3k03kHRJl
- TLSH T1D515AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 876KB
- SHA256 950d33a3f71d5f4b163aed140d9a54222ac565c28c010eec8f510bdcf2d45ad5
- MD5 e191b566957a79e4cfd2547f956f543e
- SHA1 66af560bf3465bfffc4b9686cec72aa56d2e39d0
- SHA512 4afc39ec0bf7f1eecd0333102d6c68fa614141ab244196e12a2655415404f3598b7ab729a6601c2721d7f13749b3dc438e85d0cd240000132436555198941b3d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeamI:A3k03kHRJM
- TLSH T1DC15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 876KB
- SHA256 42db73f1f7beb12c48c505ce17673d099e69578fc657054e76d1dc8d555e8e05
- MD5 112ec26c679a96c0d600c439cbb9659b
- SHA1 aeb005b04e2a1658bef0ef3cc7b3eefb08e1b7b9
- SHA512 52c43ceac3c6a3068ef2e10a73306ccf8a05e2bdeaea7197dc389aa94b7317ac60e29da8800e89321b354650b6f6b8274c0d16e6a75b49f9385af2a86943b903
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaUo:A3k03kHRJO
- TLSH T1F515AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 876KB
- SHA256 93f3ab0d31ec09011b3cab74472e2e5ae0f018e28823b5b5256b1bc11c25e5a0
- MD5 f74790c38f3d31482e539460c1fc2444
- SHA1 4aec20438f5bfca56c140cd79018f2597ed67517
- SHA512 f4609744631bb329951b81e580116e43913729fe1eefac29d68f852967fff8cf6e1ea3d3039ff99e2a57861b1bde631affac550b6e8ed7040cc2c5d7766167f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNea3+:A3k03kHRJb
- TLSH T1C515AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 876KB
- SHA256 c8d0575a2ca409effb9f75464494abea4864a5abe08bb0a3f0a3ab42f775dec6
- MD5 d2fceae6b867b23c8ed5b48608948962
- SHA1 3101d76542a062b419c148566cfa9b6c9e0b707d
- SHA512 da9cd17b5280cd199c8d81b510ccf4dd434a795a3f1fea34649dc38b95cd147d424564b86f3f65bbbec391d08305e9a7c4e64a777e74cbd941ed25dfe628f27a
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaNQ:A3k03kHRJf
- TLSH T1E215AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 876KB
- SHA256 2438ccf4469b170f873078eff6f866a63b679f311d4ca23b69abddfac66e7ad7
- MD5 3e621656169c4471e2522881bddba44e
- SHA1 c818d8e9de915f301ea23bcee1f34eca6d0deeeb
- SHA512 778ff6f3c5ee36ae2dfb086917ebffe4e661edc5cd1843829f1c5d738194fbd87f6b0d1f1fb022bfa7b13ff33880d7bcaae799ca42197c159320de422f66f5bd
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaCX:A3k03kHRJz
- TLSH T11715AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 876KB
- SHA256 23ba31a56699868ad7b2d32779d999afd1603dfc0af7363fb015b3a9e0bde9ee
- MD5 535b534b5f31aa0d51ec7a01aa9e7659
- SHA1 9c141fd7efa0d0cc1e438c104eb51a9f5780b015
- SHA512 8a85c420da7c71f03db3a9363407d3a36593d027a5fa040df77d83473a917587a09deb3cf1528ea58a71b2affd28b8aa5044ca999f7c847b0411e5cf559692a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeakL:A3k03kHRJ9
- TLSH T1F915AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 876KB
- SHA256 2991ee2dfda384ec8cf97161f6bbdbeb6c681d2682798626811d94993cfb26d8
- MD5 178919df7b395c60252abf4756634bc0
- SHA1 c6a1f25238e666bba51a1c26afceb33fcf34a2a7
- SHA512 49334d45075dd8a745e8e241a88ffb284667a7d5df9c10b2c73564aa35f94f208a80c257e6d4a1ef4c7685ce1f9ba428460d2c00ba2c29fb4ac8c7a91d5ee0bb
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaAM:A3k03kHRJE
- TLSH T1AB15AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 876KB
- SHA256 c6aa2e5542f2060e56dd516462f682e3d46a00c1c24d6be99226d1787ae3268b
- MD5 44061f8656fdcd7202f03381a6719405
- SHA1 3358227c96409e137dc6a40171852293f50b994a
- SHA512 8e9671ac898cf0fad0b8d020e6b312a5af62e96736da7619ecd7f7cb3db3182c704cef2b311adc92bd16703d8b304c034e41250a33c97ce784a22a4f15b590bc
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeahh:A3k03kHRJ+
- TLSH T11915AE13EB9500E9D10AC1749ADA8A23FB757C56176093DF2358C6152F62BD0BF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe
- Size 886KB
- SHA256 4fffaee5b163c83f43390211c4ba8d28d75ff96c10d75e5213b945a545619a4f
- MD5 e4f0d527dc5e52bc442af343914a0178
- SHA1 b9cb3c11d555203512461bd6b336986f335f5a82
- SHA512 6677ea2c1beff4f7fafa9aaf63a27a90659d467699c34025b8663ee79ce2d888879f22099474dfdfcdd07c9def1429edd136a3487e84967ad6287b23edaf363d
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaO1:A3k03kHRJ91
- TLSH T1A815AE13EB9500E9D10AC1749ADA9A23FB757C52177093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE
- Size 929KB
- SHA256 b905b0f82271cc64749fa816aa3779fd1642580ddac5c65c282cddde609a3c17
- MD5 260d9634384e810c77baa24712e191bd
- SHA1 11f32b10a10af9772023808bf00453cc76d2dd89
- SHA512 cf44679da59ec93f6debdb998dd3629ba0ea2b6eb74a6ea093d72439627ecf85dea4a30b9faaed31e2cf06e73c92d772a91c7943aa3f2c1748a7142c22c387d3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaAkUl:A3k03kHRJN
- TLSH T1BE158C03E79400E8D54AC1749A969A32FB75BC521760E2DF2368F2152F72BD06F3E7A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe
- Size 897KB
- SHA256 df1010cd6426aa4aca00eb3fd1349134944f85e0f2be5e04c69eacce4c0548f2
- MD5 fe8c39eda2cd752705c9184b3c215465
- SHA1 a32a2d0b209267f4011084384723d031a874e415
- SHA512 afc2f6b6788cc6d1b74e9b1c9733ac071dff8128576a0b711ad6aafa9e535999e7269bd7868dc7f4a60a4033c32e2eb75e802ed05402f9102e00afc3abc08986
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaSwE:A3k03kHRJZ
- TLSH T16615AE13E79500E9D10AC1749AE69A33FB75BC52176093DF2358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\Office16\msotd.exe
- Size 909KB
- SHA256 2eb4ecdf7c3f5e256562203cc8faf2220d0427c27c6c13f10d1d6814a82be360
- MD5 9662db05ac6067e8ce36ef9634c4e10c
- SHA1 fef3a9a6b382063c8800efa81efd219368d33a84
- SHA512 77e8073942e5dc56da7e39617b4d5dd1abab109ec7a03ca2604c492e5a8487ef07d44357c7cbe72dad242dd22cf38d8f6c2c4768c2dbec66f09556c18f5a32c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeajglV:A3k03kHRJh
- TLSH T1A5159D03EB9404E5D10AC17496969A22EB75BC5A176093DF237CCA152F62BF07F3E3A4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe
- Size 908KB
- SHA256 450c0b029ceec4ac401fd1705a87e316ca9e117fbad64284ea253b01ef61abee
- MD5 8644d0cb998a44fa4368602efc62da31
- SHA1 405e3143f0a38377042a73906afb5ba478b00def
- SHA512 d04307334d54fe6d448403090f359807d8e3dcd237154815b334577695eda7b61d63e8f05482cd26946fbcea6e66816b80573d05ff9acd1ab8b51b74f60a3b5f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaB2+:A3k03kHRJb+
- TLSH T17D15AE03EB9500E9D10AC17496DA9A33FB75BC56172093DF6358C6152F62BD0AF3E3A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe
- Size 914KB
- SHA256 b3971bfb3470e94ba69d7228020fee39414f473691bbfe8c82238725bb803542
- MD5 39aced81e99c7056e55147e70d49c57a
- SHA1 5170ac222eccc52074a5301586c7b8d8d278366b
- SHA512 dc541b7e2fd1488aa72de87ef906b8978e476cfaccbe06a3d84a27d0d2f31b8db205b02f9952fe79bf68fb5baebc4a040013ed73f9b35b612789e5ac98b69f1f
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaE:A3k03kHRJl
- TLSH T1F0157B23EA9404E4D10A9130569E9622EB35FC4A176093DF277CCE152F66BF07B3D7A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe
- Size 932KB
- SHA256 bcfccdcbb8de0d3c398eec3b14a047e0dffb58909fd4f71bf0952645d93d5e05
- MD5 e98ad43223a0fb0baa29ec116d848f04
- SHA1 8062bc8fedccbf8dc174ac3b2ab96266ac6dfe71
- SHA512 02c092cd1369b860b228da95e0dee72d863a751c5d03665d7f68f8c93b69bd71af4a734194a18ba52cbbf8e2266c4de138cde7f13a834d6c2659f6ef2cd768e3
- SSDEEP 24576:A3mnXoZ643mnXoZ6i6cMJliLabaonGEiFNeaLF:A3k03kHRJk
- TLSH T107159E03E6D500E5D64A8130DE9A8A22FA35BD921B2096EF2358F7152F727D07F3E794
- MD5 SHA1 SHA512 SSDEEP TLSH