Analysis
- max time kernel
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 21:28
Behavioral task
behavioral1
Sample
2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260629-en
windows11-ltsc_2024-x64
12 signatures
150 seconds
General
- Target 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 924KB
- Sample260629-1bejhagy2k
- SHA256 fa4e57e7b97758fc6fd13730f0039e2b5dc4d61976fefab004ee810b31890df4
- MD5 7ec6702d65b9a22c1efe76cc87c13113
- SHA1 15ccc71f835e47e292f240fa2e407a0905934e52
- SHA512 516b0e99363bff69c5f8e1bd374b7fa97e0f51c6885f565e5e353e447ed326060834a992f94c755eea3a48b2216afc505801b474bb73aa0cfbbdbca0e7acffb3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLao6:A3k03kB56rs
- TLSH T1E7157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 46 IoCs
resource yara_rule behavioral2/memory/2600-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c587-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2b0-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/2600-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2cd-40.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5040-41-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c88-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001984b-228.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-229.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-248.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-249.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0013000000018a5d-262.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-281.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-314.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-344.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e4-370.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-401.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-426.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-481.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-512.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-579.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-616.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-641.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-732.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-752.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-796.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f0-809.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f1-840.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f2-871.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f3-890.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-909.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-910.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f7-929.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f8-948.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f9-968.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fa-1000.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fb-1049.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fc-1068.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fd-1099.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198fe-1118.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ff-1155.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019904-1174.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019905-1193.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019906-1200.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0008000000018916-1489.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001891c-1544.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c587-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2b0-11.dat aspack_v212_v242 behavioral2/files/0x000300000001b2cd-40.dat aspack_v212_v242 behavioral2/files/0x0003000000019c88-60.dat aspack_v212_v242 behavioral2/files/0x000400000001984b-228.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-229.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-248.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-249.dat aspack_v212_v242 behavioral2/files/0x0013000000018a5d-262.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-281.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-314.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-344.dat aspack_v212_v242 behavioral2/files/0x00030000000198e4-370.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-401.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-426.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-481.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-512.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-579.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-616.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-641.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-732.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-752.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-796.dat aspack_v212_v242 behavioral2/files/0x00030000000198f0-809.dat aspack_v212_v242 behavioral2/files/0x00030000000198f1-840.dat aspack_v212_v242 behavioral2/files/0x00030000000198f2-871.dat aspack_v212_v242 behavioral2/files/0x00030000000198f3-890.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-909.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-910.dat aspack_v212_v242 behavioral2/files/0x00030000000198f7-929.dat aspack_v212_v242 behavioral2/files/0x00030000000198f8-948.dat aspack_v212_v242 behavioral2/files/0x00030000000198f9-968.dat aspack_v212_v242 behavioral2/files/0x00030000000198fa-1000.dat aspack_v212_v242 behavioral2/files/0x00030000000198fb-1049.dat aspack_v212_v242 behavioral2/files/0x00030000000198fc-1068.dat aspack_v212_v242 behavioral2/files/0x00030000000198fd-1099.dat aspack_v212_v242 behavioral2/files/0x00030000000198fe-1118.dat aspack_v212_v242 behavioral2/files/0x00030000000198ff-1155.dat aspack_v212_v242 behavioral2/files/0x0003000000019904-1174.dat aspack_v212_v242 behavioral2/files/0x0003000000019905-1193.dat aspack_v212_v242 behavioral2/files/0x0003000000019906-1200.dat aspack_v212_v242 behavioral2/files/0x0008000000018916-1489.dat aspack_v212_v242 behavioral2/files/0x000800000001891c-1544.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 5040 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Internet Explorer\ieinstal.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-040C-1000-0000000FF1CE}\misc.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\elevation_service.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\nmhproxy.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File opened for modification C:\Program Files\Internet Explorer\iexplore.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\7-Zip\7z.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javadoc.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedge_pwa_launcher.exe patcher.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{510D9819-2795-48C1-8558-59C0E4F7563B}\MicrosoftEdge_X64_139.0.3405.125.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ssvagent.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Source Engine\OSE.EXE 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\joticon.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateComRegisterShell64.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe patcher.exe File opened for modification C:\Program Files (x86)\Internet Explorer\iexplore.exe patcher.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe patcher.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe patcher.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\ink\TabTip32.exe patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe$ 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe$ patcher.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_64\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe File opened for modification C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe patcher.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2600 2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 5040 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-25_7ec6702d65b9a22c1efe76cc87c13113_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:2600
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5040
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 924KB
- SHA256 fa4e57e7b97758fc6fd13730f0039e2b5dc4d61976fefab004ee810b31890df4
- MD5 7ec6702d65b9a22c1efe76cc87c13113
- SHA1 15ccc71f835e47e292f240fa2e407a0905934e52
- SHA512 516b0e99363bff69c5f8e1bd374b7fa97e0f51c6885f565e5e353e447ed326060834a992f94c755eea3a48b2216afc505801b474bb73aa0cfbbdbca0e7acffb3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLao6:A3k03kB56rs
- TLSH T1E7157A03E6850FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe
- Size 953KB
- SHA256 cdefc4a8eea85ddf98d59d85c2f6c4a779dc01b5d6d5460df19a1de08ab7716f
- MD5 cd0268fb9fe65ec0d5024d52cd2864d2
- SHA1 42254f853a0b215f4b146d8a2102165414581526
- SHA512 6dc462c71581be61726a209e9f82cddce38bb3ff7997b068ec2f948c58bdd08724724d49025006b4ff277eff508478592aa51bfba4c6dc19460318b724ff88dd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoMP:A3k03kB56rw
- TLSH T101257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe
- Size 970KB
- SHA256 aa8bc4608112fcccde33424f7d58e41fb2bd12e2865fc06cca80a3f7ef680c6c
- MD5 fdccd05682354131eeb57c831fded714
- SHA1 df3373228afe095f523cb54122a26a79492e4461
- SHA512 8948f37e46119a932b5cdd90cb9a41a6449ce97c26f9e5f401853df9f5bebe64eacb342f2f713ecbf739e6fad9dd922972f3d09ad3c5ec795bc638ffa1a5fa4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaob0:A3k03kB56rZ0
- TLSH T1BF258B03E6950FA5D10FC1749A958662EA777C025F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 f2072287f2c3ab335c2b0f2b733e086317b5043679a13925f950dbbf303c9944
- MD5 534c715a1024e48e7d475d675c5aa1b6
- SHA1 f54ce9b6b1f351bc21461d44abdeed45ebb7fa7d
- SHA512 669870dc68cafc6f18dccaf211b6d2c49be5fd5b878a2c278c1779d600d19ac7f38859c5341276d8256aede25917aded1d028eb4dbb112265f9b549361f2c749
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoK0Le5ji0hmxNrM:A3k03kB56r0Pji0Aj
- TLSH T18D655A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 938KB
- SHA256 50cbc302e12b399989c08ed06c5c417c30a78055f04de7b0782591454378b451
- MD5 7dfae0a3b9d756859014e5f2b69ec878
- SHA1 448f69e752b83b90b49b26962a1060380496e0db
- SHA512 b30f329103f652014679314f515f7b37a9e3283f42eed0a5416067422bfdd7b310c1de9d2e505a598923d2b3ee9c78cd6216de97526ee378d8d89b8b960ef45c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoEa:A3k03kB56r
- TLSH T197157B13E6840FA5D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 972KB
- SHA256 c17d55ce51fbd2b09fbcf0958ff0c631dca4116f7384f463e61d614cfea36937
- MD5 1af7665c4ec6b1afb6654c67d782c754
- SHA1 23116502c47717fcb364b0dfe20ad920804e0ef4
- SHA512 8be7690a6d6afb22b9e65ccc36535584a449be6c6f2fc799e5e63ed654b0fd9675aea4cc863aee29b9bb96e13b76c3b78b5479211a6a010c3e4de5164fa7daec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoPb:A3k03kB56rdb
- TLSH T1B8257C03E6940FA5D10FC1749A958662EA777C425F2093DF2358AE153F72BC06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 947KB
- SHA256 84770107bf97a767b0620faaf7a4cd2806aaa05db7c97b8a6812a62d0d698178
- MD5 a93ff6afe0fa16e4495aa8cbcaaa4f52
- SHA1 f1abc4bb4b3daccf05ee74dc9d5d46f2177bd96e
- SHA512 19ebb7dbbec0214e1196aaa8523ad5db57ac7f3efabaefe87cc45bcecaee6db02dacd3718daa2fc046abd37300af0b50d2dd285c41ca2bbe4c9eea3fcabf6bf8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLao96:A3k03kB56ri
- TLSH T17A257B13E6840FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 947KB
- SHA256 4ae4510471ad5d7332ea11eb1a8044838d9871d59b08c70123ff3863cc599ec2
- MD5 4c385d47cc8596ac7d9ac4db1c2e5fb9
- SHA1 bbabce5e8b7e0fdb900b2983c33db3293c4c99ea
- SHA512 f990349877e9eea603ce16a88194e8138741a2600a5c4dbbac05db2ad030ec4d9a2388cb4003328fcdbe8d64b04b1e5e715a6d0408040196d8245dcc9703893a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoTN:A3k03kB56rL
- TLSH T1D5257B03E6850FA5D10F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 947KB
- SHA256 c97611e6559a630e89635a384959786c88958a644862c5b259e6bdaf1f280ba2
- MD5 33f0b91720b5f35eb9f9b3d7dcd30bcf
- SHA1 11bb842eb7a64e613ed3833a9d7185c235d0209d
- SHA512 bbc6815b42418ecab5cd76b7ad487796592a9fa7cc92a01955f96cc0010ebb583f9fbcaefbcdb89680ba5be3ed7da36e4c4f4ee1129ba94a36646cb8138af645
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaohf:A3k03kB56rP
- TLSH T184257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 947KB
- SHA256 d9681df7479effdac52f55aa5b54ebc4c73bcb4da4d1a8005bed6505c18ddb31
- MD5 9cf2f273f8c6ccada2a372b2a12e5026
- SHA1 aaa20773c6bc748fe879773709829b2c63bc9786
- SHA512 f0984b1535fe1eb7c94be40f82cca9fdee7f663ed9e5185fc6d3620a04a802ea01315c98e3f73965319e1bbd5c6b2ad8c2e5e0e181bac3c0c8ada938b06c2ca0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoDo:A3k03kB56rG
- TLSH T162257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 947KB
- SHA256 d14cbb4ad2f57f827421e001f747ed6bafb678e4974b75f3977be503116e370b
- MD5 04c7852590582e782f6014d09e2a8083
- SHA1 df235071464ca77390ea1c871d3ae0b927242ba9
- SHA512 594ff9f5f739bca3cc3b01d6aa679290a6af5b762156ee01c0a38c5e5e97daf2fd1b63e7c7293f0b70a3d5c528a50646e27c9ceca12b48d52ade7d7cad125a08
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLao3u:A3k03kB56rQ
- TLSH T165257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 947KB
- SHA256 6f29a68af77e30633a66d84c251877f7ab706f6330ffe46daa34aa40c391d30e
- MD5 b98a94368c9353abe58baf6389b3ba5b
- SHA1 229944656e413836f823ce40fb3fbaea54da3366
- SHA512 1a8ec9c941b8f1387673e966a97ca073919a09ed696b36f85b7c23ff0dbf2972ae097893700eb044f0305947f20d3f1199d5ec1cbcd462bb4377311507d1fc9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoF9:A3k03kB56rl
- TLSH T1B1257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 947KB
- SHA256 42ad7f556d06f836f7309b6eab642d607089a1769e4419b763813a923b6d0b31
- MD5 24fc6452ba5993b29f640e81b2e9deb8
- SHA1 8e828f537419e817fbae4e723f28e6790b0eb907
- SHA512 41316fdf4ed29f41eb81b12a763356720a97e7fbfa0bb042205634b57d238d044adc7ff1f1d24e99ac8de9c9b3d18e0f597b0bc153d93a70e2e3928fc5cdf36d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaohc:A3k03kB56rg
- TLSH T147257B13E6840FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 947KB
- SHA256 255a1b706265aea98d416da7fdf10a325c87d88a1d7d7e19b8e7eb04a4469363
- MD5 9c29c08f8ce4dc56c565a8db2922b5ea
- SHA1 c7329543f5a18ecb21944767c678f2b4e3f897c1
- SHA512 465eb9a68284a2ccc9fa31294e2e4b12f53863e906b9bdd20488aa08165470806d530f02eb5574c83cdcb9cce55f7b581fe2b3507bb5eeceb14df5d1f33cede6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoKp:A3k03kB56r2
- TLSH T1D6257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 947KB
- SHA256 16d92db106c441e2fcc731acccb640b47a8d72873315858206869882864d4550
- MD5 6d62a88e77d5acfa70a44d44aca81b61
- SHA1 d817fba2dabf6645e03338a9c61ede328f125429
- SHA512 dde8abdf00eda0bfccb480aa235a9ab09be429d93e9f10afae2091f8b849980fa627731d163f205b881ce3ab9ecae7ce4241849d0e74532ce4c5a7464c815ddf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaotN:A3k03kB56r5
- TLSH T178257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 947KB
- SHA256 184ff25202bd0c05784b98a307f99498338cd713b46ce2f8d88003a2dd8c7b31
- MD5 09bbad848edbec1e0a54a9859a98da7f
- SHA1 e7d7b53f04e1fea259440cc5c2a54f86ec1cbfd7
- SHA512 90870f01c0e2c7a94c2411f732c95115b3e20aa4ceabf31ef1fd158d1c6ddb3111288d4ab9858388b3e43fe793e6e12ec5fc2f0c15d3687ebc91258d8ec85293
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaofF:A3k03kB56rr
- TLSH T195257B03E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 947KB
- SHA256 b1f608e7a4293ff0603e4438ff85c397ab857f66e45377e9f0e2e1a47d581c8c
- MD5 12fa26ae4d27995a57c916ba16d49f0c
- SHA1 ee560dc93a52c987e882308bc5e1dcc6a1003f84
- SHA512 17f10dd5de590e1e9431d397082233411e1edc1811f8eada28083fc68866619663fed5146443d65957e0f5797e53fce34a778884bef9eeba314675ecc07b641b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoAC:A3k03kB56rH
- TLSH T11A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 947KB
- SHA256 c306afb3db33ff0793767da99e72074b6d58d8956eb1f5122d9a8b4e9fca44a0
- MD5 8d78f5b2791dc615af0617aba780b211
- SHA1 03a3ed67c661655c5dec34c1085c33bb85a13b8a
- SHA512 5d744a62deb2cf8c2c4dabb1321d304e6eb54d2b7fe0c6aa91bdaaeae87c29e42e7530671b3c493d4e9fb1df05894c3fb4f1ab8be783bcb2912a25bdf4a7332d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoTw:A3k03kB56ri
- TLSH T153257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 947KB
- SHA256 bfad16c853ef26bc38ffa76763396426bda681d89b5216c171bc0e0e44004ef0
- MD5 2700119cb2417a4d22f2c4b4ab46e967
- SHA1 e8a9d0ea59418233e24c6eeb4a263377ce690553
- SHA512 34f3e4d4db293dad28169eb83c0a59ba07988a8977e7b1218ba977848dd898aef3a0afa91b27a56e18aa51759d63f823811643f149cc3c4e2f02f2f4b2770bf3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoaT:A3k03kB56rS
- TLSH T1D3257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 947KB
- SHA256 8278adc651aece8022da459fb4914d436c05480f952e0dd87e8475eb5b8b2931
- MD5 0d140b41b224b8dbc60913bde1cf508b
- SHA1 74e17a9e85ceb20aba9c7fc48516809a37942227
- SHA512 8c334af12cee7790003db99becccd530dea9f7cd4d5832ded8d801f9c48cff67ee5b820bf7613c21b54453e5c0f9b18cbab3df81b689f69b2595c6b82756ed85
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLao6u:A3k03kB56rd
- TLSH T1E1257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 947KB
- SHA256 34345d25078e7324b174de394c723c88df6604005c56b045b71966beeab60370
- MD5 066ce5d85657184414b5710da1d10be2
- SHA1 9779111a05ceda741360bb27ceae446349daf2db
- SHA512 a55dd19315385ab8c04cfd84522ff3e43c5053ca5dc06cf240ba7e66d8850b502b3799e8104d03d92e32af79519e1b52412000e02255fadb0df67c3d3ca0c473
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoEb:A3k03kB56rs
- TLSH T178257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 947KB
- SHA256 d5d905e7ce3ed478ab8df9d53ed8087ade0824785cb6ce709006a3dfcfc96dfc
- MD5 f4434c95e7178413015e9caa61172b19
- SHA1 8a3fd5a7add8b97f5a3c648073d67f542a293943
- SHA512 82a7bab514f51ff33d63dd22eb53fea6d6dc598b888208335a5241d98b81e8db3fb14ed9642a85993278c6bfd8e69891503bad6d0858770fa6c2649378d54fd4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoKf:A3k03kB56rs
- TLSH T179257B13E6840FA5D10F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 947KB
- SHA256 3571b541e055b2a7211579d2730cbc94bed3fb455ce7c8fc3bbcaaff1c0ec0b4
- MD5 1597339a9558c5d7d9c4f9f63f226604
- SHA1 836bff90ea8fe8fedb5fef2e73c980b8312ea10b
- SHA512 2344e0bed88ac2d7826306dc41fef9171146ad87839ee922fca7189d657e54b009cbc8ec5c8f6f34da02d6f8c050bb89534a50ee1b28f5f7ccca89d81557e17c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoXK:A3k03kB56rc
- TLSH T1AB257B13E6840FA5D10F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 947KB
- SHA256 e493aea0f23a36d406224841f9b9fd3dc11d1477028593881114da3caae8b520
- MD5 24735d262dcb13ef4ca8ac510fb361a7
- SHA1 e08264a334335ad93cc35dd3eeedcd804f3f314a
- SHA512 95603da535dc2ac5119a6bcb23357151f440d52f9bf23456ac632ce78fe13a9eeefe7e8ca53c527125a454f6da9bc8b21083b8b222fe0e9a6d5b947491e055c1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaogk:A3k03kB56rl
- TLSH T15A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 947KB
- SHA256 db8403135382edfe0913726ff7f5fdddf6a9be504c9c360ac1d370ca73576b51
- MD5 7f6e01f2ebfc2c590ca2fbfcda65bf22
- SHA1 ea60a9666622a4ade194b15d878d48773f4bc4db
- SHA512 1339f1ef6fd787e36d7656a956b7ea18a75716cf996d71d43a77481f1da06567507d31ada4812cb0fa4be0b06dbd35e0d5e08fc1668f0a8f199f70c6b78d8d4e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoR0:A3k03kB56rY
- TLSH T18F257B13E6840FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 947KB
- SHA256 de7a0f0804ec5d96aa8938a90390b6a098ed4993f21544000f9b8b636d0f41b6
- MD5 38bdb8695bdf15cc0688ae3c0a8b03e6
- SHA1 5c3b73e07b0bb628cb785d5cb15023eb9d0fee6d
- SHA512 925b321d98e0c51c443d676beaf26eaafd46be783a72e89a600b599e3739a2dc0c2a2daceac7728bb922c26be509894c431ed2a264d1d195c52a1e211508ee9e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoEg:A3k03kB56r9
- TLSH T1A3257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 947KB
- SHA256 bf1d7a59ce0f9d4ecfefd85b929f2bd169f805afb087b5fc81940a4ebbf7cdd2
- MD5 a46150190f31d30191fd0c8809e034ce
- SHA1 a258dae3b3fcabf0a2312f7683b4c911376e284d
- SHA512 4acffcbdf2b784332e9a7078e707b9324d912758f74aded2a264413e1c5b05ba1c85b7869f9cf9912fe9b179ce988c223b52a1c767f5912708d4243244712de4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaohr:A3k03kB56r/
- TLSH T1C2257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 947KB
- SHA256 a306dba9aa49e9813c451a8bbc618b493b2e3f450479fbaa7e516f616b3dcfab
- MD5 9e4f9a8ee10f67014303a8ee329a9a2c
- SHA1 953c8ce7b85baed8d19dd636c1ac19db67897295
- SHA512 dc4b81602ef3a4a3e73095de0bb043bc9ca1dccec230ea7d1fdf5690dd850f2b99dbebf10dc9fa90d79070b5bb477201de7a69aa66edeffb98e9cfed509071a5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaojn:A3k03kB56r5
- TLSH T115257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 947KB
- SHA256 c169c7abd93a5e2b2c9363170b1c1b934c9d32bc391b2423721f46ba4c133516
- MD5 07513c4d4a3ac1afa37bf34b3693572b
- SHA1 3b45a57dba08536f05deb7f3e5de253b795e2718
- SHA512 aeab543e5bb06fe8d6d795a0291dbfd03167be32d697233070e67534b49a19008a45f9b6204545f4663dd2c964052e4df3848074d654821a4857bd7ff3bf7d6d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLao/x:A3k03kB56rX
- TLSH T1BC257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 947KB
- SHA256 9066d3786f04ae41852afccbf6aca5466ad21610d604a15b9c06be75a06d6b06
- MD5 74a62ed567c95352a74ce0da9b0377ab
- SHA1 0f315051c1577c0525dbf97fddb5f9d70d16bdb8
- SHA512 3a177995296c5fae591d500636fac598052201f4feb3192ac55c54ad3555d36c5837f161f984fc3e3a240893915772a01a7082b59e67c6604702b9ef13cd372f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaolA:A3k03kB56rY
- TLSH T19A257B13E6850FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 947KB
- SHA256 f1c102e236718121baa30c9669733ba82e9c761030ddf8e8530c73038a6ab3f1
- MD5 2601acfbcd771ec1b5a9f28bc519192e
- SHA1 7e135c7389424879795d3ccaea706581a8d55f44
- SHA512 64c4bd884143c0d9ba51a583ae57738547499d2e7c562174bc28e0e3d8479a30d9efc2a319f9e0d18fb454b5822794f9805a67aad23c60b5e1f3a41007217b5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoe9Q:A3k03kB56rB
- TLSH T112257B03E6850FA5D10F81749A954662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 947KB
- SHA256 a6921ed7d43dab1df66ee9ee0f65d7dd8fd89ecf9c7b2bbb5232a098b644575f
- MD5 7f97ee54c061aa266c757479e3185c95
- SHA1 afb9a014d861d052c5f8b17a88d4880f3b1a5aeb
- SHA512 26f19fcd39d5099170eacb21f48b183cf6a0b1fd7163c36e0408e78808331eae55c9c6173c4ebde4b66cb8f8376ec7a7427f0aa0f003d376573fc4cf617d92ce
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoL4:A3k03kB56rm
- TLSH T1D7257B13E6850FA5D10F81749A958662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 947KB
- SHA256 5dd80ccd98a4c86088c13369d2ac987b4f23b4e21d3a886e439fc6ae9efd1b42
- MD5 9b44f8a0434673a20d6734fe7b4582fb
- SHA1 fc8e0c8ac609556fb76ba4c862c508c18cc27c94
- SHA512 c1d2c81a4f11357d84010dadac14a64d8d18027ac1262e39294440e7d8f11225c51609e40b948432d1ebc6d17a8d066db0eb2ac8388fe63304c2427e878b113b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoCu:A3k03kB56r3
- TLSH T1C6257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 947KB
- SHA256 927019bd5c7a124b87312cd62f278d7f805b6beddbcd45a16619c1cb984fb5c3
- MD5 f300071368b4fa9132d89ac86f2e1556
- SHA1 48bf81326d40f8237d2b3e41c6d5abbf6aaf186e
- SHA512 8e3571febedda2668df34ef59a4878132aa33e4231d8697069eb66894d9a278f63ec3cef40a3047cc74f4c0edbbdc148a9618368eb79ebb115ea82cef80fa031
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoTj:A3k03kB56r5
- TLSH T18A257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 947KB
- SHA256 a9eb9cc6928d93d08cddd7a7cd4ac3c91b8bba9a5e775152cc698c25cd43274d
- MD5 fc9e94eaeb58ab7ae30f7debd8bcfb37
- SHA1 bb32adabf10826988b97130e13b071dace4e12dd
- SHA512 731535fbb065fae37e5eaeb91c9e7a711f161a9dc63a22cd1e226ba433b00ada4915bed80acb2c6a922bf49e5d5555606346cbe61ff706ad7295bd18a2b81fcc
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoeg:A3k03kB56rN
- TLSH T1DE257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 947KB
- SHA256 5e20d3b82a4925461092fa9f2ccf9e30d3e8eec159494ebc403a148c4a4f7df2
- MD5 5000ebfbfa34374539ca6e2b6988e7e7
- SHA1 dafc11d199b543868372664bbaed7c5022bad8b5
- SHA512 11a9dff26baca5354206d6f4d9044ccbb2fc13f4a048a0fa8aa0a9ed2df2757e998f0c71af77cf9f9834b90c336178cd90b687c073c16aaa8d5c7425646aaf5d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoRI:A3k03kB56rE
- TLSH T159257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 947KB
- SHA256 9e788c89e62b01101dd5cf2e56525355519cf687d6c530bfa6e337ff6a39b18e
- MD5 eb6bb1badcb6b2b55eb439ffae14271e
- SHA1 6cd8223778981b32f3adcf0eba88a4bb6a2805f4
- SHA512 0f3bdfc75e55cff4d40d096087fd9e1736cf70f5a780d2940b704e7e2f0d33423cb284a4e6e8a7be51418505096fe4a6bb16a5f88f951688d6e1f7782168b737
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoTo:A3k03kB56r2
- TLSH T1B0257B03E6850FA5D10F81749A958662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 947KB
- SHA256 12b11d541578d6e8d9ff8f16ad6f6c6d07082e878d2ba287dda27ef18d87984e
- MD5 97604d78012f3c810930cdf601f6d53c
- SHA1 03143344ecdc6dcf1ab7011db2ff009ab4c7b329
- SHA512 1eae8102edd6cdf1062d8d794b5b3efa589f79f4a90e4b73f0c7fad1a79264b0bb2e274c96e58da2513b66f0afc92d7786520e2a9f858ad1c213a298651299f3
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoY+:A3k03kB56rj
- TLSH T1FF257B13E6840FA5D10F81749A964662EA777C025F2093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 947KB
- SHA256 29b9bf62f84a6e226d3ef2459bd9687acf16e13a61abf40524bef80c2d75ef47
- MD5 0cfbd2d67a1cd31bd0779f14340ed1ff
- SHA1 db5285be480a7c462f5d543651351ec6de679f9b
- SHA512 b5ca065df8cfc60ae27843846125a9e7150b4ee6d38c8d37f49c09d0b01c4ff95953e47abd359ab32ad62c1490d3e9f239d7bcc0bf5f2849b0121a1a7aad43e6
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaowQ:A3k03kB56r3
- TLSH T19A257B03E6850FA5D10F81749A954662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 947KB
- SHA256 9c315b0c1bd3491eb59b2c0401461b2ec0c63e64d6cf07bd2219f3ed3094cb78
- MD5 6fd4bd5d8b8b2ae9a6a1d945c31f64e7
- SHA1 6c43a2a10661ae08f660e64f1d5e74f45d1d3945
- SHA512 1377983e1031cf4a9e658c43964ae88d6abefc7c325018765ea07ec056911a0a18aadb4ea130d22db1dd916338ad061b57379f71befd7cdaaeaeb50ba7bd9b6f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoZX:A3k03kB56rr
- TLSH T1BA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 947KB
- SHA256 1c9f94ad856fac2f32c95b5f156dbdf4606abe5c8ad0858cdf762947da8e87fe
- MD5 b66ecd0f7aee213bc3f7c59ca3502bb2
- SHA1 0874fa2eb4435c6bf324ab8436fde06c959fcab5
- SHA512 af10087901c931fc134ee92f897f072e2eb3312df198c2ac97a98e22f14ad4f7a65310141caf11332bb026a6d0a8a946d601127710ca4daff449abda309653c0
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaozL:A3k03kB56rl
- TLSH T1FB257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 947KB
- SHA256 fec6cc629646cbe8792793b4f8b2460c10b00ca64b2e820b96c7ceef2222f153
- MD5 bbded4a389b439bcd75c40b4351e07ab
- SHA1 4ab74ae06fc70b6182d2f3dcdc0017b93a85c07f
- SHA512 95479b6d445018b11809f4de37db136e594c9e04abfdc61875b204808e3ebe766c6cb98fd00deb9dad962442a53700a9700d2ef897adf7b7bdd22c073d092c4d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoZM:A3k03kB56rc
- TLSH T1B1257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 947KB
- SHA256 a20ce953feda2731fd4d3050205709f018cdeb0e4018176a56275653ebdef7c1
- MD5 71db4d696f0e5a372865f3c371c20bcb
- SHA1 ec33f72509ad6f6fdce686765f90efbd9ff054a5
- SHA512 302fa75fbbe6a01414d969a1b1b7c468b94dcaae0cd7c73cd7d0d99b1d780dcab1124fe0b5051c2723833dbf8e9234ee0fd0f3161d28f9675487c01be784b5db
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdocjPXcRLaoih:A3k03kB56rW
- TLSH T1EA257B03E6850FA5D10F81749A964662EA777C025F6093DF2358AE153F72BC06B3E39B
- MD5 SHA1 SHA512 SSDEEP TLSH