Analysis
- max time kernel
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/06/2026, 10:59
Behavioral task
behavioral1
Sample
2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
Resource
win11ltsc2024-20260617-en
windows11-ltsc_2024-x64
11 signatures
150 seconds
General
- Target 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe
- Size 877KB
- Sample260629-m3twlsdv4l
- SHA256 3f065162f413c17efebb1db38fc81127704a0a4ca67d0d08663ad16175cb2c29
- MD5 f6e223ba8ad7decdf5b177243f0770c8
- SHA1 4e3b14a1ea9a459770da0d5e11091950fe09d809
- SHA512 f3c2fdef6619b9163454400f7437eff9821a85d63451153d02722ee057cefeb8694c0013ab05cd7798e7db1f74416e5ecbd987664c2b98ef12700e947f2139b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6o:A3k03kB56r1
- TLSH T1E3156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 49 IoCs
resource yara_rule behavioral2/memory/1440-0-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c563-5.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000300000001b2e4-11.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/1440-21-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/memory/972-22-0x0000000000400000-0x000000000040F000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000200000001b2fb-41.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000019c77-60.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018972-204.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a19-211.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0005000000018a4f-230.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000400000001983c-232.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cc-252.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198cd-271.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0004000000018a4c-410.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d1-483.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d2-508.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d3-587.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d4-618.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d5-637.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d6-728.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d7-747.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198d9-773.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198da-799.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198db-812.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dc-855.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198dd-880.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198de-899.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198df-906.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e0-919.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e1-932.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e2-945.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e3-965.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e5-1003.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e6-1052.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e7-1065.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e8-1096.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198e9-1109.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ea-1146.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198eb-1165.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ec-1184.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ed-1197.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ee-1212.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198ef-1308.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f4-1340.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f5-1359.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00030000000198f6-1384.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x0003000000018914-1497.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000800000001891c-1540.dat INDICATOR_EXE_Packed_ASPack behavioral2/files/0x00020000000066b1-1874.dat INDICATOR_EXE_Packed_ASPack -
resource yara_rule behavioral2/files/0x000d00000001c563-5.dat aspack_v212_v242 behavioral2/files/0x000300000001b2e4-11.dat aspack_v212_v242 behavioral2/files/0x000200000001b2fb-41.dat aspack_v212_v242 behavioral2/files/0x0003000000019c77-60.dat aspack_v212_v242 behavioral2/files/0x0004000000018972-204.dat aspack_v212_v242 behavioral2/files/0x0004000000018a19-211.dat aspack_v212_v242 behavioral2/files/0x0005000000018a4f-230.dat aspack_v212_v242 behavioral2/files/0x000400000001983c-232.dat aspack_v212_v242 behavioral2/files/0x00030000000198cc-252.dat aspack_v212_v242 behavioral2/files/0x00030000000198cd-271.dat aspack_v212_v242 behavioral2/files/0x0004000000018a4c-410.dat aspack_v212_v242 behavioral2/files/0x00030000000198d1-483.dat aspack_v212_v242 behavioral2/files/0x00030000000198d2-508.dat aspack_v212_v242 behavioral2/files/0x00030000000198d3-587.dat aspack_v212_v242 behavioral2/files/0x00030000000198d4-618.dat aspack_v212_v242 behavioral2/files/0x00030000000198d5-637.dat aspack_v212_v242 behavioral2/files/0x00030000000198d6-728.dat aspack_v212_v242 behavioral2/files/0x00030000000198d7-747.dat aspack_v212_v242 behavioral2/files/0x00030000000198d9-773.dat aspack_v212_v242 behavioral2/files/0x00030000000198da-799.dat aspack_v212_v242 behavioral2/files/0x00030000000198db-812.dat aspack_v212_v242 behavioral2/files/0x00030000000198dc-855.dat aspack_v212_v242 behavioral2/files/0x00030000000198dd-880.dat aspack_v212_v242 behavioral2/files/0x00030000000198de-899.dat aspack_v212_v242 behavioral2/files/0x00030000000198df-906.dat aspack_v212_v242 behavioral2/files/0x00030000000198e0-919.dat aspack_v212_v242 behavioral2/files/0x00030000000198e1-932.dat aspack_v212_v242 behavioral2/files/0x00030000000198e2-945.dat aspack_v212_v242 behavioral2/files/0x00030000000198e3-965.dat aspack_v212_v242 behavioral2/files/0x00030000000198e5-1003.dat aspack_v212_v242 behavioral2/files/0x00030000000198e6-1052.dat aspack_v212_v242 behavioral2/files/0x00030000000198e7-1065.dat aspack_v212_v242 behavioral2/files/0x00030000000198e8-1096.dat aspack_v212_v242 behavioral2/files/0x00030000000198e9-1109.dat aspack_v212_v242 behavioral2/files/0x00030000000198ea-1146.dat aspack_v212_v242 behavioral2/files/0x00030000000198eb-1165.dat aspack_v212_v242 behavioral2/files/0x00030000000198ec-1184.dat aspack_v212_v242 behavioral2/files/0x00030000000198ed-1197.dat aspack_v212_v242 behavioral2/files/0x00030000000198ee-1212.dat aspack_v212_v242 behavioral2/files/0x00030000000198ef-1308.dat aspack_v212_v242 behavioral2/files/0x00030000000198f4-1340.dat aspack_v212_v242 behavioral2/files/0x00030000000198f5-1359.dat aspack_v212_v242 behavioral2/files/0x00030000000198f6-1384.dat aspack_v212_v242 behavioral2/files/0x0003000000018914-1497.dat aspack_v212_v242 behavioral2/files/0x000800000001891c-1540.dat aspack_v212_v242 behavioral2/files/0x00020000000066b1-1874.dat aspack_v212_v242 - Executes dropped EXE 1 IoCs
pid Process 972 patcher.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WinFirewall = "C:\\905c0769f9a06c95a24ddf945\\patcher.exe" patcher.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\:\autorun.inf patcher.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe patcher.exe File created C:\Program Files\Microsoft Office\root\Office16\msoasb.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.Loader.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\elevation_service.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\DlpUserAgent.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe patcher.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Media Player\wmlaunch.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Windows Defender\MpDlpService.exe patcher.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateBroker.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\Installer\setup.exe$ patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\bin\servertool.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe patcher.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe$ patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge.exe$ patcher.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\notification_helper.exe$ patcher.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe$ patcher.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe patcher.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jjs.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\visicon.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe patcher.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevated_tracing_service.exe patcher.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeComRegisterShellARM64.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateOnDemand.exe patcher.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\cookie_exporter.exe patcher.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe$ 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patcher.exe - NTFS ADS 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Local\Temp\:\autorun.inf 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1440 2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe 972 patcher.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-26_f6e223ba8ad7decdf5b177243f0770c8_amadey_cobalt-strike_conti_elex_hijackloader_vidar_wannacry.exe"1⤵
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of SetWindowsHookEx
PID:1440
-
C:\905c0769f9a06c95a24ddf945\patcher.exeC:\905c0769f9a06c95a24ddf945\patcher.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:972
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\905c0769f9a06c95a24ddf945\patcher.exe
- Size 877KB
- SHA256 3f065162f413c17efebb1db38fc81127704a0a4ca67d0d08663ad16175cb2c29
- MD5 f6e223ba8ad7decdf5b177243f0770c8
- SHA1 4e3b14a1ea9a459770da0d5e11091950fe09d809
- SHA512 f3c2fdef6619b9163454400f7437eff9821a85d63451153d02722ee057cefeb8694c0013ab05cd7798e7db1f74416e5ecbd987664c2b98ef12700e947f2139b4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6o:A3k03kB56r1
- TLSH T1E3156A17E6850FA4D10FC1749A968662EA737C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe
- Size 968KB
- SHA256 54a649377a9889481df78c0aa37b40471e4b65663da4679bd7b4b6eac29e729f
- MD5 b354ba357a88dfc042ead98c0fcb5757
- SHA1 5db9887703f9e33c9fe4afa35712298aac5be3b8
- SHA512 c5c404ba76a5fc73434b8b05b1f7305ba36e5d456b59e34b87808dbf0faed95eba81631ef65b9a3b011720a5854be4cff97abf0b6b3e9343a5e69a9cacda7c9f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6W:A3k03kB56rR
- TLSH T1E9257B03E6840FA5D10F81749A959672EA77BC125F2093DF2358AE153F72BC06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe
- Size 929KB
- SHA256 2b755dbbec2fb39f59e76d5849516ef56e57bebd68627717d763ba31f336edf3
- MD5 615ca773669605202886692333c2c048
- SHA1 0745e7bbc85599e7e381bc8d0a3c16f175aae05a
- SHA512 c289cd045a7b9b318023f7ad1e76415564d9aab44baa7033e96a2c86aff16b32ec9caa3950d0ff94a771e873f5198315569fd16026fcb562819a591f36cd8bb8
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6jfj:A3k03kB56r6j
- TLSH T1EB156B03E6850FA5D00F81749A958672EA777C125F2093DF2358AE153F72BD06B3A39B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.185.27\MicrosoftEdgeUpdateOnDemand.exe
- Size 975KB
- SHA256 43a559907eab8dc1b5b52cc3f3238d799feb32aacd028796c689d530b8af3fab
- MD5 d9f979dd249de0b9f72eb00e0fc49f66
- SHA1 92a182d3fffb3e5daa98fea8ff37bc299a1874c2
- SHA512 4fcdb9e1d24f67854b8bdf4e85b2c796fa3414374eafaa992731f354bf921230755a4dc4584787fdd9f99a3ca0e460f7799aa95f97b56f27c120b77f5e2997fa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6b2MqDBxc:A3k03kB56rJMqlxc
- TLSH T1DD257C13E6840FA4D11F81349A958672EA777C121F2097DF2354AE253F32BD0AB3A797
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe$
- Size 1.4MB
- SHA256 175b4ae3c63fd14bd1219151a78bd7eb107333a5e1adb7ea6a69a38026a0a8ee
- MD5 0314888928185a208c5d5127eb41a032
- SHA1 e13c777c48487b829523de52edfb57a49bea00e5
- SHA512 2dda5fc1b677059efdd086df91e73ce7e8dd8b715b5b279f56e1927396afe91e68af2feff3eedc15114fea73d33e0f595821b833bcbf4f797a126fae3461df2a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6w0Le5ji0hmxNrM:A3k03kB56rxPji0Aj
- TLSH T197654A16F6A44BA5D02FC074C5D2966AEA733C421F3087CB1354DE283F67BD19A3A762
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 891KB
- SHA256 d1d56ffdafe5e8c2cf4eb9ef052a0bce2198644fb96f4f23a557d430f8b5f6e7
- MD5 43125f05a25d455df0de946940f64964
- SHA1 70a4b8f3ae2177eced5f9d395aeafb776671b4ea
- SHA512 07021ce809b65b87c6a45c228e00c9f91b1445a901d1482d384a8b5d46808803a8b0f1888a6aa39d7b88c0b5c82c0139f798b2af309fe8568a5c184e888f8bc4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6Ka:A3k03kB56r
- TLSH T19A156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe
- Size 924KB
- SHA256 caaa5e2d5730c34c0a87303a5fa53a01e1d4417ba60148754ebacd33cffdbc06
- MD5 ea761abd3faeb5d254313618ae2f6576
- SHA1 af6f2b6f92e123ea3a7be62066f0057401a60fdb
- SHA512 563d194f461d6ab806c6973532499836da3b676bf833cca11ba51ef22362bfdcb1ccac256bf4fd7bd1c9fe508991012e3b8bd8f89b3172609d630d148c039bbf
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6Zb:A3k03kB56rAb
- TLSH T153157B03E6940FA5D10F81749AA58672EA777C421F2093DF2358AE153F72BD06B3A397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 900KB
- SHA256 d28d6511da722e173eea0f43cf278d6353c413eab3f9bce2b5caff29583029e7
- MD5 51e88395595a420b1353fbdc58860090
- SHA1 ab5f707c0cc8ea14c932c3bb6bf658322ce2ed8c
- SHA512 2fb3937cd3d00334d50fe9aa0cefcc98151408434069046cabdb54620e4559c310739286e55f28d011c24e295f44edd9995b1c8514993c98624910b118f8c8f1
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6EZ:A3k03kB56r1
- TLSH T15A156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 900KB
- SHA256 e35dfd3d307ab6b78ad81e821eace35081e38c12a1d093fe1c66747d73318408
- MD5 2330f5ffac388ec4edad185cdad56ed9
- SHA1 5355ec5437976ff3091aa49be5c1672cfc9aa40c
- SHA512 97e0723525dab7637fb5ac10a82d8a088e5501ce636dbadd8754a783d1cd366024ee1a9edec8e79a6ca2c972d364bb918c69a8795b2edb63aabac8329ef8f2aa
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6L1:A3k03kB56rS
- TLSH T176156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 900KB
- SHA256 8302099ebf51290913039d68847a3c0a7a9b9fdded35a2e20967df0db04d4075
- MD5 616795f9f772677c3c029bdf5c739fd8
- SHA1 9f3bcc6769e4a0801ab0e957e7dc19eacdb45848
- SHA512 e70b4cd88dd093b40dd331fede30422eed322fd24ef44fc40f0721cb740191adbca0b40a2da5edcf33b01332e837dcb793790eb37a8e47203a670de10bce51cd
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags676:A3k03kB56r9
- TLSH T107156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 900KB
- SHA256 eafb09e00d033eb0f5bf76d731f6f849f4fb466c5c111eb062eb920aa73d5b4e
- MD5 20bf5bceb96e1761be9a0c87911a0100
- SHA1 4f86521045eb7148c4122fb7762120f478ab0585
- SHA512 e94aaa97e4d909ff02b0983d5f40818499280133e206d49cec2773a97611b4f8d836b5b2708cc4a6862c5c9fdaae2bbfd71175d44867baeffc9be194a4b8a335
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6lN:A3k03kB56rc
- TLSH T159156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 900KB
- SHA256 08df3bfddddacc8e17754c6a02a84f72c0ff17580c56ca094ff29a5bf2e4a0a4
- MD5 196d0882f3cf598528ee8302d410db99
- SHA1 9eaaafca995b7226eb2d939546d21e8fa40443ee
- SHA512 5ad075c542e4328cc41d776c142afa4dd290c9a5509c8e9cfdac418302f53e6965e00c0ac6db6a713785e3dcaf098cac5f7bf789ebbca5df5f08dcb6a5a8740d
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6jf:A3k03kB56rc
- TLSH T1B0156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 900KB
- SHA256 5439edfa36bb967d21c247a59a2c72af7abb029cb6a9638947e3d03e7c1a90a3
- MD5 158b17196a4840707a408ce13eb9efce
- SHA1 4cb9e644abee4813fb8efca2e2a237c9dab3c5a0
- SHA512 6fd453c31bd303dc67c77a01d774ddbe788508592e06011f4f543a37839305f964e1b1142a8fce319f4b93d557d4d70b0705ce50a25f9ff27825b424b9c34914
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags61o:A3k03kB56rR
- TLSH T11D157A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 900KB
- SHA256 099a76d4f19f3b127a3c1283b1d9602521c0d5492b4a57a9c19e2b5282b2200f
- MD5 be52e04ac83d0616da073aabe28c0d93
- SHA1 dd8cb9851bf47776df5fe12b8372b84e72551b11
- SHA512 350a2d6c35fb37c802874ebf14c07c09e257c6982abc5a5ca40d0a3fea796cab10488afdf757ec2fbae9491578329baab080a8ee319659eedcced7afbc509a2f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags61u:A3k03kB56rD
- TLSH T18D156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 900KB
- SHA256 7f8bbf7dc1b29f7cdbf460a385ca3afdd6d6646b1657c65cff9145ef296287a0
- MD5 f9c3c930d8b7c2e2ff13b7bab8743416
- SHA1 342487af8bbc299e666bc2194727f062d11aaa33
- SHA512 0b2acf824d3fc2e4b4645e74ec7dbc95c8ccdee07dc299d7546bb56f615bebdd3c61731fa27d11c0d0450582efb3622a7881ee80bf8138c48afee1705c2e4d03
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6r9:A3k03kB56ri
- TLSH T14A156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 900KB
- SHA256 5e5b644675a4e689bea96b0c07369ada817ce384b11db1605148ac61d5c117cd
- MD5 70838ccfcad9257303f58bb4e2db087c
- SHA1 870cd1cb023a0d861d8fd7b897d7036b28e179f4
- SHA512 eeea37e43f9cb6e56e9625a362cd73281148959dee096d2f5bc656f01281ab12537e090990c3871948f4cef39d7fb0ef7d55ba141434166092649acac244320a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags63c:A3k03kB56rP
- TLSH T13E156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 900KB
- SHA256 146a1c9d00aea540e483075e1d14bf2d2dc9a4edd1d8e2fbdbc100761c3df42d
- MD5 936e8560608413c11b8ede4e868f092d
- SHA1 a1ed9a51c041de1b391e6f520639bc3b0b911d79
- SHA512 84b85eff837fdca27fdf93bce9f53d8bc3e2cfa508f9f3df80c8a4d04a2f2a4abe05df3f05f053046434881cbaab1a18836a774e303fb0f7bcf12f125f286661
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6Ap:A3k03kB56rF
- TLSH T1A1156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdeps.exe
- Size 900KB
- SHA256 bc217a798159d8d3c83b2bd6318dd33721cc2353037a4c1509d7a6de306dda81
- MD5 b24e39b4d8ef73e3c84d4b8caa332a6d
- SHA1 a3dd2383730cdb39ace6f0a58826b2e02490351c
- SHA512 b7062dd2179f7187ed656a881134f26efe51b1e10456b339ad1f7b9b3a8dd68062a3e754cd1467df9d8aa4ae8778a6fe126c502c53081264cc87727482ec44f7
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6HN:A3k03kB56r+
- TLSH T151156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jhat.exe
- Size 900KB
- SHA256 da2f622a7edc46e731cf992b8c3eb638cd4ab35cdbfb8a4edb98c23146434bca
- MD5 6a5861578758dd260b2cb248467443ff
- SHA1 61c16d33f08650f66a7d86ea452282461eaa74bb
- SHA512 42684e1ce39b7688a08e646c084ee30db51a94aaedb918eb1fe75eecad25c22ccf74908c762d49b474cfbd810bffed148b23439ad0c8fe1b2c1208b1fc1e5d29
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6lF:A3k03kB56r8
- TLSH T1C3156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jinfo.exe
- Size 900KB
- SHA256 55b68c8961999db860a890297caead3c4149430764805bb5ca4cd2ef767a70b2
- MD5 e8b62289fcd070f2eafa7f08b8d839a0
- SHA1 625180cc2d2fbe23187a56c7eba1fac87994618f
- SHA512 dcd57e8f0060e9a0897e730a519167f87c18a84e34e81a2312ec439030f0fb151e16590d8aed301659ddf49a369bddaa882e630d4163bde16ba7b05fe0a2e64b
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6GC:A3k03kB56rI
- TLSH T1AF157A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jjs.exe
- Size 900KB
- SHA256 dad1416428ddf900c7dcf2037d924b94d35041c3bf9c5a54f5cb664ad4ab5c23
- MD5 1246f3568152b404073a3165fd324d74
- SHA1 f90b8cd1641987cf8e7d9469f58e76b9c7722ef4
- SHA512 4824ff9911ab9aaa1ceb6298ffa17cd110df86cba19b9645bc9d14315b926d502b06566067e407eecc6aff5df74d3fc9d14bc14c684e18fa48106f1bca39d7ec
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6Jw:A3k03kB56rl
- TLSH T1E0156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jmap.exe
- Size 900KB
- SHA256 0352660fe97d482f14c2144db3ad171e57a4815dd5d52c591404035576a09921
- MD5 04a14970a2f0af162e726de98c809d51
- SHA1 56301584c100ed804a3e94be4a24966f336f418e
- SHA512 16dc3ce8f0e368c0951014c490db48d75eb6053d4220b2d69939c372a8b1e9a8a9553e679ed032a2510b3ba6046598fd28f76f95e5f39bc7688aee9b516393cb
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6QT:A3k03kB56rZ
- TLSH T118156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jps.exe
- Size 900KB
- SHA256 3217866fe5366ee81a10b2bee160ed9050d5cdc8e47d06b2bf0ad3fafb0f09f2
- MD5 d59c16ea12786a90526bb6227f78f1fe
- SHA1 75c39a4ac5332172742cd91ec06fba56a50fdf8c
- SHA512 dbeffe13873671e5eae28e316af46ae10c177c46bbf2b26d3eeb906e0f1d09e094beec4bd81171b2863fb5ef5cd92eb5140f57aeef40e3e3618fcb744b82a3c9
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags68u:A3k03kB56re
- TLSH T148156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe
- Size 900KB
- SHA256 310526bb07eca959f3e7a6a802928a071aaecd2c821e2834856f99aed05a00cc
- MD5 65d9b5d0a636b7a02fc0a8126471822e
- SHA1 57ec4347c5fbbc804e8e225ac59ee6c8417fb3f8
- SHA512 4caf7e0f0444c9aa9aca735a79ab3783c31ee68f6d385d99594c2df0386bfc8ff38e6b5b56c0901768f0aa4101232a7bfe8ebed2ea9d07f25bfd33f82dc5ecda
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6ab:A3k03kB56rf
- TLSH T1EC156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe
- Size 900KB
- SHA256 50af37fea701a877991557b1ba5c287366e46fe7bdbe9b8ba15de72f1f3e0c24
- MD5 062fb83edd8237273195ee06800642e4
- SHA1 4a567fc30514ab0a13a6817fdccabc921563d6c8
- SHA512 4c55bc48b73df59f614375c91a60c10a58ee90c9864cb52b2f0baefb1244597401f33060c6782ab8d4db09d18e108e37b8fd9e292f88793b998172f204ed2d0c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6cf:A3k03kB56rX
- TLSH T1C2156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstack.exe
- Size 900KB
- SHA256 bf4857e45517bf939c63d20d5d231f33a26ae755acd950924ecb6e4f036015b6
- MD5 4476a1bacd440d2ab12ba906defea18b
- SHA1 b21d60e09d6659aee12cd6090bc20381d019e4cb
- SHA512 4bb024d5d71fe1c633c072754682ec41948b02df80c82364ffb2ae1da43487aec06b5b09c50a722a7f13638ef5d823b081a916506ddc9081b4aaed600919414a
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags65K:A3k03kB56rX
- TLSH T1E0156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstat.exe
- Size 900KB
- SHA256 5c691ac093251a574cea085cf8eba271d3ac0a58fb1768a6fc28b6cb8c6f9354
- MD5 a79dd08d81c09b64e4412466e08e4354
- SHA1 ad783a42b09295346b29d328919dea762dfa7f97
- SHA512 da9b63d1ea3df1d74bdd7c4919bbb4d9979374d3b9c1255d65d0d91611d797813a10e76b99077ec43aa44ee47252d7e9bf7f581fbaf1e6867d98c07231cc238c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6ik:A3k03kB56ry
- TLSH T134156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jstatd.exe
- Size 900KB
- SHA256 41f70327db7d499bba12436dd1f98fb71de32de20c2af2038b7bf96faed7d61d
- MD5 c8d14314167f2d6bfd827ae6ce7d174e
- SHA1 f08692da8ffaa8a2adab400d073376286925279f
- SHA512 291b8b2d7ae063df992943d2d3d1647755bb616e4812627a3825595c8e9781cfe22a1af7b2262d41cb07ae9e7d7b272e5f882e448cf793bab5aa39e432e68c04
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags630:A3k03kB56r3
- TLSH T154156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\keytool.exe
- Size 900KB
- SHA256 343f979f9364c5f9653e4ee3b8efc9256d92eb10c73c44bc7bd57ffa329bfc8c
- MD5 7fb3ed461c9c30b4953a9454562c3957
- SHA1 a05143511c1975ace997722f6b136c0efc8eade8
- SHA512 ff3ef133ef707807341c318521c467dff2f9438f5a5e6b27e957bafaf9995ce59a0962d82d62b41cc01466a75230f9893e25fd7ccf5f1d75e3d18cf3c16723e5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6mg:A3k03kB56rK
- TLSH T1E3156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\kinit.exe
- Size 900KB
- SHA256 65716cd2dd94e8b3e288e91a84831d7501db8719ab06642e33d113f8940c8ae1
- MD5 7fde770f214a45223cc0e5f0a834cab4
- SHA1 ab35c0ba3d3b921c5e3fbe59ffde4756563a41c5
- SHA512 13ac7edebb64ec2fcf59be4c0e2967f061879e22ecfaad3f9332fdd9380ab699ffd930606c7ddc67eb15a122087ff8fd5c5265b6af5e413442757fcdf2286fef
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6vr:A3k03kB56rU
- TLSH T12E156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\klist.exe
- Size 900KB
- SHA256 c48b913494c9562fc1a991e4b1d664744eec077d6af16b8808d716a4aad82146
- MD5 0c6039ded88f4e42a25e490d844a118b
- SHA1 4b135b64817d6b88d4bf21f50678e0fa47ea926e
- SHA512 5e88ffad434e91305adc4fd3f6a0f3c1564831320a3bf22ac390a0e528b0e9d8fc75242bebcce9e1a4ac454ec05839033f956fd1d515cda44aed37c391e9903c
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags65n:A3k03kB56rO
- TLSH T173156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\ktab.exe
- Size 900KB
- SHA256 cdc65588ccd7f666632a38c74da176223934978a3897b49a793d21123dd2dc85
- MD5 8469ed199c805739eceb9a6410cec1fa
- SHA1 a9021303962d0d79a07a034bfc3698b466c63519
- SHA512 2e3e5b6d419de4f4b85529c8bd1c153ef22279929dd36b55fccb1cb9e26213b794fba0c51d70666307bb7817d230206ce3bc476bc27afd12ac19e7f6e5379033
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6Vx:A3k03kB56rU
- TLSH T1B9156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe
- Size 900KB
- SHA256 bb216e659b825de6348e0e799876b6d85d8cf266959a00a7abbeb5d7dbde1478
- MD5 3b8048f1196a3e83c711d36f7dcdb64f
- SHA1 ac2e6b20f8115e40488b47e61303af66f2896f30
- SHA512 b6148826c04a0f4222186d1e2c62c9ef61297081a2b17b438b39bbed9498e691c9fef37d19b29eda38356ec1aca4306383ce98bfc0a4b39a72e913132f62ae8e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6LA:A3k03kB56r/
- TLSH T15D156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\orbd.exe
- Size 900KB
- SHA256 c794a4b7bd370ba26c49080a397ae9ad05feeccf676fc41f0fc0fa34357a92eb
- MD5 9f255508e1c94abe720382efa4247f44
- SHA1 48f001abd22deb93469dca697bb9cf23ff1516e2
- SHA512 1752ceb1bc553ab5ad1d1aad66470adc3373421cd290eed9753a24fe829528fc5942dad2a2a4e3e8b6a5a8ff0a627242b193ca2fa82a4ea085ddb3f9e29b72e2
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6c9Q:A3k03kB56rS
- TLSH T135157A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\pack200.exe
- Size 900KB
- SHA256 7e176a97d14b92d9718d5de020886c29233197bca948163f2eacbef54f5e130d
- MD5 b48f2b3af27be89930b9f5a96dd4c087
- SHA1 b83ee8a6c72277ac0bd71a8cf35497352f93b7fd
- SHA512 ae4fa453fcbd32b8b0c72067517e9f9a10e3edc57ebebfa553d6bc62e191cbf82b41b07fef8f9f72f8ca33ddd89c26e9591f4eba0734b4de1099a77add624941
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6F4:A3k03kB56rh
- TLSH T1B0156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\policytool.exe
- Size 900KB
- SHA256 c60abe78d72f5cec6e31d3e174b61eda7be8314cdca59ac7c8b92a290ab01032
- MD5 17b078e195779fa6857beb08cbc7a47b
- SHA1 e7aed9786f6b723930398afc74135d57faaf7f77
- SHA512 6fa25de49f0a3f2b5945e9c75c6a72cb5200dfdda3d6d8a2f4c408ba750e1ac6d49f1e348503299093724998e59008518f21e4b7b8593a69601eee40d1cbe962
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6Qu:A3k03kB56r8
- TLSH T13D156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmic.exe
- Size 900KB
- SHA256 c201dc284cb0239e64a0c7eea7c1f6151d8f8612858e8dc946074fe8c3a6f557
- MD5 7b45dc9c8df0372ffb33505cb499aa9f
- SHA1 23071b61ddbb10124d93447e0c85465525930201
- SHA512 9e7e50e54856eaf12de8faf2c7cc5e27e7cca4e2f8f584fccef7a3fef1fe69af843772d70eb29f59f42dae8ad4cb687333a5918df6d6e87a6dd6148f2fd4a838
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6Rj:A3k03kB56re
- TLSH T18E156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmid.exe
- Size 900KB
- SHA256 ee1bd7b00e72c499c3eaec989c1b4af6a129357963ec500534e8604ed4233fc0
- MD5 a3e517d775aeeb36d274354b0e1fb891
- SHA1 268a6c4b4865bccbfc4d3b692b6cbe4208c60f8b
- SHA512 4504a475c77fac5f35931e2a0e07f9a41fae1ba60c1d50872baf38fc5097d17c5fcf08ecb5befa9cede5170d88ab766582793b04e214fb81e07c6e5168ac3f29
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags64g:A3k03kB56rS
- TLSH T19A156A13E6850FA4D10F81749A968662EA777C025F2093DF2358AE153F72BD06B3E397
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe
- Size 900KB
- SHA256 7d34a77c9b6a177ba239a5eb9b29962dde5e67651f6205d3524a3db9e8afc17d
- MD5 a8f09e7fa19c9886ffdaa44561e6b954
- SHA1 b028c1c4723dcf96d9b4c28c78d428724a33d1fc
- SHA512 b01f6d2b5f2f6224478c0347e3c560355f02ecb8ef980e4e894abdac3573eb6b297a63e8a58a90a5b4332c782daf301815436deedde62af6a8008eb017a5199e
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6XI:A3k03kB56rj
- TLSH T197156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\schemagen.exe
- Size 900KB
- SHA256 0ecfd846aa55b7edcf7283a177740ec3977094adbf32d29592a8089b0807dc4f
- MD5 78c83886faac81b414dcf42a3fb92025
- SHA1 a9d85860a8310a8de28a98fcb6894c18ab0633e2
- SHA512 915da5d3c1338236ad5725d3df4ed84f47e331bce1aa32e6e328071f090143a42bbf767dc2b106de2a31fc3c578ff78c8e4e3b159e0a7a859645c66790b828b5
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6do:A3k03kB56r9
- TLSH T155156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\serialver.exe
- Size 900KB
- SHA256 ef09c29db5cd3116bfd4b952c622ff178536ec53d03e4f41ddc9f70165726d63
- MD5 2578d14bffe0d450916c280730c88547
- SHA1 8ca227f03b9ddf18660d34c974d6dd4ce5666f4d
- SHA512 60c7658bcc360c273387e252e0816f2217cdce17bea88d019ab605851c437a964c9715bdb43977907cf2905fb9bee8c411b4f707b6f85fd3c863f5c80ec9ad27
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6O+:A3k03kB56r4
- TLSH T15F156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\servertool.exe
- Size 900KB
- SHA256 548f096f3fdcc09272c306093377921679f8ae5c1aa718d97f86f5cb31dc48d7
- MD5 7fab422b42097c098dfa66a59d288236
- SHA1 e4d80ac85d5fa1e9e42f9c82cdd4388a65223c9e
- SHA512 be48ab416302398dc59e5949104448e4774d8863a8ea288f230950fdd317f8f22412f7afb6c5bc58b2a8c2a974ab364f5576c5d6a4b3d51d35b61aba069e280f
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6OQ:A3k03kB56r4
- TLSH T160156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe
- Size 900KB
- SHA256 1d9df34cb1a0d84598d5badbecd9dc335a7dd4f09e0f5bf2b3d4941874308377
- MD5 89690ac98b7aa77f8b42e170e56a66f7
- SHA1 a6aa571fde939249a20dd1d79aa0b1d0dc1b6b9f
- SHA512 53b8179de745d4ff460f91a047999c8d81bf94e46dae7f346f712af08fefb8f8d885b842924b04b952aef9dd13e2e93ad222f160b8ea671013e65b972be34559
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6vX:A3k03kB56rI
- TLSH T14B157A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsgen.exe
- Size 900KB
- SHA256 167369e3f9134faf51a76b5b50aedc5a88eba03e11e0adc2c0077a2acb9ad0a0
- MD5 958452a5ef062bee122f1549781cbda0
- SHA1 a7f64ec55ee5ec63ea05a855cc6ba7c0a7876884
- SHA512 3c7f90808b3e062e6a372370245845ccad6523afffd42043b636617ac056c3176c0b2987e7a4607117832e9ffe4a2fd2e5c56ab5fb8d1c771bd9673c4fad9647
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6lL:A3k03kB56ra
- TLSH T191156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\wsimport.exe
- Size 900KB
- SHA256 c0a4b4b7949afab0c0d0e313296cc490b8975de4f3affcd8a901939ea60b9a79
- MD5 e102643074a1ff3fbd1dfadb815a55d4
- SHA1 536c061ec9d13f2dd672979af93634c514026c44
- SHA512 0fd6a282c3f665a2bee29541146b7a1cfa60b8362ac9e7913b5e480d14c71bc45765029bad572b95f87dd8bc508ab3af488829d1fceab528b5c80017ac698a07
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6DM:A3k03kB56r3
- TLSH T104156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\xjc.exe
- Size 900KB
- SHA256 f3cc98d0e3cfe68b0b9a14f1dd84a854406116ea9719240e8455a76075a7e6b9
- MD5 77d4232f30010a056382885709086b6a
- SHA1 edc2405d97dab16e4fdbbb244988563c980a2580
- SHA512 58d7429f6e412dc74073deb7a5467b742848cefe3e3c5eb599d5d3854cde8d05d5fbf4326ff0f38b0cdee1322f2701cdbd4fbf4602d7d8ca711952384c79dfe4
- SSDEEP 24576:A3mnXoZ643mnXoZ6iLa5D5TvinrmdoTpYags6Eh:A3k03kB56rp
- TLSH T172156A13E6850FA4D10FC1749A968662EA777C025F2093DF2358AE153F72BD06B3E297
- MD5 SHA1 SHA512 SSDEEP TLSH